codeep 2.1.1 → 2.1.3

package/README.md

@@ -449,9 +449,14 @@ Example — auto-format on edit (`.codeep/hooks/post_edit.sh`):
 prettier --write "$CODEEP_HOOK_FILE" 2>/dev/null
 ```
 
-Run `/hooks` to see which hooks are installed in the current workspace. Hooks
-trigger a security banner on session start since they're arbitrary shell that
-runs whenever an agent tool fires.
+Run `/hooks` to see which hooks are installed in the current workspace.
+
+**Trust required (security).** Because hooks run arbitrary shell, a freshly
+cloned repo's hooks are **not** run until you approve the workspace. Run
+`/hooks trust` to enable them for the current project (revoke with
+`/hooks untrust`); `/hooks` and the welcome banner show the trust state. Your
+own projects just need a one-time `/hooks trust`. Global `~/.codeep/hooks/` are
+never run for the same reason.
 
 ### Skill Bundles (new in 2.0)
 Beyond the built-in skills and custom slash commands, Codeep now supports
@@ -1296,3 +1301,25 @@ The chat sidebar now surfaces two extra ACP signals that previously only the TUI
 - **Diff preview on permission prompts** — manual-mode permission cards now show a `-` / `+` diff for `edit_file`, a content preview for `write_file`, and the full `$ command` + `cwd` for `execute_command`, so users can verify before clicking *Allow*. Payload is truncated (~4 KB per field, 200 lines per file) with a visible marker. Other ACP clients (Zed, etc.) ignore the extra fields silently.
 - **`@file` mentions** — type `@` in the chat input to open a workspace-wide file picker. Pick with arrow keys + Enter; the file's content is inlined into the prompt as an `[Attached files]` preamble. Files over 200 KB are skipped with a marker. Multiple mentions in one message are deduplicated.
 - **Auto-reconnect** — if the CLI process exits unexpectedly (crash, OOM kill, parent restart), the extension reconnects on its own with exponential backoff (1s → 2s → 4s → 8s → 16s → 30s, capped at 6 attempts). The status bar shows the countdown. Configurable idle-watchdog timeout (`codeep.requestTimeoutMinutes`, default 5 min) replaces the old fixed cap so slow reasoning models don't get killed mid-thought.
+
+### Editor-native actions (new in 2.2)
+
+- **Code Actions (lightbulb)** — select code and press `Ctrl+.` for **Explain**, **Improve / refactor**, **Add tests**, and **Add doc comment**. On a line with an error/warning, a **Fix this problem** quick-fix sends the diagnostic plus the code to Codeep. Everything routes through the chat, so the full agent (file edits via the diff preview, MCP tools) is available.
+- **Model picker in the status bar** — click `Codeep · <model>` (or run **Codeep: Select Provider & Model**) to switch provider + model from a quick-pick. Providers with open-ended catalogs (OpenRouter, Ollama, custom endpoints) let you type a model id.
+- **Self-hosted endpoints from settings** — point the extension at vLLM / LiteLLM / LM Studio / text-generation-webui with `codeep.baseUrl` (e.g. `http://localhost:8000/v1`), plus `codeep.provider` (`custom` or `openai`) and `codeep.model`. The `codeep.provider` / `codeep.model` settings are applied on every connect, so they stay authoritative.
+- **Get Started walkthrough** — a native VS Code walkthrough (Help → Get Started) covering CLI install, opening the chat, editor actions, and choosing a model.
+
+> The 2.2 model picker and `custom`-provider settings need CLI **2.1.2+**; they degrade gracefully on older CLIs (free-text model input, and `codeep.baseUrl` still works for the `openai` provider via `OPENAI_BASE_URL`).
+
+### Native chat & agent integration (new in 2.3)
+
+- **`@codeep` chat participant** — invoke Codeep from VS Code's built-in Chat view: type `@codeep` and ask, or `@codeep /explain` / `@codeep /review` with a selection. Answers come from your configured Codeep provider/model via the CLI (not VS Code's model picker), on an independent session.
+- **`#codeepSkills` language-model tool** — exposes your workspace's Codeep skill bundles (`.codeep/skills/*/SKILL.md`) to VS Code agent mode and `#`-references, so the native agent can follow your project's own workflows.
+- Requires VS Code **1.95+** (for the stable Chat Participant + Language Model Tools APIs).
+
+### Source control & sidebar (new in 2.3)
+
+- **Generate Commit Message** — a sparkle button in the Source Control panel (and `Codeep: Generate Commit Message` in the palette) reads your staged diff and writes a Conventional Commits message into the commit box. Falls back to the working-tree diff if nothing is staged; asks before replacing a message you've already typed.
