zames_pro 2.82.59 → 2.82.61

package/CHANGELOG.md

@@ -7,6 +7,18 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.82.61] - 2026-10-23
+
+### Fixed
+
+- **tools:** Glob cannot report files outside the project root
+
+## [2.82.60] - 2026-10-23
+
+### Fixed
+
+- **permissions:** scan nested path arguments for every tool, not only MCP
+
 ## [2.82.59] - 2026-10-23
 
 ### Fixed

package/dist/permissions.js

@@ -123,7 +123,13 @@ export function collectPathCandidates(tool, args) {
     // free to nest (`{file: {path}}`) or take `argv: ['cat', '/etc/x']`. Only
     // values that clearly look like paths are taken (depth-bounded to avoid a
     // pathological payload).
-    if (tool.includes('__')) {
+    //
+    // This runs for EVERY tool, not only MCP ones: a model that invents an
+    // argument shape (`{file: {path}}`, `{files: [...]}`) on a built-in tool
+    // used to slip past a `path` deny rule, silently widening the operator's
+    // policy. Path-looking values of a built-in's own arguments are exactly what
+    // such a rule is meant to match.
+    {
         const walk = (v, depth) => {
             if (depth > 4 || v === null || v === undefined)
                 return;
@@ -146,7 +152,9 @@ export function collectPathCandidates(tool, args) {
         for (const v of Object.values(a))
             walk(v, 0);
     }
-    return out;
+    // De-duplicate: a known key (`path`) is now also reached by the generic
+    // nested walk, and callers compare the candidate LIST (`deepEqual`).
+    return Array.from(new Set(out));
 }
 export function decidePermission(policy, tool, args) {
     if (!policy)

package/dist/tools.js

@@ -300,12 +300,23 @@ export function createTools(workdir, { undo, todos, readOnly = false, subagents
                 const cwd = searchPath ? safe(String(searchPath)) : workdir;
                 const results = [];
                 for await (const f of glob(req(pattern, 'pattern'), { cwd })) {
-                    // Sandbox: ignore anything that goes outside root.
-                    const abs = path.resolve(cwd, f);
-                    const rel = path.relative(root, abs);
-                    if (rel.startsWith('..') || path.isAbsolute(rel))
+                    // Sandbox: ignore anything that goes outside root. safePath() does
+                    // the LEXICAL and the symlink-REAL check; a plain `rel.startsWith`
+                    // here passed a pattern carrying `..` (`../**/*.ts` listed a SIBLING
+                    // directory, and the printed path started with `..`).
+                    let inside = true;
+                    try {
+                        safePath(root, path.resolve(root, f));
+                    }
+                    catch {
+                        inside = false;
+                    }
+                    if (!inside)
                         continue;
-                    results.push(f);
+                    // Print a path relative to the PROJECT, never one that starts with
+                    // `..`: the pattern may carry `..` (`../**/*.ts`) and node's glob
+                    // then prefixes every result with it, which looked like an escape.
+                    results.push(path.relative(root, path.resolve(root, f)) || '.');
                 }
                 return results.length ? results.join('\n') : 'No matches found.';
             },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zames_pro",
-  "version": "2.82.59",
+  "version": "2.82.61",
   "description": "Terminal coding agent that drives a real browser to chat with DeepSeek, Qwen and other web LLMs — no API key required. Reads and edits files, runs commands, commits to git, like Claude Code / Codex CLI.",
   "type": "module",
   "bin": {