zames_pro 2.73.2 → 2.73.3

package/CHANGELOG.md

@@ -7,6 +7,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.73.3] - 2026-10-11
+
+### Fixed
+
+- harden SSRF guard, sandbox, git args, mcp lifecycle and editor
+
 ## [2.73.2] - 2026-10-11
 
 ### Changed

package/dist/attachments.js

@@ -197,18 +197,22 @@ export function looksLikeFileName(name) {
 export async function saveToTemp(tmpDir, name, data) {
     await fs.mkdir(tmpDir, { recursive: true });
     const base = sanitize(name);
-    let target = path.join(tmpDir, base);
-    if (await fs.stat(target).catch(() => null)) {
-        const ext = path.extname(base);
-        const stem = base.slice(0, base.length - ext.length);
-        let i = 1;
-        while (await fs.stat(target).catch(() => null)) {
-            target = path.join(tmpDir, stem + '-' + i + ext);
-            i++;
+    const ext = path.extname(base);
+    const stem = base.slice(0, base.length - ext.length);
+    // O_EXCL ('wx'): pick the first free name and CREATE it atomically. A
+    // stat-then-write raced with another attach and silently overwrote a file.
+    for (let i = 0; i < 10_000; i++) {
+        const target = path.join(tmpDir, i === 0 ? base : stem + '-' + i + ext);
+        try {
+            await fs.writeFile(target, data, { flag: 'wx' });
+            return target;
+        }
+        catch (e) {
+            if (e.code !== 'EEXIST')
+                throw e;
         }
     }
-    await fs.writeFile(target, data);
-    return target;
+    throw new Error('could not find a free temp name for ' + base);
 }
 // True if any OS clipboard tool is available on this machine.
 export function hasClipboardTool() {

package/dist/checkpoint.js

@@ -2,6 +2,7 @@ import fs from 'fs/promises';
 import path from 'path';
 import os from 'os';
 import { execFile } from 'child_process';
+import { randomBytes } from 'crypto';
 import { writeJsonAtomic } from './fsutil.js';
 // Checkpoints / rewind (BACKLOG B3).
 //
@@ -120,7 +121,11 @@ export class CheckpointStore {
             return null;
         await this._ensure();
         const stamp = Date.now();
-        const file = path.join(this.dir, `${stamp}.tgz`);
+        // Two checkpoints in the SAME millisecond would share `${stamp}.tgz` and
+        // the second would overwrite the first (losing a snapshot). Add a random
+        // suffix so an archive name is unique.
+        const uniq = randomBytes(3).toString('hex');
+        const file = path.join(this.dir, `${stamp}-${uniq}.tgz`);
         const res = await runTar(tarCreateArgs(file, workdir), workdir);
         if (res.code !== 0) {
             await fs.rm(file, { force: true }).catch(() => { });
@@ -187,7 +192,19 @@ export class CheckpointStore {
                     .rm(path.join(record.workdir, e), { recursive: true, force: true })
                     .catch(() => { });
             }
-            await copyTree(tmp, record.workdir);
+            // A copy failure here must NOT surface as an uncaught throw that leaves
+            // the (already wiped) tree half-restored: report it as a failure so the
+            // caller can tell the operator to /rewind from the pre-rewind backup.
+            try {
+                await copyTree(tmp, record.workdir);
+            }
+            catch (e) {
+                return {
+                    ok: false,
+                    reason: 'copy_failed',
+                    detail: e.message,
+                };
+            }
             return { ok: true, record, backup };
         }
         finally {

package/dist/config.js

@@ -119,6 +119,12 @@ export function providerAskDeadlineMs(cfg) {
 }
 function deepMerge(target, source) {
     for (const key of Object.keys(source)) {
+        // A `.zamesrc.json` (possibly shared/copied from elsewhere) could carry a
+        // `__proto__` / `constructor` / `prototype` key; assigning those to a
+        // plain object mutates Object.prototype (prototype pollution). Skip them.
+        if (key === '__proto__' || key === 'constructor' || key === 'prototype') {
+            continue;
+        }
         if (source[key] &&
             typeof source[key] === 'object' &&
             !Array.isArray(source[key])) {

