codeep 2.1.2 → 2.1.4

package/README.md

@@ -181,7 +181,7 @@ Codeep works as a **full AI coding agent** that autonomously:
 ### Context Persistence
 - **Save conversations** - Continue where you left off
 - **Per-project context** - Each project maintains its own history
-- **Automatic summarization** - Old messages are summarized to save space
+- **Automatic summarization** - When prior history overflows the agent's context budget, the dropped (oldest) messages are condensed into a short recap (decisions, constraints, unfinished threads) instead of being silently truncated — so long sessions don't forget how they started. One cheap LLM call, made only on overflow and cached per session; opt out with `autoSummarizeHistory: false` (`/settings`)
 
 ### Web & MCP Tools
 - Agent can fetch documentation and web content
@@ -449,9 +449,14 @@ Example — auto-format on edit (`.codeep/hooks/post_edit.sh`):
 prettier --write "$CODEEP_HOOK_FILE" 2>/dev/null
 ```
 
-Run `/hooks` to see which hooks are installed in the current workspace. Hooks
-trigger a security banner on session start since they're arbitrary shell that
-runs whenever an agent tool fires.
+Run `/hooks` to see which hooks are installed in the current workspace.
+
+**Trust required (security).** Because hooks run arbitrary shell, a freshly
+cloned repo's hooks are **not** run until you approve the workspace. Run
+`/hooks trust` to enable them for the current project (revoke with
+`/hooks untrust`); `/hooks` and the welcome banner show the trust state. Your
+own projects just need a one-time `/hooks trust`. Global `~/.codeep/hooks/` are
+never run for the same reason.
 
 ### Skill Bundles (new in 2.0)
 Beyond the built-in skills and custom slash commands, Codeep now supports

package/dist/acp/commands.js

@@ -881,8 +881,18 @@ Anything else the agent should know — edge cases, gotchas, things to double-ch
             return { handled: true, response: `Unknown subcommand: \`${sub}\`. Use \`show\`, \`prefer\`, \`ignore\`, \`fallbacks\`, \`privacy\`, or \`clear\`.` };
         }
         case 'hooks': {
-            const { listInstalledHooks, formatHookList } = await import('../utils/hooks.js');
-            return { handled: true, response: formatHookList(listInstalledHooks(session.workspaceRoot)) };
+            const { listInstalledHooks, formatHookList, formatHookTrust, trustWorkspaceHooks, untrustWorkspaceHooks } = await import('../utils/hooks.js');
+            const sub = (args[0] || '').toLowerCase();
+            if (sub === 'trust') {
+                trustWorkspaceHooks(session.workspaceRoot);
+                return { handled: true, response: 'Hooks trusted for this workspace — they will now run.' };
+            }
+            if (sub === 'untrust') {
+                untrustWorkspaceHooks(session.workspaceRoot);
+                return { handled: true, response: 'Hooks untrusted — they will be skipped until you trust again.' };
+            }
+            const trust = formatHookTrust(session.workspaceRoot);
+            return { handled: true, response: formatHookList(listInstalledHooks(session.workspaceRoot)) + (trust ? `\n\n${trust}` : '') };
         }
         case 'mcp': {
             const sub = args[0]?.toLowerCase();

package/dist/config/index.d.ts

@@ -27,6 +27,15 @@ interface ConfigSchema {
      *  small background API call (uses the active model) once per session.
      *  Default true; set false to avoid any unsolicited API calls. */
     autoSessionTitle: boolean;
+    /** When prior chat history overflows the agent's context budget, summarize
+     *  the dropped (oldest) messages via one LLM call instead of silently
+     *  discarding them — so long sessions keep early decisions/constraints.
