codeep 2.20.0 → 2.22.0

package/dist/utils/codeepCloud.js

@@ -301,6 +301,52 @@ function writeFileBundle(kind, items) {
  * file so web edits actually take effect, but every divergent local body is
  * first copied to ~/.codeep/backups/personalities/. */
 let lastPersonalityPullBackupCount = 0;
+/** Copy an about-to-be-replaced-or-removed personality into the backup dir.
+ *  Shared so a deletion is backed up by exactly the same rules as an overwrite
+ *  — nothing local is ever lost without a copy first. */
+function backupLocalPersonality(name, body) {
+    const backupDir = join(homedir(), '.codeep', 'backups', 'personalities');
+    if (!existsSync(backupDir))
+        mkdirSync(backupDir, { recursive: true });
+    const suffix = new Date().toISOString().replace(/[:.]/g, '-');
+    let backupPath = join(backupDir, `${name}-${suffix}.md`);
+    let collision = 1;
+    while (existsSync(backupPath)) {
+        backupPath = join(backupDir, `${name}-${suffix}-${collision++}.md`);
+    }
+    writeFileSync(backupPath, body);
+    lastPersonalityPullBackupCount++;
+}
+/** Apply the server's explicit deletion list.
+ *
+ *  Only names the server named. Absence from `items` is deliberately NOT a
+ *  deletion signal: an expired session, the wrong account, or a truncated
+ *  response all yield an empty `items`, and deleting on absence would wipe
+ *  every local agent. Project-scoped agents in `.codeep/personalities/` are
+ *  not cloud-owned and are never touched — only the global directory is.
+ *  Every removal is backed up first, and a failed backup cancels the delete. */
+function applyPersonalityTombstones(deleted) {
+    const dir = globalDir('personalities');
+    if (!existsSync(dir))
+        return 0;
+    let removed = 0;
+    for (const name of deleted) {
+        if (typeof name !== 'string' || !/^[a-z0-9][a-z0-9-]*$/.test(name) || name.length > 64)
+            continue;
+        const filePath = join(dir, `${name}.md`);
+        if (!existsSync(filePath))
+            continue;
+        try {
+            backupLocalPersonality(name, readFileSync(filePath, 'utf8'));
+            unlinkSync(filePath);
+            removed++;
+        }
+        catch {
+            // A failed backup must not become a deletion — leave the file alone.
+        }
+    }
+    return removed;
+}
 function writePulledPersonalityBundle(items) {
     lastPersonalityPullBackupCount = 0;
     const dir = globalDir('personalities');
@@ -317,17 +363,7 @@ function writePulledPersonalityBundle(items) {
                 const local = readFileSync(filePath, 'utf8');
                 if (local === body)
                     continue;
-                const backupDir = join(homedir(), '.codeep', 'backups', 'personalities');
-                if (!existsSync(backupDir))
-                    mkdirSync(backupDir, { recursive: true });
-                let suffix = new Date().toISOString().replace(/[:.]/g, '-');
-                let backupPath = join(backupDir, `${name}-${suffix}.md`);
-                let collision = 1;
-                while (existsSync(backupPath)) {
-                    backupPath = join(backupDir, `${name}-${suffix}-${collision++}.md`);
-                }
-                writeFileSync(backupPath, local);
