codeep 2.18.0 → 2.19.0

package/dist/utils/shell.d.ts

@@ -17,7 +17,8 @@ export interface CommandOptions {
     projectRoot?: string;
 }
 /**
- * Validate if a command is safe to execute
+ * Validate if a command is safe to execute (synchronous checks).
+ * See validateCommandAsync for the DNS-resolving SSRF checks.
  */
 export declare function validateCommand(command: string, args: string[], options?: CommandOptions): {
     valid: boolean;
@@ -27,6 +28,15 @@ export declare function validateCommand(command: string, args: string[], options
  * Execute a shell command with safety checks
  */
 export declare function executeCommand(command: string, args?: string[], options?: CommandOptions): CommandResult;
+/**
+ * Async validation: everything in validateCommand plus the DNS-resolving
+ * SSRF check for URL-carrying commands (curl/wget/http/https). Split from
+ * the sync part because DNS lookups can't block the event loop.
+ */
+export declare function validateCommandAsync(command: string, args: string[], options?: CommandOptions): Promise<{
+    valid: boolean;
+    reason?: string;
+}>;
 /**
  * Execute a shell command asynchronously (non-blocking)
  */

package/dist/utils/shell.js

@@ -4,6 +4,7 @@
 import { spawnSync, spawn } from 'child_process';
 import { resolve, relative, isAbsolute } from 'path';
 import { existsSync } from 'fs';
+import { assertFetchUrlAllowed } from './ssrfGuard.js';
 // Dangerous command patterns that should never be executed
 const BLOCKED_COMMANDS = new Set([
     'sudo',
@@ -68,8 +69,13 @@ const ALLOWED_COMMANDS = new Set([
     // Linting/Formatting
     'eslint', 'prettier', 'black', 'rustfmt',
     // Other common tools
-    'echo', 'pwd', 'which', 'env', 'date', 'sleep',
-    'curl', 'wget', // allowed but patterns checked
+    // NOTE: `env` deliberately NOT whitelisted — it dumps process.env to
+    // stdout, which lands in the model's context. Provider API keys ride in
+    // env vars, so a single `env` call would exfiltrate every credential the
+    // CLI holds. `printenv` is excluded for the same reason. Run these
+    // yourself outside the agent if you need environment info.
+    'echo', 'pwd', 'which', 'date', 'sleep',
+    'curl', 'wget', // allowed but patterns + SSRF-checked
     'tar', 'unzip', 'zip',
     // HTTP tools
     'http', 'https',
@@ -105,8 +111,62 @@ function hasInlineEval(command, args) {
     }
     return false;
 }
+// Commands whose arguments carry URLs that must pass the SSRF guard
+// (private/loopback/metadata IP check) before execution. `fetch_url` already
+// routes through assertFetchUrlAllowed; without this list the same model-
+// controlled URL could just be passed to curl instead.
+const URL_CARRYING_COMMANDS = new Set(['curl', 'wget', 'http', 'https']);
+// Heuristic: extract URL-looking arguments. curl/wget accept URLs with or
+// without a scheme (curl example.com works), and URLs may also ride in
+// option values (`--url=…`, `-d @url`, header values like
+// `Host: internal.corp`). We normalize scheme-less hosts so the guard sees
+// what curl will actually connect to.
+function extractUrlCandidates(args) {
+    const urls = [];
+    for (const arg of args) {
+        if (arg.startsWith('-')) {
+            // Option values: --url=x, --output=y are paths not URLs, but
+            // --header="Host: x" can smuggle a host. Keep it simple: only check
+            // --url= style options that plausibly carry a URL.
+            const m = arg.match(/^--url=(.+)$/i);
+            if (m)
+                urls.push(m[1]);
+            continue;
+        }
+        if (/^https?:\/\//i.test(arg)) {
+            urls.push(arg);
+        }
+        else if (
+        // scheme-less host forms curl accepts: literal IPs (with optional
+        // port/path), 'localhost', and named hosts (example.com, internal.corp).
+        // Anything else (plain filenames, package names) is left alone.
+        /^(localhost([\/?#].*)?|\d{1,3}(\.\d{1,3}){3}(:\d+)?([\/?#].*)?|[a-z0-9-]+(\.[a-z0-9-]+)+(:\d+)?([\/?#].*)?)$/i.test(arg)) {
+            // scheme-less host or host/path — what curl will connect to
+            urls.push(`http://${arg}`);
+        }
+    }
+    return urls;
+}
+// Exec-escapes: whitelisted utilities that can run ARBITRARY other commands
+// as part of their arguments, silently bypassing the whitelist above.
