codeep 2.22.0 → 2.23.0

package/dist/utils/codeReview.js

@@ -55,11 +55,14 @@ const CODE_PATTERNS = [
     // Performance issues
     {
         id: 'foreach-await',
-        pattern: /\.forEach\s*\([^)]*\)\s*{\s*await/g,
+        pattern: /\.forEach\s*\(\s*async\b[^{]{0,120}\{[^{}]{0,200}?\bawait\b/g,
         category: 'performance',
         severity: 'warning',
         message: 'Sequential async operations in forEach are inefficient',
         suggestion: 'Use Promise.all() with map() for parallel execution',
+        // Both quantifiers are bounded and both classes are negated, so the match
+        // is linear in the input — this rule is a built-in and never passes
+        // through the custom-rule screening in utils/reviewConfig.ts.
         extensions: ['.js', '.ts', '.jsx', '.tsx'],
     },
     {
@@ -172,12 +175,27 @@ const CODE_PATTERNS = [
         extensions: ['.js', '.ts', '.jsx', '.tsx'],
     },
 ];
+/**
+ * Collapse JavaScript's module-flavoured extensions onto `.js`.
+ *
+ * `.mjs` and `.cjs` are JavaScript — the module system differs, nothing a
+ * regex rule cares about does. Without this, thirteen rules that name `.js`
+ * silently skipped every such file, security rules included: `eval()`,
+ * `innerHTML` and hardcoded credentials went unreported in `.mjs` entirely.
+ *
+ * Normalising here rather than widening each rule's `extensions` array means a
+ * rule added tomorrow is covered by default. The arrays were the wrong place
+ * to fix it — thirteen copies of the same fact is how it went wrong once.
+ */
+function normaliseExtension(ext) {
+    return ext === '.mjs' || ext === '.cjs' ? '.js' : ext;
+}
 /**
  * Analyze a single file for issues
  */
 function analyzeFile(filePath, content, projectRoot, rules, disabled) {
     const issues = [];
-    const ext = extname(filePath);
+    const ext = normaliseExtension(extname(filePath));
     const relativePath = relative(projectRoot, filePath);
     const lines = content.split('\n');
     // Skip the regex pass on very large files (the cheap line-count heuristics
@@ -299,7 +317,7 @@ function getAllSourceFiles(dir, maxFiles = 50) {
                 }
                 else if (entry.isFile()) {
                     const ext = extname(entry.name);
-                    if (['.ts', '.tsx', '.js', '.jsx', '.py', '.php', '.go', '.rs'].includes(ext)) {
+                    if (['.ts', '.tsx', '.js', '.mjs', '.cjs', '.jsx', '.py', '.php', '.go', '.rs'].includes(ext)) {
                         files.push(fullPath);
                     }
                 }

package/dist/utils/headlessReview.js

@@ -220,7 +220,12 @@ async function runFixPlan(plan, context) {
         // no boundary at all while the tests happily asserted otherwise.
         const result = await runAgent(plan.prompt, context, {
             personalityOverride: plan.personality,
-            maxIterations: 12,
+            // The product default. 12 was picked to keep a CI run cheap and was
+            // simply too small: fixing one innerHTML call and running the suite ran
+            // out of steps, and an agent stopped mid-edit leaves a worse diff than
+            // one that never started. The real bounds on cost here are the size of
+            // the plan, which buildFixPlan caps, and the action's wall-clock.
+            maxIterations: 25,
         });
         const edited = new Set(result.actions
             .filter(a => a.type === 'write' || a.type === 'edit')

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const VERSION = "2.22.0";
+export declare const VERSION = "2.23.0";

package/dist/version.js

@@ -1,4 +1,4 @@
 // AUTO-GENERATED by scripts/gen-version.js — do not edit by hand.
 // Baked from package.json at build time so the bun-compiled binary reports
 // the right version (it has no package.json on disk to read at runtime).
-export const VERSION = '2.22.0';
+export const VERSION = '2.23.0';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeep",
-  "version": "2.22.0",
+  "version": "2.23.0",
   "description": "AI-powered coding assistant built for the terminal. Multiple LLM providers, project-aware context, and a seamless development workflow.",
   "type": "module",
   "main": "dist/index.js",