package/dist/context.js

@@ -211,7 +211,17 @@ export function skillBody(raw) {
     const end = norm.indexOf(NL + '---', 3);
     if (end === -1)
         return norm.trim();
-    return norm.slice(norm.indexOf(NL, end + 1) + 1).trim();
+    // The closing `---` may be the LAST line with no trailing newline; then
+    // indexOf(NL, …) is -1 and slice(0) returned the WHOLE file (frontmatter
+    // included). Guard the -1 -> the body is everything after the closing ---.
+    const after = norm.indexOf(NL, end + 1);
+    if (after === -1) {
+        // No newline after the closing delimiter: the body is empty (or just the
+        // rest of that final line, which IS the `---`).
+        const rest = norm.slice(end + 1);
+        return rest.replace(/^-*$/, '').trim();
+    }
+    return norm.slice(after + 1).trim();
 }
 async function findSkillFiles(root, depth = 3) {
     const out = [];
@@ -500,11 +510,17 @@ async function loadScopedAgents(workdir, touchPaths) {
     const out = [];
     const seen = new Set();
     for (const dir of dirs) {
+        // AGENTS.md is head-clipped; MEMORY.md is append-only so it uses the
+        // memory budget and keeps its TAIL (same rule as the main memory chain) —
+        // otherwise the newest notes in a large nested MEMORY.md were lost.
         for (const names of [AGENT_NAMES, MEMORY_NAMES]) {
+            const isMemory = names === MEMORY_NAMES;
             const p = await findNamedFile(dir, names);
             if (!p || seen.has(p))
                 continue;
-            const f = await readIfFile(p, MAX_FILE_BASE);
+            const f = isMemory
+                ? await readIfFile(p, MAX_MEMORY_FILE, true)
+                : await readIfFile(p, MAX_FILE_BASE);
             if (!f)
                 continue;
             seen.add(p);

package/dist/gitTools.js

@@ -150,7 +150,11 @@ export function createGitTools(workdir) {
                 const err = await ensureRepo();
                 if (err)
                     return err;
-                return runGitArgs(['log', '--oneline', '--decorate', '-n', String(Number(count) || 10)], workdir, 10_000);
+                // Guard the count: `Number(count)||10` let -3 and Infinity through as
+                // literal `-n -3` / `-n Infinity`. Keep a positive integer only.
+                const n = Math.trunc(Number(count));
+                const lim = Number.isFinite(n) && n > 0 ? n : 10;
+                return runGitArgs(['log', '--oneline', '--decorate', '-n', String(lim)], workdir, 10_000);
             },
         },
         {
@@ -238,14 +242,17 @@ export function createGitTools(workdir) {
                 const fs = await import('fs/promises');
                 const path = await import('path');
                 const os = await import('os');
-                const tmp = path.join(os.tmpdir(), `dsa-commit-${Date.now()}.txt`);
-                await fs.writeFile(tmp, msg, 'utf-8');
+                // O_EXCL ('wx') so a pre-created symlink at this predictable path
+                // cannot redirect the write to another file (TOCTOU on a shared /tmp).
+                const tmpDir = await fs.mkdtemp(path.join(os.tmpdir(), 'zames-commit-'));
+                const tmp = path.join(tmpDir, 'msg.txt');
+                await fs.writeFile(tmp, msg, { encoding: 'utf-8', flag: 'wx' });
                 try {
                     const result = await runGitArgs(['commit', '-F', tmp], workdir, 30_000);
                     return `add: ${addResult}\ncommit: ${result}`;
                 }
                 finally {
-                    await fs.unlink(tmp).catch(() => { });
+                    await fs.rm(tmpDir, { recursive: true, force: true }).catch(() => { });
                 }
             },
         },
@@ -269,6 +276,15 @@ export function createGitTools(workdir) {
                 if (!/^[A-Za-z0-9._/-]+$/.test(b) || b.startsWith('-')) {
                     return `Error: invalid branch name: ${b}`;
                 }
+                // The regex above allows `..` and `@{`, which git parses as a REFSPEC
+                // RANGE (`git push origin a..b`), not a branch. Ask git itself so the
+                // name is valid by construction.
+                const refCheck = await runGitArgs(['check-ref-format', '--branch', b], workdir, 5000);
+                // On success git echoes the branch name; on failure it prints an
+                // `Exit code: <n>` / `fatal:` block instead.
+                if (refCheck.trim() !== b) {
+                    return `Error: invalid branch name: ${b}`;
+                }
                 const args = ['push'];
                 if (setUpstream)
                     args.push('-u');

