zames_pro 2.82.56 → 2.82.57

package/CHANGELOG.md

@@ -7,6 +7,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.82.57] - 2026-10-23
+
+### Fixed
+
+- **shell:** strip every quote from a cd target before the sandbox check
+
 ## [2.82.56] - 2026-10-23
 
 ### Fixed

package/dist/shell.js

@@ -33,7 +33,12 @@ export function assertCommandInsideRoot(root, command) {
     const cdRe = /(?:^|[;&|(\s`])(?:cd|pushd)\s*([^;&|)]+)/gi;
     let m;
     while ((m = cdRe.exec(cmd))) {
-        const raw = m[1].trim().replace(/^["']|["']$/g, '');
+        // The shell removes EVERY quote in the word, wherever it sits —
+        // `cd "a"/"../../.."` is one word whose value is `a/../../..`. Stripping
+        // only a matching PAIR at the ENDS left the inner quotes in place, so the
+        // target was compared as the literal `a/"/../../..` (which normalizes to
+        // a path INSIDE the root), passed the guard, and then escaped for real.
+        const raw = m[1].trim().replace(/["']/g, '');
         if (!raw || raw === '-')
             continue;
         // A `cd` target we cannot RESOLVE statically is rejected: the shell would

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zames_pro",
-  "version": "2.82.56",
+  "version": "2.82.57",
   "description": "Terminal coding agent that drives a real browser to chat with DeepSeek, Qwen and other web LLMs — no API key required. Reads and edits files, runs commands, commits to git, like Claude Code / Codex CLI.",
   "type": "module",
   "bin": {