zames_pro 2.82.60 → 2.82.61

package/CHANGELOG.md

@@ -7,6 +7,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.82.61] - 2026-10-23
+
+### Fixed
+
+- **tools:** Glob cannot report files outside the project root
+
 ## [2.82.60] - 2026-10-23
 
 ### Fixed

package/dist/tools.js

@@ -300,12 +300,23 @@ export function createTools(workdir, { undo, todos, readOnly = false, subagents
                 const cwd = searchPath ? safe(String(searchPath)) : workdir;
                 const results = [];
                 for await (const f of glob(req(pattern, 'pattern'), { cwd })) {
-                    // Sandbox: ignore anything that goes outside root.
-                    const abs = path.resolve(cwd, f);
-                    const rel = path.relative(root, abs);
-                    if (rel.startsWith('..') || path.isAbsolute(rel))
+                    // Sandbox: ignore anything that goes outside root. safePath() does
+                    // the LEXICAL and the symlink-REAL check; a plain `rel.startsWith`
+                    // here passed a pattern carrying `..` (`../**/*.ts` listed a SIBLING
+                    // directory, and the printed path started with `..`).
+                    let inside = true;
+                    try {
+                        safePath(root, path.resolve(root, f));
+                    }
+                    catch {
+                        inside = false;
+                    }
+                    if (!inside)
                         continue;
-                    results.push(f);
+                    // Print a path relative to the PROJECT, never one that starts with
+                    // `..`: the pattern may carry `..` (`../**/*.ts`) and node's glob
+                    // then prefixes every result with it, which looked like an escape.
+                    results.push(path.relative(root, path.resolve(root, f)) || '.');
                 }
                 return results.length ? results.join('\n') : 'No matches found.';
             },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zames_pro",
-  "version": "2.82.60",
+  "version": "2.82.61",
   "description": "Terminal coding agent that drives a real browser to chat with DeepSeek, Qwen and other web LLMs — no API key required. Reads and edits files, runs commands, commits to git, like Claude Code / Codex CLI.",
   "type": "module",
   "bin": {