zames_pro 2.90.12 → 2.90.14

package/CHANGELOG.md

@@ -7,6 +7,18 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.90.14] - 2026-10-29
+
+### Fixed
+
+- **sandbox:** block a recursive rm of an absolute or outside path
+
+## [2.90.13] - 2026-10-29
+
+### Fixed
+
+- **apply-patch:** start each hunk search where the previous one ended
+
 ## [2.90.12] - 2026-10-29
 
 ### Fixed

package/dist/extraTools.js

@@ -168,6 +168,11 @@ export function applyUpdateHunk(content, hunkLines) {
     const hasCRLF = content.includes('\r\n');
     const eol = hasCRLF ? '\r\n' : NL;
     let fileLines = content.split(/\r?\n/);
+    // Hunks are ordered top-to-bottom, so the search for the next block must not
+    // go back before the end of the previous one. Searching from 0 made a hunk
+    // re-find a region an EARLIER hunk had already consumed (or, once that text
+    // was gone, fail with "Context not found").
+    let searchFrom = 0;
     for (const block of splitHunks(hunkLines)) {
         const oldLines = [];
         const newLines = [];
@@ -198,7 +203,7 @@ export function applyUpdateHunk(content, hunkLines) {
                 error: 'Hunk has no context or removed lines to anchor on.',
             };
         }
-        const at = locateBlock(fileLines, oldLines, block.oldStart, 0);
+        const at = locateBlock(fileLines, oldLines, block.oldStart, searchFrom);
         if (at === -1) {
             return {
                 ok: false,
@@ -211,6 +216,9 @@ export function applyUpdateHunk(content, hunkLines) {
             ...newLines,
             ...fileLines.slice(at + oldLines.length),
         ];
+        // The next block starts after the lines this hunk just produced: its text
+        // cannot legitimately live BEFORE them.
+        searchFrom = at + newLines.length;
     }
     return { ok: true, content: fileLines.join(eol) };
 }

package/dist/shell.js

@@ -70,6 +70,48 @@ export function assertCommandInsideRoot(root, command) {
     if (/\bchroot\b/i.test(cmd)) {
         throw new Error('Sandbox: chroot is forbidden');
     }
+    // A RECURSIVE deletion aimed at an absolute path, `~`, `.`, `..` or the root
+    // itself can never be "inside the root": a single typo in a cleanup command
+    // destroyed the whole project tree (and the directories above it) in a real
+    // session. Only the destructive form is refused — `rm file.txt` and
+    // `rm -rf tmp/build` stay allowed.
+    const rmRe = /(?:^|[;&|(]\s*)\s*(?:sudo\s+)?rm\s+([^;&|)]+)/gi;
+    let rm;
+    while ((rm = rmRe.exec(cmd))) {
+        const words = rm[1].trim().split(/\s+/);
+        const recursive = words.some((w) => w === '--recursive' || /^-[a-zA-Z]*[rR][a-zA-Z]*$/.test(w));
+        if (!recursive)
+            continue;
+        for (const w of words) {
+            if (w.startsWith('-'))
+                continue;
+            const raw = w.replace(/["']/g, '');
+            if (!raw)
+                continue;
+            if (raw === '/' ||
+                raw === '.' ||
+                raw === '..' ||
+                raw === '~' ||
+                raw.startsWith('~/') ||
+                raw.startsWith('/') ||
+                raw.startsWith('..')) {
+                throw new Error('Sandbox: recursive rm of an absolute/outside path is forbidden (' +
+                    raw +
+                    ')');
+            }
+            // A RELATIVE target is resolved against the root; anything that escapes
+            // (a `../` inside a longer path) is refused too.
+            const target = path.resolve(root, raw);
+            const rel = path.relative(root, target);
+            if (rel.startsWith('..') || path.isAbsolute(rel)) {
+                throw new Error('Sandbox: recursive rm outside ' +
+                    root +
+                    ' is forbidden (' +
+                    raw +
+                    ')');
+            }
+        }
+    }
 }
 function formatExecResult(err, stdout, stderr, timeout, okExitCodes) {
     const out = (stdout || '').toString();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zames_pro",
-  "version": "2.90.12",
+  "version": "2.90.14",
   "description": "Terminal coding agent that drives a real browser to chat with DeepSeek, Qwen or GLM — no API key required. Reads and edits files, runs commands, commits to git, like Claude Code / Codex CLI.",
   "type": "module",
   "bin": {