codeep 2.18.1 → 2.20.0

package/dist/utils/agentChat.js

@@ -23,6 +23,8 @@ import { recordTokenUsage, extractOpenAIUsage, extractAnthropicUsage } from './t
 import { parseOpenAIToolCalls, parseAnthropicToolCalls, parseToolCalls } from './toolParsing.js';
 import { formatToolDefinitions, getOpenAITools, getAnthropicTools } from './tools.js';
 import { readOpenRouterPreferences } from './openrouterPrefs.js';
+import { checkApiRateLimit } from './ratelimit.js';
+import { ApiError } from '../api/index.js';
 import { handleStream, handleOpenAIAgentStream, handleAnthropicAgentStream } from './agentStream.js';
 import { logger } from './logger.js';
 const debug = (...args) => {
@@ -282,21 +284,24 @@ export async function summarizeEarlierHistory(history, maxChars = 16000) {
         return ''; // graceful — recent verbatim history still gets injected
     }
 }
-export function getAgentSystemPrompt(projectContext) {
+export function getAgentSystemPrompt(projectContext, runtime) {
     const root = projectContext.root || process.cwd();
     // State the real underlying model/provider so "which model are you"
     // gets a truthful answer instead of a hallucinated one.
-    const model = String(config.get('model') || '');
-    const providerId = String(config.get('provider') || '');
+    const model = String(runtime?.model || config.get('model') || '');
+    const providerId = String(runtime?.providerId || config.get('provider') || '');
     const identity = model
         ? `You are Codeep, an autonomous AI coding agent operating inside this project. The underlying model is \`${model}\` (via ${providerId}). If asked which model or provider you are, answer truthfully with these details. Never claim to be Claude or any other model unless that is genuinely the configured model.`
         : `You are Codeep, an autonomous AI coding agent operating inside this project. Never refer to yourself as Claude or any other AI unless that is genuinely the configured model.`;
+    const toolInstructions = runtime?.allowedToolNames !== undefined
+        ? `This run has an enforced tool allowlist. Only these tools may be used: ${runtime.allowedToolNames.length ? runtime.allowedToolNames.slice(0, 50).join(', ') : '(none)'}. Do not request or claim access to any other tool.`
+        : `- read_file / write_file / edit_file / delete_file — file ops (prefer edit_file for modifications to keep surrounding content intact)
+- create_directory / list_files / search_code — project navigation
+- execute_command — ONLY for package managers & version control: npm, yarn, pnpm, bun, git, composer, pip, cargo, go, make. Never for ls/cat/grep/mkdir/rm/cp/mv/touch — use the dedicated tools.`;
     return `${identity}
 
 ## Tools
-- read_file / write_file / edit_file / delete_file — file ops (prefer edit_file for modifications to keep surrounding content intact)
-- create_directory / list_files / search_code — project navigation
-- execute_command — ONLY for package managers & version control: npm, yarn, pnpm, bun, git, composer, pip, cargo, go, make. Never for ls/cat/grep/mkdir/rm/cp/mv/touch — use the dedicated tools.
+${toolInstructions}
 
