codeep 2.1.2 → 2.1.3

package/README.md

@@ -449,9 +449,14 @@ Example — auto-format on edit (`.codeep/hooks/post_edit.sh`):
 prettier --write "$CODEEP_HOOK_FILE" 2>/dev/null
 ```
 
-Run `/hooks` to see which hooks are installed in the current workspace. Hooks
-trigger a security banner on session start since they're arbitrary shell that
-runs whenever an agent tool fires.
+Run `/hooks` to see which hooks are installed in the current workspace.
+
+**Trust required (security).** Because hooks run arbitrary shell, a freshly
+cloned repo's hooks are **not** run until you approve the workspace. Run
+`/hooks trust` to enable them for the current project (revoke with
+`/hooks untrust`); `/hooks` and the welcome banner show the trust state. Your
+own projects just need a one-time `/hooks trust`. Global `~/.codeep/hooks/` are
+never run for the same reason.
 
 ### Skill Bundles (new in 2.0)
 Beyond the built-in skills and custom slash commands, Codeep now supports

package/dist/acp/commands.js

@@ -881,8 +881,18 @@ Anything else the agent should know — edge cases, gotchas, things to double-ch
             return { handled: true, response: `Unknown subcommand: \`${sub}\`. Use \`show\`, \`prefer\`, \`ignore\`, \`fallbacks\`, \`privacy\`, or \`clear\`.` };
         }
         case 'hooks': {
-            const { listInstalledHooks, formatHookList } = await import('../utils/hooks.js');
-            return { handled: true, response: formatHookList(listInstalledHooks(session.workspaceRoot)) };
+            const { listInstalledHooks, formatHookList, formatHookTrust, trustWorkspaceHooks, untrustWorkspaceHooks } = await import('../utils/hooks.js');
+            const sub = (args[0] || '').toLowerCase();
+            if (sub === 'trust') {
+                trustWorkspaceHooks(session.workspaceRoot);
+                return { handled: true, response: 'Hooks trusted for this workspace — they will now run.' };
+            }
+            if (sub === 'untrust') {
+                untrustWorkspaceHooks(session.workspaceRoot);
+                return { handled: true, response: 'Hooks untrusted — they will be skipped until you trust again.' };
+            }
+            const trust = formatHookTrust(session.workspaceRoot);
+            return { handled: true, response: formatHookList(listInstalledHooks(session.workspaceRoot)) + (trust ? `\n\n${trust}` : '') };
         }
         case 'mcp': {
             const sub = args[0]?.toLowerCase();

package/dist/config/index.d.ts

@@ -27,6 +27,10 @@ interface ConfigSchema {
      *  small background API call (uses the active model) once per session.
      *  Default true; set false to avoid any unsolicited API calls. */
     autoSessionTitle: boolean;
+    /** Absolute workspace roots whose project-local `.codeep/hooks/*` the user
+     *  has approved to run. Untrusted projects' hooks are skipped (a cloned repo
+     *  can't execute shell on first tool call). Granted via `/hooks trust`. */
+    trustedHookProjects: string[];
     currentSessionId: string;
     temperature: number;
     maxTokens: number;

package/dist/config/index.js

@@ -167,6 +167,7 @@ function createConfig() {
         language: 'en',
         autoSave: true,
         autoSessionTitle: true,
+        trustedHookProjects: [],
         currentSessionId: '',
         temperature: 0.7,
         maxTokens: 32768,

package/dist/renderer/commands.js

@@ -1151,8 +1151,21 @@ Format: use headers per category, only include categories where you found issues
             break;
         }
         case 'hooks': {
-            const { listInstalledHooks, formatHookList } = await import('../utils/hooks.js');
-            ctx.app.addMessage({ role: 'system', content: formatHookList(listInstalledHooks(ctx.projectPath)) });
+            const { listInstalledHooks, formatHookList, formatHookTrust, trustWorkspaceHooks, untrustWorkspaceHooks } = await import('../utils/hooks.js');
+            const sub = (args[0] || '').toLowerCase();
+            if (sub === 'trust') {
+                trustWorkspaceHooks(ctx.projectPath);
+                ctx.app.notify('Hooks trusted for this workspace — they will now run.');
+                break;
+            }
+            if (sub === 'untrust') {
+                untrustWorkspaceHooks(ctx.projectPath);
+                ctx.app.notify('Hooks untrusted — they will be skipped until you trust again.');
+                break;
+            }
+            const trust = formatHookTrust(ctx.projectPath);
+            const body = formatHookList(listInstalledHooks(ctx.projectPath)) + (trust ? `\n\n${trust}` : '');
+            ctx.app.addMessage({ role: 'system', content: body });
             break;
         }
         case 'rewind': {

package/dist/utils/codeepCloud.js

@@ -110,9 +110,13 @@ export function reportStats(payload) {
     const githubId = getGithubId();
     if (!githubId)
         return; // not linked, skip silently
+    // Send the sync token so the server can attribute the event to us. The
+    // server derives github_id from the token and ignores the body value (the
+    // body githubId is kept only for backward-compat with older servers).
