codeep 2.22.0 → 2.24.0

package/dist/utils/agentChat.js

@@ -259,7 +259,7 @@ export async function summarizeEarlierHistory(history, maxChars = 16000) {
     if (dropped.length === 0)
         return '';
     const key = createHash('sha256')
-        .update(dropped.map(m => `${m.role}:${m.content}`).join(''))
+        .update(dropped.map(m => `${m.role}:${m.content}`).join('\u0000'))
         .digest('hex');
     const cached = earlierSummaryCache.get(key);
     if (cached)
@@ -507,7 +507,12 @@ additionalTools, runtime) {
             if (errorText.includes('tools') || errorText.includes('function') || response.status === 400) {
                 return await agentChatFallback(messages, systemPrompt, onChunk, abortSignal, dynamicTimeout, additionalTools, runtime);
             }
-            throw new Error(`API error: ${response.status} - ${errorText}`);
+            // ApiError, not Error: runAgent's retry loop refuses to retry a 4xx by
+            // checking `err instanceof ApiError && err.status`. A bare Error made
+            // that guard silently inapplicable, so an expired key was retried once
+            // per iteration until the budget ran out and the run reported "Exceeded
+            // maximum of N iterations" — the one explanation unrelated to the cause.
+            throw new ApiError(`API error: ${response.status} - ${errorText}`, response.status);
         }
         if (useStreaming && response.body) {
             if (protocol === 'openai')
@@ -658,7 +663,9 @@ export async function agentChatFallback(messages, systemPrompt, onChunk, abortSi
         });
         if (!response.ok) {
             const error = await response.text();
-            throw new Error(`API error: ${response.status} - ${error}`);
+            // Same reasoning as the native-tools path: the status has to survive, or
+            // the caller cannot tell "your key is wrong" from "the network hiccuped".
+            throw new ApiError(`API error: ${response.status} - ${error}`, response.status);
         }
         let content;
         if (onChunk && response.body) {

package/dist/utils/codeReview.js

@@ -55,11 +55,14 @@ const CODE_PATTERNS = [
     // Performance issues
     {
         id: 'foreach-await',
-        pattern: /\.forEach\s*\([^)]*\)\s*{\s*await/g,
+        pattern: /\.forEach\s*\(\s*async\b[^{]{0,120}\{[^{}]{0,200}?\bawait\b/g,
         category: 'performance',
         severity: 'warning',
         message: 'Sequential async operations in forEach are inefficient',
         suggestion: 'Use Promise.all() with map() for parallel execution',
+        // Both quantifiers are bounded and both classes are negated, so the match
+        // is linear in the input — this rule is a built-in and never passes
+        // through the custom-rule screening in utils/reviewConfig.ts.
         extensions: ['.js', '.ts', '.jsx', '.tsx'],
     },
     {
@@ -172,12 +175,27 @@ const CODE_PATTERNS = [
         extensions: ['.js', '.ts', '.jsx', '.tsx'],
     },
 ];
+/**
+ * Collapse JavaScript's module-flavoured extensions onto `.js`.
+ *
+ * `.mjs` and `.cjs` are JavaScript — the module system differs, nothing a
+ * regex rule cares about does. Without this, thirteen rules that name `.js`
+ * silently skipped every such file, security rules included: `eval()`,
+ * `innerHTML` and hardcoded credentials went unreported in `.mjs` entirely.
+ *
+ * Normalising here rather than widening each rule's `extensions` array means a
+ * rule added tomorrow is covered by default. The arrays were the wrong place
+ * to fix it — thirteen copies of the same fact is how it went wrong once.
+ */
+function normaliseExtension(ext) {
+    return ext === '.mjs' || ext === '.cjs' ? '.js' : ext;
+}
 /**
  * Analyze a single file for issues
  */
 function analyzeFile(filePath, content, projectRoot, rules, disabled) {
     const issues = [];
-    const ext = extname(filePath);
+    const ext = normaliseExtension(extname(filePath));
     const relativePath = relative(projectRoot, filePath);
     const lines = content.split('\n');
     // Skip the regex pass on very large files (the cheap line-count heuristics
@@ -299,7 +317,7 @@ function getAllSourceFiles(dir, maxFiles = 50) {
                 }
                 else if (entry.isFile()) {
                     const ext = extname(entry.name);
-                    if (['.ts', '.tsx', '.js', '.jsx', '.py', '.php', '.go', '.rs'].includes(ext)) {
+                    if (['.ts', '.tsx', '.js', '.mjs', '.cjs', '.jsx', '.py', '.php', '.go', '.rs'].includes(ext)) {
                         files.push(fullPath);
                     }
                 }