+     *  Default true; set false to fall back to plain truncation (no extra call). */
+    autoSummarizeHistory: boolean;
+    /** Absolute workspace roots whose project-local `.codeep/hooks/*` the user
+     *  has approved to run. Untrusted projects' hooks are skipped (a cloned repo
+     *  can't execute shell on first tool call). Granted via `/hooks trust`. */
+    trustedHookProjects: string[];
     currentSessionId: string;
     temperature: number;
     maxTokens: number;

package/dist/config/index.js

@@ -167,6 +167,8 @@ function createConfig() {
         language: 'en',
         autoSave: true,
         autoSessionTitle: true,
+        autoSummarizeHistory: true,
+        trustedHookProjects: [],
         currentSessionId: '',
         temperature: 0.7,
         maxTokens: 32768,

package/dist/renderer/commands.js

@@ -1151,8 +1151,21 @@ Format: use headers per category, only include categories where you found issues
             break;
         }
         case 'hooks': {
-            const { listInstalledHooks, formatHookList } = await import('../utils/hooks.js');
-            ctx.app.addMessage({ role: 'system', content: formatHookList(listInstalledHooks(ctx.projectPath)) });
+            const { listInstalledHooks, formatHookList, formatHookTrust, trustWorkspaceHooks, untrustWorkspaceHooks } = await import('../utils/hooks.js');
+            const sub = (args[0] || '').toLowerCase();
+            if (sub === 'trust') {
+                trustWorkspaceHooks(ctx.projectPath);
+                ctx.app.notify('Hooks trusted for this workspace — they will now run.');
+                break;
+            }
+            if (sub === 'untrust') {
+                untrustWorkspaceHooks(ctx.projectPath);
+                ctx.app.notify('Hooks untrusted — they will be skipped until you trust again.');
+                break;
+            }
+            const trust = formatHookTrust(ctx.projectPath);
+            const body = formatHookList(listInstalledHooks(ctx.projectPath)) + (trust ? `\n\n${trust}` : '');
+            ctx.app.addMessage({ role: 'system', content: body });
             break;
         }
         case 'rewind': {

package/dist/utils/agent.js

@@ -11,7 +11,7 @@ const debug = (...args) => {
     }
 };
 // Import chat layer (prompt building + API calls)
-import { agentChat, getAgentSystemPrompt, getFallbackSystemPrompt, loadProjectRules, loadProgressLog, writeProgressLog, formatChatHistoryForAgent, } from './agentChat.js';
+import { agentChat, getAgentSystemPrompt, getFallbackSystemPrompt, loadProjectRules, loadProgressLog, writeProgressLog, formatChatHistoryForAgent, summarizeEarlierHistory, } from './agentChat.js';
 import { ApiError } from '../api/index.js';
 export { loadProjectRules, loadProgressLog, writeProgressLog, formatChatHistoryForAgent };
 /**
@@ -242,7 +242,13 @@ export async function runAgent(prompt, projectContext, options = {}) {
     if (taskCtx) {
         systemPrompt += taskCtx;
     }
-    // Inject prior chat session context
+    // Inject prior chat session context. When the history overflows the budget,
+    // prepend an LLM recap of the dropped (oldest) messages so long sessions
+    // keep early decisions/constraints, then the recent messages verbatim.
+    const earlierSummary = await summarizeEarlierHistory(opts.chatHistory);
+    if (earlierSummary) {
+        systemPrompt += earlierSummary;
+    }
     const chatHistoryStr = formatChatHistoryForAgent(opts.chatHistory);
     if (chatHistoryStr) {
         systemPrompt += chatHistoryStr;

package/dist/utils/agentChat.d.ts

@@ -52,6 +52,21 @@ export declare function formatChatHistoryForAgent(history?: Array<{
     role: 'user' | 'assistant';
     content: string;
 }>, maxChars?: number): string;
+/**
+ * Summarize the OVERFLOW that `formatChatHistoryForAgent` drops. When prior
+ * history exceeds `maxChars`, that function keeps only the most recent messages
+ * and silently discards the older ones — losing early decisions/constraints on
+ * long sessions. This condenses those dropped messages into a short recap that
+ * the caller prepends *before* the recent verbatim history.
+ *
+ * Returns '' when: opted out (`autoSummarizeHistory === false`), nothing
+ * overflows, or the summarization call fails (graceful fallback — the recent
+ * history still goes in, we just don't add a recap).