-                lastPersonalityPullBackupCount++;
+                backupLocalPersonality(name, local);
             }
             // Same-directory rename is atomic on supported local filesystems: a
             // crash cannot leave a half-written active personality.
@@ -348,39 +384,54 @@ function writePulledPersonalityBundle(items) {
     }
     return written;
 }
+export function describeSyncFailure(reason) {
+    switch (reason) {
+        case 'not-linked': return 'not linked to codeep.dev — run: codeep account';
+        case 'unreachable': return "couldn't reach codeep.dev";
+        case 'rejected': return 'codeep.dev refused the request — try signing in again';
+        case 'malformed': return 'codeep.dev sent a response this version cannot read';
+    }
+}
 async function pullBundle(kind) {
     const syncToken = getSyncToken();
     if (!syncToken)
-        return null;
+        return { ok: false, reason: 'not-linked' };
     const res = await fetchWithRetry(`${API_BASE}/api/${kind}`, { headers: { 'x-sync-token': syncToken } });
     if (!res?.ok)
-        return null;
+        return { ok: false, reason: 'unreachable' };
     try {
         const data = await res.json();
         if (!data.ok)
-            return null;
-        return kind === 'personalities'
+            return { ok: false, reason: 'rejected' };
+        const count = kind === 'personalities'
             ? writePulledPersonalityBundle(data.items ?? {})
             : writeFileBundle(kind, data.items ?? {});
+        // A missing `deleted` field means "no deletions" — never "delete
+        // everything". Older servers simply omit it, and a client that treated the
+        // omission as a full tombstone list would empty the user's agent folder.
+        const removed = kind === 'personalities' && Array.isArray(data.deleted)
+            ? applyPersonalityTombstones(data.deleted)
+            : 0;
+        return { ok: true, count, removed };
     }
     catch {
-        return null;
+        return { ok: false, reason: 'malformed' };
     }
 }
 async function pushBundle(kind) {
     const syncToken = getSyncToken();
     if (!syncToken)
-        return null;
+        return { ok: false, reason: 'not-linked' };
     const items = readFileBundle(kind);
     const count = Object.keys(items).length;
     if (count === 0)
-        return 0;
+        return { ok: true, count: 0, removed: 0 };
     const res = await fetchWithRetry(`${API_BASE}/api/${kind}`, {
         method: 'POST',
         headers: { 'Content-Type': 'application/json', 'x-sync-token': syncToken },
         body: JSON.stringify({ items }),
     });
-    return res?.ok ? count : null;
+    return res?.ok ? { ok: true, count, removed: 0 } : { ok: false, reason: 'unreachable' };
 }
 export const pullPersonalities = () => pullBundle('personalities');
 export const getLastPersonalityPullBackupCount = () => lastPersonalityPullBackupCount;
@@ -699,3 +750,4 @@ export const _globalDirForTest = globalDir;
 export const _readFileBundleForTest = readFileBundle;
 export const _writeFileBundleForTest = writeFileBundle;
 export const _writePulledPersonalityBundleForTest = writePulledPersonalityBundle;
+export const _applyPersonalityTombstonesForTest = applyPersonalityTombstones;

