zames_pro 2.66.0 → 2.67.0

package/dist/permissions.js

@@ -63,12 +63,51 @@ function safeRegex(source) {
 // A file path may arrive in any of these keys depending on the tool.
 // We collect them all and match the path regex against ANY of them.
 const PATH_KEYS = ['path', 'file_path', 'notebook_path', 'from', 'to'];
+// Best-effort check whether a string looks like a filesystem path. Used for
+// tools whose arguments are not covered by PATH_KEYS (MCP tools take arbitrary
+// arg names from their JSON Schema), so a `path` rule is not silently
+// bypassed just because the tool named the field differently.
+function looksLikePath(v) {
+    return /[\\/]/.test(v) || /^\.[.\\/]/.test(v) || /^[A-Za-z]:[\\/]/.test(v);
+}
+// Collect every path-ish string from a tool call's arguments. ApplyPatch keeps
+// the paths INSIDE the patch text (not in a `path` key), and MCP tools use
+// arbitrary names; both used to slip past a `{path: ...}` rule.
+export function collectPathCandidates(tool, args) {
+    const a = (args ?? {});
+    const out = [];
+    for (const k of PATH_KEYS) {
+        if (typeof a[k] === 'string')
+            out.push(a[k]);
+    }
+    if (tool === 'ApplyPatch') {
+        // Parse the patch and pull the file headers out of it.
+        const text = typeof a['patch'] === 'string'
+            ? a['patch']
+            : typeof a['patch_base64'] === 'string'
+                ? Buffer.from(a['patch_base64'], 'base64').toString('utf-8')
+                : '';
+        const re = /^\*\*\*\s*(?:Add|Update|Delete) File:\s*(.+?)\s*$/gm;
+        let m;
+        while ((m = re.exec(text)))
+            out.push(m[1]);
+    }
+    // MCP tools (and any unknown tool): scan the string values for path-looking
+    // entries. Conservative — only values that clearly look like paths.
+    if (tool.includes('__')) {
+        for (const v of Object.values(a)) {
+            if (typeof v === 'string' && looksLikePath(v))
+                out.push(v);
+        }
+    }
+    return out;
+}
 export function decidePermission(policy, tool, args) {
     if (!policy)
         return { action: 'allow', reason: 'no policy' };
     const a = (args ?? {});
     const command = typeof a['command'] === 'string' ? a['command'] : '';
-    const paths = PATH_KEYS.map((k) => a[k]).filter((v) => typeof v === 'string');
+    const paths = collectPathCandidates(tool, args);
     for (const r of policy.rules) {
         if (r.tool) {
             const re = safeRegex(r.tool);

package/dist/run-task.js

@@ -276,6 +276,9 @@ export async function runTask(deps, browser, tools, taskText, workdir, opts, att
             },
         });
     try {
+        // Set when the loop ends without a real answer (iteration limit / watchdog)
+        // so the one-shot mode can exit non-zero. See N5.
+        let failure = null;
         let next = {
             text: taskText,
             attachments,
@@ -363,6 +366,7 @@ export async function runTask(deps, browser, tools, taskText, workdir, opts, att
                     outcome.startsWith('ask() watchdog'))) {
                 ui.warning(outcome);
                 transcript?.log('agent_no_answer', { outcome });
+                failure = outcome;
             }
             // T7: one summary line per task (duration + tool calls + tokens spent).
             // Printed even on an abort, so the operator sees what happened.
@@ -428,6 +432,7 @@ export async function runTask(deps, browser, tools, taskText, workdir, opts, att
                 sendSystemPrompt: false,
             };
         }
+        return failure ? { ok: false, error: failure } : { ok: true };
     }
     catch (e) {
         ui.stop();
@@ -435,6 +440,7 @@ export async function runTask(deps, browser, tools, taskText, workdir, opts, att
         if (debug)
             console.error(e.stack);
         transcript?.log('agent_error', { error: e.message });
+        return { ok: false, error: e.message };
     }
     finally {
         stopWatching();