 ## Behavior
 - Do what the user asked — in whatever language they wrote. Tool names stay English.
@@ -332,8 +337,9 @@ ${projectContext.structure ? `\n## Project Structure\n${projectContext.structure
         return intelligence ? `\n\n${generateContextFromIntelligence(intelligence)}` : '';
     })()}`;
 }
-export function getFallbackSystemPrompt(projectContext, additionalTools) {
-    return getAgentSystemPrompt(projectContext) + '\n\n' + formatToolDefinitions(additionalTools);
+export function getFallbackSystemPrompt(projectContext, additionalTools, runtime) {
+    const allowed = runtime?.allowedToolNames ? new Set(runtime.allowedToolNames) : undefined;
+    return getAgentSystemPrompt(projectContext, runtime) + '\n\n' + formatToolDefinitions(additionalTools, allowed);
 }
 /**
  * Make a chat API call for agent mode with native tool support.
@@ -346,17 +352,29 @@ export async function agentChat(messages, systemPrompt, onChunk, abortSignal, dy
  * invoke). Optional — built-in tools work the same whether this is
  * omitted or an empty array.
  */
-additionalTools) {
-    const protocol = config.get('protocol');
-    const model = config.get('model');
-    const providerId = config.get('provider');
-    const apiKey = getApiKey() || (isNoApiKeyProvider(providerId) ? 'ollama' : null);
+additionalTools, runtime) {
+    const protocol = runtime?.protocol ?? config.get('protocol');
+    const model = runtime?.model ?? config.get('model');
+    const providerId = runtime?.providerId ?? config.get('provider');
+    const apiKey = getApiKey(providerId) || (isNoApiKeyProvider(providerId) ? 'ollama' : null);
+    const allowedTools = runtime?.allowedToolNames ? new Set(runtime.allowedToolNames) : undefined;
     let baseUrl = resolveBaseUrl(providerId, protocol);
     const authHeader = getProviderAuthHeader(providerId, protocol);
     if (!baseUrl)
         throw new Error(`Provider ${providerId} does not support ${protocol} protocol`);
+    // Global API throttle — same choke point as api/chat(). Checked here so
+    // the agent loop (which can run up to agentMaxIterations iterations, each
+    // with its own API call) is rate-limited even when it never routes
+    // through api/chat(). Bypassed for no-key local providers (Ollama) —
+    // there is no quota to protect on localhost.
+    if (!isNoApiKeyProvider(providerId)) {
+        const rateCheck = checkApiRateLimit();
+        if (!rateCheck.allowed) {
+            throw new ApiError(rateCheck.message || 'API rate limit exceeded', 429);
+        }
+    }
     if (!supportsNativeTools(providerId, protocol)) {
-        return await agentChatFallback(messages, systemPrompt, onChunk, abortSignal);
+        return await agentChatFallback(messages, systemPrompt, onChunk, abortSignal, dynamicTimeout, additionalTools, runtime);
     }
     const controller = new AbortController();
     const timeoutMs = dynamicTimeout || config.get('apiTimeout');
@@ -427,7 +445,7 @@ additionalTools) {
                     model,
                     messages: [],
                     rawMessages: [{ role: 'system', content: systemPrompt }, ...messages],
-                    tools: getOpenAITools(additionalTools),
+                    tools: getOpenAITools(additionalTools, allowedTools),
                     numCtx,
                     keepAlive: config.get('ollamaKeepAlive') || undefined,
                     temperature: requiresDefaultTemperature(providerId) ? undefined : Number(config.get('temperature')),
@@ -447,7 +465,7 @@ additionalTools) {
             }
             body = {
                 model, messages: [{ role: 'system', content: systemPrompt }, ...messages],
-                tools: getOpenAITools(additionalTools), tool_choice: 'auto', stream: useStreaming,
+                tools: getOpenAITools(additionalTools, allowedTools), tool_choice: 'auto', stream: useStreaming,
                 ...tempParam, ...tokParam, ...reasoningParam,
