codeep 2.4.2 → 2.5.1

package/README.md

@@ -1050,6 +1050,7 @@ In `dangerous` mode, configure which tools require confirmation via `/settings`:
 | `codeep account` | Link CLI to codeep.dev (GitHub OAuth) |
 | `codeep account sync` | Pull API keys + personalities + commands from codeep.dev → local |
 | `codeep account push` | Push local API keys + personalities + commands → codeep.dev |
+| `codeep review [files…]` | Offline, deterministic code review for CI — markdown or `--json`, `--fail-on <error\|warning\|info\|none>` sets the exit code. No API key needed. |
 
 ### Authentication
 

package/dist/acp/session.js

@@ -154,7 +154,9 @@ export async function runAgentSession(opts) {
     });
     // result.finalResponse is already emitted via onChunk streaming above;
     // only emit it here if nothing was streamed (e.g. non-streaming fallback path)
-    if (result.finalResponse && chunksEmitted === 0) {
+    // — except a paused/interrupted run, whose finalResponse is a fresh "say
+    // continue" notice that was never streamed and must always reach the client.
+    if (result.finalResponse && (chunksEmitted === 0 || result.interrupted)) {
         opts.onChunk(result.finalResponse);
     }
     // Surface errors as thrown exceptions so the ACP server can handle them correctly.

package/dist/renderer/agentExecution.js

@@ -343,6 +343,14 @@ export async function executeAgentTask(task, dryRun, ctx) {
         else if (result.aborted) {
             app.addMessage({ role: 'assistant', content: 'Agent stopped by user.' });
         }
+        else if (result.interrupted) {
+            // Paused at a step/time safety limit — resumable, not a failure. Show the
+            // agent's partial summary and nudge the user to resume.
+            if (result.finalResponse) {
+                app.addMessage({ role: 'assistant', content: result.finalResponse });
+            }
+            app.notify('Paused at the safety limit — say "continue" to keep going');
+        }
         else {
             // Show the agent's summary if available, with error details below
             if (result.finalResponse) {

package/dist/renderer/main.js

@@ -375,6 +375,13 @@ function showSessionPickerInline() {
 // ─── Main ─────────────────────────────────────────────────────────────────────
 async function main() {
     const args = process.argv.slice(2);
+    // Headless, deterministic code review for CI (no API key, no TUI). Handled
+    // before the global --help/--version checks so `codeep review --help` shows
+    // the review usage rather than the top-level help.
+    if (args[0] === 'review') {
+        const { runHeadlessReview } = await import('../utils/headlessReview.js');
+        process.exit(runHeadlessReview(args.slice(1)));
+    }
     if (args.includes('--version') || args.includes('-v')) {
         console.log(`Codeep v${getCurrentVersion()}`);
         process.exit(0);
@@ -389,6 +396,7 @@ Usage:
   codeep account sync   Pull keys + personalities + commands + profile from codeep.dev
   codeep account push   Push local keys + personalities + commands + profile to codeep.dev
   codeep acp          Start ACP server (for Zed editor integration)
+  codeep review       Offline code review for CI (--json, --fail-on <level>)
   codeep --version    Show version
   codeep --help       Show this help
 

package/dist/utils/agent.d.ts

@@ -71,6 +71,8 @@ export interface AgentOptions {
     /** Role system-prompt addendum injected for a delegated sub-agent. */
     roleAddendum?: string;
 }
+/** Why a run stopped early at a safety limit — both are resumable, not errors. */
+export type InterruptKind = 'iteration_limit' | 'time_limit';
 export interface AgentResult {
     success: boolean;
     iterations: number;
@@ -78,7 +80,22 @@ export interface AgentResult {
     finalResponse: string;
     error?: string;
     aborted?: boolean;
+    /** Set when the run paused at a step/time safety limit. The caller can offer
+     *  a "continue" affordance instead of treating it as a failure. */
+    interrupted?: InterruptKind;
 }
+/**
+ * Build the result for a run that paused at a safety limit. Pausing is a normal,
+ * resumable state — not an error — so the summary tells the user how to resume.
+ * Shared by both limit checks in the loop so the wording + `interrupted` signal
+ * stay in sync.
+ */
+export declare function buildPausedResult(kind: InterruptKind, ctx: {
+    iterations: number;
+    actions: ActionLog[];
+    maxIterations?: number;
+    durationMin?: number;
+}): AgentResult;
 /**
  * Run the agent loop
  */