package/dist/utils/diffPreview.js

@@ -15,7 +15,6 @@ export function generateDiff(oldContent, newContent, contextLines = 3) {
     let oldIdx = 0;
     let newIdx = 0;
     let currentHunk = null;
-    let pendingContext = [];
     for (const [oldMatch, newMatch] of lcs) {
         // Handle deletions
         while (oldIdx < oldMatch) {

package/dist/utils/git.js

@@ -286,7 +286,6 @@ export function generateCommitMessage(prompt, actions) {
     const hasWrites = actions.some(a => a.type === 'write');
     const hasEdits = actions.some(a => a.type === 'edit');
     const hasDeletes = actions.some(a => a.type === 'delete');
-    const hasCommands = actions.some(a => a.type === 'command');
     // Determine prefix
     let prefix = 'chore';
     // Check prompt for common patterns

package/dist/utils/headlessReview.d.ts

@@ -1,3 +1,4 @@
+import { type FixPlan } from './reviewFix.js';
 import { ReviewResult } from './codeReview.js';
 export type FailOn = 'error' | 'warning' | 'info' | 'none';
 export interface ReviewArgs {
@@ -7,8 +8,12 @@ export interface ReviewArgs {
     rules: boolean;
     ai: boolean;
     help: boolean;
+    /** Hand the findings to an agent and let it edit the working tree. */
+    fix: boolean;
+    /** Lowest severity the fix run may act on. Suggestions are never eligible. */
+    fixMinSeverity: 'error' | 'warning';
 }
-export declare const REVIEW_HELP = "Usage: codeep review [options] [files...]\n\nRun a deterministic, offline code review (no API key required). With no files,\nreviews your unstaged git changes, falling back to a src/ scan when the tree is\nclean. Pass files (or let your CI pass the PR's changed files) to scope it.\n\nCustom/disabled rules come from .codeep/review.yml (or .json) in the repo.\n\nOptions:\n  --json              Print the result as JSON instead of the markdown report\n  --fail-on <level>   Exit non-zero when an issue at or above <level> is found:\n                      error | warning | info | none   (default: error)\n  --rules             List the built-in rule ids (for \"disable\" in .codeep/review.*) and exit\n  --ai                After the offline pass, ask your configured provider for a\n                      contextual second opinion on the working-tree diff\n                      (advisory; needs an API key; never affects the exit code)\n  -h, --help          Show this help\n\nExit code: 0 when nothing at/above --fail-on is found, 1 otherwise.";
+export declare const REVIEW_HELP = "Usage: codeep review [options] [files...]\n\nRun a deterministic, offline code review (no API key required). With no files,\nreviews your unstaged git changes, falling back to a src/ scan when the tree is\nclean. Pass files (or let your CI pass the PR's changed files) to scope it.\n\nCustom/disabled rules come from .codeep/review.yml (or .json) in the repo.\n\nOptions:\n  --json              Print the result as JSON instead of the markdown report\n  --fail-on <level>   Exit non-zero when an issue at or above <level> is found:\n                      error | warning | info | none   (default: error)\n  --fix               After the review, let an agent fix what it found. Edits the\n                      working tree and stops there \u2014 it never commits, branches\n                      or pushes. Runs under a files+tests boundary: no shell, no\n                      network, no git. Needs an API key.\n  --fix-min-severity  Lowest severity --fix may act on: error | warning\n                      (default: warning). Suggestions are never eligible.\n  --rules             List the built-in rule ids (for \"disable\" in .codeep/review.*) and exit\n  --ai                After the offline pass, ask your configured provider for a\n                      contextual second opinion on the working-tree diff\n                      (advisory; needs an API key; never affects the exit code)\n  -h, --help          Show this help\n\nExit code: 0 when nothing at/above --fail-on is found, 1 otherwise.";
 /** Parse `codeep review` argv (everything after the subcommand). Pure. */
 export declare function parseReviewArgs(argv: string[]): ReviewArgs;
 /** Exit code for a result under a fail-on threshold. Pure. */
@@ -29,6 +34,9 @@ export interface ReviewDeps {
         provider?: string;
         model?: string;
     };
+    /** Run an agent over a fix plan. Returns a human summary, or null when it
+     *  could not run at all (no API key, provider unreachable). */
+    applyFixes: (plan: FixPlan) => Promise<string | null>;
 }
 /**
  * Orchestrate a headless review and return the process exit code. Side effects

