codeep 2.5.1 → 2.6.0

package/dist/renderer/commands.js

@@ -5,7 +5,7 @@
  * decoupled from global state. Import-heavy commands use dynamic imports
  * to keep startup time low.
  */
-import { config, getCurrentProvider, getModelsForCurrentProvider, PROTOCOLS, LANGUAGES, setProvider, setApiKey, clearApiKey, getApiKey, saveSession, startNewSession, loadSession, listSessionsWithInfo, deleteSession, renameSession, setProjectPermission, saveProfile, loadProfile, applyProfile, listProfiles, deleteProfile, initializeAsProject, isManuallyInitializedProject, } from '../config/index.js';
+import { config, getCurrentProvider, getModelsForCurrentProvider, PROTOCOLS, LANGUAGES, setProvider, setApiKey, clearApiKey, getApiKey, isTelemetryEnabled, telemetryForcedOffByEnv, saveSession, startNewSession, loadSession, listSessionsWithInfo, deleteSession, renameSession, setProjectPermission, saveProfile, loadProfile, applyProfile, listProfiles, deleteProfile, initializeAsProject, isManuallyInitializedProject, } from '../config/index.js';
 import { getProjectContext } from '../utils/project.js';
 import { getCurrentVersion } from '../utils/update.js';
 import { getProviderList, getProvider } from '../config/providers.js';
@@ -245,6 +245,35 @@ export async function handleCommand(command, args, ctx) {
             ctx.app.addMessage({ role: 'system', content: lines.join('\n') });
             break;
         }
+        case 'telemetry': {
+            const sub = args[0]?.toLowerCase();
+            const envOff = telemetryForcedOffByEnv();
+            if (sub === 'on' || sub === 'off') {
+                if (envOff) {
+                    ctx.app.notify('Telemetry is forced OFF by CODEEP_NO_TELEMETRY / DO_NOT_TRACK — unset that env var to change it.');
+                    break;
+                }
+                config.set('telemetry', sub === 'on');
+                ctx.app.notify(sub === 'on'
+                    ? 'Telemetry on — usage stats, transcripts, progress & notes sync to codeep.dev.'
+                    : 'Telemetry off — no automatic cloud uploads.');
+                break;
+            }
+            if (sub && sub !== 'status') {
+                ctx.app.notify('Usage: /telemetry · /telemetry on · /telemetry off');
+                break;
+            }
+            const flag = config.get('telemetry') !== false;
+            const tLines = ['## Telemetry', ''];
+            tLines.push(`**State**      ${isTelemetryEnabled() ? 'on' : 'off'}`);
+            tLines.push(`**Flag**       telemetry = ${flag}`);
+            if (envOff)
+                tLines.push('**Env**        forced off by CODEEP_NO_TELEMETRY / DO_NOT_TRACK (overrides the flag)');
+            tLines.push('');
+            tLines.push('Toggle with `/telemetry on` or `/telemetry off`. Controls automatic uploads of usage stats, session transcripts, progress, and memory notes.');
+            ctx.app.addMessage({ role: 'system', content: tLines.join('\n') });
+            break;
+        }
         case 'grant': {
             setProjectPermission(ctx.projectPath, true, true);
             ctx.setHasWriteAccess(true);
@@ -880,8 +909,13 @@ Format: use headers per category, only include categories where you found issues
             ctx.app.showLogin(providers.map(p => ({ id: p.id, name: p.name, description: p.description, subscribeUrl: p.subscribeUrl, noApiKey: p.noApiKey })), async (result) => {
                 if (result) {
                     setProvider(result.providerId);
-                    await setApiKey(result.apiKey);
-                    ctx.app.notify('Logged in successfully');
+                    try {
+                        await setApiKey(result.apiKey);
+                        ctx.app.notify('Logged in successfully');
+                    }
+                    catch {
+                        ctx.app.notify('Could not save the API key (secure storage unavailable).');
+                    }
                 }
             });
             break;
@@ -901,11 +935,11 @@ Format: use headers per category, only include categories where you found issues
                     return;
                 if (result === 'all') {
                     for (const p of configuredProviders)
-                        clearApiKey(p.id);
+                        void clearApiKey(p.id);
                     ctx.app.notify('Logged out from all providers. Use /login to sign in.');
                 }
                 else {
-                    clearApiKey(result);
+                    void clearApiKey(result);
                     const provider = configuredProviders.find(p => p.id === result);
                     ctx.app.notify(`Logged out from ${provider?.name || result}`);
                     if (result === currentProvider.id) {