+- **Sessions tree view** — a native **Sessions** view in the Codeep sidebar lists saved conversations (title + age). Click to load into the chat, inline-delete, or start a New Session from the title bar.
+- **MCP config validation** — `.codeep/mcp_servers.json` (project and global) gets JSON schema validation + autocomplete, so a mistyped `command` / `args` / `env` is caught before a session starts.
+- **Workspace Trust** — declares limited support for untrusted workspaces, with a reminder to review permission prompts carefully (Codeep runs a local agent that can edit files and run commands).

package/dist/acp/commands.js

@@ -881,8 +881,18 @@ Anything else the agent should know — edge cases, gotchas, things to double-ch
             return { handled: true, response: `Unknown subcommand: \`${sub}\`. Use \`show\`, \`prefer\`, \`ignore\`, \`fallbacks\`, \`privacy\`, or \`clear\`.` };
         }
         case 'hooks': {
-            const { listInstalledHooks, formatHookList } = await import('../utils/hooks.js');
-            return { handled: true, response: formatHookList(listInstalledHooks(session.workspaceRoot)) };
+            const { listInstalledHooks, formatHookList, formatHookTrust, trustWorkspaceHooks, untrustWorkspaceHooks } = await import('../utils/hooks.js');
+            const sub = (args[0] || '').toLowerCase();
+            if (sub === 'trust') {
+                trustWorkspaceHooks(session.workspaceRoot);
+                return { handled: true, response: 'Hooks trusted for this workspace — they will now run.' };
+            }
+            if (sub === 'untrust') {
+                untrustWorkspaceHooks(session.workspaceRoot);
+                return { handled: true, response: 'Hooks untrusted — they will be skipped until you trust again.' };
+            }
+            const trust = formatHookTrust(session.workspaceRoot);
+            return { handled: true, response: formatHookList(listInstalledHooks(session.workspaceRoot)) + (trust ? `\n\n${trust}` : '') };
         }
         case 'mcp': {
             const sub = args[0]?.toLowerCase();

package/dist/acp/server.js

@@ -752,6 +752,18 @@ export function startAcpServer() {
                 config.set('model', value);
             }
         }
+        else if (configId === 'provider' && typeof value === 'string') {
+            // Switch provider without specifying a model — picks the provider's
+            // default model + protocol. Used by editor clients that pin a provider
+            // in their settings (e.g. the VS Code `codeep.provider` setting).
+            setProvider(value);
+        }
+        else if (configId === 'customBaseUrl' && typeof value === 'string') {
+            // Base URL for the `custom` (OpenAI-compatible) provider — lets editor
+            // clients point Codeep at a self-hosted endpoint (vLLM/LiteLLM/LM Studio)
+            // without hand-editing ~/.codeep/config.json.
+            config.set('customBaseUrl', value);
+        }
         else if (configId === 'language' && typeof value === 'string') {
             config.set('language', value);
         }
@@ -837,6 +849,14 @@ export function startAcpServer() {
             hint: p.hint ?? p.description,
             requiresKey: !p.noApiKey,
             subscribeUrl: p.subscribeUrl,
+            // Model metadata so ACP clients (e.g. the VS Code model picker) can
+            // offer a provider → model selector without hardcoding a catalog.
+            // `dynamicModels` flags providers whose model list is open-ended
+            // (OpenRouter, Ollama, custom endpoints) — clients should let the
+            // user type a model id rather than only pick from `models`.
+            models: p.models.map((m) => ({ id: m.id, name: m.name })),
+            defaultModel: p.defaultModel,
+            dynamicModels: p.dynamicModels ?? false,
         }));
         transport.respond(msg.id, { providers });
     }

package/dist/config/index.d.ts

@@ -27,6 +27,10 @@ interface ConfigSchema {
      *  small background API call (uses the active model) once per session.
