codebot-ai 1.4.3 → 1.6.0

package/dist/tools/write.js

@@ -37,6 +37,8 @@ exports.WriteFileTool = void 0;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const os = __importStar(require("os"));
+const security_1 = require("../security");
+const secrets_1 = require("../secrets");
 const UNDO_DIR = path.join(os.homedir(), '.codebot', 'undo');
 class WriteFileTool {
     name = 'write_file';
@@ -60,6 +62,20 @@ class WriteFileTool {
         const filePath = path.resolve(args.path);
         const content = String(args.content);
         const dir = path.dirname(filePath);
+        // Security: path safety check
+        const projectRoot = process.cwd();
+        const safety = (0, security_1.isPathSafe)(filePath, projectRoot);
+        if (!safety.safe) {
+            return `Error: ${safety.reason}`;
+        }
+        // Security: secret detection (warn but don't block)
+        const secrets = (0, secrets_1.scanForSecrets)(content);
+        let warning = '';
+        if (secrets.length > 0) {
+            warning = `\n\n⚠️  WARNING: ${secrets.length} potential secret(s) detected:\n` +
+                secrets.map(s => `  Line ${s.line}: ${s.type} — ${s.snippet}`).join('\n') +
+                '\nConsider using environment variables instead of hardcoding secrets.';
+        }
         if (!fs.existsSync(dir)) {
             fs.mkdirSync(dir, { recursive: true });
         }
@@ -74,7 +90,7 @@ class WriteFileTool {
         }
         fs.writeFileSync(filePath, content, 'utf-8');
         const lines = content.split('\n').length;
-        return `${existed ? 'Overwrote' : 'Created'} ${filePath} (${lines} lines, ${content.length} bytes)`;
+        return `${existed ? 'Overwrote' : 'Created'} ${filePath} (${lines} lines, ${content.length} bytes)${warning}`;
     }
     saveSnapshot(filePath, content) {
         try {

package/dist/types.d.ts

@@ -23,6 +23,7 @@ export interface Tool {
     description: string;
     parameters: Record<string, unknown>;
     permission: 'auto' | 'prompt' | 'always-ask';
+    cacheable?: boolean;
     execute(args: Record<string, unknown>): Promise<string>;
 }
 export interface ProviderConfig {
@@ -78,5 +79,6 @@ export interface Config {
     maxIterations: number;
     autoApprove: boolean;
     contextBudget?: number;
+    projectRoot?: string;
 }
 //# sourceMappingURL=types.d.ts.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codebot-ai",
-  "version": "1.4.3",
+  "version": "1.6.0",
   "description": "Zero-dependency autonomous AI agent. Code, browse, search, automate. Works with any LLM — Ollama, Claude, GPT, Gemini, DeepSeek, Groq, Mistral, Grok.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",