package/dist/renderer/main.js

@@ -278,7 +278,14 @@ async function showLoginFlow() {
                                 renderCurrentStep();
                                 return;
                             }
-                            await setApiKey(key);
+                            try {
+                                await setApiKey(key);
+                            }
+                            catch {
+                                loginError = 'Could not save the API key (secure storage unavailable). Please try again.';
+                                renderCurrentStep();
+                                return;
+                            }
                             cleanup();
                             resolve(key);
                         },
@@ -414,11 +421,15 @@ Commands (in chat):
         if (sub === 'sync' || sub === 'pull') {
             // Pull API keys from codeep.dev and save to local config
             const { pullKeys } = await import('../utils/codeepCloud.js');
-            const { getSyncToken, setApiKey } = await import('../config/index.js');
+            const { getSyncToken, setApiKey, loadAllApiKeys: loadKeys } = await import('../config/index.js');
             if (!getSyncToken()) {
                 console.log('\n  Not linked to codeep.dev. Run: codeep account\n');
                 process.exit(1);
             }
+            // Run the one-time plaintext->keychain migration BEFORE storing any pulled
+            // key. Otherwise the first setApiKey flips keysSecured=true and any local
+            // legacy plaintext keys would never migrate (orphaned, invisible).
+            await loadKeys();
             process.stdout.write('  Pulling keys from codeep.dev...');
             const keys = await pullKeys();
             if (!keys) {
@@ -430,10 +441,17 @@ Commands (in chat):
                 console.log(' no keys found.\n  Add keys at codeep.dev/dashboard');
             }
             else {
+                let synced = 0;
                 for (const [provider, key] of Object.entries(keys)) {
-                    setApiKey(key, provider);
+                    try {
+                        await setApiKey(key, provider);
+                        synced++;
+                    }
+                    catch {
+                        console.log(`\n  Warning: could not securely store the key for ${provider}.`);
+                    }
                 }
-                console.log(` synced ${count} key${count !== 1 ? 's' : ''}.`);
+                console.log(` synced ${synced} key${synced !== 1 ? 's' : ''}.`);
             }
             // Also pull portable personal config — personalities + custom commands +
             // the user profile. Additive merge (never clobbers local files).

package/dist/utils/agent.d.ts

@@ -13,6 +13,15 @@ import { undoLastAction, undoAllActions, getCurrentSession, getRecentSessions, f
 import { VerifyResult } from './verify';
 import { TaskPlan, SubTask } from './taskPlanner';
 export type PermissionOutcome = 'allow_once' | 'allow_always' | 'reject_once' | 'reject_always';
+export type PermissionDecision = 'allow-once' | 'allow-always' | 'deny-once' | 'deny-always';
+/**
+ * Map a permission outcome to a decision, FAILING CLOSED: a dangerous tool is
+ * allowed only on an explicit allow outcome. `reject_*` deny, and — critically —
+ * any unknown/malformed outcome from a buggy or hostile client also denies
+ * (deny-once) rather than slipping through to execution. Pure + exported so the
+ * invariant is unit-tested independently of the agent loop.
+ */
+export declare function classifyPermissionOutcome(outcome: string | undefined | null): PermissionDecision;
 export interface AgentOptions {
     maxIterations: number;
     maxDuration: number;

