codeep 2.18.1 → 2.20.0

package/dist/utils/toolExecution.js

@@ -6,8 +6,8 @@
  * listDirectory() and htmlToText() are private helpers.
  * createActionLog() converts a ToolCall+ToolResult into a history ActionLog.
  */
-import { existsSync, readdirSync, statSync, readFileSync, writeFileSync, unlinkSync, mkdirSync, rmSync, realpathSync } from 'fs';
-import { join, dirname, relative, resolve, isAbsolute } from 'path';
+import { existsSync, readdirSync, statSync, lstatSync, readFileSync, writeFileSync, unlinkSync, mkdirSync, rmSync, realpathSync } from 'fs';
+import { join, dirname, relative, resolve, isAbsolute, sep } from 'path';
 import { executeCommandAsync } from './shell.js';
 import { recordWrite, recordEdit, recordDelete, recordMkdir, recordCommand } from './history.js';
 import { loadIgnoreRules, isIgnored } from './gitignore.js';
@@ -15,83 +15,13 @@ import { normalizeToolName } from './toolParsing.js';
 import { getZaiMcpConfig, getZaiVisionConfig, getMinimaxMcpConfig, callZaiMcp, callZaiVisionApi, callMinimaxApi } from './mcpIntegration.js';
 import { logger } from './logger.js';
 import { runHook } from './hooks.js';
+import { checkCommandRateLimit } from './ratelimit.js';
 import { isMcpToolName, callSessionTool, isVirtualMcpToolName, callSessionVirtualTool } from './mcpRegistry.js';
-import { lookup as dnsLookup } from 'dns/promises';
-/**
- * SSRF guard for the agent's `fetch_url` tool. The URL there comes from model
- * output / page content (untrusted, prompt-injectable), so the agent must not
- * be able to reach internal services or the cloud metadata endpoint
- * (169.254.169.254). NOTE: this does NOT apply to user-configured provider
- * base URLs (Ollama localhost, custom vLLM/Tailscale endpoints) — those are
- * trusted config and never routed through fetch_url.
- */
-function isBlockedIp(ip) {
-    const s = ip.trim().toLowerCase();
-    if (s.includes(':')) {
-        // IPv6
-        if (s === '::1' || s === '::')
-            return true; // loopback / unspecified
-        if (s.startsWith('fe80') || s.startsWith('fc') || s.startsWith('fd'))
-            return true; // link-local / ULA
-        const mapped = s.match(/::ffff:(\d+\.\d+\.\d+\.\d+)$/); // IPv4-mapped
-        if (mapped)
-            return isBlockedIp(mapped[1]);
-        return false;
-    }
-    const parts = s.split('.').map(Number);
-    if (parts.length !== 4 || parts.some((n) => Number.isNaN(n) || n < 0 || n > 255))
-        return false;
-    const [a, b] = parts;
-    if (a === 127)
-        return true; // loopback
-    if (a === 10)
-        return true; // RFC1918
-    if (a === 172 && b >= 16 && b <= 31)
-        return true; // RFC1918
-    if (a === 192 && b === 168)
-        return true; // RFC1918
-    if (a === 169 && b === 254)
-        return true; // link-local incl. metadata 169.254.169.254
-    if (a === 0)
-        return true; // 0.0.0.0/8
-    return false;
-}
-/** Returns an error string if the URL must not be fetched, else null. */
-async function assertFetchUrlAllowed(rawUrl) {
-    let u;
-    try {
-        u = new URL(rawUrl);
-    }
-    catch {
-        return 'Invalid URL format';
-    }
-    if (u.protocol !== 'http:' && u.protocol !== 'https:') {
-        return `Blocked: only http/https URLs can be fetched (got "${u.protocol}")`;
-    }
-    const host = u.hostname.replace(/^\[|\]$/g, ''); // strip IPv6 brackets
-    if (host === 'localhost' || host.endsWith('.localhost')) {
-        return 'Blocked: localhost is not fetchable by the agent';
-    }
-    if (/^[0-9.]+$/.test(host) || host.includes(':')) {
-        // Literal IP — check directly.
-        if (isBlockedIp(host))
-            return `Blocked: ${host} is a private/loopback/link-local address`;
-        return null;
-    }
-    // Resolve and check every address (catches internal hostnames + single-record rebinding).
-    try {
-        const addrs = await dnsLookup(host, { all: true });
-        for (const a of addrs) {
-            if (isBlockedIp(a.address)) {
-                return `Blocked: ${host} resolves to a private/internal address (${a.address})`;
-            }
-        }
-    }
-    catch {
-        // DNS failure — let curl attempt and fail naturally; not an SSRF risk.
-    }
-    return null;
-}
+// SSRF guard (isBlockedIp / assertFetchUrlAllowed) moved to ./ssrfGuard —
+// shared with shell.ts for curl/wget URL checks. Re-exported here so the
+// existing tests that import it from toolExecution keep working.
