codeep 2.5.1 → 2.6.0

package/dist/utils/reviewConfig.js

@@ -0,0 +1,129 @@
+/**
+ * Project-level review configuration: `.codeep/review.json`.
+ *
+ * Lets a repo extend the deterministic reviewer with its own rules, disable
+ * built-in rules by id, and scope which files are reviewed — all checked into
+ * the repo so the CLI (`codeep review`) and the GitHub Action enforce the same
+ * conventions with zero LLM cost. Loading is fully defensive: a missing,
+ * malformed, or partially-invalid config never throws — bad entries are skipped
+ * with a warning and the review proceeds with whatever is valid.
+ *
+ * Shape:
+ *   {
+ *     "rules": [
+ *       { "id": "no-foo", "pattern": "\\bfoo\\(", "flags": "gi",
+ *         "category": "bug", "severity": "warning",
+ *         "message": "Avoid foo()", "suggestion": "Use bar()",
+ *         "extensions": [".ts", ".js"] }
+ *     ],
+ *     "disable": ["eval-usage", "todo-comment"],
+ *     "include": ["src/**"],
+ *     "exclude": ["vendor/**", "dist/**"]
+ *   }
+ */
+import { existsSync, readFileSync } from 'fs';
+import { join } from 'path';
+const CONFIG_PATH = '.codeep/review.json';
+const MAX_RULES = 200;
+const VALID_CATEGORIES = [
+    'security', 'performance', 'maintainability', 'bug', 'style', 'types', 'best-practice', 'documentation',
+];
+const VALID_SEVERITIES = ['error', 'warning', 'info', 'suggestion'];
+/** Convert a simple glob (`**`, `*`, `?`) into an anchored RegExp over posix paths. */
+export function globToRegExp(glob) {
+    // Escape regex metacharacters but keep the glob wildcards * ? for translation.
+    // Function replacer (not `$&`) so a literal `$` in a path can't be mangled.
+    const escaped = glob.replace(/[.+^${}()|[\]\\]/g, (m) => '\\' + m);
+    // Plain ASCII sentinels that won't appear in a real glob; split/join avoids
+    // any `$`-replacement pitfalls when substituting the regex fragments.
+    const DSTAR_SLASH = '__CODEEP_DSTAR_SLASH__';
+    const DSTAR = '__CODEEP_DSTAR__';
+    const body = escaped
+        .replace(/\*\*\//g, DSTAR_SLASH) // **/ → zero or more directory segments
+        .replace(/\*\*/g, DSTAR) // **  → anything, including slashes
+        .replace(/\*/g, '[^/]*') // *   → within a single path segment
+        .replace(/\?/g, '[^/]') // ?   → a single non-slash char
+        .split(DSTAR_SLASH).join('(?:.*/)?')
+        .split(DSTAR).join('.*');
+    return new RegExp('^' + body + '$');
+}
+function asStringArray(v) {
+    return Array.isArray(v)
+        ? v.filter((x) => typeof x === 'string' && x.length > 0)
+        : [];
+}
+export function loadReviewConfig(projectRoot) {
+    const filePath = join(projectRoot, CONFIG_PATH);
+    if (!existsSync(filePath))
+        return null;
+    let data;
+    try {
+        data = JSON.parse(readFileSync(filePath, 'utf-8'));
+    }
+    catch {
+        console.warn(`[codeep] Ignoring ${CONFIG_PATH}: not valid JSON.`);
+        return null;
+    }
+    if (!data || typeof data !== 'object' || Array.isArray(data)) {
+        console.warn(`[codeep] Ignoring ${CONFIG_PATH}: expected a JSON object.`);
+        return null;
+    }
+    const cfg = data;
+    const disabled = new Set(asStringArray(cfg.disable));
+    const include = asStringArray(cfg.include);
+    const exclude = asStringArray(cfg.exclude);
+    const rules = [];
+    const rawRules = Array.isArray(cfg.rules) ? cfg.rules.slice(0, MAX_RULES) : [];
+    for (const raw of rawRules) {
+        if (!raw || typeof raw !== 'object')
+            continue;
+        const r = raw;
+        const id = typeof r.id === 'string' && r.id.trim() ? r.id.trim() : null;
+        const message = typeof r.message === 'string' && r.message.trim() ? r.message.trim() : null;
+        const patternSrc = typeof r.pattern === 'string' && r.pattern ? r.pattern : null;
+        if (!id || !message || !patternSrc) {
+            console.warn(`[codeep] Skipping a rule in ${CONFIG_PATH}: each rule needs id, pattern and message.`);
+            continue;
+        }
+        // Reject oversized patterns outright — keeps regex compilation/run bounded.
+        if (patternSrc.length > 1000) {
+            console.warn(`[codeep] Skipping rule "${id}" in ${CONFIG_PATH}: pattern is too long (>1000 chars).`);
+            continue;
+        }
+        // Conservative ReDoS screen: reject the classic catastrophic shape — a group
+        // ending in an unbounded quantifier that is itself quantified, e.g. (a+)+,
+        // (\d*)*, (.*)+, (x+){2,}. Not exhaustive (the GitHub Action also bounds
+        // wall-clock), but it blocks the common foot-guns in an untrusted review.json.
+        if (/\([^)]*[+*]\)\s*[+*{]/.test(patternSrc)) {
+            console.warn(`[codeep] Skipping rule "${id}" in ${CONFIG_PATH}: nested quantifiers risk catastrophic backtracking (ReDoS).`);
+            continue;
+        }
+        // Always include the global flag so every match in a file is found.
+        let flags = typeof r.flags === 'string' && /^[gimsuy]*$/.test(r.flags) ? r.flags : '';
+        if (!flags.includes('g'))
+            flags += 'g';
+        let pattern;
+        try {
+            pattern = new RegExp(patternSrc, flags);
+        }
+        catch {
+            console.warn(`[codeep] Skipping rule "${id}" in ${CONFIG_PATH}: invalid regex.`);
+            continue;
+        }
+        const category = VALID_CATEGORIES.includes(r.category)
+            ? r.category : 'best-practice';
+        const severity = VALID_SEVERITIES.includes(r.severity)
+            ? r.severity : 'warning';
+        const extensions = asStringArray(r.extensions);
+        rules.push({
+            id,
+            pattern,
+            category,
+            severity,
+            message,
+            suggestion: typeof r.suggestion === 'string' ? r.suggestion : undefined,
+            extensions: extensions.length ? extensions : undefined,
+        });
+    }
+    return { rules, disabled, include, exclude };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeep",
-  "version": "2.5.1",
+  "version": "2.6.0",
   "description": "AI-powered coding assistant built for the terminal. Multiple LLM providers, project-aware context, and a seamless development workflow.",
   "type": "module",
   "main": "dist/index.js",