      *  Default true; set false to avoid any unsolicited API calls. */
     autoSessionTitle: boolean;
+    /** Absolute workspace roots whose project-local `.codeep/hooks/*` the user
+     *  has approved to run. Untrusted projects' hooks are skipped (a cloned repo
+     *  can't execute shell on first tool call). Granted via `/hooks trust`. */
+    trustedHookProjects: string[];
     currentSessionId: string;
     temperature: number;
     maxTokens: number;

package/dist/config/index.js

@@ -167,6 +167,7 @@ function createConfig() {
         language: 'en',
         autoSave: true,
         autoSessionTitle: true,
+        trustedHookProjects: [],
         currentSessionId: '',
         temperature: 0.7,
         maxTokens: 32768,

package/dist/renderer/commands.js

@@ -1151,8 +1151,21 @@ Format: use headers per category, only include categories where you found issues
             break;
         }
         case 'hooks': {
-            const { listInstalledHooks, formatHookList } = await import('../utils/hooks.js');
-            ctx.app.addMessage({ role: 'system', content: formatHookList(listInstalledHooks(ctx.projectPath)) });
+            const { listInstalledHooks, formatHookList, formatHookTrust, trustWorkspaceHooks, untrustWorkspaceHooks } = await import('../utils/hooks.js');
+            const sub = (args[0] || '').toLowerCase();
+            if (sub === 'trust') {
+                trustWorkspaceHooks(ctx.projectPath);
+                ctx.app.notify('Hooks trusted for this workspace — they will now run.');
+                break;
+            }
+            if (sub === 'untrust') {
+                untrustWorkspaceHooks(ctx.projectPath);
+                ctx.app.notify('Hooks untrusted — they will be skipped until you trust again.');
+                break;
+            }
+            const trust = formatHookTrust(ctx.projectPath);
+            const body = formatHookList(listInstalledHooks(ctx.projectPath)) + (trust ? `\n\n${trust}` : '');
+            ctx.app.addMessage({ role: 'system', content: body });
             break;
         }
         case 'rewind': {

package/dist/utils/codeepCloud.js

@@ -110,9 +110,13 @@ export function reportStats(payload) {
     const githubId = getGithubId();
     if (!githubId)
         return; // not linked, skip silently
+    // Send the sync token so the server can attribute the event to us. The
+    // server derives github_id from the token and ignores the body value (the
+    // body githubId is kept only for backward-compat with older servers).
+    const syncToken = getSyncToken();
     fetchWithRetry(`${API_BASE}/api/stats`, {
         method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
+        headers: { 'Content-Type': 'application/json', ...(syncToken ? { 'x-sync-token': syncToken } : {}) },
         body: JSON.stringify({ ...payload, githubId, isGit: payload.isGit ?? false }),
     }).catch(() => { });
 }
@@ -120,9 +124,10 @@ export async function reportStatsAsync(payload) {
     const githubId = getGithubId();
     if (!githubId)
         return;
+    const syncToken = getSyncToken();
     await fetchWithRetry(`${API_BASE}/api/stats`, {
         method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
+        headers: { 'Content-Type': 'application/json', ...(syncToken ? { 'x-sync-token': syncToken } : {}) },
         body: JSON.stringify({ ...payload, githubId, isGit: payload.isGit ?? false }),
     });
 }

package/dist/utils/hooks.d.ts

@@ -45,6 +45,9 @@
  * banner warns when hooks exist (see `summarizeHooks`); we do not run
  * hooks from `~/.codeep/hooks/` (global) for that reason.
  */
+export declare function isHooksTrusted(workspaceRoot: string): boolean;
+export declare function trustWorkspaceHooks(workspaceRoot: string): void;
+export declare function untrustWorkspaceHooks(workspaceRoot: string): void;
 export type HookEvent = 'pre_tool_call' | 'post_edit' | 'on_error' | 'pre_commit';
 export declare const HOOK_EVENTS: readonly HookEvent[];
 export interface HookContext {
@@ -69,6 +72,9 @@ export interface HookResult {
     blocked: boolean;
     /** Path that was executed (useful for error messages). */
     scriptPath?: string;
+    /** True when a hook script exists but the workspace isn't trusted, so it was
+     *  skipped (not run). Lets callers surface "run /hooks trust to enable". */
+    untrusted?: boolean;
 }
 /**
  * Execute the configured hook for an event, if any. Returns `executed: false`
@@ -90,6 +96,11 @@ export declare function listInstalledHooks(workspaceRoot: string): {
  * Render an installed-hook list as Markdown for `/hooks` output.
  */
 export declare function formatHookList(hooks: ReturnType<typeof listInstalledHooks>): string;
+/**
+ * Build the trust banner for `/hooks` and the welcome screen. `workspaceRoot`
+ * is needed to read trust state; returns '' if no hooks are installed.
+ */
+export declare function formatHookTrust(workspaceRoot: string): string;
 /**
  * Short one-line summary used in the welcome banner when hooks are present.
  * Returns empty string if no hooks installed.