package/dist/utils/agent.js

@@ -103,6 +103,32 @@ function compressMessages(messages, actions) {
     debug(`Context compressed: ${totalChars} chars → keeping first + summary + last ${keep} messages`);
     return [firstMessage, summaryMessage, ...recentMessages];
 }
+/**
+ * Build the result for a run that paused at a safety limit. Pausing is a normal,
+ * resumable state — not an error — so the summary tells the user how to resume.
+ * Shared by both limit checks in the loop so the wording + `interrupted` signal
+ * stay in sync.
+ */
+export function buildPausedResult(kind, ctx) {
+    const editedFiles = [...new Set(ctx.actions.filter(a => a.type === 'write' || a.type === 'edit').map(a => a.target))];
+    const head = kind === 'time_limit'
+        ? `⏸ Paused after the ${ctx.durationMin}-minute time limit.`
+        : `⏸ Paused after ${ctx.maxIterations} tool steps (the safety limit).`;
+    const lines = [head, '', 'This is a safety limit, not an error — say **continue** to pick up where it left off.'];
+    if (editedFiles.length > 0) {
+        lines.push('', '**Progress so far — files written/edited:**', ...editedFiles.map(f => `  ✓ \`${f}\``));
+    }
+    return {
+        success: false,
+        iterations: ctx.iterations,
+        actions: ctx.actions,
+        finalResponse: lines.join('\n'),
+        error: kind === 'time_limit'
+            ? `Exceeded maximum duration of ${ctx.durationMin} min`
+            : `Exceeded maximum of ${ctx.maxIterations} iterations`,
+        interrupted: kind,
+    };
+}
 const DEFAULT_OPTIONS = {
     // Modern models (GLM-5.1, Claude 4.5, GPT-4.1) complete typical coding tasks in
     // 3–8 iterations. The old cap of 100 mostly let broken loops wander for minutes
@@ -452,21 +478,8 @@ export async function runAgent(prompt, projectContext, options = {}) {
         while (iteration < opts.maxIterations) {
             // Check timeout
             if (Date.now() - startTime > opts.maxDuration) {
-                const filesDone = actions.filter(a => a.type === 'write' || a.type === 'edit').map(a => a.target);
                 const durationMin = Math.round(opts.maxDuration / 60000);
-                const partialLines = [`Agent reached the time limit (${durationMin} min).`];
-                if (filesDone.length > 0) {
-                    partialLines.push(`\n**Partial progress — files written/edited:**`);
-                    [...new Set(filesDone)].forEach(f => partialLines.push(`  ✓ \`${f}\``));
-                    partialLines.push(`\nYou can continue by running the agent again.`);
-                }
-                result = {
-                    success: false,
-                    iterations: iteration,
-                    actions,
-                    finalResponse: partialLines.join('\n'),
-                    error: `Exceeded maximum duration of ${durationMin} min`,
-                };
+                result = buildPausedResult('time_limit', { iterations: iteration, actions, durationMin });
                 if (!opts.nested)
                     writeProgressLog(projectContext.root || '', prompt, result, projectContext.name);
                 return result;
@@ -894,20 +907,7 @@ export async function runAgent(prompt, projectContext, options = {}) {
         }
         // Check if we hit max iterations — build partial summary from actions log
         if (iteration >= opts.maxIterations && !finalResponse) {
-            const filesDone = actions.filter(a => a.type === 'write' || a.type === 'edit').map(a => a.target);
-            const partialLines = [`Agent reached the iteration limit (${opts.maxIterations} steps).`];
-            if (filesDone.length > 0) {
-                partialLines.push(`\n**Partial progress — files written/edited:**`);
-                [...new Set(filesDone)].forEach(f => partialLines.push(`  ✓ \`${f}\``));
-                partialLines.push(`\nThe task may be incomplete. You can continue by running the agent again.`);
-            }
-            result = {
-                success: false,
-                iterations: iteration,
-                actions,
-                finalResponse: partialLines.join('\n'),
-                error: `Exceeded maximum of ${opts.maxIterations} iterations`,
-            };
+            result = buildPausedResult('iteration_limit', { iterations: iteration, actions, maxIterations: opts.maxIterations });
             if (!opts.nested)
                 writeProgressLog(projectContext.root || '', prompt, result, projectContext.name);
             return result;