+    const syncToken = getSyncToken();
     fetchWithRetry(`${API_BASE}/api/stats`, {
         method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
+        headers: { 'Content-Type': 'application/json', ...(syncToken ? { 'x-sync-token': syncToken } : {}) },
         body: JSON.stringify({ ...payload, githubId, isGit: payload.isGit ?? false }),
     }).catch(() => { });
 }
@@ -120,9 +124,10 @@ export async function reportStatsAsync(payload) {
     const githubId = getGithubId();
     if (!githubId)
         return;
+    const syncToken = getSyncToken();
     await fetchWithRetry(`${API_BASE}/api/stats`, {
         method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
+        headers: { 'Content-Type': 'application/json', ...(syncToken ? { 'x-sync-token': syncToken } : {}) },
         body: JSON.stringify({ ...payload, githubId, isGit: payload.isGit ?? false }),
     });
 }

package/dist/utils/hooks.d.ts

@@ -45,6 +45,9 @@
  * banner warns when hooks exist (see `summarizeHooks`); we do not run
  * hooks from `~/.codeep/hooks/` (global) for that reason.
  */
+export declare function isHooksTrusted(workspaceRoot: string): boolean;
+export declare function trustWorkspaceHooks(workspaceRoot: string): void;
+export declare function untrustWorkspaceHooks(workspaceRoot: string): void;
 export type HookEvent = 'pre_tool_call' | 'post_edit' | 'on_error' | 'pre_commit';
 export declare const HOOK_EVENTS: readonly HookEvent[];
 export interface HookContext {
@@ -69,6 +72,9 @@ export interface HookResult {
     blocked: boolean;
     /** Path that was executed (useful for error messages). */
     scriptPath?: string;
+    /** True when a hook script exists but the workspace isn't trusted, so it was
+     *  skipped (not run). Lets callers surface "run /hooks trust to enable". */
+    untrusted?: boolean;
 }
 /**
  * Execute the configured hook for an event, if any. Returns `executed: false`
@@ -90,6 +96,11 @@ export declare function listInstalledHooks(workspaceRoot: string): {
  * Render an installed-hook list as Markdown for `/hooks` output.
  */
 export declare function formatHookList(hooks: ReturnType<typeof listInstalledHooks>): string;
+/**
+ * Build the trust banner for `/hooks` and the welcome screen. `workspaceRoot`
+ * is needed to read trust state; returns '' if no hooks are installed.
+ */
+export declare function formatHookTrust(workspaceRoot: string): string;
 /**
  * Short one-line summary used in the welcome banner when hooks are present.
  * Returns empty string if no hooks installed.

package/dist/utils/hooks.js

@@ -48,6 +48,31 @@
 import { existsSync, readdirSync, statSync, accessSync, constants } from 'fs';
 import { join } from 'path';
 import { spawnSync } from 'child_process';
+import { config } from '../config/index.js';
+// ─── Trust-on-first-use ──────────────────────────────────────────────────────
+// Project-local hooks run arbitrary shell, so a freshly-cloned hostile repo
+// must NOT execute its scripts on the first tool call. A workspace's hooks run
+// only after the user explicitly trusts it (`/hooks trust`); the approval is
+// stored per-workspace-root in config. Mirrors VS Code Workspace Trust /
+// `direnv allow`.