+//   find . -exec <anything> \;        → runs <anything>
+//   find . -execdir <anything> \;
+//   tar --to-command=<anything>       → pipes each extracted file into it
+//   xargs <anything>                  → not whitelisted itself, but listed
+//                                       here for documentation; see note.
+const EXEC_ESCAPE_SHORT = {
+    find: ['-exec', '-execdir', '-ok', '-okdir'],
+    tar: ['--to-command'],
+};
+function hasExecEscape(command, args) {
+    const flags = EXEC_ESCAPE_SHORT[command] ?? [];
+    if (flags.length === 0)
+        return false;
+    return args.some((a) => flags.includes(a) || flags.some((f) => a.startsWith(f + '=')));
+}
 /**
- * Validate if a command is safe to execute
+ * Validate if a command is safe to execute (synchronous checks).
+ * See validateCommandAsync for the DNS-resolving SSRF checks.
  */
 export function validateCommand(command, args, options) {
     // Check if command is in blocked list
@@ -122,6 +182,11 @@ export function validateCommand(command, args, options) {
     if (hasInlineEval(command, args)) {
         return { valid: false, reason: `Inline code execution via '${command}' (e.g. -e/-c/--eval) is not allowed in agent mode — put the code in a file and run that, or run it yourself.` };
     }
+    // Block whitelisted utilities whose flags spawn OTHER commands — that
+    // would bypass the whitelist entirely (find . -exec rm -rf / \;).
+    if (hasExecEscape(command, args)) {
+        return { valid: false, reason: `'${command}' with exec flags (-exec/-execdir/--to-command…) runs arbitrary commands and is not allowed in agent mode.` };
+    }
     // Check full command string against dangerous patterns
     const fullCommand = `${command} ${args.join(' ')}`;
     for (const pattern of BLOCKED_PATTERNS) {
@@ -241,6 +306,25 @@ export function executeCommand(command, args = [], options) {
         };
     }
 }
+/**
+ * Async validation: everything in validateCommand plus the DNS-resolving
+ * SSRF check for URL-carrying commands (curl/wget/http/https). Split from
+ * the sync part because DNS lookups can't block the event loop.
+ */
+export async function validateCommandAsync(command, args, options) {
+    const sync = validateCommand(command, args, options);
+    if (!sync.valid)
+        return sync;
+    if (URL_CARRYING_COMMANDS.has(command)) {
+        for (const url of extractUrlCandidates(args)) {
+            const blocked = await assertFetchUrlAllowed(url);
+            if (blocked) {
+                return { valid: false, reason: `Blocked URL in ${command} arguments: ${blocked}` };
+            }
+        }
+    }
+    return { valid: true };
+}
 /**
  * Execute a shell command asynchronously (non-blocking)
  */
@@ -249,88 +333,91 @@ export function executeCommandAsync(command, args = [], options) {
         const startTime = Date.now();
         const cwd = options?.cwd || process.cwd();
         const timeout = options?.timeout || 60000;
-        // Validate command first (synchronous, fast)
-        const validation = validateCommand(command, args, options);
-        if (!validation.valid) {
-            resolve({
-                success: false,
-                stdout: '',
-                stderr: validation.reason || 'Command validation failed',
-                exitCode: -1,
-                duration: 0,
-                command,
-                args,
-            });
-            return;
-        }
-        // Ensure cwd exists
-        if (!existsSync(cwd)) {
-            resolve({
-                success: false,
-                stdout: '',
-                stderr: `Working directory does not exist: ${cwd}`,
-                exitCode: -1,
-                duration: 0,
-                command,
-                args,
-            });
-            return;
-        }
-        const child = spawn(command, args, {
-            cwd,
-            env: { ...process.env, ...options?.env },
-        });
-        let stdout = '';
-        let stderr = '';
-        child.stdout.on('data', (data) => { stdout += data.toString(); });
-        child.stderr.on('data', (data) => { stderr += data.toString(); });
-        let settled = false;
-        const timer = setTimeout(() => {
-            if (settled)
+        // Validate command first — async because URL-carrying commands get a