package/dist/utils/hooks.js

@@ -48,6 +48,31 @@
 import { existsSync, readdirSync, statSync, accessSync, constants } from 'fs';
 import { join } from 'path';
 import { spawnSync } from 'child_process';
+import { config } from '../config/index.js';
+// ─── Trust-on-first-use ──────────────────────────────────────────────────────
+// Project-local hooks run arbitrary shell, so a freshly-cloned hostile repo
+// must NOT execute its scripts on the first tool call. A workspace's hooks run
+// only after the user explicitly trusts it (`/hooks trust`); the approval is
+// stored per-workspace-root in config. Mirrors VS Code Workspace Trust /
+// `direnv allow`.
+export function isHooksTrusted(workspaceRoot) {
+    try {
+        const trusted = config.get('trustedHookProjects');
+        return Array.isArray(trusted) && trusted.includes(workspaceRoot);
+    }
+    catch {
+        return false;
+    }
+}
+export function trustWorkspaceHooks(workspaceRoot) {
+    const cur = config.get('trustedHookProjects') ?? [];
+    if (!cur.includes(workspaceRoot))
+        config.set('trustedHookProjects', [...cur, workspaceRoot]);
+}
+export function untrustWorkspaceHooks(workspaceRoot) {
+    const cur = config.get('trustedHookProjects') ?? [];
+    config.set('trustedHookProjects', cur.filter((p) => p !== workspaceRoot));
+}
 export const HOOK_EVENTS = ['pre_tool_call', 'post_edit', 'on_error', 'pre_commit'];
 /** Events whose non-zero exit aborts the action that triggered them. */
 const BLOCKING_EVENTS = new Set(['pre_tool_call', 'pre_commit']);
@@ -89,6 +114,12 @@ export function runHook(ctx, opts = {}) {
     const script = findHookScript(ctx.workspaceRoot, ctx.event);
     if (!script)
         return NOT_EXECUTED;
+    // Trust gate: never run a project's hooks until the user has approved this
+    // workspace. A non-blocking skip — the agent proceeds without the hook
+    // rather than being held hostage by an untrusted (or hostile) script.
+    if (!isHooksTrusted(ctx.workspaceRoot)) {
+        return { executed: false, exitCode: 0, stdout: '', stderr: '', blocked: false, untrusted: true, scriptPath: script };
+    }
     const env = {
         ...process.env,
         CODEEP_HOOK_EVENT: ctx.event,
@@ -211,6 +242,22 @@ export function formatHookList(hooks) {
     }
     return lines.join('\n');
 }
+/**
+ * Build the trust banner for `/hooks` and the welcome screen. `workspaceRoot`
+ * is needed to read trust state; returns '' if no hooks are installed.
+ */
+export function formatHookTrust(workspaceRoot) {
+    const hooks = listInstalledHooks(workspaceRoot);
+    if (hooks.length === 0)
+        return '';
+    if (isHooksTrusted(workspaceRoot)) {
+        return '✓ This workspace is **trusted** — its hooks will run. Use `/hooks untrust` to revoke.';
+    }
+    return [
+        '⚠️ This workspace is **not trusted**, so its hooks are **skipped** (they run arbitrary shell).',
+        'If you wrote these hooks (or trust this repo), run `/hooks trust` to enable them.',
+    ].join('\n');
+}
 /**
  * Short one-line summary used in the welcome banner when hooks are present.
  * Returns empty string if no hooks installed.
@@ -219,5 +266,9 @@ export function summarizeHooks(workspaceRoot) {
     const hooks = listInstalledHooks(workspaceRoot);
     if (hooks.length === 0)
         return '';
-    return `${hooks.length} hook${hooks.length === 1 ? '' : 's'} active (${hooks.map(h => h.event).join(', ')})`;
+    const list = hooks.map(h => h.event).join(', ');
+    if (!isHooksTrusted(workspaceRoot)) {
+        return `${hooks.length} hook${hooks.length === 1 ? '' : 's'} present but NOT trusted — run /hooks trust to enable (${list})`;
+    }
+    return `${hooks.length} hook${hooks.length === 1 ? '' : 's'} active (${list})`;
 }

package/dist/utils/toolExecution.js

@@ -16,6 +16,82 @@ import { getZaiMcpConfig, getZaiVisionConfig, getMinimaxMcpConfig, callZaiMcp, c
 import { logger } from './logger.js';
 import { runHook } from './hooks.js';
 import { isMcpToolName, callSessionTool, isVirtualMcpToolName, callSessionVirtualTool } from './mcpRegistry.js';
+import { lookup as dnsLookup } from 'dns/promises';
+/**
+ * SSRF guard for the agent's `fetch_url` tool. The URL there comes from model
+ * output / page content (untrusted, prompt-injectable), so the agent must not
+ * be able to reach internal services or the cloud metadata endpoint
+ * (169.254.169.254). NOTE: this does NOT apply to user-configured provider
+ * base URLs (Ollama localhost, custom vLLM/Tailscale endpoints) — those are
+ * trusted config and never routed through fetch_url.