package/dist/utils/headlessReview.js

@@ -1,3 +1,4 @@
+import { buildFixPlan, summariseFixPlan } from './reviewFix.js';
 // Headless `codeep review` — a non-interactive entry point around the
 // deterministic reviewer in codeReview.ts. No API key, no TUI: it scans, prints
 // a report (markdown or JSON), and exits non-zero when issues at/above a chosen
@@ -24,6 +25,12 @@ Options:
   --json              Print the result as JSON instead of the markdown report
   --fail-on <level>   Exit non-zero when an issue at or above <level> is found:
                       error | warning | info | none   (default: error)
+  --fix               After the review, let an agent fix what it found. Edits the
+                      working tree and stops there — it never commits, branches
+                      or pushes. Runs under a files+tests boundary: no shell, no
+                      network, no git. Needs an API key.
+  --fix-min-severity  Lowest severity --fix may act on: error | warning
+                      (default: warning). Suggestions are never eligible.
   --rules             List the built-in rule ids (for "disable" in .codeep/review.*) and exit
   --ai                After the offline pass, ask your configured provider for a
                       contextual second opinion on the working-tree diff
@@ -33,7 +40,10 @@ Options:
 Exit code: 0 when nothing at/above --fail-on is found, 1 otherwise.`;
 /** Parse `codeep review` argv (everything after the subcommand). Pure. */
 export function parseReviewArgs(argv) {
-    const out = { files: [], json: false, failOn: 'error', rules: false, ai: false, help: false };
+    const out = {
+        files: [], json: false, failOn: 'error', rules: false, ai: false, help: false,
+        fix: false, fixMinSeverity: 'warning',
+    };
     for (let i = 0; i < argv.length; i++) {
         const arg = argv[i];
         if (arg === '--json') {
@@ -45,6 +55,19 @@ export function parseReviewArgs(argv) {
         else if (arg === '--ai') {
             out.ai = true;
         }
+        else if (arg === '--fix') {
+            out.fix = true;
+        }
+        else if (arg === '--fix-min-severity') {
+            const v = argv[++i];
+            if (v === 'error' || v === 'warning')
+                out.fixMinSeverity = v;
+        }
+        else if (arg.startsWith('--fix-min-severity=')) {
+            const v = arg.slice('--fix-min-severity='.length);
+            if (v === 'error' || v === 'warning')
+                out.fixMinSeverity = v;
+        }
         else if (arg === '-h' || arg === '--help') {
             out.help = true;
         }
@@ -104,12 +127,26 @@ export async function runHeadlessReview(argv, deps = defaultDeps()) {
     }
     const result = deps.review(args.files.length ? args.files : undefined);
     const aiText = args.ai ? await deps.aiReview(result) : null;
+    // Fixing happens after reporting, and never changes the exit code. CI decides
+    // pass or fail from what the reviewer found; whether an agent then managed to
+    // repair some of it is a separate question, and letting a successful fix turn
+    // a red check green would hide the finding rather than resolve it.
+    let fixSummary = null;
+    if (args.fix) {
+        const plan = buildFixPlan(result.issues, { minSeverity: args.fixMinSeverity });
+        fixSummary = plan.skipped ? summariseFixPlan(plan) : await deps.applyFixes(plan);
+    }
     if (args.json) {
-        deps.write(JSON.stringify(args.ai ? { ...result, aiReview: aiText } : result, null, 2));
+        deps.write(JSON.stringify({
+            ...result,
+            ...(args.ai ? { aiReview: aiText } : {}),
+            ...(args.fix ? { fix: fixSummary } : {}),
+        }, null, 2));
     }
     else {
         const md = formatReviewResult(result);
-        deps.write(args.ai ? appendAiSection(md, aiText, deps.aiMeta()) : md);
+        const withAi = args.ai ? appendAiSection(md, aiText, deps.aiMeta()) : md;
+        deps.write(fixSummary ? `${withAi}\n\n## Fix run\n\n${fixSummary}\n` : withAi);
     }
     return exitCodeForResult(result, args.failOn);
 }
@@ -132,6 +169,7 @@ function defaultDeps() {
         review: (files) => performCodeReview(minimalContext(cwd), files),
         write: (text) => process.stdout.write(text + '\n'),
         listRules: () => formatBuiltinRules(),
+        applyFixes: (plan) => runFixPlan(plan, minimalContext(cwd)),
         aiMeta: () => {
             try {
                 return { provider: getCurrentProvider().name, model: String(config.get('model') || '') };
@@ -165,3 +203,39 @@ function defaultDeps() {
         },
     };
 }
+/**
+ * Run a fix plan through the agent.
+ *
+ * The plan's personality is passed as the active one, so the same enforcement
+ * any custom bot gets applies here: the model is offered `files` and `tests`
+ * and nothing else. It edits the working tree and stops — branching, committing
+ * and opening a pull request belong to whatever called this, which in CI is the
+ * action that holds the token.
+ */
+async function runFixPlan(plan, context) {
+    try {
+        const { runAgent } = await import('./agent.js');
+        // No cast here. `as never` on this call once hid the fact that
+        // personalityOverride did not exist, which would have run the CI fix with
+        // no boundary at all while the tests happily asserted otherwise.
+        const result = await runAgent(plan.prompt, context, {
+            personalityOverride: plan.personality,
+            maxIterations: 12,
+        });
+        const edited = new Set(result.actions
+            .filter(a => a.type === 'write' || a.type === 'edit')
+            .map(a => a.target));
+        if (!result.success) {
+            return `${summariseFixPlan(plan)} The run did not finish: ${result.error ?? 'unknown error'}.`;
+        }
+        if (edited.size === 0) {
+            return `${summariseFixPlan(plan)} Nothing was changed — the agent judged the findings not mechanically fixable.`;
+        }
+        return `${summariseFixPlan(plan)} Edited ${edited.size} file${edited.size === 1 ? '' : 's'}: ${[...edited].join(', ')}.`;
+    }
+    catch (error) {
+        // A missing key or an unreachable provider must not fail the review. The
+        // findings are already reported and the exit code already decided.
+        return `Could not run the fix: ${error.message}`;
+    }
+}