+ */
+export declare function summarizeEarlierHistory(history?: Array<{
+    role: 'user' | 'assistant';
+    content: string;
+}>, maxChars?: number): Promise<string>;
 export declare function getAgentSystemPrompt(projectContext: ProjectContext): string;
 export declare function getFallbackSystemPrompt(projectContext: ProjectContext, additionalTools?: AdditionalToolDef[]): string;
 /**

package/dist/utils/agentChat.js

@@ -13,6 +13,7 @@
  */
 import { existsSync, readFileSync, writeFileSync } from 'fs';
 import { join } from 'path';
+import { createHash } from 'crypto';
 import { config, getApiKey, resolveBaseUrl } from '../config/index.js';
 import { loadProjectIntelligence, generateContextFromIntelligence } from './projectIntelligence.js';
 import { syncProgress, generateProjectId } from './codeepCloud.js';
@@ -180,6 +181,84 @@ export function formatChatHistoryForAgent(history, maxChars = 16000) {
     const lines = selected.map(m => `**${m.role === 'user' ? 'User' : 'Assistant'}:** ${m.content}`).join('\n\n');
     return `\n\n## Prior Conversation Context\nThe following is the recent chat history from this session. Use it as background context to understand the user's intent, but focus on completing the current task.\n\n${lines}`;
 }
+// Same noise filter formatChatHistoryForAgent uses — kept in sync so the two
+// functions agree on which messages are "real" conversation.
+function filterAgentHistory(history) {
+    return history.filter(m => {
+        const content = m.content.trimStart();
+        if (content.startsWith('[AGENT]') || content.startsWith('[DRY RUN]'))
+            return false;
+        if (content.startsWith('Agent completed') || content.startsWith('Agent failed') || content.startsWith('Agent stopped'))
+            return false;
+        return true;
+    });
+}
+// Cache summaries by a hash of the dropped messages, so re-running the agent in
+// the same session (same overflow) doesn't re-summarize on every task.
+const earlierSummaryCache = new Map();
+/**
+ * Summarize the OVERFLOW that `formatChatHistoryForAgent` drops. When prior
+ * history exceeds `maxChars`, that function keeps only the most recent messages
+ * and silently discards the older ones — losing early decisions/constraints on
+ * long sessions. This condenses those dropped messages into a short recap that
+ * the caller prepends *before* the recent verbatim history.
+ *
+ * Returns '' when: opted out (`autoSummarizeHistory === false`), nothing
+ * overflows, or the summarization call fails (graceful fallback — the recent
+ * history still goes in, we just don't add a recap).
+ */
+export async function summarizeEarlierHistory(history, maxChars = 16000) {
+    if (config.get('autoSummarizeHistory') === false)
+        return '';
+    if (!history || history.length === 0)
+        return '';
+    const filtered = filterAgentHistory(history);
+    if (filtered.length === 0)
+        return '';
+    // Mirror formatChatHistoryForAgent's newest→oldest budget walk to find which
+    // messages it KEEPS; everything older than the oldest kept message is dropped.
+    let totalChars = 0;
+    let firstKept = filtered.length;
+    for (let i = filtered.length - 1; i >= 0; i--) {
+        const entry = `${filtered[i].role === 'user' ? 'User' : 'Assistant'}: ${filtered[i].content}`;
+        if (totalChars + entry.length > maxChars && firstKept < filtered.length)
+            break;
+        if (entry.length > maxChars) {
+            firstKept = i;
+            break;
+        }
+        firstKept = i;
+        totalChars += entry.length;
+    }
+    const dropped = filtered.slice(0, firstKept);
+    if (dropped.length === 0)
+        return '';
+    const key = createHash('sha256')
+        .update(dropped.map(m => `${m.role}:${m.content}`).join(''))
+        .digest('hex');
+    const cached = earlierSummaryCache.get(key);
+    if (cached)
+        return cached;
+    // Compact transcript of the dropped messages, capped so the summarization
+    // prompt stays cheap even when a lot has overflowed.