                 // Ask ALL OpenAI-compatible providers to emit a usage block in the
                 // stream — without this most (DeepSeek/Kimi/Grok/Qwen/GLM/…) send no
@@ -466,7 +484,7 @@ additionalTools) {
             // Cache hits cost 0.1× input. Misses ("cache creation") cost 1.25×.
             // Net win after the 2nd same-shape request. Below 1024 input tokens
             // Anthropic silently skips caching — no error path to handle.
-            const anthropicTools = getAnthropicTools(additionalTools);
+            const anthropicTools = getAnthropicTools(additionalTools, allowedTools);
             const cachedTools = anthropicTools.length > 0
                 ? [
                     ...anthropicTools.slice(0, -1),
@@ -487,7 +505,7 @@ additionalTools) {
         if (!response.ok) {
             const errorText = await response.text();
             if (errorText.includes('tools') || errorText.includes('function') || response.status === 400) {
-                return await agentChatFallback(messages, systemPrompt, onChunk, abortSignal);
+                return await agentChatFallback(messages, systemPrompt, onChunk, abortSignal, dynamicTimeout, additionalTools, runtime);
             }
             throw new Error(`API error: ${response.status} - ${errorText}`);
         }
@@ -546,7 +564,7 @@ additionalTools) {
             throw error;
         }
         if (err.message.includes('tools') || err.message.includes('function')) {
-            return await agentChatFallback(messages, systemPrompt, onChunk, abortSignal);
+            return await agentChatFallback(messages, systemPrompt, onChunk, abortSignal, dynamicTimeout, additionalTools, runtime);
         }
         throw error;
     }
@@ -559,15 +577,25 @@ additionalTools) {
 /**
  * Fallback chat without native tools (text-based tool format)
  */
-export async function agentChatFallback(messages, systemPrompt, onChunk, abortSignal, dynamicTimeout) {
-    const protocol = config.get('protocol');
-    const model = config.get('model');
-    const providerId = config.get('provider');
-    const apiKey = getApiKey() || (isNoApiKeyProvider(providerId) ? 'ollama' : null);
+export async function agentChatFallback(messages, systemPrompt, onChunk, abortSignal, dynamicTimeout, additionalTools, runtime) {
+    const protocol = runtime?.protocol ?? config.get('protocol');
+    const model = runtime?.model ?? config.get('model');
+    const providerId = runtime?.providerId ?? config.get('provider');
+    const apiKey = getApiKey(providerId) || (isNoApiKeyProvider(providerId) ? 'ollama' : null);
+    const allowedTools = runtime?.allowedToolNames ? new Set(runtime.allowedToolNames) : undefined;
     let baseUrl = resolveBaseUrl(providerId, protocol);
     const authHeader = getProviderAuthHeader(providerId, protocol);
     if (!baseUrl)
         throw new Error(`Provider ${providerId} does not support ${protocol} protocol`);
+    // See rate-limit note in agentChat above — same choke point, same local-
+    // provider bypass. This path runs when the provider has no native tool
+    // support, so it's reached directly (not via agentChat's early return).
+    if (!isNoApiKeyProvider(providerId)) {
+        const rateCheck = checkApiRateLimit();
+        if (!rateCheck.allowed) {
+            throw new ApiError(rateCheck.message || 'API rate limit exceeded', 429);
+        }
+    }
     const controller = new AbortController();
     const timeoutMs = dynamicTimeout || config.get('apiTimeout');
     let isTimeout = false;
@@ -589,7 +617,7 @@ export async function agentChatFallback(messages, systemPrompt, onChunk, abortSi
         headers['anthropic-version'] = '2023-06-01';
     const fallbackPrompt = systemPrompt.includes('## Available Tools')
         ? systemPrompt
-        : systemPrompt + '\n\n' + formatToolDefinitions();
+        : systemPrompt + '\n\n' + formatToolDefinitions(additionalTools, allowedTools);
     try {
         let endpoint;
         let body;