package/dist/utils/mcpStreamableHttp.d.ts

@@ -32,7 +32,6 @@ export declare class StreamableHttpClient {
     private notificationAbort;
     private stopped;
     /** True after the server has set a session id (i.e. it tracks state). */
-    private get hasServerSession();
     constructor(opts: StreamableHttpOptions);
     /**
      * Issue a JSON-RPC frame as POST. Reply may be a single JSON response

package/dist/utils/mcpStreamableHttp.js

@@ -28,9 +28,6 @@ export class StreamableHttpClient {
     notificationAbort = null;
     stopped = false;
     /** True after the server has set a session id (i.e. it tracks state). */
-    get hasServerSession() {
-        return this.sessionId !== null;
-    }
     constructor(opts) {
         this.opts = opts;
     }

package/dist/utils/personalities.js

@@ -648,7 +648,6 @@ export function isPersonalityToolCallAllowed(personality, toolCall, registeredMc
     if (tool === 'execute_command') {
         if (personality.tools?.includes('terminal'))
             return true;
-        const command = commandName(toolCall);
         if (personality.tools?.includes('git') && isRestrictedGitCommandAllowed(toolCall))
             return true;
         if (personality.tools?.includes('tests') && isTestCommand(toolCall))

package/dist/utils/reviewFix.d.ts

@@ -0,0 +1,65 @@
+/**
+ * Deciding what a CI agent may attempt to fix, and under what boundary.
+ *
+ * The reviewer already finds problems. This decides which of them are worth
+ * handing to an agent, caps how much it may take on, and pins the capabilities
+ * it runs with. It deliberately stops there: it produces a plan, never a
+ * commit. Staging, branching and opening a pull request belong to the action,
+ * which has the token — and keeping git out of the agent's reach is half the
+ * reason this is safe to run in CI at all.
+ *
+ * The boundary is the point. A fix run gets `files` (it must edit) and `tests`
+ * (it must check its own work) and nothing else. No shell, no git, no network.
+ * Enforced by the same machinery as any other custom bot, so an agent that
+ * decides it would like to curl something simply has no tool to do it with.
+ */
+import type { ReviewIssue } from './codeReview.js';
+import type { Personality } from './personalities.js';
+export interface FixPlanOptions {
+    /** Lowest severity to attempt. Defaults to `warning`. */
+    minSeverity?: 'error' | 'warning';
+    /** Most issues to hand over in one run. */
+    maxIssues?: number;
+    /** Most files to touch. A fix that rewrites half the repo is not a fix. */
+    maxFiles?: number;
+}
+export interface FixPlan {
+    /** The issues the agent is being asked to address, in file order. */
+    issues: ReviewIssue[];
+    /** Files it is allowed to be working in. */
+    files: string[];
+    /** Why nothing is being attempted, when that is the case. */
+    skipped?: 'no-issues' | 'nothing-fixable';
+    /** The instruction handed to the agent. */
+    prompt: string;
+    /** The capability boundary the run executes under. */
+    personality: Personality;
+}
+/**
+ * `suggestion` and `info` are opinion — style preferences, "consider extracting
+ * this". Acting on them unasked produces churn in someone else's pull request
+ * and buries the findings that matter. Only what the reviewer states as a
+ * defect is eligible.
+ */
+export declare function isFixable(issue: ReviewIssue, minSeverity: 'error' | 'warning'): boolean;
+/**
+ * The capability set a CI fix runs under.
+ *
+ * Not a suggestion in the prompt — a real `custom-bot/v1` personality, enforced
+ * by `isPersonalityToolCallAllowed` and by the tool registry filter, exactly as
+ * a bot built in Agent Studio would be. An agent running unattended against
+ * someone else's repository is precisely where a boundary has to be real.
+ */
+export declare function ciFixPersonality(): Personality;
+/**
+ * Turn a review into a bounded instruction, or decline.
+ *
+ * Caps matter more than they look. An agent handed sixty findings across forty
+ * files will produce a pull request nobody reviews, which is the same as no
+ * pull request — except it also burned tokens and someone's afternoon.
+ */
+export declare function buildFixPlan(issues: ReviewIssue[], options?: FixPlanOptions): FixPlan;
+/** The instruction the agent receives: the findings, grouped by file. */
+export declare function formatFixPrompt(issues: ReviewIssue[]): string;
+/** A one-line summary for the pull request body the action opens. */
+export declare function summariseFixPlan(plan: FixPlan): string;