+export function isHooksTrusted(workspaceRoot) {
+    try {
+        const trusted = config.get('trustedHookProjects');
+        return Array.isArray(trusted) && trusted.includes(workspaceRoot);
+    }
+    catch {
+        return false;
+    }
+}
+export function trustWorkspaceHooks(workspaceRoot) {
+    const cur = config.get('trustedHookProjects') ?? [];
+    if (!cur.includes(workspaceRoot))
+        config.set('trustedHookProjects', [...cur, workspaceRoot]);
+}
+export function untrustWorkspaceHooks(workspaceRoot) {
+    const cur = config.get('trustedHookProjects') ?? [];
+    config.set('trustedHookProjects', cur.filter((p) => p !== workspaceRoot));
+}
 export const HOOK_EVENTS = ['pre_tool_call', 'post_edit', 'on_error', 'pre_commit'];
 /** Events whose non-zero exit aborts the action that triggered them. */
 const BLOCKING_EVENTS = new Set(['pre_tool_call', 'pre_commit']);
@@ -89,6 +114,12 @@ export function runHook(ctx, opts = {}) {
     const script = findHookScript(ctx.workspaceRoot, ctx.event);
     if (!script)
         return NOT_EXECUTED;
+    // Trust gate: never run a project's hooks until the user has approved this
+    // workspace. A non-blocking skip — the agent proceeds without the hook
+    // rather than being held hostage by an untrusted (or hostile) script.
+    if (!isHooksTrusted(ctx.workspaceRoot)) {
+        return { executed: false, exitCode: 0, stdout: '', stderr: '', blocked: false, untrusted: true, scriptPath: script };
+    }
     const env = {
         ...process.env,
         CODEEP_HOOK_EVENT: ctx.event,
@@ -211,6 +242,22 @@ export function formatHookList(hooks) {
     }
     return lines.join('\n');
 }
+/**
+ * Build the trust banner for `/hooks` and the welcome screen. `workspaceRoot`
+ * is needed to read trust state; returns '' if no hooks are installed.
+ */
+export function formatHookTrust(workspaceRoot) {
+    const hooks = listInstalledHooks(workspaceRoot);
+    if (hooks.length === 0)
+        return '';
+    if (isHooksTrusted(workspaceRoot)) {
+        return '✓ This workspace is **trusted** — its hooks will run. Use `/hooks untrust` to revoke.';
+    }
+    return [
+        '⚠️ This workspace is **not trusted**, so its hooks are **skipped** (they run arbitrary shell).',
+        'If you wrote these hooks (or trust this repo), run `/hooks trust` to enable them.',
+    ].join('\n');
+}
 /**
  * Short one-line summary used in the welcome banner when hooks are present.
  * Returns empty string if no hooks installed.
@@ -219,5 +266,9 @@ export function summarizeHooks(workspaceRoot) {
     const hooks = listInstalledHooks(workspaceRoot);
     if (hooks.length === 0)
         return '';
-    return `${hooks.length} hook${hooks.length === 1 ? '' : 's'} active (${hooks.map(h => h.event).join(', ')})`;
+    const list = hooks.map(h => h.event).join(', ');
+    if (!isHooksTrusted(workspaceRoot)) {
+        return `${hooks.length} hook${hooks.length === 1 ? '' : 's'} present but NOT trusted — run /hooks trust to enable (${list})`;
+    }
+    return `${hooks.length} hook${hooks.length === 1 ? '' : 's'} active (${list})`;
 }

package/dist/utils/toolExecution.js

@@ -16,6 +16,82 @@ import { getZaiMcpConfig, getZaiVisionConfig, getMinimaxMcpConfig, callZaiMcp, c
 import { logger } from './logger.js';
 import { runHook } from './hooks.js';
 import { isMcpToolName, callSessionTool, isVirtualMcpToolName, callSessionVirtualTool } from './mcpRegistry.js';
+import { lookup as dnsLookup } from 'dns/promises';
+/**
+ * SSRF guard for the agent's `fetch_url` tool. The URL there comes from model
+ * output / page content (untrusted, prompt-injectable), so the agent must not
+ * be able to reach internal services or the cloud metadata endpoint
+ * (169.254.169.254). NOTE: this does NOT apply to user-configured provider
+ * base URLs (Ollama localhost, custom vLLM/Tailscale endpoints) — those are
+ * trusted config and never routed through fetch_url.