package/dist/utils/headlessReview.js

@@ -1,4 +1,4 @@
-import { buildFixPlan, summariseFixPlan } from './reviewFix.js';
+import { buildFixPlan, summariseFixPlan, describeAgentActivity } from './reviewFix.js';
 // Headless `codeep review` — a non-interactive entry point around the
 // deterministic reviewer in codeReview.ts. No API key, no TUI: it scans, prints
 // a report (markdown or JSON), and exits non-zero when issues at/above a chosen
@@ -214,22 +214,40 @@ function defaultDeps() {
  */
 async function runFixPlan(plan, context) {
     try {
+        // Populate the key cache before anything asks for it. `getApiKey` is
+        // synchronous and reads the cache alone — it does not consult the
+        // environment — so without this every request goes out with an empty
+        // bearer token and the provider answers 401. The AI review path next door
+        // has always done this; the fix path never did, which is why a CI run with
+        // a perfectly good key in the environment spent its whole iteration budget
+        // being rejected.
+        const { loadAllApiKeys, isConfigured } = await import('../config/index.js');
+        await loadAllApiKeys();
+        if (!isConfigured()) {
+            return `${summariseFixPlan(plan)} No API key is configured for the current provider, so the fix agent could not start.`;
+        }
         const { runAgent } = await import('./agent.js');
         // No cast here. `as never` on this call once hid the fact that
         // personalityOverride did not exist, which would have run the CI fix with
         // no boundary at all while the tests happily asserted otherwise.
         const result = await runAgent(plan.prompt, context, {
             personalityOverride: plan.personality,
-            maxIterations: 12,
+            // The product default. 12 was picked to keep a CI run cheap and was
+            // simply too small: fixing one innerHTML call and running the suite ran
+            // out of steps, and an agent stopped mid-edit leaves a worse diff than
+            // one that never started. The real bounds on cost here are the size of
+            // the plan, which buildFixPlan caps, and the action's wall-clock.
+            maxIterations: 25,
         });
         const edited = new Set(result.actions
             .filter(a => a.type === 'write' || a.type === 'edit')
             .map(a => a.target));
+        const activity = describeAgentActivity(result.actions);
         if (!result.success) {
-            return `${summariseFixPlan(plan)} The run did not finish: ${result.error ?? 'unknown error'}.`;
+            return `${summariseFixPlan(plan)} The run did not finish: ${result.error ?? 'unknown error'}. ${activity}`;
         }
         if (edited.size === 0) {
-            return `${summariseFixPlan(plan)} Nothing was changed — the agent judged the findings not mechanically fixable.`;
+            return `${summariseFixPlan(plan)} Nothing was changed. ${activity}`;
         }
         return `${summariseFixPlan(plan)} Edited ${edited.size} file${edited.size === 1 ? '' : 's'}: ${[...edited].join(', ')}.`;
     }

package/dist/utils/reviewFix.d.ts

@@ -63,3 +63,21 @@ export declare function buildFixPlan(issues: ReviewIssue[], options?: FixPlanOpt
 export declare function formatFixPrompt(issues: ReviewIssue[]): string;
 /** A one-line summary for the pull request body the action opens. */
 export declare function summariseFixPlan(plan: FixPlan): string;
+/**
+ * What the agent actually did, in one line.
+ *
+ * A fix that changes nothing is the hardest outcome to act on, because the
+ * summary that reports it — "the run did not finish", "nothing was changed" —
+ * says what did not happen and never what did. Debugging one such run through
+ * CI cost two releases and forty minutes of guessing at whether the agent
+ * could not find the file, could not write, or was being refused a tool.
+ *
+ * Counting the action log answers that in the message itself. Failures are
+ * called out separately from successes, and one failing detail is quoted,
+ * because a refusal reason is usually the whole explanation.
+ */
+export declare function describeAgentActivity(actions: {
+    type: string;
+    result: string;
+    details?: string;
+}[]): string;

package/dist/utils/reviewFix.js

@@ -139,3 +139,35 @@ export function summariseFixPlan(plan) {
     ].filter(Boolean);
     return `Attempting ${parts.join(' and ')} across ${plan.files.length} file${plan.files.length === 1 ? '' : 's'}.`;
 }
+/**
+ * What the agent actually did, in one line.
+ *
+ * A fix that changes nothing is the hardest outcome to act on, because the
+ * summary that reports it — "the run did not finish", "nothing was changed" —
+ * says what did not happen and never what did. Debugging one such run through
+ * CI cost two releases and forty minutes of guessing at whether the agent
+ * could not find the file, could not write, or was being refused a tool.
+ *
+ * Counting the action log answers that in the message itself. Failures are
+ * called out separately from successes, and one failing detail is quoted,
+ * because a refusal reason is usually the whole explanation.
+ */
+export function describeAgentActivity(actions) {
+    if (actions.length === 0)
+        return 'It made no tool calls at all.';
+    const byType = new Map();
+    for (const action of actions) {
+        const tally = byType.get(action.type) ?? { ok: 0, failed: 0 };
+        if (action.result === 'error')
+            tally.failed++;
+        else
+            tally.ok++;
+        byType.set(action.type, tally);
+    }
+    const parts = [...byType.entries()]
+        .sort((a, b) => (b[1].ok + b[1].failed) - (a[1].ok + a[1].failed))
+        .map(([type, { ok, failed }]) => (failed ? `${ok + failed} ${type} (${failed} failed)` : `${ok} ${type}`));
+    const firstFailure = actions.find(a => a.result === 'error' && a.details);
+    const why = firstFailure ? ` First failure: ${firstFailure.details.slice(0, 200)}` : '';
+    return `It made ${actions.length} tool call${actions.length === 1 ? '' : 's'}: ${parts.join(', ')}.${why}`;
+}

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const VERSION = "2.22.0";
+export declare const VERSION = "2.24.0";

package/dist/version.js

@@ -1,4 +1,4 @@
 // AUTO-GENERATED by scripts/gen-version.js — do not edit by hand.
 // Baked from package.json at build time so the bun-compiled binary reports
 // the right version (it has no package.json on disk to read at runtime).
-export const VERSION = '2.22.0';
+export const VERSION = '2.24.0';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeep",
-  "version": "2.22.0",
+  "version": "2.24.0",
   "description": "AI-powered coding assistant built for the terminal. Multiple LLM providers, project-aware context, and a seamless development workflow.",
   "type": "module",
   "main": "dist/index.js",