package/dist/utils/diffPreview.js

@@ -283,7 +283,9 @@ export function createEditDiff(path, oldText, newText, projectRoot) {
         if (!content.includes(oldText)) {
             return null;
         }
-        const newContent = content.replace(oldText, newText);
+        // Literal replacement ($-safe): a plain-string replace would interpret
+        // $&, $1, $$ in newText and mis-render the diff.
+        const newContent = content.replace(oldText, () => newText);
         const hunks = generateDiff(content, newContent);
         return {
             path,

package/dist/utils/headlessReview.d.ts

@@ -0,0 +1,24 @@
+import { ReviewResult } from './codeReview.js';
+export type FailOn = 'error' | 'warning' | 'info' | 'none';
+export interface ReviewArgs {
+    files: string[];
+    json: boolean;
+    failOn: FailOn;
+    help: boolean;
+}
+export declare const REVIEW_HELP = "Usage: codeep review [options] [files...]\n\nRun a deterministic, offline code review (no API key required). With no files,\nreviews your unstaged git changes, falling back to a src/ scan when the tree is\nclean. Pass files (or let your CI pass the PR's changed files) to scope it.\n\nOptions:\n  --json              Print the result as JSON instead of the markdown report\n  --fail-on <level>   Exit non-zero when an issue at or above <level> is found:\n                      error | warning | info | none   (default: error)\n  -h, --help          Show this help\n\nExit code: 0 when nothing at/above --fail-on is found, 1 otherwise.";
+/** Parse `codeep review` argv (everything after the subcommand). Pure. */
+export declare function parseReviewArgs(argv: string[]): ReviewArgs;
+/** Exit code for a result under a fail-on threshold. Pure. */
+export declare function exitCodeForResult(result: ReviewResult, failOn: FailOn): number;
+export interface ReviewDeps {
+    /** Run the review over optional specific files. */
+    review: (files?: string[]) => ReviewResult;
+    /** Sink for the report (one call). */
+    write: (text: string) => void;
+}
+/**
+ * Orchestrate a headless review and return the process exit code. Side effects
+ * (filesystem, stdout) live behind `deps` so the flow is unit-testable.
+ */
+export declare function runHeadlessReview(argv: string[], deps?: ReviewDeps): number;