package/dist/sandbox.js

@@ -0,0 +1,49 @@
+import fs from 'node:fs';
+import path from 'node:path';
+// Resolve a path against the sandbox root and reject anything that leaves it.
+// The LEXICAL check (comparing the resolved path with the root) is not
+// enough: a symlink inside the project can point outside it, and the
+// lexical path would still look inside. Therefore the real path
+// (fs.realpath, which follows links) is compared too. For a path that
+// does not exist yet (writing a new file) the nearest existing ancestor
+// is resolved and the remainder is appended on top.
+function realPathNearest(target) {
+    let cur = target;
+    const tail = [];
+    while (true) {
+        try {
+            return path.join(fs.realpathSync(cur), ...tail.slice().reverse());
+        }
+        catch {
+            // not found (or a broken link) -> climb to the parent
+        }
+        const parent = path.dirname(cur);
+        if (parent === cur)
+            return target;
+        tail.push(path.basename(cur));
+        cur = parent;
+    }
+}
+/**
+ * Return the absolute path of `p` within `root`, or throw. The check is
+ * double: lexical (catches `../` traversal) and real (catches a symlink
+ * escape). Pure except for the fs.realpathSync calls, which are sync on
+ * purpose: the callers are sync tool handlers and turning them async would
+ * just add noise.
+ */
+export function safePath(root, p) {
+    const resolved = path.resolve(root, p);
+    // startsWith(root) would let through sibling paths with a common
+    // prefix (C:\work\proj vs C:\work\proj-old). We compute via relative().
+    const rel = path.relative(root, resolved);
+    if (rel.startsWith('..') || path.isAbsolute(rel)) {
+        throw new Error(`Access outside the working directory is forbidden: ${p}`);
+    }
+    const realRoot = realPathNearest(path.resolve(root));
+    const realTarget = realPathNearest(resolved);
+    const realRel = path.relative(realRoot, realTarget);
+    if (realRel.startsWith('..') || path.isAbsolute(realRel)) {
+        throw new Error(`Access outside the working directory is forbidden: ${p}`);
+    }
+    return resolved;
+}

package/dist/scheduler.js

@@ -100,6 +100,8 @@ export function cronMatches(expr, date) {
 // Next epoch ms at which the expression fires, strictly after `fromMs`. Scans
 // minute by minute (bounded to ~4 years); a one-time cost when a job is
 // created/rescheduled, and the field checks reject almost every minute fast.
+// The parsed fields are REUSED across the scan: calling cronMatches() re-parsed
+// the expression on every minute (millions of parses for a far-future date).
 export function nextCronTime(expr, fromMs) {
     const c = parseCron(expr);
     if (!c)
@@ -109,8 +111,13 @@ export function nextCronTime(expr, fromMs) {
     d.setMinutes(d.getMinutes() + 1);
     const limit = fromMs + 4 * 366 * 24 * 60 * 60 * 1000;
     while (d.getTime() <= limit) {
-        if (cronMatches(expr, d))
+        if (c.minute.has(d.getMinutes()) &&
+            c.hour.has(d.getHours()) &&
+            c.dom.has(d.getDate()) &&
+            c.month.has(d.getMonth() + 1) &&
+            c.dow.has(d.getDay())) {
             return d.getTime();
+        }
         d.setMinutes(d.getMinutes() + 1);
     }
     return null;