package/dist/utils/reviewFix.js

@@ -0,0 +1,141 @@
+/**
+ * Deciding what a CI agent may attempt to fix, and under what boundary.
+ *
+ * The reviewer already finds problems. This decides which of them are worth
+ * handing to an agent, caps how much it may take on, and pins the capabilities
+ * it runs with. It deliberately stops there: it produces a plan, never a
+ * commit. Staging, branching and opening a pull request belong to the action,
+ * which has the token — and keeping git out of the agent's reach is half the
+ * reason this is safe to run in CI at all.
+ *
+ * The boundary is the point. A fix run gets `files` (it must edit) and `tests`
+ * (it must check its own work) and nothing else. No shell, no git, no network.
+ * Enforced by the same machinery as any other custom bot, so an agent that
+ * decides it would like to curl something simply has no tool to do it with.
+ */
+/** Severities an agent may act on, in descending confidence. */
+const FIXABLE_SEVERITIES = ['error', 'warning'];
+const DEFAULTS = { minSeverity: 'warning', maxIssues: 20, maxFiles: 10 };
+/**
+ * `suggestion` and `info` are opinion — style preferences, "consider extracting
+ * this". Acting on them unasked produces churn in someone else's pull request
+ * and buries the findings that matter. Only what the reviewer states as a
+ * defect is eligible.
+ */
+export function isFixable(issue, minSeverity) {
+    if (!FIXABLE_SEVERITIES.includes(issue.severity))
+        return false;
+    return minSeverity === 'warning' ? true : issue.severity === 'error';
+}
+/**
+ * The capability set a CI fix runs under.
+ *
+ * Not a suggestion in the prompt — a real `custom-bot/v1` personality, enforced
+ * by `isPersonalityToolCallAllowed` and by the tool registry filter, exactly as
+ * a bot built in Agent Studio would be. An agent running unattended against
+ * someone else's repository is precisely where a boundary has to be real.
+ */
+export function ciFixPersonality() {
+    return {
+        name: 'ci-fix',
+        displayName: 'CI Fix',
+        description: 'Applies review findings in CI. Files and tests only.',
+        prompt: [
+            'You are fixing problems a reviewer already found in a pull request.',
+            '',
+            'Rules:',
+            '- Fix only the issues listed. Do not refactor around them.',
+            '- Do not reformat untouched lines; the diff should read as a fix, not a rewrite.',
+            '- Run the project tests when you are done and fix what you broke.',
+            '- If an issue needs a judgement call you cannot make from the code, leave it and say so.',
+        ].join('\n'),
+        scope: 'project',
+        structured: true,
+        schemaValid: true,
+        modelPreference: 'automatic',
+        restrictTools: true,
+        tools: ['files', 'tests'],
+        declaredTools: ['files', 'tests'],
+        projectScope: 'all',
+    };
+}
+/**
+ * Turn a review into a bounded instruction, or decline.
+ *
+ * Caps matter more than they look. An agent handed sixty findings across forty
+ * files will produce a pull request nobody reviews, which is the same as no
+ * pull request — except it also burned tokens and someone's afternoon.