+    const transcript = dropped
+        .map(m => `${m.role === 'user' ? 'User' : 'Assistant'}: ${m.content.replace(/\s+/g, ' ').slice(0, 600)}`)
+        .join('\n')
+        .slice(0, 24000);
+    const system = 'You are condensing the EARLIER part of an ongoing coding session that no longer fits the context window. Summarize what happened in 3-6 sentences: concrete decisions made, constraints/requirements stated, files or APIs involved, and anything still unfinished. Past tense, no preamble, no bullet headers — just the recap.';
+    try {
+        const { chat } = await import('../api/index.js');
+        const summary = (await chat(transcript, [{ role: 'system', content: system }])).trim();
+        if (!summary)
+            return '';
+        const block = `\n\n## Earlier Conversation (summarized)\nThe earlier part of this session was condensed to fit context. Treat it as established background:\n\n${summary}`;
+        earlierSummaryCache.set(key, block);
+        return block;
+    }
+    catch {
+        return ''; // graceful — recent verbatim history still gets injected
+    }
+}
 export function getAgentSystemPrompt(projectContext) {
     const root = projectContext.root || process.cwd();
     // State the real underlying model/provider so "which model are you"

package/dist/utils/codeepCloud.js

@@ -110,9 +110,13 @@ export function reportStats(payload) {
     const githubId = getGithubId();
     if (!githubId)
         return; // not linked, skip silently
+    // Send the sync token so the server can attribute the event to us. The
+    // server derives github_id from the token and ignores the body value (the
+    // body githubId is kept only for backward-compat with older servers).
+    const syncToken = getSyncToken();
     fetchWithRetry(`${API_BASE}/api/stats`, {
         method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
+        headers: { 'Content-Type': 'application/json', ...(syncToken ? { 'x-sync-token': syncToken } : {}) },
         body: JSON.stringify({ ...payload, githubId, isGit: payload.isGit ?? false }),
     }).catch(() => { });
 }
@@ -120,9 +124,10 @@ export async function reportStatsAsync(payload) {
     const githubId = getGithubId();
     if (!githubId)
         return;
+    const syncToken = getSyncToken();
     await fetchWithRetry(`${API_BASE}/api/stats`, {
         method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
+        headers: { 'Content-Type': 'application/json', ...(syncToken ? { 'x-sync-token': syncToken } : {}) },
         body: JSON.stringify({ ...payload, githubId, isGit: payload.isGit ?? false }),
     });
 }

package/dist/utils/hooks.d.ts

@@ -45,6 +45,9 @@
  * banner warns when hooks exist (see `summarizeHooks`); we do not run
  * hooks from `~/.codeep/hooks/` (global) for that reason.
  */
+export declare function isHooksTrusted(workspaceRoot: string): boolean;
+export declare function trustWorkspaceHooks(workspaceRoot: string): void;
+export declare function untrustWorkspaceHooks(workspaceRoot: string): void;
 export type HookEvent = 'pre_tool_call' | 'post_edit' | 'on_error' | 'pre_commit';
 export declare const HOOK_EVENTS: readonly HookEvent[];
 export interface HookContext {
@@ -69,6 +72,9 @@ export interface HookResult {
     blocked: boolean;
     /** Path that was executed (useful for error messages). */
     scriptPath?: string;
+    /** True when a hook script exists but the workspace isn't trusted, so it was
+     *  skipped (not run). Lets callers surface "run /hooks trust to enable". */
+    untrusted?: boolean;
 }
 /**
  * Execute the configured hook for an event, if any. Returns `executed: false`
@@ -90,6 +96,11 @@ export declare function listInstalledHooks(workspaceRoot: string): {
  * Render an installed-hook list as Markdown for `/hooks` output.
  */
 export declare function formatHookList(hooks: ReturnType<typeof listInstalledHooks>): string;
+/**
+ * Build the trust banner for `/hooks` and the welcome screen. `workspaceRoot`
+ * is needed to read trust state; returns '' if no hooks are installed.