+export { isBlockedIp, assertFetchUrlAllowed } from './ssrfGuard.js';
+import { assertFetchUrlAllowed } from './ssrfGuard.js';
 const debug = (...args) => {
     if (process.env.CODEEP_DEBUG === '1') {
         logger.debug(args.map(String).join(' '));
@@ -115,20 +45,37 @@ export function validatePath(path, projectRoot) {
     if (relativePath.startsWith('..')) {
         return { valid: false, absolutePath, error: `Path '${path}' is outside project directory` };
     }
-    // Resolve symlinks to prevent traversal attacks (only if path exists)
-    if (existsSync(absolutePath)) {
-        try {
-            const realPath = realpathSync(absolutePath);
-            const realRoot = realpathSync(projectRoot);
-            if (!realPath.startsWith(realRoot + '/') && realPath !== realRoot) {
-                return { valid: false, absolutePath, error: `Path '${path}' resolves outside project directory (symlink traversal)` };
+    // Resolve the deepest existing ancestor, not only the complete target. A
+    // write to `project/link-to-outside/new.txt` has a non-existent leaf, but
+    // still follows the existing symlinked parent. lstat is intentional: unlike
+    // existsSync it also sees a broken symlink, which must fail closed rather
+    // than be followed by writeFileSync.
+    try {
+        const realRoot = realpathSync(projectRoot);
+        let existingAncestor = absolutePath;
+        while (true) {
+            try {
+                lstatSync(existingAncestor);
+                break;
+            }
+            catch {
+                const parent = dirname(existingAncestor);
+                if (parent === existingAncestor) {
+                    return { valid: false, absolutePath, error: `Path '${path}' could not be resolved` };
+                }
+                existingAncestor = parent;
             }
         }
-        catch {
-            // realpathSync can fail on broken symlinks — treat as invalid
-            return { valid: false, absolutePath, error: `Path '${path}' could not be resolved` };
+        const realAncestor = realpathSync(existingAncestor);
+        const ancestorRelative = relative(realRoot, realAncestor);
+        if (ancestorRelative === '..' || ancestorRelative.startsWith(`..${sep}`) || isAbsolute(ancestorRelative)) {
+            return { valid: false, absolutePath, error: `Path '${path}' resolves outside project directory (symlink traversal)` };
         }
     }
+    catch {
+        // realpathSync fails for broken symlinks and inaccessible ancestors.
+        return { valid: false, absolutePath, error: `Path '${path}' could not be resolved` };
+    }
     return { valid: true, absolutePath };
 }
 /**
@@ -145,6 +92,11 @@ function listDirectory(dir, projectRoot, recursive, prefix = '', ignoreRules, vi
             continue;
         if (entry.isDirectory() || entry.isSymbolicLink()) {
             try {
+                // Recursive listing must not follow an in-workspace symlink into an
+                // external directory. Top-level paths already pass validatePath, but
+                // each discovered symlink needs the same boundary check.
+                if (entry.isSymbolicLink() && !validatePath(fullPath, projectRoot).valid)
+                    continue;
                 const st = statSync(fullPath); // follows symlinks
                 if (st.isDirectory()) {
                     if (visitedInodes.has(st.ino))
@@ -533,6 +485,14 @@ async function dispatchTool(tool, parameters, projectRoot, fs, toolCall) {
                 const args = parameters.args || [];
                 if (!command)
                     return { success: false, output: '', error: 'Missing required parameter: command', tool, parameters };
+                // Command throttle — guards against agent loops that spawn commands
+                // every iteration (each can be up to 2 minutes of subprocess time).
+                // Rate-limited *after* permission resolution: an allowed command
+                // consumes budget, a denied one never reaches here.
+                const cmdRate = checkCommandRateLimit();
+                if (!cmdRate.allowed) {
+                    return { success: false, output: '', error: cmdRate.message || 'Command rate limit exceeded', tool, parameters };
+                }
                 recordCommand(command, args);
                 const result = await executeCommandAsync(command, args, {
                     cwd: projectRoot,

