zames_pro 2.82.55 → 2.82.57

package/CHANGELOG.md

@@ -7,6 +7,20 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.82.57] - 2026-10-23
+
+### Fixed
+
+- **shell:** strip every quote from a cd target before the sandbox check
+
+## [2.82.56] - 2026-10-23
+
+### Fixed
+
+- **tool-summary:** mark an MCP failure as an error, not a success
+- **tools:** answer Read failures in the tool's own words
+- **paste:** never swap the bodies of two same-size pastes
+
 ## [2.82.55] - 2026-10-23
 
 ### Fixed

package/dist/input/layout.js

@@ -64,28 +64,77 @@ export function pasteReplacement(raw) {
         return null;
     return { marker: formatPasteMarker(lines), text };
 }
-// Replace "[Pasted lines#N]" markers with the original pasted text. The marker
-// carries ONLY the line count, so two pastes of the same length share it: a
-// plain indexOf-per-paste substituted the FIRST paste's text into whichever
-// marker survived (the operator deleted the first one) — the model then got
-// the WRONG paste under a plausible marker. Replacing ONE occurrence per paste
-// and tying each marker to the pasted text it was CREATED with fixes it for
-// every order: an unmatched paste leaves the marker as text instead of
-// swapping bodies.
-export function expandPastes(pastes, text) {
+// Replace "[Pasted lines#N]" markers with the original pasted text.
+//
+// The marker carries ONLY the line count, so two pastes of the same length are
+// indistinguishable in the buffer. The old "last occurrence for the last paste"
+// walk handed the SURVIVING marker the wrong body whenever the operator deleted
+// the other one. The caller can also name the paste it deleted
+// (`deletedIndex`), which removes the ambiguity completely; without it, an
+// ambiguous case (two same-size pastes, exactly one marker left) cannot be
+// resolved from the text, so the marker is left AS IS — sending the literal
+// "[Pasted lines#3]" is visible to the operator, while the wrong body under a
+// plausible marker silently sends the model someone else's text.
+export function expandPastes(pastes, text, deletedIndex) {
     if (!pastes.length)
         return text;
-    // Expand in REVERSE order of appearance: each paste consumes its OWN marker
-    // occurrence (the last one for the last paste), so a marker the operator
-    // deleted cannot shift another paste's text into the wrong slot. With a
-    // single occurrence left, the LAST paste owns it — the operator deleted the
-    // EARLIER marker, so the later paste's body is the right fill.
-    let out = String(text);
-    for (let i = pastes.length - 1; i >= 0; i--) {
-        const p = pastes[i];
-        const idx = out.lastIndexOf(p.marker);
+    const src = String(text);
+    // Without a deletion hint, expansion is only unambiguous when the number of
+    // surviving markers matches the number of pastes (nothing was deleted) or
+    // the markers differ (different line counts).
+    const occurrences = new Map();
+    for (const p of pastes) {
+        occurrences.set(p.marker, (occurrences.get(p.marker) || 0) + 1);
+    }
+    let ambiguous = false;
+    for (const [marker, count] of occurrences) {
+        let seen = 0;
+        let from = 0;
+        while (true) {
+            const idx = src.indexOf(marker, from);
+            if (idx === -1)
+                break;
+            seen++;
+            from = idx + marker.length;
+        }
+        if (seen === count)
+            continue;
+        // Fewer markers than pastes means one was deleted; more than one survivor
+        // of the same text cannot be attributed.
+        if (seen > 1 || count > 1)
+            ambiguous = true;
+    }
+    if (deletedIndex !== undefined)
+        ambiguous = false;
+    // With a KNOWN deletion index the mapping is exact: the remaining pastes in
+    // order own the remaining markers in order.
+    const pool = deletedIndex !== undefined &&
+        deletedIndex >= 0 &&
+        deletedIndex < pastes.length
+        ? pastes.filter((_p, i) => i !== deletedIndex)
+        : pastes;
+    let out = src;
+    let scanFrom = 0;
+    const positions = [];
+    for (const p of pool) {
+        const idx = out.indexOf(p.marker, scanFrom);
         if (idx === -1)
             continue;
+        positions.push({ p, idx });
+        scanFrom = idx + p.marker.length;
+    }
+    const survivors = pool.length;
+    const total = pastes.length;
+    const lost = total - pool.length;
+    const found = positions.length;
+    // Every marker left in the text must be accounted for, and every unmatched
+    // paste must have actually lost its marker. Anything else is ambiguous.
+    if (!ambiguous && (found !== survivors || lost < 0))
+        ambiguous = true;
+    if (ambiguous)
+        return src;
+    for (let i = positions.length - 1; i >= 0; i--) {
+        const { p, idx } = positions[i];
         out = out.slice(0, idx) + p.text + out.slice(idx + p.marker.length);
     }
     return out;

