zames_pro 2.82.58 → 2.82.60

package/CHANGELOG.md

@@ -7,6 +7,18 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.82.60] - 2026-10-23
+
+### Fixed
+
+- **permissions:** scan nested path arguments for every tool, not only MCP
+
+## [2.82.59] - 2026-10-23
+
+### Fixed
+
+- **commands:** /diffstat hides the padded no-output sentinel
+
 ## [2.82.58] - 2026-10-23
 
 ### Fixed

package/dist/commands.js

@@ -46,7 +46,10 @@ export function formatDiffStat(statText, opts = {}, t = translate('en')) {
         .split(CR + NL)
         .join(NL)
         .trimEnd();
-    if (!trimmed || trimmed === '(command produced no output)') {
+    // Compare the TRIMMED text: the runner's sentinel reaches this function
+    // with its own padding, and a raw comparison then printed the internal
+    // marker to the operator (formatDiff already trims).
+    if (!trimmed || trimmed.trim() === '(command produced no output)') {
         return t('diff.no_changes');
     }
     const lines = trimmed.split(NL);

package/dist/permissions.js

@@ -123,7 +123,13 @@ export function collectPathCandidates(tool, args) {
     // free to nest (`{file: {path}}`) or take `argv: ['cat', '/etc/x']`. Only
     // values that clearly look like paths are taken (depth-bounded to avoid a
     // pathological payload).
-    if (tool.includes('__')) {
+    //
+    // This runs for EVERY tool, not only MCP ones: a model that invents an
+    // argument shape (`{file: {path}}`, `{files: [...]}`) on a built-in tool
+    // used to slip past a `path` deny rule, silently widening the operator's
+    // policy. Path-looking values of a built-in's own arguments are exactly what
+    // such a rule is meant to match.
+    {
         const walk = (v, depth) => {
             if (depth > 4 || v === null || v === undefined)
                 return;
@@ -146,7 +152,9 @@ export function collectPathCandidates(tool, args) {
         for (const v of Object.values(a))
             walk(v, 0);
     }
-    return out;
+    // De-duplicate: a known key (`path`) is now also reached by the generic
+    // nested walk, and callers compare the candidate LIST (`deepEqual`).
+    return Array.from(new Set(out));
 }
 export function decidePermission(policy, tool, args) {
     if (!policy)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zames_pro",
-  "version": "2.82.58",
+  "version": "2.82.60",
   "description": "Terminal coding agent that drives a real browser to chat with DeepSeek, Qwen and other web LLMs — no API key required. Reads and edits files, runs commands, commits to git, like Claude Code / Codex CLI.",
   "type": "module",
   "bin": {