+        // DNS-resolving SSRF check (private/loopback/metadata IP guard) that
+        // matches the one on the fetch_url tool.
+        validateCommandAsync(command, args, options).then((validation) => {
+            if (!validation.valid) {
+                resolve({
+                    success: false,
+                    stdout: '',
+                    stderr: validation.reason || 'Command validation failed',
+                    exitCode: -1,
+                    duration: 0,
+                    command,
+                    args,
+                });
                 return;
-            settled = true;
-            child.kill('SIGTERM');
-            const duration = Date.now() - startTime;
-            resolve({
-                success: false,
-                stdout,
-                stderr: `Command timed out after ${timeout}ms`,
-                exitCode: -1,
-                duration,
-                command,
-                args,
-            });
-        }, timeout);
-        child.on('close', (code) => {
-            if (settled)
+            }
+            // Ensure cwd exists
+            if (!existsSync(cwd)) {
+                resolve({
+                    success: false,
+                    stdout: '',
+                    stderr: `Working directory does not exist: ${cwd}`,
+                    exitCode: -1,
+                    duration: 0,
+                    command,
+                    args,
+                });
                 return;
-            settled = true;
-            clearTimeout(timer);
-            const duration = Date.now() - startTime;
-            resolve({
-                success: code === 0,
-                stdout,
-                stderr,
-                exitCode: code ?? -1,
-                duration,
-                command,
-                args,
+            }
+            const child = spawn(command, args, {
+                cwd,
+                env: { ...process.env, ...options?.env },
             });
-        });
-        child.on('error', (err) => {
-            if (settled)
-                return;
-            settled = true;
-            clearTimeout(timer);
-            const duration = Date.now() - startTime;
-            resolve({
-                success: false,
-                stdout: '',
-                stderr: err.message,
-                exitCode: -1,
-                duration,
-                command,
-                args,
+            let stdout = '';
+            let stderr = '';
+            child.stdout.on('data', (data) => { stdout += data.toString(); });
+            child.stderr.on('data', (data) => { stderr += data.toString(); });
+            let settled = false;
+            const timer = setTimeout(() => {
+                if (settled)
+                    return;
+                settled = true;
+                child.kill('SIGTERM');
+                const duration = Date.now() - startTime;
+                resolve({
+                    success: false,
+                    stdout,
+                    stderr: `Command timed out after ${timeout}ms`,
+                    exitCode: -1,
+                    duration,
+                    command,
+                    args,
+                });
+            }, timeout);
+            child.on('close', (code) => {
+                if (settled)
+                    return;
+                settled = true;
+                clearTimeout(timer);
+                const duration = Date.now() - startTime;
+                resolve({
+                    success: code === 0,
+                    stdout,
+                    stderr,
+                    exitCode: code ?? -1,
+                    duration,
+                    command,
+                    args,
+                });
+            });
+            child.on('error', (err) => {
+                if (settled)
+                    return;
+                settled = true;
+                clearTimeout(timer);
+                const duration = Date.now() - startTime;
+                resolve({
+                    success: false,
+                    stdout: '',
+                    stderr: err.message,
+                    exitCode: -1,
+                    duration,
+                    command,
+                    args,
+                });
             });
         });
     });