package/dist/self-review.js

@@ -48,18 +48,40 @@ async function loadFresh() {
 async function ensureDir(p) {
     await fs.mkdir(p, { recursive: true });
 }
+// Recursively list every .ts file under `dir`, as paths RELATIVE to `dir`
+// (POSIX separators). self-review used to read only the top level of src/, so
+// files in subfolders (src/i18n/, src/input/) never made it into a snapshot —
+// the diff/apply silently ignored them. Recursing keeps the whole tree in the
+// snapshot. `_context` is skipped: it is a read-only copy of configs/scripts,
+// not part of the editable set.
+export async function listTsFiles(dir, base = '') {
+    const entries = await fs.readdir(path.join(dir, base), {
+        withFileTypes: true,
+    });
+    const out = [];
+    for (const e of entries) {
+        const rel = base ? base + '/' + e.name : e.name;
+        if (e.isDirectory()) {
+            if (rel === '_context')
+                continue;
+            out.push(...(await listTsFiles(dir, rel)));
+        }
+        else if (e.name.endsWith('.ts')) {
+            out.push(rel);
+        }
+    }
+    return out;
+}
 async function copyDirJsFiles(from, to) {
     await ensureDir(to);
-    const entries = await fs.readdir(from);
-    const copied = [];
-    for (const e of entries) {
-        if (!e.endsWith('.ts'))
-            continue;
-        const data = await fs.readFile(path.join(from, e), 'utf-8');
-        await fs.writeFile(path.join(to, e), data, 'utf-8');
-        copied.push(e);
+    const rels = await listTsFiles(from);
+    for (const rel of rels) {
+        const data = await fs.readFile(path.join(from, rel), 'utf-8');
+        const dest = path.join(to, rel);
+        await ensureDir(path.dirname(dest));
+        await fs.writeFile(dest, data, 'utf-8');
     }
-    return copied;
+    return rels;
 }
 // Root files and folders a review often needs but that are NOT part of the
 // editable src/ set (scripts, lint/ts configs). They are copied into a
@@ -176,11 +198,9 @@ export async function selfDiff({ name, locale, }) {
     if (!snapStat)
         throw new Error(t('self.snapshot_not_found', { dir: snapDir }));
     const { unifiedDiff, colorDiff } = await import('./diff.js');
-    const files = await fs.readdir(snapDir);
+    const files = await listTsFiles(snapDir);
     let anyDiff = false;
     for (const f of files) {
-        if (!f.endsWith('.ts'))
-            continue;
         const orig = await fs
             .readFile(path.join(SRC_DIR, f), 'utf-8')
             .catch(() => '');
@@ -209,7 +229,7 @@ export async function selfApply({ name, locale, }) {
     const stamp = new Date().toISOString().replace(/[:.]/g, '-');
     const backupDir = path.join(SNAP_ROOT, `backup-before-apply-${stamp}`);
     await copyDirJsFiles(SRC_DIR, backupDir);
-    const files = await fs.readdir(snapDir);
+    const files = await listTsFiles(snapDir);
     const jsFiles = files.filter((f) => f.endsWith('.ts'));
     if (jsFiles.length === 0) {
         throw new Error(t('self.apply_no_ts', { dir: snapDir }));
@@ -217,7 +237,9 @@ export async function selfApply({ name, locale, }) {
     const applied = [];
     for (const f of jsFiles) {
         const data = await fs.readFile(path.join(snapDir, f), 'utf-8');
-        await fs.writeFile(path.join(SRC_DIR, f), data, 'utf-8');
+        const dest = path.join(SRC_DIR, f);
+        await ensureDir(path.dirname(dest));
+        await fs.writeFile(dest, data, 'utf-8');
         applied.push(f);
     }
     console.log(theme.assistant('\n' + t('self.applied', { n: applied.length })));
@@ -265,11 +287,9 @@ export async function selfList({ locale, } = {}) {
 }
 // ---------- helpers ----------
 async function diffFiles(origDir, newDir) {
-    const files = await fs.readdir(newDir).catch(() => []);
+    const files = await listTsFiles(newDir).catch(() => []);
     const changed = [];
     for (const f of files) {
-        if (!f.endsWith('.ts'))
-            continue;
         const a = await fs.readFile(path.join(origDir, f), 'utf-8').catch(() => '');
         const b = await fs.readFile(path.join(newDir, f), 'utf-8').catch(() => '');
         if (a !== b)