package/dist/index.js

@@ -85,7 +85,13 @@ const headless = hasFlag('--headed')
     : hasFlag('--headless') || config.headless;
 const debug = hasFlag('--debug') || config.debug;
 const maxIterArg = getArg('--max-iter', null);
-const maxIter = maxIterArg !== null ? Number(maxIterArg) : config.maxIterations;
+// A non-numeric `--max-iter abc` yields NaN, which the loop treats as
+// "unlimited" (NaN > 0 is false). Fall back to the configured value instead
+// of silently disabling the cap.
+const maxIterParsed = maxIterArg !== null ? Number(maxIterArg) : NaN;
+const maxIter = Number.isFinite(maxIterParsed)
+    ? maxIterParsed
+    : config.maxIterations;
 const positional = getPositional();
 const task = getArg('--task', positional.join(' ').trim() || null);
 const chatIdArg = getArg('--chat', null);

package/dist/input.js

@@ -892,28 +892,17 @@ export class LineEditor {
         }
         const cols = process.stdout.columns || 80;
         const lay = layoutInput(this.promptStr, this.buf, this.cursor, cols);
-        const sugg = this._suggestions();
-        const shown = sugg.slice(0, 8);
-        this._suggestCount = shown.length;
-        const linesBelow = shown.length
-            ? shown.length + (sugg.length > shown.length ? 1 : 0)
-            : 0;
+        // Reuse the SAME windowed+highlighted suggestion lines as _writeBlock.
+        // Before, this used a hardcoded `sugg.slice(0, 8)`, so navigating past
+        // page 1 (Ctrl+N/P) left the repaint showing the first page without the
+        // highlight, and linesBelow drifted from the real row count.
+        const sug = this._suggestionLines(this._suggestOffset);
+        const linesBelow = sug.rows;
         // Move up to the INPUT top using the OLD cursor row (on screen right now).
         this._eraseInputOnly(this.cursorRowFromTop - this._statusTop);
         let out = lay.rows.map((r) => r.prefix + r.text).join(NL);
-        if (shown.length) {
-            const maxName = Math.max(...shown.map((c) => c.name.length));
-            const lines = shown.map((c) => {
-                const name = theme.prompt(c.name.padEnd(maxName));
-                const desc = theme.dim('  ' + c.description);
-                return '   ' + name + desc;
-            });
-            out += NL + lines.join(NL);
-            const hidden = sugg.length - shown.length;
-            if (hidden > 0)
-                out +=
-                    NL +
-                        theme.dim('   ' + translate(this.locale)('editor.more', { n: hidden }));
+        if (sug.lines.length) {
+            out += NL + sug.lines.join(NL);
         }
         // A buffer change can UNWRAP the input (backspace on a wrapped line), so
         // the block can get shorter here too — push it back to the bottom BEFORE