package/dist/utils/ssrfGuard.d.ts

@@ -0,0 +1,18 @@
+/**
+ * SSRF (Server-Side Request Forgery) guard, shared by the agent's network-
+ * touching surfaces.
+ *
+ * Used by:
+ *   - toolExecution.ts  → the `fetch_url` tool
+ *   - shell.ts          → curl/wget/http(s) arguments in execute_command
+ *
+ * The URLs in both cases originate from model output / page content
+ * (untrusted, prompt-injectable), so the agent must not be able to reach
+ * internal services or the cloud metadata endpoint (169.254.169.254).
+ * NOTE: this deliberately does NOT apply to user-configured provider base
+ * URLs (Ollama localhost, custom vLLM/Tailscale endpoints) — those are
+ * trusted config and never routed through agent tools.
+ */
+export declare function isBlockedIp(ip: string): boolean;
+/** Returns an error string if the URL must not be fetched, else null. */
+export declare function assertFetchUrlAllowed(rawUrl: string): Promise<string | null>;

package/dist/utils/ssrfGuard.js

@@ -0,0 +1,83 @@
+/**
+ * SSRF (Server-Side Request Forgery) guard, shared by the agent's network-
+ * touching surfaces.
+ *
+ * Used by:
+ *   - toolExecution.ts  → the `fetch_url` tool
+ *   - shell.ts          → curl/wget/http(s) arguments in execute_command
+ *
+ * The URLs in both cases originate from model output / page content
+ * (untrusted, prompt-injectable), so the agent must not be able to reach
+ * internal services or the cloud metadata endpoint (169.254.169.254).
+ * NOTE: this deliberately does NOT apply to user-configured provider base
+ * URLs (Ollama localhost, custom vLLM/Tailscale endpoints) — those are
+ * trusted config and never routed through agent tools.
+ */
+import { lookup as dnsLookup } from 'dns/promises';
+export function isBlockedIp(ip) {
+    const s = ip.trim().toLowerCase();
+    if (s.includes(':')) {
+        // IPv6
+        if (s === '::1' || s === '::')
+            return true; // loopback / unspecified
+        if (s.startsWith('fe80') || s.startsWith('fc') || s.startsWith('fd'))
+            return true; // link-local / ULA
+        const mapped = s.match(/::ffff:(\d+\.\d+\.\d+\.\d+)$/); // IPv4-mapped
+        if (mapped)
+            return isBlockedIp(mapped[1]);
+        return false;
+    }
+    const parts = s.split('.').map(Number);
+    if (parts.length !== 4 || parts.some((n) => Number.isNaN(n) || n < 0 || n > 255))
+        return false;
+    const [a, b] = parts;
+    if (a === 127)
+        return true; // loopback
+    if (a === 10)
+        return true; // RFC1918
+    if (a === 172 && b >= 16 && b <= 31)
+        return true; // RFC1918
+    if (a === 192 && b === 168)
+        return true; // RFC1918
+    if (a === 169 && b === 254)
+        return true; // link-local incl. metadata 169.254.169.254
+    if (a === 0)
+        return true; // 0.0.0.0/8
+    return false;
+}
+/** Returns an error string if the URL must not be fetched, else null. */
+export async function assertFetchUrlAllowed(rawUrl) {
+    let u;
+    try {
+        u = new URL(rawUrl);
+    }
+    catch {
+        return 'Invalid URL format';
+    }
+    if (u.protocol !== 'http:' && u.protocol !== 'https:') {
+        return `Blocked: only http/https URLs can be fetched (got "${u.protocol}")`;
+    }
+    const host = u.hostname.replace(/^\[|\]$/g, ''); // strip IPv6 brackets
+    if (host === 'localhost' || host.endsWith('.localhost')) {
+        return 'Blocked: localhost is not fetchable by the agent';
+    }
+    if (/^[0-9.]+$/.test(host) || host.includes(':')) {
+        // Literal IP — check directly.
+        if (isBlockedIp(host))
+            return `Blocked: ${host} is a private/loopback/link-local address`;
+        return null;
+    }
+    // Resolve and check every address (catches internal hostnames + single-record rebinding).
+    try {
+        const addrs = await dnsLookup(host, { all: true });
+        for (const a of addrs) {
+            if (isBlockedIp(a.address)) {
+                return `Blocked: ${host} resolves to a private/internal address (${a.address})`;
+            }
+        }
+    }
+    catch {
+        // DNS failure — let curl attempt and fail naturally; not an SSRF risk.
+    }
+    return null;
+}

package/dist/utils/taskPlanner.d.ts

@@ -12,6 +12,12 @@ export interface TaskPlan {
     tasks: SubTask[];
     estimatedIterations: number;
 }
+/** Per-run provider selection. Used by custom bots without mutating config. */
+export interface TaskPlannerRuntime {
+    providerId?: string;
+    model?: string;
+    protocol?: 'openai' | 'anthropic';
+}
 /**
  * Ask AI to break down a complex task into subtasks
  */
@@ -19,7 +25,7 @@ export declare function planTasks(userPrompt: string, projectContext: {
     name: string;
     type: string;
     structure: string;
-}): Promise<TaskPlan>;
+}, runtime?: TaskPlannerRuntime): Promise<TaskPlan>;
 /**
  * Check if a task's dependencies are completed
  */