package/dist/utils/agent.js

@@ -103,6 +103,22 @@ function compressMessages(messages, actions) {
     debug(`Context compressed: ${totalChars} chars → keeping first + summary + last ${keep} messages`);
     return [firstMessage, summaryMessage, ...recentMessages];
 }
+/**
+ * Map a permission outcome to a decision, FAILING CLOSED: a dangerous tool is
+ * allowed only on an explicit allow outcome. `reject_*` deny, and — critically —
+ * any unknown/malformed outcome from a buggy or hostile client also denies
+ * (deny-once) rather than slipping through to execution. Pure + exported so the
+ * invariant is unit-tested independently of the agent loop.
+ */
+export function classifyPermissionOutcome(outcome) {
+    if (outcome === 'allow_always')
+        return 'allow-always';
+    if (outcome === 'allow_once')
+        return 'allow-once';
+    if (outcome === 'reject_always')
+        return 'deny-always';
+    return 'deny-once'; // 'reject_once' OR anything unexpected → fail closed
+}
 /**
  * Build the result for a run that paused at a safety limit. Pausing is a normal,
  * resumable state — not an error — so the summary tells the user how to resume.
@@ -779,15 +795,18 @@ export async function runAgent(prompt, projectContext, options = {}) {
                         continue;
                     }
                     const outcome = await opts.onRequestPermission(toolCall);
-                    if (outcome === 'allow_always') {
+                    // Fail CLOSED: allow ONLY on an explicit allow outcome; reject_* and
+                    // any malformed/unknown outcome deny (see classifyPermissionOutcome).
+                    const decision = classifyPermissionOutcome(outcome);
+                    if (decision === 'allow-always') {
                         alwaysAllowedTools.add(toolCall.tool);
                     }
-                    else if (outcome === 'reject_always') {
-                        alwaysRejectedTools.add(toolCall.tool);
-                        rejectResult();
-                        continue;
+                    else if (decision === 'allow-once') {
+                        // proceed this once
                     }
-                    else if (outcome === 'reject_once') {
+                    else {
+                        if (decision === 'deny-always')
+                            alwaysRejectedTools.add(toolCall.tool);
                         rejectResult();
                         continue;
                     }

package/dist/utils/codeReview.d.ts

@@ -28,6 +28,20 @@ export interface ReviewSummary {
     byCategory: Record<ReviewCategory, number>;
     bySeverity: Record<string, number>;
 }
+/**
+ * A single deterministic review rule. Built-in rules and user rules from
+ * `.codeep/review.json` share this shape. `id` is stable so a project can
+ * disable a built-in rule by id (see utils/reviewConfig.ts).
+ */
+export interface RuleDef {
+    id: string;
+    pattern: RegExp;
+    category: ReviewCategory;
+    severity: ReviewIssue['severity'];
+    message: string;
+    suggestion?: string;
+    extensions?: string[];
+}
 /**
  * Perform code review
  */