+ */
+export function buildFixPlan(issues, options = {}) {
+    const { minSeverity, maxIssues, maxFiles } = { ...DEFAULTS, ...options };
+    const personality = ciFixPersonality();
+    if (issues.length === 0) {
+        return { issues: [], files: [], skipped: 'no-issues', prompt: '', personality };
+    }
+    const eligible = issues
+        .filter(issue => isFixable(issue, minSeverity))
+        // Errors before warnings, then by file so one file's issues arrive together.
+        .sort((a, b) => {
+        if (a.severity !== b.severity)
+            return a.severity === 'error' ? -1 : 1;
+        return a.file.localeCompare(b.file) || (a.line ?? 0) - (b.line ?? 0);
+    });
+    if (eligible.length === 0) {
+        return { issues: [], files: [], skipped: 'nothing-fixable', prompt: '', personality };
+    }
+    // Take whole files rather than cutting a file's issues in half — a partial
+    // fix to one file is the worst outcome available, since it looks addressed.
+    const files = [];
+    const taken = [];
+    for (const issue of eligible) {
+        const knownFile = files.includes(issue.file);
+        if (!knownFile && files.length >= maxFiles)
+            continue;
+        if (taken.length >= maxIssues && !knownFile)
+            continue;
+        if (!knownFile)
+            files.push(issue.file);
+        taken.push(issue);
+    }
+    return { issues: taken, files, prompt: formatFixPrompt(taken), personality };
+}
+/** The instruction the agent receives: the findings, grouped by file. */
+export function formatFixPrompt(issues) {
+    const byFile = new Map();
+    for (const issue of issues) {
+        const list = byFile.get(issue.file) ?? [];
+        list.push(issue);
+        byFile.set(issue.file, list);
+    }
+    const lines = [
+        `Fix the following ${issues.length} review finding${issues.length === 1 ? '' : 's'}.`,
+        '',
+    ];
+    for (const [file, found] of byFile) {
+        lines.push(`## ${file}`);
+        for (const issue of found) {
+            const where = issue.line ? `line ${issue.line}` : 'file';
+            lines.push(`- [${issue.severity}] ${where}: ${issue.message}`);
+            if (issue.suggestion)
+                lines.push(`  suggested: ${issue.suggestion}`);
+        }
+        lines.push('');
+    }
+    lines.push('Change nothing outside these files.');
+    return lines.join('\n');
+}
+/** A one-line summary for the pull request body the action opens. */
+export function summariseFixPlan(plan) {
+    if (plan.skipped === 'no-issues')
+        return 'The review found nothing.';
+    if (plan.skipped === 'nothing-fixable') {
+        return 'The review found only suggestions, which are left for a human to weigh.';
+    }
+    const errors = plan.issues.filter(i => i.severity === 'error').length;
+    const warnings = plan.issues.length - errors;
+    const parts = [
+        errors ? `${errors} error${errors === 1 ? '' : 's'}` : '',
+        warnings ? `${warnings} warning${warnings === 1 ? '' : 's'}` : '',
+    ].filter(Boolean);
+    return `Attempting ${parts.join(' and ')} across ${plan.files.length} file${plan.files.length === 1 ? '' : 's'}.`;
+}