package/dist/shell.js

@@ -1,25 +1,77 @@
-import { exec } from 'child_process';
+import { exec, execFile } from 'child_process';
 import path from 'path';
+import os from 'os';
 // Shared shell runner for the Bash tool and the operator's `!command` escape.
 // Kept in its own module so both call sites use the SAME sandbox guard and the
 // SAME abort wiring; a second, ad-hoc runner would drift from the real one.
+// Quote one argument for POSIX sh: wrap in single quotes and turn every inner
+// single quote into '\''. Inside single quotes sh expands NOTHING, so a value
+// carrying $(...), backticks or $VAR is passed through literally. A plain
+// JSON.stringify is NOT a safe substitute: it produces double quotes, inside
+// which sh still performs command substitution.
+export function shellQuote(arg) {
+    return "'" + String(arg).replace(/'/g, "'\\''") + "'";
+}
 // Sandbox (option A): don't let a shell command go above the project root.
 // This is a protective barrier, not full OS isolation.
 export function assertCommandInsideRoot(root, command) {
     const cmd = String(command || '');
-    const cdRe = /(?:^|[;&|]|\s)(?:cd|pushd)\s+([^;&|]+)/gi;
+    // eval re-parses its argument, so a `cd` hidden inside a string is invisible
+    // to the static scan; refusing eval together with cd is the honest answer
+    // instead of pretending the barrier still holds.
+    if (/\beval\b/.test(cmd) && /\bcd\b/.test(cmd)) {
+        throw new Error('Sandbox: eval with cd is forbidden');
+    }
+    // `(` and backticks open a subshell / command substitution where a `cd` is
+    // still executed; include them in the prefix so the scan sees it.
+    const cdRe = /(?:^|[;&|(\s`])(?:cd|pushd)\s+([^;&|)]+)/gi;
     let m;
     while ((m = cdRe.exec(cmd))) {
-        const raw = m[1].trim();
+        const raw = m[1].trim().replace(/^["']|["']$/g, '');
         if (!raw || raw === '-')
             continue;
-        const target = path.resolve(root, raw);
+        // sh expands ~ and $HOME AFTER this check, so expand them here as well —
+        // otherwise `cd ~` passes the guard and then leaves the root.
+        const expanded = raw
+            .replace(/^~(?=$|[/\\])/, os.homedir())
+            .replace(/\$\{?HOME\}?/g, os.homedir());
+        const target = path.resolve(root, expanded);
         const rel = path.relative(root, target);
         if (rel.startsWith('..') || path.isAbsolute(rel)) {
             throw new Error('Sandbox: leaving ' + root + ' is forbidden (cd ' + raw + ')');
         }
     }
 }
+function formatExecResult(err, stdout, stderr, timeout, okExitCodes) {
+    const out = (stdout || '').toString();
+    const errStr = (stderr || '').toString();
+    if (!err ||
+        (typeof err.code === 'number' && okExitCodes.includes(err.code))) {
+        const combined = (out + errStr).trim();
+        return combined || '(command produced no output)';
+    }
+    const parts = [];
+    if (err.killed) {
+        parts.push('\u23f1 Timeout after ' + timeout + 'ms \u2014 process killed.');
+    }
+    else if (err.code === 'ABORT_ERR') {
+        parts.push('(aborted by the operator)');
+    }
+    else if (err.code !== undefined && err.code !== null) {
+        parts.push('Exit code: ' + err.code);
+    }
+    else if (err.signal) {
+        parts.push('Killed by signal: ' + err.signal);
+    }
+    else {
+        parts.push('Error: ' + err.message);
+    }
+    if (out.trim())
+        parts.push('stdout:\n' + out.trim());
+    if (errStr.trim())
+        parts.push('stderr:\n' + errStr.trim());
+    return parts.join('\n');
+}
 export function runShell(workdir, command, timeout = 30_000, signal) {
     return new Promise((resolve) => {
         const options = {
@@ -39,34 +91,24 @@ export function runShell(workdir, command, timeout = 30_000, signal) {
             options.shell = '/bin/sh';
         }
         exec(command, options, (err, stdout, stderr) => {
-            const out = (stdout || '').toString();
-            const errStr = (stderr || '').toString();
-            if (!err) {
-                const combined = (out + errStr).trim();
-                resolve(combined || '(command produced no output)');
-                return;
-            }
-            const parts = [];
-            if (err.killed) {
-                parts.push('\u23f1 Timeout after ' + timeout + 'ms \u2014 process killed.');
-            }
-            else if (err.code === 'ABORT_ERR') {
-                parts.push('(aborted by the operator)');
-            }
-            else if (err.code !== undefined && err.code !== null) {
-                parts.push('Exit code: ' + err.code);
-            }
-            else if (err.signal) {
-                parts.push('Killed by signal: ' + err.signal);
-            }
-            else {
-                parts.push('Error: ' + err.message);
-            }
-            if (out.trim())
-                parts.push('stdout:\n' + out.trim());
-            if (errStr.trim())
-                parts.push('stderr:\n' + errStr.trim());
-            resolve(parts.join('\n'));
+            resolve(formatExecResult(err, stdout, stderr, timeout, []));
+        });
+    });
+}
+// Run an executable directly with an argument ARRAY (no shell). Use this
+// whenever an argument comes from the model: the shell never sees it, so
+// $(...), backticks and quotes cannot be interpreted as commands.
+export function runFile(workdir, file, args, timeout = 30_000, signal, okExitCodes = []) {
+    return new Promise((resolve) => {
+        execFile(file, args, {
+            cwd: workdir,
+            timeout,
+            maxBuffer: 1024 * 1024 * 8,
+            windowsHide: true,
+            env: { ...process.env },
+            signal,
+        }, (err, stdout, stderr) => {
+            resolve(formatExecResult(err, stdout, stderr, timeout, okExitCodes));
         });
     });
 }

