codeep 1.2.87 → 1.2.88

package/dist/acp/commands.js

@@ -190,12 +190,17 @@ export async function handleCommand(input, session, onChunk, abortSignal) {
             return { handled: true, response: `Write access granted for \`${ctx?.name || session.workspaceRoot}\`` };
         }
         case 'lang': {
+            const validLangs = ['auto', 'en', 'zh', 'es', 'hi', 'ar', 'pt', 'fr', 'de', 'ja', 'ru', 'hr'];
             if (!args.length) {
                 const current = config.get('language') || 'auto';
-                return { handled: true, response: `Current language: \`${current}\`. Usage: \`/lang <code>\` (e.g. \`en\`, \`hr\`, \`auto\`)` };
+                return { handled: true, response: `Current language: \`${current}\`. Usage: \`/lang <code>\` (${validLangs.join(', ')})` };
             }
-            config.set('language', args[0]);
-            return { handled: true, response: `Language set to \`${args[0]}\`` };
+            const lang = args[0].toLowerCase();
+            if (!validLangs.includes(lang)) {
+                return { handled: true, response: `Invalid language \`${args[0]}\`. Valid: ${validLangs.join(', ')}` };
+            }
+            config.set('language', lang);
+            return { handled: true, response: `Language set to \`${lang}\`` };
         }
         // ─── File context ──────────────────────────────────────────────────────────
         case 'add': {
@@ -211,7 +216,11 @@ export async function handleCommand(input, session, onChunk, abortSignal) {
             const added = [];
             const errors = [];
             for (const filePath of args) {
-                const fullPath = pathMod.isAbsolute(filePath) ? filePath : pathMod.join(root, filePath);
+                const fullPath = pathMod.resolve(root, filePath);
+                if (!fullPath.startsWith(root + pathMod.sep) && fullPath !== root) {
+                    errors.push(`\`${filePath}\`: path outside workspace`);
+                    continue;
+                }
                 const relativePath = pathMod.relative(root, fullPath);
                 try {
                     const stat = await fs.stat(fullPath);
@@ -248,7 +257,9 @@ export async function handleCommand(input, session, onChunk, abortSignal) {
             const root = session.workspaceRoot;
             let dropped = 0;
             for (const filePath of args) {
-                const fullPath = pathMod.isAbsolute(filePath) ? filePath : pathMod.join(root, filePath);
+                const fullPath = pathMod.resolve(root, filePath);
+                if (!fullPath.startsWith(root + pathMod.sep) && fullPath !== root)
+                    continue;
                 if (session.addedFiles.delete(fullPath))
                     dropped++;
             }

package/dist/acp/transport.js

@@ -1,5 +1,7 @@
 // acp/transport.ts
 // Newline-delimited JSON-RPC over stdio
+const MAX_BUFFER_SIZE = 10 * 1024 * 1024; // 10MB
+const REQUEST_TIMEOUT_MS = 30_000; // 30s
 export class StdioTransport {
     buffer = '';
     handler = null;
@@ -13,6 +15,10 @@ export class StdioTransport {
     }
     onData(chunk) {
         this.buffer += chunk;
+        if (this.buffer.length > MAX_BUFFER_SIZE) {
+            this.buffer = '';
+            return;
+        }
         const lines = this.buffer.split('\n');
         this.buffer = lines.pop() ?? '';
         for (const line of lines) {
@@ -59,6 +65,11 @@ export class StdioTransport {
         return new Promise((resolve) => {
             this.pendingRequests.set(id, resolve);
             process.stdout.write(JSON.stringify({ jsonrpc: '2.0', id, method, params }) + '\n');
+            setTimeout(() => {
+                if (this.pendingRequests.delete(id)) {
+                    resolve(null);
+                }
+            }, REQUEST_TIMEOUT_MS);
         });
     }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeep",
-  "version": "1.2.87",
+  "version": "1.2.88",
   "description": "AI-powered coding assistant built for the terminal. Multiple LLM providers, project-aware context, and a seamless development workflow.",
   "type": "module",
   "main": "dist/index.js",