package/dist/utils/headlessReview.js

@@ -0,0 +1,91 @@
+// Headless `codeep review` — a non-interactive entry point around the
+// deterministic reviewer in codeReview.ts. No API key, no TUI: it scans, prints
+// a report (markdown or JSON), and exits non-zero when issues at/above a chosen
+// severity are found, so it drops cleanly into CI (e.g. a GitHub Action).
+import { performCodeReview, formatReviewResult } from './codeReview.js';
+const FAIL_ON_VALUES = ['error', 'warning', 'info', 'none'];
+// Higher = more severe. `suggestion` sits below `info` so `--fail-on info`
+// never trips on a mere suggestion.
+const SEVERITY_RANK = { suggestion: 0, info: 1, warning: 2, error: 3 };
+export const REVIEW_HELP = `Usage: codeep review [options] [files...]
+
+Run a deterministic, offline code review (no API key required). With no files,
+reviews your unstaged git changes, falling back to a src/ scan when the tree is
+clean. Pass files (or let your CI pass the PR's changed files) to scope it.
+
+Options:
+  --json              Print the result as JSON instead of the markdown report
+  --fail-on <level>   Exit non-zero when an issue at or above <level> is found:
+                      error | warning | info | none   (default: error)
+  -h, --help          Show this help
+
+Exit code: 0 when nothing at/above --fail-on is found, 1 otherwise.`;
+/** Parse `codeep review` argv (everything after the subcommand). Pure. */
+export function parseReviewArgs(argv) {
+    const out = { files: [], json: false, failOn: 'error', help: false };
+    for (let i = 0; i < argv.length; i++) {
+        const arg = argv[i];
+        if (arg === '--json') {
+            out.json = true;
+        }
+        else if (arg === '-h' || arg === '--help') {
+            out.help = true;
+        }
+        else if (arg === '--fail-on') {
+            const v = argv[++i];
+            if (FAIL_ON_VALUES.includes(v))
+                out.failOn = v;
+        }
+        else if (arg.startsWith('--fail-on=')) {
+            const v = arg.slice('--fail-on='.length);
+            if (FAIL_ON_VALUES.includes(v))
+                out.failOn = v;
+        }
+        else if (!arg.startsWith('-')) {
+            out.files.push(arg);
+        }
+        // Unknown flags are ignored so a future flag doesn't hard-fail old clients.
+    }
+    return out;
+}
+/** Exit code for a result under a fail-on threshold. Pure. */
+export function exitCodeForResult(result, failOn) {
+    if (failOn === 'none')
+        return 0;
+    const threshold = SEVERITY_RANK[failOn];
+    const tripped = result.issues.some((i) => (SEVERITY_RANK[i.severity] ?? 0) >= threshold);
+    return tripped ? 1 : 0;
+}
+/**
+ * Orchestrate a headless review and return the process exit code. Side effects
+ * (filesystem, stdout) live behind `deps` so the flow is unit-testable.
+ */
+export function runHeadlessReview(argv, deps = defaultDeps()) {
+    const args = parseReviewArgs(argv);
+    if (args.help) {
+        deps.write(REVIEW_HELP);
+        return 0;
+    }
+    const result = deps.review(args.files.length ? args.files : undefined);
+    deps.write(args.json ? JSON.stringify(result, null, 2) : formatReviewResult(result));
+    return exitCodeForResult(result, args.failOn);
+}
+// Only the reviewer's `.root` is read, so a minimal context rooted at cwd is
+// enough — no need for a full (slower) project scan just to lint.
+function minimalContext(root) {
+    return {
+        root,
+        name: root.split('/').pop() ?? 'workspace',
+        type: 'Unknown',
+        structure: '',
+        keyFiles: [],
+        fileCount: 0,
+        summary: `Workspace at ${root}`,
+    };
+}
+function defaultDeps() {
+    return {
+        review: (files) => performCodeReview(minimalContext(process.cwd()), files),
+        write: (text) => process.stdout.write(text + '\n'),
+    };
+}