package/dist/utils/tools.d.ts

@@ -328,16 +328,16 @@ export interface AdditionalToolDef {
  * Optionally appends an "Additional tools" section listing tools from
  * sources outside the built-in catalog (currently MCP servers).
  */
-export declare function formatToolDefinitions(additionalTools?: AdditionalToolDef[]): string;
+export declare function formatToolDefinitions(additionalTools?: AdditionalToolDef[], allowedToolNames?: ReadonlySet<string>): string;
 /**
  * Get tools in OpenAI Function Calling format.
  * Additional tools (e.g. MCP) are appended with their JSON-schema as-is.
  */
-export declare function getOpenAITools(additionalTools?: AdditionalToolDef[]): OpenAITool[];
+export declare function getOpenAITools(additionalTools?: AdditionalToolDef[], allowedToolNames?: ReadonlySet<string>): OpenAITool[];
 /**
  * Get tools in Anthropic Tool Use format.
  * Additional tools (e.g. MCP) are appended with their JSON-schema as-is.
  */
-export declare function getAnthropicTools(additionalTools?: AdditionalToolDef[]): AnthropicTool[];
+export declare function getAnthropicTools(additionalTools?: AdditionalToolDef[], allowedToolNames?: ReadonlySet<string>): AnthropicTool[];
 export { normalizeToolName, parseOpenAIToolCalls, parseAnthropicToolCalls, parseToolCalls } from './toolParsing';
 export { executeTool, validatePath, createActionLog } from './toolExecution';

