zames_pro 2.82.23 → 2.82.24

package/CHANGELOG.md

@@ -7,6 +7,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.82.24] - 2026-10-22
+
+### Fixed
+
+- **permissions:** drop a rule with an unknown condition key
+
 ## [2.82.23] - 2026-10-22
 
 ### Fixed

package/dist/permissions.js

@@ -25,6 +25,15 @@ export function parsePermissions(raw) {
         const action = normAltion(e['action']);
         if (!action)
             continue;
+        // A rule whose condition key is not one we understand (`paths`, `tools`,
+        // `cmd`) would otherwise lose that condition and match EVERY call of the
+        // listed tool — the operator wrote a narrow rule and got a global block.
+        // Such a rule is UNUSABLE: dropping it keeps the operator's policy honest
+        // (the default still applies) instead of silently widening it.
+        const KNOWN = new Set(['action', 'tool', 'command', 'path']);
+        const unknown = Object.keys(e).find((k) => !KNOWN.has(k));
+        if (unknown !== undefined)
+            continue;
         out.push({
             action,
             tool: typeof e['tool'] === 'string' ? e['tool'] : undefined,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zames_pro",
-  "version": "2.82.23",
+  "version": "2.82.24",
   "description": "Terminal coding agent that drives a real browser to chat with DeepSeek, Qwen and other web LLMs — no API key required. Reads and edits files, runs commands, commits to git, like Claude Code / Codex CLI.",
   "type": "module",
   "bin": {