+ */
+export declare function formatHookTrust(workspaceRoot: string): string;
 /**
  * Short one-line summary used in the welcome banner when hooks are present.
  * Returns empty string if no hooks installed.

package/dist/utils/hooks.js

@@ -48,6 +48,31 @@
 import { existsSync, readdirSync, statSync, accessSync, constants } from 'fs';
 import { join } from 'path';
 import { spawnSync } from 'child_process';
+import { config } from '../config/index.js';
+// ─── Trust-on-first-use ──────────────────────────────────────────────────────
+// Project-local hooks run arbitrary shell, so a freshly-cloned hostile repo
+// must NOT execute its scripts on the first tool call. A workspace's hooks run
+// only after the user explicitly trusts it (`/hooks trust`); the approval is
+// stored per-workspace-root in config. Mirrors VS Code Workspace Trust /
+// `direnv allow`.
+export function isHooksTrusted(workspaceRoot) {
+    try {
+        const trusted = config.get('trustedHookProjects');
+        return Array.isArray(trusted) && trusted.includes(workspaceRoot);
+    }
+    catch {
+        return false;
+    }
+}
+export function trustWorkspaceHooks(workspaceRoot) {
+    const cur = config.get('trustedHookProjects') ?? [];
+    if (!cur.includes(workspaceRoot))
+        config.set('trustedHookProjects', [...cur, workspaceRoot]);
+}
+export function untrustWorkspaceHooks(workspaceRoot) {
+    const cur = config.get('trustedHookProjects') ?? [];
+    config.set('trustedHookProjects', cur.filter((p) => p !== workspaceRoot));
+}
 export const HOOK_EVENTS = ['pre_tool_call', 'post_edit', 'on_error', 'pre_commit'];
 /** Events whose non-zero exit aborts the action that triggered them. */
 const BLOCKING_EVENTS = new Set(['pre_tool_call', 'pre_commit']);
@@ -89,6 +114,12 @@ export function runHook(ctx, opts = {}) {
     const script = findHookScript(ctx.workspaceRoot, ctx.event);
     if (!script)
         return NOT_EXECUTED;
+    // Trust gate: never run a project's hooks until the user has approved this
+    // workspace. A non-blocking skip — the agent proceeds without the hook
+    // rather than being held hostage by an untrusted (or hostile) script.
+    if (!isHooksTrusted(ctx.workspaceRoot)) {
+        return { executed: false, exitCode: 0, stdout: '', stderr: '', blocked: false, untrusted: true, scriptPath: script };
+    }
     const env = {
         ...process.env,
         CODEEP_HOOK_EVENT: ctx.event,
@@ -211,6 +242,22 @@ export function formatHookList(hooks) {
     }
     return lines.join('\n');
 }
+/**
+ * Build the trust banner for `/hooks` and the welcome screen. `workspaceRoot`
+ * is needed to read trust state; returns '' if no hooks are installed.
+ */
+export function formatHookTrust(workspaceRoot) {
+    const hooks = listInstalledHooks(workspaceRoot);
+    if (hooks.length === 0)
+        return '';
+    if (isHooksTrusted(workspaceRoot)) {
+        return '✓ This workspace is **trusted** — its hooks will run. Use `/hooks untrust` to revoke.';
+    }
+    return [
+        '⚠️ This workspace is **not trusted**, so its hooks are **skipped** (they run arbitrary shell).',
+        'If you wrote these hooks (or trust this repo), run `/hooks trust` to enable them.',
+    ].join('\n');
+}
 /**
  * Short one-line summary used in the welcome banner when hooks are present.
  * Returns empty string if no hooks installed.
