zames_pro 2.81.2 → 2.81.4

package/CHANGELOG.md

@@ -7,6 +7,18 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.81.4] - 2026-10-21
+
+### Fixed
+
+- **web:** SSRF guard blocks metadata/kubernetes service aliases
+
+## [2.81.3] - 2026-10-21
+
+### Fixed
+
+- **context:** allowed-tools accepts a space-separated list
+
 ## [2.81.2] - 2026-10-21
 
 ### Fixed

package/dist/context.js

@@ -279,10 +279,14 @@ function parseFrontmatter(raw) {
         }
     }
     const allowedTools = typeof out['allowed-tools'] === 'string'
-        ? out['allowed-tools']
-            .split(/,/)
-            .map((s) => s.trim())
-            .filter(Boolean)
+        ? // A comma list is the documented form, but a hand-written SKILL.md
+            // often uses plain spaces (`allowed-tools: Read Bash Grep`). Splitting
+            // on commas alone made that ONE name, no tool matched, and the skill
+            // could only call respond.
+            out['allowed-tools']
+                .split(/[,\s]+/)
+                .map((s) => s.trim())
+                .filter(Boolean)
         : undefined;
     const userInvokable = typeof out['user-invokable'] === 'string'
         ? out['user-invokable'].toLowerCase() !== 'false'

package/dist/web.js

@@ -318,8 +318,15 @@ export function isPrivateHostname(host) {
         return true;
     if (h === 'localhost' || h.endsWith('.localhost'))
         return true;
+    // Cloud metadata / cluster service ALIASES. `metadata` (GCP), `instance-data`
+    // (AWS) and `kubernetes.default[.svc]` are internal-only names; blocking them
+    // by name does not depend on a split-horizon DNS answering with a private IP.
     if (h === 'metadata.google.internal')
         return true;
+    if (h === 'metadata' || h === 'instance-data')
+        return true;
+    if (h === 'kubernetes.default' || h === 'kubernetes.default.svc')
+        return true;
     // Internal/mDNS/service names that never belong to the public internet.
     if (h.endsWith('.internal') || h === 'internal')
         return true;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zames_pro",
-  "version": "2.81.2",
+  "version": "2.81.4",
   "description": "Terminal coding agent that drives a real browser to chat with DeepSeek, Qwen and other web LLMs — no API key required. Reads and edits files, runs commands, commits to git, like Claude Code / Codex CLI.",
   "type": "module",
   "bin": {