package/dist/utils/codeReview.js

@@ -4,10 +4,13 @@
 import { existsSync, readFileSync, readdirSync } from 'fs';
 import { join, extname, relative } from 'path';
 import { getChangedFiles } from './git.js';
-// Common code patterns that indicate issues
+import { loadReviewConfig, globToRegExp } from './reviewConfig.js';
+// Built-in code patterns that indicate issues. Each has a stable `id` so it can
+// be turned off per-project via `.codeep/review.json` { "disable": ["..."] }.
 const CODE_PATTERNS = [
     // Security issues
     {
+        id: 'eval-usage',
         pattern: /eval\s*\(/g,
         category: 'security',
         severity: 'error',
@@ -16,6 +19,7 @@ const CODE_PATTERNS = [
         extensions: ['.js', '.ts', '.jsx', '.tsx'],
     },
     {
+        id: 'inner-html',
         pattern: /innerHTML\s*=/g,
         category: 'security',
         severity: 'warning',
@@ -24,6 +28,7 @@ const CODE_PATTERNS = [
         extensions: ['.js', '.ts', '.jsx', '.tsx'],
     },
     {
+        id: 'dangerously-set-inner-html',
         pattern: /dangerouslySetInnerHTML/g,
         category: 'security',
         severity: 'warning',
@@ -32,6 +37,7 @@ const CODE_PATTERNS = [
         extensions: ['.jsx', '.tsx'],
     },
     {
+        id: 'hardcoded-password',
         pattern: /password\s*=\s*['"][^'"]+['"]/gi,
         category: 'security',
         severity: 'error',
@@ -39,6 +45,7 @@ const CODE_PATTERNS = [
         suggestion: 'Use environment variables for sensitive data',
     },
     {
+        id: 'hardcoded-api-key',
         pattern: /api[_-]?key\s*=\s*['"][^'"]+['"]/gi,
         category: 'security',
         severity: 'error',
@@ -47,6 +54,7 @@ const CODE_PATTERNS = [
     },
     // Performance issues
     {
+        id: 'foreach-await',
         pattern: /\.forEach\s*\([^)]*\)\s*{\s*await/g,
         category: 'performance',
         severity: 'warning',
@@ -55,6 +63,7 @@ const CODE_PATTERNS = [
         extensions: ['.js', '.ts', '.jsx', '.tsx'],
     },
     {
+        id: 'await-in-loop',
         pattern: /for\s*\([^)]+\)\s*{\s*await/g,
         category: 'performance',
         severity: 'info',
@@ -63,6 +72,7 @@ const CODE_PATTERNS = [
         extensions: ['.js', '.ts', '.jsx', '.tsx'],
     },
     {
+        id: 'select-star',
         pattern: /SELECT\s+\*/gi,
         category: 'performance',
         severity: 'warning',
@@ -71,6 +81,7 @@ const CODE_PATTERNS = [
     },
     // Bug-prone patterns
     {
+        id: 'loose-null-check',
         pattern: /==\s*null|null\s*==/g,
         category: 'bug',
         severity: 'info',
@@ -79,6 +90,7 @@ const CODE_PATTERNS = [
         extensions: ['.js', '.ts', '.jsx', '.tsx'],
     },
     {
+        id: 'empty-catch',
         pattern: /catch\s*\(\s*\w*\s*\)\s*{\s*}/g,
         category: 'bug',
         severity: 'warning',
@@ -86,6 +98,7 @@ const CODE_PATTERNS = [
         suggestion: 'Log the error or handle it appropriately',
     },
     {
+        id: 'console-statement',
         pattern: /console\.(log|debug|info|warn|error)\s*\(/g,
         category: 'maintainability',
         severity: 'info',
@@ -94,6 +107,7 @@ const CODE_PATTERNS = [
         extensions: ['.js', '.ts', '.jsx', '.tsx'],
     },
     {
+        id: 'todo-comment',
         pattern: /TODO|FIXME|HACK|XXX/g,
         category: 'maintainability',
         severity: 'info',
@@ -102,6 +116,7 @@ const CODE_PATTERNS = [
     },
     // Type safety
     {
+        id: 'any-type',
         pattern: /:\s*any\b/g,
         category: 'types',
         severity: 'warning',
@@ -110,6 +125,7 @@ const CODE_PATTERNS = [
         extensions: ['.ts', '.tsx'],
     },
     {
+        id: 'ts-ignore',
         pattern: /@ts-ignore/g,
         category: 'types',
         severity: 'warning',
@@ -118,6 +134,7 @@ const CODE_PATTERNS = [
         extensions: ['.ts', '.tsx'],
     },
     {
+        id: 'as-any',
         pattern: /as\s+any\b/g,
         category: 'types',
         severity: 'warning',
@@ -127,6 +144,7 @@ const CODE_PATTERNS = [
     },
     // Best practices
     {
+        id: 'var-usage',
         pattern: /var\s+\w+/g,
         category: 'best-practice',
         severity: 'info',
@@ -135,6 +153,7 @@ const CODE_PATTERNS = [
         extensions: ['.js', '.jsx'],
     },
     {
+        id: 'anonymous-function',
         pattern: /function\s*\(/g,
         category: 'style',
         severity: 'info',
@@ -144,6 +163,7 @@ const CODE_PATTERNS = [
     },
     // Documentation
     {
+        id: 'missing-jsdoc',
         pattern: /export\s+(default\s+)?(?:function|class|const)\s+\w+/g,
         category: 'documentation',
         severity: 'suggestion',
@@ -155,22 +175,31 @@ const CODE_PATTERNS = [
 /**
  * Analyze a single file for issues
  */
-function analyzeFile(filePath, content, projectRoot) {
+function analyzeFile(filePath, content, projectRoot, rules, disabled) {