package/dist/mcp.js

@@ -44,9 +44,9 @@ export function hardenPlaywrightArgs(command, args) {
     const hay = (String(command || '') + ' ' + args.join(' ')).toLowerCase();
     if (!hay.includes('playwright') || !hay.includes('mcp'))
         return args;
-    if (args.some((a) => a === '--isolated' ||
+    if (args.some((a) => a.startsWith('--isolated') ||
         a.startsWith('--user-data-dir') ||
-        a === '--extension' ||
+        a.startsWith('--extension') ||
         a.startsWith('--cdp-endpoint'))) {
         return args;
     }
@@ -292,10 +292,15 @@ export function dedupeToolNames(tools) {
 }
 // Connect to ONE server and return a ready connection (or an error).
 async function connectServer(name, cfg, debug) {
+    // Declared OUTSIDE the try so the catch can close a half-open server: a
+    // stdio transport SPAWNS a child process on connect, and if connect() or
+    // listTools() throws we would otherwise leak an orphan process on every run.
+    let client = null;
+    let transport = null;
     try {
         const { Client } = await import('@modelcontextprotocol/sdk/client/index.js');
-        const client = new Client({ name: 'zames', version: packageVersion() }, { capabilities: {} });
-        let transport;
+        const c = new Client({ name: 'zames', version: packageVersion() }, { capabilities: {} });
+        client = c;
         if (cfg.url) {
             if (cfg.transport === 'sse') {
                 const { SSEClientTransport } = await import('@modelcontextprotocol/sdk/client/sse.js');
@@ -320,8 +325,8 @@ async function connectServer(name, cfg, debug) {
                 stderr: 'pipe',
             });
         }
-        await client.connect(transport);
-        const listed = await client.listTools();
+        await c.connect(transport);
+        const listed = await c.listTools();
         const tools = (listed.tools || []).map((t) => {
             const tool = t;
             return {
@@ -331,11 +336,22 @@ async function connectServer(name, cfg, debug) {
             };
         });
         debug?.(`MCP: connected to ${name} (${tools.length} tools)`);
-        return { name, client, tools };
+        return { name, client: c, tools };
     }
     catch (e) {
         const msg = e.message || String(e);
         debug?.(`MCP: failed to connect to ${name}: ${msg}`);
+        // Close a half-open connection so a spawned stdio child is not orphaned.
+        try {
+            if (client)
+                await client.close().catch(() => { });
+        }
+        catch { }
+        try {
+            if (transport?.close)
+                await Promise.resolve(transport.close()).catch(() => { });
+        }
+        catch { }
         return { error: msg };
     }
 }

package/dist/sessions.js

@@ -98,11 +98,16 @@ function writeIndex({ id, workdir }) {
         if (!index.byWorkdir || typeof index.byWorkdir !== 'object') {
             index.byWorkdir = {};
         }
+        // An EMPTY workdir must not become a byWorkdir key: it would make every
+        // project fall back to `index.last` and restore a chat from ANOTHER
+        // project on the next launch. Only track a real directory.
         const key = workdir || '';
-        index.byWorkdir[key] = id;
-        index.last = id;
-        index.updatedAt = new Date().toISOString();
-        writeJsonAtomic(INDEX_FILE, index);
+        if (key) {
+            index.byWorkdir[key] = id;
+            index.last = id;
+            index.updatedAt = new Date().toISOString();
+            writeJsonAtomic(INDEX_FILE, index);
+        }
     }
     catch { }
 }

package/dist/shell.js

@@ -23,6 +23,15 @@ export function assertCommandInsideRoot(root, command) {
         const raw = m[1].trim().replace(/^["']|["']$/g, '');
         if (!raw || raw === '-')
             continue;
+        // A `cd` target we cannot RESOLVE statically is rejected: the shell would
+        // expand it AFTER this scan, so `d=/; cd $d` would otherwise slip past as
+        // root/$d. `$HOME`/`${HOME}` is the one variable we CAN expand (below), so
+        // it is allowed; any OTHER `$var`, a backtick substitution or `~user` is
+        // refused outright.
+        const withoutHome = raw.replace(/\$\{?HOME\}?/g, '');
+        if (/[$`]/.test(withoutHome) || /^~[^/\\]/.test(raw)) {
+            throw new Error('Sandbox: cannot verify cd target ' + raw + ' (variable/substitution)');
+        }
         // sh expands ~ and $HOME AFTER this check, so expand them here as well —
         // otherwise `cd ~` passes the guard and then leaves the root.
         const expanded = raw

package/dist/transcript.js

@@ -64,10 +64,10 @@ export class Transcript {
         if (!stream)
             return Promise.resolve();
         return new Promise((resolve) => {
-            stream.end(() => resolve());
-            // A write error must not hang the exit; the error listener is installed
-            // in the constructor.
+            // Attach the error handler BEFORE end(): an error emitted synchronously
+            // by end() would otherwise reach no listener on this tick.
             stream.on('error', () => resolve());
+            stream.end(() => resolve());
         });
     }
 }