@@ -219,5 +266,9 @@ export function summarizeHooks(workspaceRoot) {
     const hooks = listInstalledHooks(workspaceRoot);
     if (hooks.length === 0)
         return '';
-    return `${hooks.length} hook${hooks.length === 1 ? '' : 's'} active (${hooks.map(h => h.event).join(', ')})`;
+    const list = hooks.map(h => h.event).join(', ');
+    if (!isHooksTrusted(workspaceRoot)) {
+        return `${hooks.length} hook${hooks.length === 1 ? '' : 's'} present but NOT trusted — run /hooks trust to enable (${list})`;
+    }
+    return `${hooks.length} hook${hooks.length === 1 ? '' : 's'} active (${list})`;
 }

package/dist/utils/shell.js

@@ -74,6 +74,37 @@ const ALLOWED_COMMANDS = new Set([
     // HTTP tools
     'http', 'https',
 ]);
+// Interpreter flags that execute inline code straight from the command line.
+// Without this check, a whitelisted runtime (`node`, `python`, …) becomes
+// arbitrary code execution — `node -e "<anything>"`, `python -c "<anything>"` —
+// bypassing the command whitelist entirely. File execution (`node app.js`)
+// stays allowed; only the eval flags are blocked.
+const INLINE_EVAL_SHORT = {
+    node: ['e', 'p'], bun: ['e'], python: ['c'], python3: ['c'], php: ['r'], ruby: ['e'], perl: ['e', 'E'],
+};
+const INLINE_EVAL_LONG = {
+    node: ['--eval', '--print'], deno: ['eval'], bun: ['--eval'],
+};
+function hasInlineEval(command, args) {
+    const short = INLINE_EVAL_SHORT[command] ?? [];
+    const long = INLINE_EVAL_LONG[command] ?? [];
+    if (short.length === 0 && long.length === 0)
+        return false;
+    for (const arg of args) {
+        if (arg.startsWith('--')) {
+            if (long.includes(arg.split('=')[0]))
+                return true; // --eval / --print(=...)
+        }
+        else if (arg.length > 1 && arg.startsWith('-')) {
+            if (arg.slice(1).split('').some((l) => short.includes(l)))
+                return true; // -e, -c, -pe …
+        }
+        else if (long.includes(arg)) {
+            return true; // bare subcommand, e.g. `deno eval`
+        }
+    }
+    return false;
+}
 /**
  * Validate if a command is safe to execute
  */
@@ -86,6 +117,11 @@ export function validateCommand(command, args, options) {
     if (!ALLOWED_COMMANDS.has(command)) {
         return { valid: false, reason: `Command '${command}' is not in the allowed list` };
     }
+    // Block inline-code execution that would turn a whitelisted interpreter into
+    // arbitrary code execution (the whitelist alone doesn't stop `node -e "…"`).
+    if (hasInlineEval(command, args)) {
+        return { valid: false, reason: `Inline code execution via '${command}' (e.g. -e/-c/--eval) is not allowed in agent mode — put the code in a file and run that, or run it yourself.` };
+    }
     // Check full command string against dangerous patterns
     const fullCommand = `${command} ${args.join(' ')}`;
     for (const pattern of BLOCKED_PATTERNS) {

package/dist/utils/toolExecution.js

@@ -16,6 +16,82 @@ import { getZaiMcpConfig, getZaiVisionConfig, getMinimaxMcpConfig, callZaiMcp, c
 import { logger } from './logger.js';
 import { runHook } from './hooks.js';
 import { isMcpToolName, callSessionTool, isVirtualMcpToolName, callSessionVirtualTool } from './mcpRegistry.js';
+import { lookup as dnsLookup } from 'dns/promises';
+/**
+ * SSRF guard for the agent's `fetch_url` tool. The URL there comes from model
+ * output / page content (untrusted, prompt-injectable), so the agent must not
+ * be able to reach internal services or the cloud metadata endpoint
+ * (169.254.169.254). NOTE: this does NOT apply to user-configured provider
+ * base URLs (Ollama localhost, custom vLLM/Tailscale endpoints) — those are
+ * trusted config and never routed through fetch_url.