package/dist/tools.js

@@ -1,6 +1,7 @@
 import fs from 'fs/promises';
 import path from 'path';
-import { assertCommandInsideRoot, runShell } from './shell.js';
+import { assertCommandInsideRoot, runFile, runShell } from './shell.js';
+import { safePath } from './sandbox.js';
 import { createGitTools } from './gitTools.js';
 import { createWebTools } from './web.js';
 import { createExtraTools } from './extraTools.js';
@@ -10,16 +11,7 @@ import { createExtraTools } from './extraTools.js';
 // those live in src/i18n.ts (CATALOG) and are picked by the locale setting.
 export function createTools(workdir, { undo, todos, readOnly = false, } = {}) {
     const root = path.resolve(workdir);
-    const safe = (p) => {
-        const resolved = path.resolve(root, p);
-        // startsWith(root) would let through sibling paths with a common prefix
-        // (C:\work\proj vs C:\work\proj-old). We compute via relative().
-        const rel = path.relative(root, resolved);
-        if (rel.startsWith('..') || path.isAbsolute(rel)) {
-            throw new Error(`Access outside the working directory is forbidden: ${p}`);
-        }
-        return resolved;
-    };
+    const safe = (p) => safePath(root, p);
     // Extracts text from content/content_base64. base64 is needed because the
     // channel that delivers the model's answer may corrupt characters ($,
     // backslashes, newlines). base64 consists only of [A-Za-z0-9+/=] and is not
@@ -124,7 +116,9 @@ export function createTools(workdir, { undo, todos, readOnly = false, } = {}) {
                 }
                 if (undo)
                     await undo.backup(file);
-                content = content.replace(oldStr, newStr);
+                // Functional replacement: a string replacer interprets $-patterns
+                // ($&, $$, $1) inside newStr and silently corrupts the written text.
+                content = content.replace(oldStr, () => newStr);
                 await fs.writeFile(file, content, 'utf-8');
                 return `Edited: ${p}`;
             },
@@ -182,17 +176,18 @@ export function createTools(workdir, { undo, todos, readOnly = false, } = {}) {
                     .map((s) => s.trim())
                     .filter(Boolean);
                 const mode = String(output || 'content').toLowerCase();
+                // The pattern and the target come from the model, so they are passed
+                // as an execFile ARGUMENT ARRAY: the shell never parses them and a
+                // pattern carrying $(...)/backticks cannot run as a command (this
+                // used to be a sandbox escape). Exit code 1 = no matches, not an error.
                 if (process.platform === 'win32') {
-                    const escaped = pat.replace(/"/g, '\\"');
-                    const scope = searchPath ? '"' + target + '\\*' : '*';
-                    return runShell(workdir, `findstr /s /n /r /c:"${escaped}" ` + scope);
+                    const args = ['/s', '/n', '/r', '/c:' + pat];
+                    args.push(searchPath ? target + '\\*' : '*');
+                    return runFile(workdir, 'findstr', args, 30_000, undefined, [1]);
                 }
                 const flags = mode === 'files_only' ? '-rlE' : mode === 'count' ? '-rcE' : '-rnE';
-                const includeArg = incs