+ */
+function isBlockedIp(ip) {
+    const s = ip.trim().toLowerCase();
+    if (s.includes(':')) {
+        // IPv6
+        if (s === '::1' || s === '::')
+            return true; // loopback / unspecified
+        if (s.startsWith('fe80') || s.startsWith('fc') || s.startsWith('fd'))
+            return true; // link-local / ULA
+        const mapped = s.match(/::ffff:(\d+\.\d+\.\d+\.\d+)$/); // IPv4-mapped
+        if (mapped)
+            return isBlockedIp(mapped[1]);
+        return false;
+    }
+    const parts = s.split('.').map(Number);
+    if (parts.length !== 4 || parts.some((n) => Number.isNaN(n) || n < 0 || n > 255))
+        return false;
+    const [a, b] = parts;
+    if (a === 127)
+        return true; // loopback
+    if (a === 10)
+        return true; // RFC1918
+    if (a === 172 && b >= 16 && b <= 31)
+        return true; // RFC1918
+    if (a === 192 && b === 168)
+        return true; // RFC1918
+    if (a === 169 && b === 254)
+        return true; // link-local incl. metadata 169.254.169.254
+    if (a === 0)
+        return true; // 0.0.0.0/8
+    return false;
+}
+/** Returns an error string if the URL must not be fetched, else null. */
+async function assertFetchUrlAllowed(rawUrl) {
+    let u;
+    try {
+        u = new URL(rawUrl);
+    }
+    catch {
+        return 'Invalid URL format';
+    }
+    if (u.protocol !== 'http:' && u.protocol !== 'https:') {
+        return `Blocked: only http/https URLs can be fetched (got "${u.protocol}")`;
+    }
+    const host = u.hostname.replace(/^\[|\]$/g, ''); // strip IPv6 brackets
+    if (host === 'localhost' || host.endsWith('.localhost')) {
+        return 'Blocked: localhost is not fetchable by the agent';
+    }
+    if (/^[0-9.]+$/.test(host) || host.includes(':')) {
+        // Literal IP — check directly.
+        if (isBlockedIp(host))
+            return `Blocked: ${host} is a private/loopback/link-local address`;
+        return null;
+    }
+    // Resolve and check every address (catches internal hostnames + single-record rebinding).
+    try {
+        const addrs = await dnsLookup(host, { all: true });
+        for (const a of addrs) {
+            if (isBlockedIp(a.address)) {
+                return `Blocked: ${host} resolves to a private/internal address (${a.address})`;
+            }
+        }
+    }
+    catch {
+        // DNS failure — let curl attempt and fail naturally; not an SSRF risk.
+    }
+    return null;
+}
 const debug = (...args) => {
     if (process.env.CODEEP_DEBUG === '1') {
         logger.debug(args.map(String).join(' '));
@@ -515,13 +591,13 @@ async function dispatchTool(tool, parameters, projectRoot, fs, toolCall) {
                 const url = parameters.url;
                 if (!url)
                     return { success: false, output: '', error: 'Missing required parameter: url', tool, parameters };
-                try {
-                    new URL(url);
-                }
-                catch {
-                    return { success: false, output: '', error: 'Invalid URL format', tool, parameters };
-                }
-                const result = await executeCommandAsync('curl', ['-s', '-L', '-m', '30', '-A', 'Codeep/1.0', '--max-filesize', '1000000', url], {
+                const blockedReason = await assertFetchUrlAllowed(url);
+                if (blockedReason)
+                    return { success: false, output: '', error: blockedReason, tool, parameters };
+                // Restrict to http/https on the initial request AND redirects, and cap
+                // redirect hops — defends against protocol-smuggling and limits
+                // redirect-based SSRF reach (initial host is already IP-checked above).
+                const result = await executeCommandAsync('curl', ['-s', '-L', '--proto', '=http,https', '--proto-redir', '=http,https', '--max-redirs', '5', '-m', '30', '-A', 'Codeep/1.0', '--max-filesize', '1000000', url], {
                     cwd: projectRoot,
                     projectRoot,
                     timeout: 35000,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeep",
-  "version": "2.1.2",
+  "version": "2.1.3",
   "description": "AI-powered coding assistant built for the terminal. Multiple LLM providers, project-aware context, and a seamless development workflow.",
   "type": "module",
   "main": "dist/index.js",