     const issues = [];
     const ext = extname(filePath);
     const relativePath = relative(projectRoot, filePath);
     const lines = content.split('\n');
-    for (const pattern of CODE_PATTERNS) {
+    // Skip the regex pass on very large files (the cheap line-count heuristics
+    // below still run) so an oversized file can't stall the reviewer. NOTE: this
+    // bounds input SIZE only, not regex run-time — catastrophic backtracking is a
+    // function of pattern shape. Untrusted custom rules from .codeep/review.json
+    // are additionally screened at load (utils/reviewConfig.ts) and the GitHub
+    // Action caps wall-clock, but a zero-width match is guarded right here.
+    const scannable = content.length <= 2_000_000 ? content : '';
+    const MAX_MATCHES_PER_RULE = 1000;
+    for (const pattern of rules) {
         // Skip if pattern doesn't apply to this file type
         if (pattern.extensions && !pattern.extensions.includes(ext)) {
             continue;
         }
         // Find all matches
         let match;
+        let count = 0;
         const regex = new RegExp(pattern.pattern.source, pattern.pattern.flags);
-        while ((match = regex.exec(content)) !== null) {
+        while ((match = regex.exec(scannable)) !== null) {
             // Find line number
-            const beforeMatch = content.slice(0, match.index);
+            const beforeMatch = scannable.slice(0, match.index);
             const lineNumber = beforeMatch.split('\n').length;
             issues.push({
                 file: relativePath,
@@ -180,10 +209,17 @@ function analyzeFile(filePath, content, projectRoot) {
                 message: pattern.message,
                 suggestion: pattern.suggestion,
             });
+            // A zero-width match (e.g. a custom rule like `a?` or `(?:)`) leaves
+            // lastIndex unchanged, so exec() would return it forever — advance past it.
+            if (match.index === regex.lastIndex)
+                regex.lastIndex++;
+            // Bound pathological match floods (also caps the per-match work above).
+            if (++count >= MAX_MATCHES_PER_RULE)
+                break;
         }
     }
     // Check for long files
-    if (lines.length > 500) {
+    if (!disabled.has('long-file') && lines.length > 500) {
         issues.push({
             file: relativePath,
             severity: 'info',
@@ -194,7 +230,8 @@ function analyzeFile(filePath, content, projectRoot) {
     // Check for long functions (basic heuristic)
     let braceDepth = 0;
     let functionStart = -1;
-    for (let i = 0; i < lines.length; i++) {
+    const checkLongFunctions = !disabled.has('long-function');
+    for (let i = 0; checkLongFunctions && i < lines.length; i++) {
         const line = lines[i];
         if (/function\s+\w+|=>\s*{|\)\s*{/.test(line)) {
             if (braceDepth === 0) {
@@ -278,7 +315,28 @@ function getAllSourceFiles(dir, maxFiles = 50) {
  */
 export function performCodeReview(projectContext, specificFiles) {
     const projectRoot = projectContext.root || process.cwd();
-    const filesToReview = getFilesToReview(projectRoot, specificFiles);
+    // Project-level config (.codeep/review.json): custom rules, disabled built-in
+    // ids, and include/exclude globs. Absent/invalid → defaults (built-ins only).
+    const config = loadReviewConfig(projectRoot);
+    const disabled = config?.disabled ?? new Set();
+    const effectiveRules = [
+        ...CODE_PATTERNS.filter((p) => !disabled.has(p.id)),
+        ...(config?.rules ?? []),
+    ];
+    let filesToReview = getFilesToReview(projectRoot, specificFiles);
+    // Apply include/exclude globs (posix-relative paths). Empty include = all.
+    if (config && (config.include.length > 0 || config.exclude.length > 0)) {
+        const inc = config.include.map(globToRegExp);
+        const exc = config.exclude.map(globToRegExp);
+        filesToReview = filesToReview.filter((f) => {
+            const rel = relative(projectRoot, f).split('\\').join('/');
+            if (inc.length > 0 && !inc.some((re) => re.test(rel)))
+                return false;
+            if (exc.some((re) => re.test(rel)))
+                return false;
+            return true;
+        });
+    }
     const allIssues = [];
     // Determine scope — mirrors the branching in getFilesToReview so the user
     // sees exactly which branch ran.
@@ -295,7 +353,7 @@ export function performCodeReview(projectContext, specificFiles) {
     for (const filePath of filesToReview) {
         try {
             const content = readFileSync(filePath, 'utf-8');
-            const issues = analyzeFile(filePath, content, projectRoot);
+            const issues = analyzeFile(filePath, content, projectRoot, effectiveRules, disabled);
             allIssues.push(...issues);
         }
         catch { }