package/dist/utils/taskPlanner.js

@@ -2,11 +2,11 @@
  * Task Planning - breaks down complex tasks into subtasks
  */
 import { config, getApiKey, resolveBaseUrl } from '../config/index.js';
-import { getProviderAuthHeader, requiresDefaultTemperature } from '../config/providers.js';
+import { getProviderAuthHeader, isNoApiKeyProvider, requiresDefaultTemperature } from '../config/providers.js';
 /**
  * Ask AI to break down a complex task into subtasks
  */
-export async function planTasks(userPrompt, projectContext) {
+export async function planTasks(userPrompt, projectContext, runtime = {}) {
     const systemPrompt = `You are a task planning expert. Break down user requests into clear, sequential subtasks.
 
 RULES:
@@ -36,14 +36,17 @@ User Request: ${userPrompt}
 
 Break this down into subtasks. Each task = one file or one logical unit. Respond with JSON only.`;
     try {
-        const apiKey = await getApiKey();
+        const protocol = runtime.protocol ?? config.get('protocol');
+        const provider = runtime.providerId ?? config.get('provider');
+        const model = runtime.model ?? config.get('model');
+        const apiKey = getApiKey(provider) || (isNoApiKeyProvider(provider) ? 'ollama' : '');
         if (!apiKey) {
             throw new Error('No API key configured');
         }
-        const protocol = config.get('protocol');
-        const provider = config.get('provider');
-        const model = config.get('model');
         const baseUrl = resolveBaseUrl(provider, protocol);
+        if (!baseUrl) {
+            throw new Error(`No API base URL configured for ${provider}`);
+        }
         const authHeaderType = getProviderAuthHeader(provider, protocol);
         const messages = [
             { role: 'user', content: systemPrompt }
@@ -73,7 +76,13 @@ Break this down into subtasks. Each task = one file or one logical unit. Respond
         else {
             headers['Authorization'] = `Bearer ${apiKey}`;
         }
-        const response = await fetch(`${baseUrl}/chat/completions`, {
+        if (protocol === 'anthropic') {
+            headers['anthropic-version'] = '2023-06-01';
+        }
+        const endpoint = protocol === 'anthropic'
+            ? `${baseUrl}/v1/messages`
+            : `${baseUrl}/chat/completions`;
+        const response = await fetch(endpoint, {
             method: 'POST',
             headers,
             body: JSON.stringify(requestBody),

package/dist/utils/tokenTracker.d.ts

@@ -111,8 +111,15 @@ export declare function getCostBreakdown(startIndex?: number): ProviderCostBreak
 export interface CacheStats {
     cacheCreationTokens: number;
     cacheReadTokens: number;
-    /** Sum of estimatedSavings across all Anthropic-priced records. */
+    /** Sum of estimatedSavings across pay-per-use records only. */
     estimatedSavingsUsd: number;
+    /** True when some cached tokens came from a flat-fee plan, whose "savings"
+     *  are not a dollar amount at all. Lets the report say so instead of quoting
+     *  a figure that silently covers only part of the session. */
+    hasFlatFeeCacheUsage: boolean;
+    /** True when EVERY cached token came from a flat-fee plan — there is no
+     *  metered spend to have saved against. */
+    isEntirelyFlatFeeCache: boolean;
 }
 export declare function getCacheStats(): CacheStats;
 /**

