zames_pro 2.90.13 → 2.90.14

package/CHANGELOG.md

@@ -7,6 +7,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.90.14] - 2026-10-29
+
+### Fixed
+
+- **sandbox:** block a recursive rm of an absolute or outside path
+
 ## [2.90.13] - 2026-10-29
 
 ### Fixed

package/dist/shell.js

@@ -70,6 +70,48 @@ export function assertCommandInsideRoot(root, command) {
     if (/\bchroot\b/i.test(cmd)) {
         throw new Error('Sandbox: chroot is forbidden');
     }
+    // A RECURSIVE deletion aimed at an absolute path, `~`, `.`, `..` or the root
+    // itself can never be "inside the root": a single typo in a cleanup command
+    // destroyed the whole project tree (and the directories above it) in a real
+    // session. Only the destructive form is refused — `rm file.txt` and
+    // `rm -rf tmp/build` stay allowed.
+    const rmRe = /(?:^|[;&|(]\s*)\s*(?:sudo\s+)?rm\s+([^;&|)]+)/gi;
+    let rm;
+    while ((rm = rmRe.exec(cmd))) {
+        const words = rm[1].trim().split(/\s+/);
+        const recursive = words.some((w) => w === '--recursive' || /^-[a-zA-Z]*[rR][a-zA-Z]*$/.test(w));
+        if (!recursive)
+            continue;
+        for (const w of words) {
+            if (w.startsWith('-'))
+                continue;
+            const raw = w.replace(/["']/g, '');
+            if (!raw)
+                continue;
+            if (raw === '/' ||
+                raw === '.' ||
+                raw === '..' ||
+                raw === '~' ||
+                raw.startsWith('~/') ||
+                raw.startsWith('/') ||
+                raw.startsWith('..')) {
+                throw new Error('Sandbox: recursive rm of an absolute/outside path is forbidden (' +
+                    raw +
+                    ')');
+            }
+            // A RELATIVE target is resolved against the root; anything that escapes
+            // (a `../` inside a longer path) is refused too.
+            const target = path.resolve(root, raw);
+            const rel = path.relative(root, target);
+            if (rel.startsWith('..') || path.isAbsolute(rel)) {
+                throw new Error('Sandbox: recursive rm outside ' +
+                    root +
+                    ' is forbidden (' +
+                    raw +
+                    ')');
+            }
+        }
+    }
 }
 function formatExecResult(err, stdout, stderr, timeout, okExitCodes) {
     const out = (stdout || '').toString();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zames_pro",
-  "version": "2.90.13",
+  "version": "2.90.14",
   "description": "Terminal coding agent that drives a real browser to chat with DeepSeek, Qwen or GLM — no API key required. Reads and edits files, runs commands, commits to git, like Claude Code / Codex CLI.",
   "type": "module",
   "bin": {