package/dist/utils/codeepCloud.d.ts

@@ -84,7 +84,9 @@ declare function readFileBundle(kind: 'personalities' | 'commands'): Record<stri
  *  files. Only writes files that don't already exist (additive merge —
  *  never clobber local edits). Returns the count of newly written files. */
 declare function writeFileBundle(kind: 'personalities' | 'commands', items: Record<string, string>): number;
+declare function writePulledPersonalityBundle(items: Record<string, string>): number;
 export declare const pullPersonalities: () => Promise<number | null>;
+export declare const getLastPersonalityPullBackupCount: () => number;
 export declare const pushPersonalities: () => Promise<number | null>;
 export declare const pullCommands: () => Promise<number | null>;
 export declare const pushCommands: () => Promise<number | null>;
@@ -181,4 +183,5 @@ export declare function syncMemoryNotes(projectName: string, notes: string[]): P
 export declare const _globalDirForTest: typeof globalDir;
 export declare const _readFileBundleForTest: typeof readFileBundle;
 export declare const _writeFileBundleForTest: typeof writeFileBundle;
+export declare const _writePulledPersonalityBundleForTest: typeof writePulledPersonalityBundle;
 export {};

package/dist/utils/codeepCloud.js

@@ -241,11 +241,11 @@ export async function purgeKeys() {
 //
 // Both are name → raw-.md-body bundles stored in a global dir
 // (~/.codeep/personalities, ~/.codeep/commands). The sync is bidirectional
-// and merge-based: pull writes any remote file not present locally; push
-// sends every local file. Last-write-wins on the server via upsert. We
-// never delete locally on pull — additive only, so a sync can't nuke
-// work you haven't pushed.
-import { readFileSync, readdirSync, existsSync, mkdirSync, writeFileSync } from 'fs';
+// and merge-based. Personality pulls are cloud-authoritative because the web
+// builder edits the cloud copy: changed local files are backed up before the
+// remote body replaces them. Commands retain the older additive-only merge.
+// Pull never deletes a local file that disappeared from the server.
+import { readFileSync, readdirSync, existsSync, mkdirSync, writeFileSync, renameSync, unlinkSync } from 'fs';
 import { join } from 'path';
 import { homedir } from 'os';
 function globalDir(kind) {
@@ -284,7 +284,7 @@ function writeFileBundle(kind, items) {
         mkdirSync(dir, { recursive: true });
     let written = 0;
     for (const [name, body] of Object.entries(items)) {
-        if (!/^[a-z0-9][a-z0-9-]*$/.test(name) || name.length > 64 || typeof body !== 'string' || !body)
+        if (!/^[a-z0-9][a-z0-9-]*$/.test(name) || name.length > 64 || typeof body !== 'string' || !body || body.length > 64 * 1024)
             continue;
         const filePath = join(dir, `${name}.md`);
         if (existsSync(filePath))
@@ -297,6 +297,57 @@ function writeFileBundle(kind, items) {
     }
     return written;
 }
+/** Apply a cloud personality bundle. Updated bodies replace the active local
+ * file so web edits actually take effect, but every divergent local body is
+ * first copied to ~/.codeep/backups/personalities/. */
+let lastPersonalityPullBackupCount = 0;
+function writePulledPersonalityBundle(items) {
+    lastPersonalityPullBackupCount = 0;
+    const dir = globalDir('personalities');
+    if (!existsSync(dir))
+        mkdirSync(dir, { recursive: true });
+    let written = 0;
+    for (const [name, body] of Object.entries(items)) {
+        if (!/^[a-z0-9][a-z0-9-]*$/.test(name) || name.length > 64 || typeof body !== 'string' || !body || body.length > 64 * 1024)
+            continue;
+        const filePath = join(dir, `${name}.md`);
+        let tempPath = '';
+        try {
+            if (existsSync(filePath)) {
+                const local = readFileSync(filePath, 'utf8');
+                if (local === body)
+                    continue;
+                const backupDir = join(homedir(), '.codeep', 'backups', 'personalities');
+                if (!existsSync(backupDir))
+                    mkdirSync(backupDir, { recursive: true });
+                let suffix = new Date().toISOString().replace(/[:.]/g, '-');
+                let backupPath = join(backupDir, `${name}-${suffix}.md`);
+                let collision = 1;
+                while (existsSync(backupPath)) {
+                    backupPath = join(backupDir, `${name}-${suffix}-${collision++}.md`);
+                }
+                writeFileSync(backupPath, local);
+                lastPersonalityPullBackupCount++;
+            }
+            // Same-directory rename is atomic on supported local filesystems: a
+            // crash cannot leave a half-written active personality.
+            tempPath = join(dir, `.${name}.${process.pid}.${randomBytes(4).toString('hex')}.tmp`);
+            writeFileSync(tempPath, body);
+            renameSync(tempPath, filePath);
+            written++;
+        }
+        catch {
+            // A backup/write failure leaves the existing active file untouched.
+            if (tempPath && existsSync(tempPath)) {
+                try {
+                    unlinkSync(tempPath);
+                }
+                catch { /* best effort temp cleanup */ }
+            }
+        }
+    }
+    return written;
+}
 async function pullBundle(kind) {
     const syncToken = getSyncToken();
     if (!syncToken)
@@ -308,7 +359,9 @@ async function pullBundle(kind) {
         const data = await res.json();
         if (!data.ok)
             return null;
-        return writeFileBundle(kind, data.items ?? {});
+        return kind === 'personalities'
+            ? writePulledPersonalityBundle(data.items ?? {})
+            : writeFileBundle(kind, data.items ?? {});
     }
     catch {
         return null;
@@ -330,6 +383,7 @@ async function pushBundle(kind) {
     return res?.ok ? count : null;
 }
 export const pullPersonalities = () => pullBundle('personalities');
+export const getLastPersonalityPullBackupCount = () => lastPersonalityPullBackupCount;
 export const pushPersonalities = () => pushBundle('personalities');
 export const pullCommands = () => pullBundle('commands');
 export const pushCommands = () => pushBundle('commands');
@@ -644,3 +698,4 @@ async function fetchWithRetry(url, options, maxRetries = 2) {
 export const _globalDirForTest = globalDir;
 export const _readFileBundleForTest = readFileBundle;
 export const _writeFileBundleForTest = writeFileBundle;
+export const _writePulledPersonalityBundleForTest = writePulledPersonalityBundle;