package/dist/utils/tokenTracker.js

@@ -96,6 +96,12 @@ const MODEL_PRICING = {
     'claude-sonnet-5': { inputPer1M: 3.00, outputPer1M: 15.00 },
     'claude-haiku-4-5-20251001': { inputPer1M: 1.00, outputPer1M: 5.00 },
     // DeepSeek (cache-miss input pricing)
+    // DeepSeek moved to peak / off-peak billing on 2026-08-16, with off-peak at
+    // half these rates. This table holds one rate per model and has no notion of
+    // wall-clock time, so it keeps the PEAK figures: an over-estimate is the
+    // honest direction for a cost estimate, and rule 5 of the catalogue policy
+    // allows a clearly-labelled conservative approximation but never an invented
+    // number. Cache-miss input; cache hits are ~1/50th and not modelled here.
     'deepseek-v4-pro': { inputPer1M: 0.435, outputPer1M: 0.87 },
     'deepseek-v4-flash': { inputPer1M: 0.14, outputPer1M: 0.28 },
     // Google
@@ -274,9 +280,20 @@ export function getCacheStats() {
     let cacheCreate = 0;
     let cacheRead = 0;
     let savings = 0;
+    let flatFeeCached = 0;
+    let meteredCached = 0;
     for (const record of currentRecords()) {
+        const cached = (record.cacheCreationTokens ?? 0) + (record.cacheReadTokens ?? 0);
         cacheCreate += record.cacheCreationTokens ?? 0;
         cacheRead += record.cacheReadTokens ?? 0;
+        // A plan bills a flat fee, so caching saves latency but not money — pricing
+        // its cached tokens would invent a dollar figure the same way the per-model
+        // cost lines used to. Count the tokens (measured), skip the arithmetic.
+        if (isFlatFeeProvider(record.provider)) {
+            flatFeeCached += cached;
+            continue;
+        }
+        meteredCached += cached;
         // Savings = what cache-read tokens would have cost at full input rate,
         // minus what they actually cost at 0.1×. (Cache creation is a slight
         // *penalty* of 0.25× — netted in for honest reporting.)
@@ -287,7 +304,13 @@ export function getCacheStats() {
             savings += cReadSaved - cCreateCost;
         }
     }
-    return { cacheCreationTokens: cacheCreate, cacheReadTokens: cacheRead, estimatedSavingsUsd: Math.max(0, savings) };
+    return {
+        cacheCreationTokens: cacheCreate,
+        cacheReadTokens: cacheRead,
+        estimatedSavingsUsd: Math.max(0, savings),
+        hasFlatFeeCacheUsage: flatFeeCached > 0,
+        isEntirelyFlatFeeCache: flatFeeCached > 0 && meteredCached === 0,
+    };
 }
 /**
  * Get session stats
@@ -395,12 +418,22 @@ export function formatCostReport() {
     const cache = getCacheStats();
     if (cache.cacheReadTokens > 0 || cache.cacheCreationTokens > 0) {
         lines.push('', '### Prompt caching');
-        lines.push(`**Cache reads:** ${formatTokenCount(cache.cacheReadTokens)} tokens (billed at 0.1× input rate)`);
+        // The billing multipliers only describe a metered account. On a plan
+        // nothing is billed per token, so quoting a rate there would be as invented
+        // as the per-model prices this report already refuses to show.
+        const readNote = cache.isEntirelyFlatFeeCache ? '' : ' (billed at 0.1× input rate)';
+        const writeNote = cache.isEntirelyFlatFeeCache ? '' : ' (billed at 1.25× input rate)';
+        lines.push(`**Cache reads:** ${formatTokenCount(cache.cacheReadTokens)} tokens${readNote}`);
         if (cache.cacheCreationTokens > 0) {
-            lines.push(`**Cache writes:** ${formatTokenCount(cache.cacheCreationTokens)} tokens (billed at 1.25× input rate)`);
+            lines.push(`**Cache writes:** ${formatTokenCount(cache.cacheCreationTokens)} tokens${writeNote}`);
+        }
+        if (cache.isEntirelyFlatFeeCache) {
+            lines.push('**Savings:** caching saves latency, not money — this session is on a plan');
         }
-        if (cache.estimatedSavingsUsd > 0) {
-            lines.push(`**Estimated savings vs no caching:** $${cache.estimatedSavingsUsd.toFixed(4)}`);
+        else if (cache.estimatedSavingsUsd > 0) {
+            // Name the partial coverage rather than letting one figure look total.
+            const scope = cache.hasFlatFeeCacheUsage ? ' (pay-per-use models only)' : '';
+            lines.push(`**Estimated savings vs no caching:** $${cache.estimatedSavingsUsd.toFixed(4)}${scope}`);
         }
     }
     lines.push('', ...formatResourceImpactReport(stats.totalTokens));

package/dist/utils/toolExecution.d.ts

@@ -7,6 +7,7 @@
  * createActionLog() converts a ToolCall+ToolResult into a history ActionLog.
  */
 import { ToolCall, ToolResult, ActionLog } from './tools';
+export { isBlockedIp, assertFetchUrlAllowed } from './ssrfGuard';
 /**
  * Validate path is within project root.
  * Uses realpathSync to resolve symlinks, preventing symlink traversal attacks