package/dist/utils/skillBundles.js

@@ -52,12 +52,10 @@ export function parseFrontmatter(raw) {
         return { meta: {}, body: normalised };
     const meta = {};
     const lines = match[1].split('\n');
-    let currentKey = null;
     let currentList = null;
     for (const rawLine of lines) {
         const line = rawLine.replace(/\s+$/, '');
         if (!line.trim()) {
-            currentKey = null;
             currentList = null;
             continue;
         }
@@ -75,7 +73,6 @@ export function parseFrontmatter(raw) {
         let value = kv[2];
         if (value === '') {
             // Empty → expecting a block list below
-            currentKey = key;
             currentList = [];
             meta[key] = currentList;
             continue;
@@ -89,7 +86,6 @@ export function parseFrontmatter(raw) {
             value = stripQuotes(value);
         }
         meta[key] = value;
-        currentKey = null;
         currentList = null;
     }
     return { meta, body: match[2].trimStart() };

package/dist/utils/smartContext.js

@@ -9,24 +9,6 @@ import { logger } from './logger.js';
 const MAX_CONTEXT_SIZE = 50000;
 const MAX_FILES = 15;
 // File extensions we care about
-const CODE_EXTENSIONS = new Set([
-    '.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs',
-    '.py', '.pyw',
-    '.go',
-    '.rs',
-    '.php', '.phtml',
-    '.java', '.kt', '.scala',
-    '.cs', '.fs',
-    '.rb',
-    '.swift',
-    '.c', '.cpp', '.h', '.hpp',
-    '.vue', '.svelte',
-    '.css', '.scss', '.less',
-    '.html', '.htm',
-    '.json', '.yaml', '.yml', '.toml',
-    '.sql',
-    '.md',
-]);
 /**
  * Extract imports/requires from file content
  */

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const VERSION = "2.20.0";
+export declare const VERSION = "2.22.0";

package/dist/version.js

@@ -1,4 +1,4 @@
 // AUTO-GENERATED by scripts/gen-version.js — do not edit by hand.
 // Baked from package.json at build time so the bun-compiled binary reports
 // the right version (it has no package.json on disk to read at runtime).
-export const VERSION = '2.20.0';
+export const VERSION = '2.22.0';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeep",
-  "version": "2.20.0",
+  "version": "2.22.0",
   "description": "AI-powered coding assistant built for the terminal. Multiple LLM providers, project-aware context, and a seamless development workflow.",
   "type": "module",
   "main": "dist/index.js",
@@ -42,7 +42,7 @@
     "@napi-rs/keyring": "^1.3.0",
     "clipboardy": "^4.0.0",
     "conf": "^13.1.0",
-    "js-yaml": "^4.1.0",
+    "js-yaml": "^4.3.1",
     "open": "^10.0.0"
   },
   "devDependencies": {

package/dist/renderer/components/Permission.d.ts

@@ -1,24 +0,0 @@
-/**
- * Permission screen for granting folder access
- */
-import { Screen } from '../Screen';
-export type PermissionLevel = 'none' | 'read' | 'write';
-export interface PermissionOptions {
-    projectPath: string;
-    isProject: boolean;
-    currentPermission: PermissionLevel;
-    onSelect: (permission: PermissionLevel) => void;
-    onCancel: () => void;
-}
-/**
- * Render permission screen
- */
-export declare function renderPermissionScreen(screen: Screen, options: PermissionOptions, selectedIndex: number): void;
-/**
- * Get permission options array for easy indexing
- */
-export declare function getPermissionOptions(): PermissionLevel[];
-/**
- * Truncate path for display
- */
-export declare function truncatePath(path: string, maxLen: number): string;