package/dist/shell.js

@@ -33,7 +33,12 @@ export function assertCommandInsideRoot(root, command) {
     const cdRe = /(?:^|[;&|(\s`])(?:cd|pushd)\s*([^;&|)]+)/gi;
     let m;
     while ((m = cdRe.exec(cmd))) {
-        const raw = m[1].trim().replace(/^["']|["']$/g, '');
+        // The shell removes EVERY quote in the word, wherever it sits —
+        // `cd "a"/"../../.."` is one word whose value is `a/../../..`. Stripping
+        // only a matching PAIR at the ENDS left the inner quotes in place, so the
+        // target was compared as the literal `a/"/../../..` (which normalizes to
+        // a path INSIDE the root), passed the guard, and then escaped for real.
+        const raw = m[1].trim().replace(/["']/g, '');
         if (!raw || raw === '-')
             continue;
         // A `cd` target we cannot RESOLVE statically is rejected: the shell would

package/dist/tool-summary.js

@@ -97,6 +97,11 @@ export function looksLikeToolError(result) {
         head.startsWith('blocked by') ||
         head.startsWith('denied by') ||
         head.startsWith('unknown tool') ||
+        // An MCP failure is returned AS the result (see renderMcpResult):
+        // `MCP error: …` for an isError answer, `MCP error (server/tool): …`
+        // when the call throws. Neither was recognised, so a failed MCP call was
+        // drawn with a green check.
+        head.startsWith('mcp error') ||
         head.startsWith('subagents are not available') ||
         head.startsWith('subagent failed') ||
         head.startsWith('subagent error') ||

package/dist/tools.js

@@ -107,7 +107,30 @@ export function createTools(workdir, { undo, todos, readOnly = false, subagents
                 // Binary guard (N35): reading an image/archive as utf-8 produced
                 // mojibake the model tried to reason about. Detect a binary buffer
                 // BEFORE decoding and answer with useful metadata instead.
-                const buf = await fs.readFile(file);
+                // A read FAILURE (a missing file, a directory, EACCES) is answered in
+                // the tool's own words: the raw Node error carries the ABSOLUTE server
+                // path and a POSIX-only message, and the loop would wrap it as
+                // `Error: ENOENT: …`, which tells the model nothing actionable.
+                let buf;
+                try {
+                    buf = await fs.readFile(file);
+                }
+                catch (e) {
+                    const code = e.code;
+                    if (code === 'ENOENT') {
+                        return ('File not found: ' +
+                            p +
+                            ' (check the path; it must be inside the working directory)');
+                    }
+                    if (code === 'EISDIR') {
+                        return (p +
+                            ' is a directory, not a file. Use LS or Glob to list its contents.');
+                    }
+                    if (code === 'EACCES' || code === 'EPERM') {
+                        return 'Permission denied reading ' + p;
+                    }
+                    return 'Error reading ' + p + ': ' + e.message;
+                }
                 if (isImageName(file)) {
                     return ('[image: ' +
                         p +

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zames_pro",
-  "version": "2.82.55",
+  "version": "2.82.57",
   "description": "Terminal coding agent that drives a real browser to chat with DeepSeek, Qwen and other web LLMs — no API key required. Reads and edits files, runs commands, commits to git, like Claude Code / Codex CLI.",
   "type": "module",
   "bin": {