package/dist/utils/tools.js

@@ -140,11 +140,13 @@ export const AGENT_TOOLS = {
 /**
  * Get filtered tool entries (excludes provider-specific tools when API key not available)
  */
-function getFilteredToolEntries() {
+function getFilteredToolEntries(allowedToolNames) {
     const hasMcp = hasZaiMcpAccess();
     const hasZaiVision = hasZaiVisionAccess();
     const hasMinimaxMcp = hasMinimaxMcpAccess();
     return Object.entries(AGENT_TOOLS).filter(([name]) => {
+        if (allowedToolNames && !allowedToolNames.has(name))
+            return false;
         if (ZAI_MCP_TOOLS.includes(name))
             return hasMcp;
         if (ZAI_VISION_TOOLS.includes(name))
@@ -159,9 +161,9 @@ function getFilteredToolEntries() {
  * Optionally appends an "Additional tools" section listing tools from
  * sources outside the built-in catalog (currently MCP servers).
  */
-export function formatToolDefinitions(additionalTools) {
+export function formatToolDefinitions(additionalTools, allowedToolNames) {
     const lines = [];
-    for (const [name, tool] of getFilteredToolEntries()) {
+    for (const [name, tool] of getFilteredToolEntries(allowedToolNames)) {
         lines.push(`### ${name}`);
         lines.push(tool.description);
         lines.push('Parameters:');
@@ -171,7 +173,8 @@ export function formatToolDefinitions(additionalTools) {
         }
         lines.push('');
     }
-    if (additionalTools?.length) {
+    const allowedAdditionalTools = additionalTools?.filter(tool => !allowedToolNames || allowedToolNames.has(tool.name));
+    if (allowedAdditionalTools?.length) {
         // Token budget caps. MCP servers can return tools with absurdly verbose
         // JSON Schema definitions (multi-KB per tool). Without caps a 30-tool
         // server eats ~10K tokens of every prompt. Per-tool 2KB + total 16KB
@@ -183,7 +186,7 @@ export function formatToolDefinitions(additionalTools) {
         let skipped = 0;
         lines.push('## Additional tools (from MCP servers)');
         lines.push('');
-        for (const tool of additionalTools) {
+        for (const tool of allowedAdditionalTools) {
             if (budget <= 0) {
                 skipped++;
                 continue;
@@ -227,8 +230,8 @@ function additionalToolSchema(tool) {
  * Get tools in OpenAI Function Calling format.
  * Additional tools (e.g. MCP) are appended with their JSON-schema as-is.
  */
-export function getOpenAITools(additionalTools) {
-    const builtin = getFilteredToolEntries().map(([name, tool]) => {
+export function getOpenAITools(additionalTools, allowedToolNames) {
+    const builtin = getFilteredToolEntries(allowedToolNames).map(([name, tool]) => {
         const properties = {};
         const required = [];
         for (const [param, info] of Object.entries(tool.parameters)) {
@@ -251,9 +254,10 @@ export function getOpenAITools(additionalTools) {
             },
         };
     });
-    if (!additionalTools?.length)
+    const allowedAdditionalTools = additionalTools?.filter(tool => !allowedToolNames || allowedToolNames.has(tool.name));
+    if (!allowedAdditionalTools?.length)
         return builtin;
-    const extra = additionalTools.map(t => ({
+    const extra = allowedAdditionalTools.map(t => ({
         type: 'function',
         function: {
             name: t.name,
@@ -269,8 +273,8 @@ export function getOpenAITools(additionalTools) {
  * Get tools in Anthropic Tool Use format.
  * Additional tools (e.g. MCP) are appended with their JSON-schema as-is.
  */
-export function getAnthropicTools(additionalTools) {
-    const builtin = getFilteredToolEntries().map(([name, tool]) => {
+export function getAnthropicTools(additionalTools, allowedToolNames) {
+    const builtin = getFilteredToolEntries(allowedToolNames).map(([name, tool]) => {
         const properties = {};
         const required = [];
         for (const [param, info] of Object.entries(tool.parameters)) {
@@ -290,9 +294,10 @@ export function getAnthropicTools(additionalTools) {
             input_schema: { type: 'object', properties, required },
         };
     });
-    if (!additionalTools?.length)
+    const allowedAdditionalTools = additionalTools?.filter(tool => !allowedToolNames || allowedToolNames.has(tool.name));
+    if (!allowedAdditionalTools?.length)
         return builtin;
-    const extra = additionalTools.map(t => ({
+    const extra = allowedAdditionalTools.map(t => ({
         name: t.name,
         description: t.description ?? `External tool: ${t.name}`,
         input_schema: additionalToolSchema(t),

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const VERSION = "2.18.1";
+export declare const VERSION = "2.20.0";

package/dist/version.js

@@ -1,4 +1,4 @@
 // AUTO-GENERATED by scripts/gen-version.js — do not edit by hand.
 // Baked from package.json at build time so the bun-compiled binary reports
 // the right version (it has no package.json on disk to read at runtime).
-export const VERSION = '2.18.1';
+export const VERSION = '2.20.0';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeep",
-  "version": "2.18.1",
+  "version": "2.20.0",
   "description": "AI-powered coding assistant built for the terminal. Multiple LLM providers, project-aware context, and a seamless development workflow.",
   "type": "module",
   "main": "dist/index.js",