-                    .map((g) => ' --include=' + JSON.stringify(g))
-                    .join('');
-                return runShell(workdir, `grep ${flags}${includeArg} ${JSON.stringify(pat)} ` +
-                    `${JSON.stringify(target)} || true`);
+                const args = [flags, ...incs.map((g) => '--include=' + g), pat, target];
+                return runFile(workdir, 'grep', args, 30_000, undefined, [1]);
             },
         },
     ];
@@ -233,3 +228,28 @@ export const MUTATING_TOOLS = new Set([
 export function filterToolsForReadOnly(tools) {
     return tools.filter((t) => !MUTATING_TOOLS.has(t.name));
 }
+// MCP tool names are opaque (server + '__' + tool), so the exact-name
+// MUTATING_TOOLS set cannot classify them. Instead we match the common
+// mutating VERBS in the tool name. It is a heuristic deny-list, not a proof:
+// an exotic server could name a mutating tool innocuously. The honest default
+// in read-only mode is therefore to drop everything that looks like a writer.
+const MCP_MUTATING_RE = /(^|_)(click|type|navigate|press|upload|select|drag|fill|hover|evaluate|run_code|run_|handle_dialog|key|screenshot|write|create|delete|update|set|put|post|patch|execute|exec|insert|remove|drop|restart|stop|start|install|kill|move|rename|copy|mkdir|rmdir|touch|chmod|chown)(_|$)/;
+export function isMutatingMcpTool(name) {
+    // Strip the server prefix and normalize separators to underscores so the
+    // verb matcher sees "browser_click" -> "click".
+    const tail = String(name).split('__').pop() || String(name);
+    const norm = tail.toLowerCase().replace(/[^a-z0-9]+/g, '_');
+    return MCP_MUTATING_RE.test('_' + norm + '_');
+}
+// Merge MCP tools into the base set. In read-only (plan) mode the MCP tools
+// must be filtered too: an MCP server (e.g. @playwright/mcp) exposes mutating
+// tools (click/type/navigate) that would otherwise defeat the read-only
+// promise. This is a SEPARATE helper (not ad-hoc push sites) so the filtering
+// cannot be forgotten at one of the four call sites. Pure; unit-tested.
+export function mergeTools(base, mcp, readOnly = false) {
+    const all = mcp || [];
+    const extra = readOnly
+        ? all.filter((t) => !MUTATING_TOOLS.has(t.name) && !isMutatingMcpTool(t.name))
+        : all;
+    return [...base, ...extra];
+}

package/dist/transcript.js

@@ -53,8 +53,21 @@ export class Transcript {
         }
         catch { }
     }
+    // Flush the stream and resolve once the data reached the file. The callers
+    // run on process.exit paths (one-shot --task, browser error, clean exit), and
+    // end() without awaiting the callback lets the process die before the buffer
+    // is written — exactly the final events (task result, agent error) one needs
+    // for a post-mortem. A no-op promise when there is no stream.
     close() {
-        if (this.stream)
-            this.stream.end();
+        const stream = this.stream;
+        this.stream = null;
+        if (!stream)
+            return Promise.resolve();
+        return new Promise((resolve) => {
+            stream.end(() => resolve());
+            // A write error must not hang the exit; the error listener is installed
+            // in the constructor.
+            stream.on('error', () => resolve());
+        });
     }
 }