package/dist/utils/codeepCloud.js

@@ -7,7 +7,7 @@
  */
 import { randomBytes, createHash } from 'crypto';
 import { spawn } from 'child_process';
-import { getGithubId, getSyncToken, setGithubAccount, setSyncToken, getDeviceId } from '../config/index.js';
+import { getGithubId, getSyncToken, setGithubAccount, setSyncToken, getDeviceId, isTelemetryEnabled } from '../config/index.js';
 import { hostname } from 'os';
 const API_BASE = 'https://codeep.dev';
 const POLL_INTERVAL_MS = 2000;
@@ -110,6 +110,8 @@ export function generateProjectId(projectRoot) {
  * Retries up to 2 times on network errors or 5xx responses.
  */
 export function reportStats(payload) {
+    if (!isTelemetryEnabled())
+        return; // user opted out of automatic uploads
     const githubId = getGithubId();
     if (!githubId)
         return; // not linked, skip silently
@@ -124,6 +126,8 @@ export function reportStats(payload) {
     }).catch(() => { });
 }
 export async function reportStatsAsync(payload) {
+    if (!isTelemetryEnabled())
+        return; // user opted out of automatic uploads
     const githubId = getGithubId();
     if (!githubId)
         return;
@@ -320,6 +324,8 @@ export const pushCommands = () => pushBundle('commands');
  * Fire-and-forget. Only sends if linked and sync_token is available.
  */
 export function syncSession(payload) {
+    if (!isTelemetryEnabled())
+        return; // user opted out of conversation/session upload
     const githubId = getGithubId();
     const syncToken = getSyncToken();
     if (!githubId || !syncToken)
@@ -335,6 +341,8 @@ export function syncSession(payload) {
     }).catch(() => { });
 }
 export async function syncSessionAsync(payload) {
+    if (!isTelemetryEnabled())
+        return; // user opted out of conversation/session upload
     const githubId = getGithubId();
     const syncToken = getSyncToken();
     if (!githubId || !syncToken)
@@ -354,6 +362,8 @@ export async function syncSessionAsync(payload) {
  * Fire-and-forget. Only sends if linked (githubId + syncToken).
  */
 export function syncProgress(payload) {
+    if (!isTelemetryEnabled())
+        return; // user opted out of automatic uploads
     const githubId = getGithubId();
     const syncToken = getSyncToken();
     if (!githubId || !syncToken)
@@ -483,6 +493,8 @@ export async function pullUserProfile() {
     }
 }
 export async function syncMemoryNotes(projectName, notes) {
+    if (!isTelemetryEnabled())
+        return; // user opted out of automatic uploads
     const syncToken = getSyncToken();
     if (!syncToken)
         return;