+ */
+function isBlockedIp(ip) {
+    const s = ip.trim().toLowerCase();
+    if (s.includes(':')) {
+        // IPv6
+        if (s === '::1' || s === '::')
+            return true; // loopback / unspecified
+        if (s.startsWith('fe80') || s.startsWith('fc') || s.startsWith('fd'))
+            return true; // link-local / ULA
+        const mapped = s.match(/::ffff:(\d+\.\d+\.\d+\.\d+)$/); // IPv4-mapped
+        if (mapped)
+            return isBlockedIp(mapped[1]);
+        return false;
+    }
+    const parts = s.split('.').map(Number);
+    if (parts.length !== 4 || parts.some((n) => Number.isNaN(n) || n < 0 || n > 255))
+        return false;
+    const [a, b] = parts;
+    if (a === 127)
+        return true; // loopback
+    if (a === 10)
+        return true; // RFC1918
+    if (a === 172 && b >= 16 && b <= 31)
+        return true; // RFC1918
+    if (a === 192 && b === 168)
+        return true; // RFC1918
+    if (a === 169 && b === 254)
+        return true; // link-local incl. metadata 169.254.169.254
+    if (a === 0)
+        return true; // 0.0.0.0/8
+    return false;
+}
+/** Returns an error string if the URL must not be fetched, else null. */
+async function assertFetchUrlAllowed(rawUrl) {
+    let u;
+    try {
+        u = new URL(rawUrl);
+    }
+    catch {
+        return 'Invalid URL format';
+    }
+    if (u.protocol !== 'http:' && u.protocol !== 'https:') {
+        return `Blocked: only http/https URLs can be fetched (got "${u.protocol}")`;
+    }
+    const host = u.hostname.replace(/^\[|\]$/g, ''); // strip IPv6 brackets
+    if (host === 'localhost' || host.endsWith('.localhost')) {
+        return 'Blocked: localhost is not fetchable by the agent';
+    }
+    if (/^[0-9.]+$/.test(host) || host.includes(':')) {
+        // Literal IP — check directly.
+        if (isBlockedIp(host))
+            return `Blocked: ${host} is a private/loopback/link-local address`;
+        return null;
+    }
+    // Resolve and check every address (catches internal hostnames + single-record rebinding).
+    try {
+        const addrs = await dnsLookup(host, { all: true });
+        for (const a of addrs) {
+            if (isBlockedIp(a.address)) {
+                return `Blocked: ${host} resolves to a private/internal address (${a.address})`;
+            }
+        }
+    }
+    catch {
+        // DNS failure — let curl attempt and fail naturally; not an SSRF risk.
+    }
+    return null;
+}
 const debug = (...args) => {
     if (process.env.CODEEP_DEBUG === '1') {
         logger.debug(args.map(String).join(' '));
@@ -515,13 +591,13 @@ async function dispatchTool(tool, parameters, projectRoot, fs, toolCall) {
                 const url = parameters.url;
                 if (!url)
                     return { success: false, output: '', error: 'Missing required parameter: url', tool, parameters };
-                try {
-                    new URL(url);
-                }
-                catch {
-                    return { success: false, output: '', error: 'Invalid URL format', tool, parameters };
-                }
-                const result = await executeCommandAsync('curl', ['-s', '-L', '-m', '30', '-A', 'Codeep/1.0', '--max-filesize', '1000000', url], {
+                const blockedReason = await assertFetchUrlAllowed(url);
+                if (blockedReason)
+                    return { success: false, output: '', error: blockedReason, tool, parameters };
+                // Restrict to http/https on the initial request AND redirects, and cap
+                // redirect hops — defends against protocol-smuggling and limits
+                // redirect-based SSRF reach (initial host is already IP-checked above).
+                const result = await executeCommandAsync('curl', ['-s', '-L', '--proto', '=http,https', '--proto-redir', '=http,https', '--max-redirs', '5', '-m', '30', '-A', 'Codeep/1.0', '--max-filesize', '1000000', url], {
                     cwd: projectRoot,
                     projectRoot,
                     timeout: 35000,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeep",
-  "version": "2.1.2",
+  "version": "2.1.4",
   "description": "AI-powered coding assistant built for the terminal. Multiple LLM providers, project-aware context, and a seamless development workflow.",
   "type": "module",
   "main": "dist/index.js",