package/dist/utils/personalities.d.ts

@@ -10,13 +10,21 @@
  *
  * Project shadows global shadows built-in, by name.
  *
- * File format (project / global):
+ * File format (project / global): legacy prompt-only Markdown remains valid;
+ * structured custom bots add a small versioned frontmatter block:
  *   ```
- *   # Personality: Concise Reviewer
- *   <free-form Markdown body — gets appended to system prompt verbatim>
+ *   ---
+ *   codeep: custom-bot/v1
+ *   model: automatic
+ *   tools: [files, tests, git]
+ *   scope: all
+ *   projects: []
+ *   ---
+ *   # Concise Reviewer
+ *   <behavior sections — appended to the system prompt>
  *   ```
- * (The first H1 line is parsed as the display name; everything else is
- * the prompt body.)
+ * The first H1 is the display name. Tools/model/scope are enforced only for
+ * structured files; old files stay unrestricted.
  *
  * Activation:
  *   - `config.activePersonality` holds the active name (or null/undefined
@@ -26,7 +34,15 @@
  *     personality is active.
  *   - Persists across sessions until cleared with `/personality off`.
  */
+import type { ToolCall } from './tools.js';
 export type PersonalityScope = 'builtin' | 'project' | 'global';
+export type PersonalityCapability = 'files' | 'terminal' | 'tests' | 'git' | 'web' | 'mcp';
+export type PersonalityProjectScope = 'all' | 'selected' | 'personal' | 'unspecified';
+export interface PersonalityRuntimeModel {
+    providerId: string;
+    model: string;
+    protocol: 'openai' | 'anthropic';
+}
 export interface Personality {
     /** Slug (filename without .md, or built-in id). Lowercase, hyphens. */
     name: string;
@@ -37,9 +53,50 @@ export interface Personality {
     /** Markdown body appended to the system prompt when active. */
     prompt: string;
     scope: PersonalityScope;
+    /** True for `custom-bot/v1` files and the previous web section format. */
+    structured?: boolean;
+    /** False when a frontmatter `codeep` schema marker is present but unsupported. */
+    schemaValid?: boolean;
+    /** `automatic` inherits the user's current provider/model for this run. */
+    modelPreference?: string;
+    /** Normalised high-level capabilities selected in the builder. */
+    tools?: PersonalityCapability[];
+    /** Original declared tool values, retained for diagnostics/UI. */
+    declaredTools?: string[];
+    /** True when a structured file explicitly declares Tools, including `[]`. */
+    restrictTools?: boolean;
+    projectScope?: PersonalityProjectScope;
+    /** False when versioned metadata explicitly declares an unknown scope. */
+    scopeValid?: boolean;
+    projects?: string[];
+    responsibility?: string;
+    responseStyle?: string;
+    always?: string[];
+    never?: string[];
+    advancedInstructions?: string;
 }
+/** Whether a structured bot's model field satisfies the portable v1 contract. */
+export declare function isPersonalityModelPreferenceValid(personality: Personality): boolean;
+/** Parse both custom-bot/v1 and the original web builder's heading format. */
+export declare function parsePersonalityMarkdown(raw: string, name: string, scope: PersonalityScope): Personality;
+/**
+ * Scope is enforced against the workspace basename only. This intentionally
+ * avoids accepting arbitrary paths from cloud-authored metadata.
+ */
+export declare function isPersonalityAvailable(personality: Personality, workspaceRoot?: string): boolean;
+/** Concrete tool names that may be advertised for a structured custom bot. */
+export declare function getPersonalityToolAllowlist(personality: Personality, registeredMcpToolNames?: ReadonlySet<string>): string[] | undefined;
+/** Runtime gate. It is deliberately stricter than the prompt/tool catalog. */
+export declare function isPersonalityToolCallAllowed(personality: Personality, toolCall: ToolCall, registeredMcpToolNames?: ReadonlySet<string>): boolean;
+/** Resolve an exact provider/model preference without mutating global config. */
+export declare function resolvePersonalityRuntimeModel(personality: Personality, current: {
+    providerId: string;
+    model: string;
+    protocol: 'openai' | 'anthropic';
+}): PersonalityRuntimeModel | null;
 export declare function loadAllPersonalities(workspaceRoot?: string): Personality[];
 export declare function findPersonality(name: string, workspaceRoot?: string): Personality | null;
+export declare function getActivePersonality(workspaceRoot?: string): Personality | null;
 /**
  * Returns the prompt addendum for the currently active personality, or
  * '' when none is set. Called from agent.ts after the base system prompt
@@ -47,4 +104,5 @@ export declare function findPersonality(name: string, workspaceRoot?: string): P
  * project rules conflict.
  */
 export declare function getActivePersonalityPrompt(workspaceRoot?: string): string;
+export declare function formatPersonalityActivation(personality: Personality): string;
 export declare function formatPersonalityList(workspaceRoot?: string): string;