+ */
+function isBlockedIp(ip) {
+    const s = ip.trim().toLowerCase();
+    if (s.includes(':')) {
+        // IPv6
+        if (s === '::1' || s === '::')
+            return true; // loopback / unspecified
+        if (s.startsWith('fe80') || s.startsWith('fc') || s.startsWith('fd'))
+            return true; // link-local / ULA
+        const mapped = s.match(/::ffff:(\d+\.\d+\.\d+\.\d+)$/); // IPv4-mapped
+        if (mapped)
+            return isBlockedIp(mapped[1]);
+        return false;
+    }
+    const parts = s.split('.').map(Number);
+    if (parts.length !== 4 || parts.some((n) => Number.isNaN(n) || n < 0 || n > 255))
+        return false;
+    const [a, b] = parts;
+    if (a === 127)
+        return true; // loopback
+    if (a === 10)
+        return true; // RFC1918
+    if (a === 172 && b >= 16 && b <= 31)
+        return true; // RFC1918
+    if (a === 192 && b === 168)
+        return true; // RFC1918
+    if (a === 169 && b === 254)
+        return true; // link-local incl. metadata 169.254.169.254
+    if (a === 0)
+        return true; // 0.0.0.0/8
+    return false;
+}
+/** Returns an error string if the URL must not be fetched, else null. */
+async function assertFetchUrlAllowed(rawUrl) {
+    let u;
+    try {
+        u = new URL(rawUrl);
+    }
+    catch {
+        return 'Invalid URL format';
+    }
+    if (u.protocol !== 'http:' && u.protocol !== 'https:') {
+        return `Blocked: only http/https URLs can be fetched (got "${u.protocol}")`;
+    }
+    const host = u.hostname.replace(/^\[|\]$/g, ''); // strip IPv6 brackets
+    if (host === 'localhost' || host.endsWith('.localhost')) {
+        return 'Blocked: localhost is not fetchable by the agent';
+    }
+    if (/^[0-9.]+$/.test(host) || host.includes(':')) {
+        // Literal IP — check directly.
+        if (isBlockedIp(host))
+            return `Blocked: ${host} is a private/loopback/link-local address`;
+        return null;
+    }
+    // Resolve and check every address (catches internal hostnames + single-record rebinding).
+    try {
+        const addrs = await dnsLookup(host, { all: true });
+        for (const a of addrs) {
+            if (isBlockedIp(a.address)) {
+                return `Blocked: ${host} resolves to a private/internal address (${a.address})`;
+            }
+        }
+    }
+    catch {
+        // DNS failure — let curl attempt and fail naturally; not an SSRF risk.
+    }
+    return null;
+}
 const debug = (...args) => {
     if (process.env.CODEEP_DEBUG === '1') {
         logger.debug(args.map(String).join(' '));
@@ -515,13 +591,13 @@ async function dispatchTool(tool, parameters, projectRoot, fs, toolCall) {
                 const url = parameters.url;
                 if (!url)
                     return { success: false, output: '', error: 'Missing required parameter: url', tool, parameters };
-                try {
-                    new URL(url);
-                }
-                catch {
-                    return { success: false, output: '', error: 'Invalid URL format', tool, parameters };
-                }
-                const result = await executeCommandAsync('curl', ['-s', '-L', '-m', '30', '-A', 'Codeep/1.0', '--max-filesize', '1000000', url], {
+                const blockedReason = await assertFetchUrlAllowed(url);
+                if (blockedReason)
+                    return { success: false, output: '', error: blockedReason, tool, parameters };
+                // Restrict to http/https on the initial request AND redirects, and cap
+                // redirect hops — defends against protocol-smuggling and limits
+                // redirect-based SSRF reach (initial host is already IP-checked above).
+                const result = await executeCommandAsync('curl', ['-s', '-L', '--proto', '=http,https', '--proto-redir', '=http,https', '--max-redirs', '5', '-m', '30', '-A', 'Codeep/1.0', '--max-filesize', '1000000', url], {
                     cwd: projectRoot,
                     projectRoot,
                     timeout: 35000,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeep",
-  "version": "2.1.1",
+  "version": "2.1.3",
   "description": "AI-powered coding assistant built for the terminal. Multiple LLM providers, project-aware context, and a seamless development workflow.",
   "type": "module",
   "main": "dist/index.js",