package/dist/undo.js

@@ -1,6 +1,7 @@
 import fs from 'fs/promises';
 import path from 'path';
 import os from 'os';
+import { randomBytes } from 'crypto';
 import { writeJsonAtomic } from './fsutil.js';
 const UNDO_DIR = path.join(os.homedir(), '.zames', 'undo');
 const INDEX = path.join(UNDO_DIR, 'index.json');
@@ -44,7 +45,12 @@ export class UndoStore {
         const hash = Buffer.from(filePath).toString('hex').slice(0, 16);
         let backupFile = null;
         if (existed) {
-            backupFile = path.join(UNDO_DIR, `${stamp}-${hash}.bak`);
+            // The stamp is only ms-precision and the hash is the first 8 bytes of
+            // the path, so two SIBLING files edited in the same millisecond would
+            // collide and the second write would clobber the first (losing the
+            // backup). Add a random suffix so a backup name is unique.
+            const uniq = randomBytes(4).toString('hex');
+            backupFile = path.join(UNDO_DIR, `${stamp}-${hash}-${uniq}.bak`);
             await fs.writeFile(backupFile, content);
         }
         const history = await this._readIndex();

package/dist/web.js

@@ -71,12 +71,34 @@ export function isPrivateIp(ip) {
     const low = ip.toLowerCase();
     if (low === '::1' || low === '::')
         return true;
-    if (low.startsWith('fe80') || low.startsWith('fc') || low.startsWith('fd')) {
+    // IPv6 link-local is fe80::/10, i.e. fe80..febf (the old `startsWith('fe80')`
+    // missed fe90::, fea0:: and febf::). ULA is fc00::/7 (fc..fd). fec0::/10
+    // (deprecated site-local) is also treated as non-public.
+    if (/^fe[89abcde]/.test(low) ||
+        low.startsWith('fc') ||
+        low.startsWith('fd')) {
         return true;
     }
+    // IPv4-mapped in DOTTED form (::ffff:127.0.0.1).
     const mapped = low.match(/^::ffff:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/);
     if (mapped)
         return isPrivateIp(mapped[1]);
+    // IPv4-mapped in HEX form (::ffff:7f00:1 == 127.0.0.1) and the NAT64
+    // well-known prefix 64:ff9b::/96 (which can encode 127.0.0.1 too).
+    const mappedHex = low.match(/^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/);
+    if (mappedHex) {
+        const hi = parseInt(mappedHex[1], 16);
+        const lo = parseInt(mappedHex[2], 16);
+        return isPrivateIp(((hi >> 8) & 0xff) +
+            '.' +
+            (hi & 0xff) +
+            '.' +
+            ((lo >> 8) & 0xff) +
+            '.' +
+            (lo & 0xff));
+    }
+    if (low.startsWith('64:ff9b:'))
+        return true;
     return false;
 }
 export function isPrivateHostname(host) {
@@ -87,6 +109,13 @@ export function isPrivateHostname(host) {
         return true;
     if (h === 'metadata.google.internal')
         return true;
+    // Internal/mDNS/service names that never belong to the public internet.
+    if (h.endsWith('.internal') || h === 'internal')
+        return true;
+    if (h.endsWith('.local') || h === 'local')
+        return true;
+    if (h.endsWith('.home.arpa'))
+        return true;
     return false;
 }
 export async function assertPublicUrl(rawUrl) {
@@ -191,6 +220,10 @@ export async function httpFetch(url, { timeout = DEFAULT_TIMEOUT, headers = {},
                     const next = new URL(loc, current).toString();
                     // Validate the TARGET before requesting it.
                     await assertPublicUrl(next);
+                    // Drain/close the redirect body: otherwise each hop leaks a socket
+                    // (up to MAX_REDIRECTS per fetch), which exhausts the pool on a long
+                    // series of fetches.
+                    await res.body?.cancel().catch(() => { });
                     current = next;
                     continue;
                 }
@@ -310,7 +343,7 @@ export function createWebTools() {
                 if (!/^https?:\/\//i.test(String(url))) {
                     return `Error: URL must start with http:// or https://`;
                 }
-                const limit = Math.min(Number(maxChars) || MAX_TEXT, 60_000);
+                const limit = Math.max(1, Math.min(Number(maxChars) || MAX_TEXT, 60_000));
                 try {
                     await assertPublicUrl(String(url));
                     if (render) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zames_pro",
-  "version": "2.73.2",
+  "version": "2.73.3",
   "description": "Terminal coding agent that drives a real browser to chat with DeepSeek, Qwen and other web LLMs — no API key required. Reads and edits files, runs commands, commits to git, like Claude Code / Codex CLI.",
   "type": "module",
   "bin": {