package/dist/utils/keychain.js

@@ -1,10 +1,23 @@
 import { logger } from './logger.js';
-// keytar is a native addon — load dynamically so compiled binaries fall back gracefully
-let keytar = null;
-try {
-    keytar = (await import('keytar')).default;
+// keytar is a native addon — load it LAZILY (on first use), never at module
+// top level. A top-level `await import()` here gives the module a top-level
+// await, which makes `bun build --compile` reject any CommonJS require() that
+// transitively depends on this file (renderer/main.js → codeepCloud → config →
+// keychain). Lazy loading keeps the module side-effect-free at import time.
+let _keytar = null;
+let _keytarTried = false;
+async function loadKeytar() {
+    if (!_keytarTried) {
+        _keytarTried = true;
+        try {
+            _keytar = (await import('keytar')).default;
+        }
+        catch {
+            _keytar = null; /* native addon unavailable */
+        }
+    }
+    return _keytar;
 }
-catch { /* native addon unavailable */ }
 const SERVICE_NAME = 'codeep';
 class KeychainStorage {
     getAccountName(providerId) {
@@ -12,9 +25,11 @@ class KeychainStorage {
     }
     async getApiKey(providerId) {
         try {
+            const kt = await loadKeytar();
+            if (!kt)
+                return null;
             const account = this.getAccountName(providerId);
-            const password = await keytar.getPassword(SERVICE_NAME, account);
-            return password;
+            return await kt.getPassword(SERVICE_NAME, account);
         }
         catch (error) {
             logger.debug(`Failed to get API key from keychain: ${error}`);
@@ -23,8 +38,11 @@ class KeychainStorage {
     }
     async setApiKey(providerId, apiKey) {
         try {
+            const kt = await loadKeytar();
+            if (!kt)
+                throw new Error('keytar unavailable');
             const account = this.getAccountName(providerId);
-            await keytar.setPassword(SERVICE_NAME, account, apiKey);
+            await kt.setPassword(SERVICE_NAME, account, apiKey);
         }
         catch (error) {
             throw new Error(`Failed to store API key in keychain: ${error}`);
@@ -32,8 +50,11 @@ class KeychainStorage {
     }
     async deleteApiKey(providerId) {
         try {
+            const kt = await loadKeytar();
+            if (!kt)
+                return;
             const account = this.getAccountName(providerId);
-            await keytar.deletePassword(SERVICE_NAME, account);
+            await kt.deletePassword(SERVICE_NAME, account);
         }
         catch (error) {
             logger.debug(`Failed to delete API key from keychain: ${error}`);
@@ -89,10 +110,11 @@ class SmartStorage {
             return;
         try {
             const testKey = '__codeep_test__';
-            if (!keytar)
+            const kt = await loadKeytar();
+            if (!kt)
                 throw new Error('keytar unavailable');
-            await keytar.setPassword(SERVICE_NAME, testKey, 'test');
-            await keytar.deletePassword(SERVICE_NAME, testKey);
+            await kt.setPassword(SERVICE_NAME, testKey, 'test');
+            await kt.deletePassword(SERVICE_NAME, testKey);
             this.useKeychain = true;
         }
         catch {

package/dist/utils/reviewConfig.d.ts

@@ -0,0 +1,10 @@
+import type { RuleDef } from './codeReview';
+export interface ReviewConfig {
+    rules: RuleDef[];
+    disabled: Set<string>;
+    include: string[];
+    exclude: string[];
+}
+/** Convert a simple glob (`**`, `*`, `?`) into an anchored RegExp over posix paths. */
+export declare function globToRegExp(glob: string): RegExp;
+export declare function loadReviewConfig(projectRoot: string): ReviewConfig | null;