package/dist/utils/projectIntelligence.js

@@ -126,6 +126,74 @@ export function saveProjectIntelligence(projectPath, intelligence) {
         return false;
     }
 }
+/**
+ * Complete default intelligence skeleton — every nested section is present so
+ * consumers (e.g. generateContextFromIntelligence) never dereference an
+ * undefined section. Used as the merge base when normalizing a loaded file.
+ */
+function createBaseIntelligence(projectPath) {
+    return {
+        version: INTELLIGENCE_VERSION,
+        scannedAt: new Date().toISOString(),
+        projectPath,
+        name: basename(projectPath),
+        type: 'Unknown',
+        description: '',
+        structure: {
+            totalFiles: 0,
+            totalDirectories: 0,
+            languages: {},
+            topDirectories: [],
+        },
+        dependencies: {
+            runtime: [],
+            dev: [],
+            frameworks: [],
+        },
+        keyFiles: [],
+        entryPoints: [],
+        scripts: {},
+        architecture: {
+            patterns: [],
+            mainModules: [],
+            ciSystem: null,
+            containerization: [],
+            monorepoTool: null,
+        },
+        conventions: {
+            indentation: 'spaces',
+            quotes: 'single',
+            semicolons: true,
+            namingStyle: 'camelCase',
+        },
+        testing: {
+            framework: null,
+            testDirectory: null,
+            hasTests: false,
+        },
+        notes: [],
+    };
+}
+/**
+ * Merge a loaded (possibly partial or older-schema) intelligence object over
+ * the complete default skeleton so every nested section is guaranteed present.
+ * An interrupted scan or an older CLI can write a file that is missing whole
+ * sections (e.g. `conventions`); without this, reading `conventions.indentation`
+ * downstream throws "Cannot read properties of undefined". Nested objects are
+ * merged per-section so partial sub-objects are also backfilled.
+ */
+function normalizeIntelligence(data, projectPath) {
+    const base = createBaseIntelligence(projectPath);
+    return {
+        ...base,
+        ...data,
+        structure: { ...base.structure, ...data.structure },
+        dependencies: { ...base.dependencies, ...data.dependencies },
+        architecture: { ...base.architecture, ...data.architecture },
+        conventions: { ...base.conventions, ...data.conventions },
+        testing: { ...base.testing, ...data.testing },
+    };
+}
 /**
  * Load intelligence from .codeep/intelligence.json
  */
@@ -135,9 +203,13 @@ export function loadProjectIntelligence(projectPath) {
         if (!existsSync(filePath))
             return null;
         const data = JSON.parse(readFileSync(filePath, 'utf-8'));
+        if (!data || typeof data !== 'object')
+            return null;
         if (data.version !== INTELLIGENCE_VERSION)
             return null;
-        return data;
+        // Backfill any missing sections so a partial/interrupted file can't crash
+        // downstream consumers that assume a complete shape.
+        return normalizeIntelligence(data, projectPath);
     }
     catch {
         return null;
@@ -159,6 +231,10 @@ export function isIntelligenceFresh(projectPath, maxAgeHours = 24) {
  * Generate AI-friendly context from intelligence
  */
 export function generateContextFromIntelligence(intelligence) {
+    // Defensive: backfill any missing sections so a partial object (e.g. from an
+    // older/interrupted scan, or an external SDK caller) can't crash the
+    // formatter on a nested dereference like `conventions.indentation`.
+    intelligence = normalizeIntelligence((intelligence ?? {}), intelligence?.projectPath ?? '');
     const lines = [];
     lines.push(`# Project: ${intelligence.name}`);
     lines.push(`Type: ${intelligence.type}`);

package/dist/utils/skills.js

@@ -741,7 +741,11 @@ function sanitizeForShell(text) {
 export function interpolateParams(content, params) {
     let result = content;
     for (const [key, value] of Object.entries(params)) {
-        result = result.replace(new RegExp(`\\$\\{${key}\\}`, 'g'), value);
+        // Literal find/replace-all via split+join. Avoids two bugs of the old
+        // regex form: a regex-meta char in `key` (e.g. `.`, `(`) breaking the match
+        // or throwing, and `$`-sequences in `value` ($&, $$, $1) being interpreted
+        // as replacement patterns and corrupting the output.
+        result = result.split('${' + key + '}').join(value);
     }
     return result;
 }

package/dist/utils/toolExecution.js

@@ -456,7 +456,10 @@ async function dispatchTool(tool, parameters, projectRoot, fs, toolCall) {
                     return { success: false, output: '', error: `old_text matches ${matchCount} locations in the file. Provide more surrounding context to make it unique (only 1 match allowed).`, tool, parameters };
                 }
                 recordEdit(validation.absolutePath);
-                const updated = content.replace(oldText, newText);
+                // Function replacer so newText is written literally — a plain-string
+                // replacement interprets $&, $1, $$ etc., which silently corrupts any
+                // edit whose new_text contains `$` (shell vars, template literals, regex).
+                const updated = content.replace(oldText, () => newText);
                 if (fs?.writeTextFile) {
                     try {
                         await fs.writeTextFile(validation.absolutePath, updated);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeep",
-  "version": "2.4.2",
+  "version": "2.5.1",
   "description": "AI-powered coding assistant built for the terminal. Multiple LLM providers, project-aware context, and a seamless development workflow.",
   "type": "module",
   "main": "dist/index.js",