codeep 2.5.2 → 2.6.0

package/README.md

@@ -217,6 +217,43 @@ AI-powered review of your git diff with `/review`:
 
 If there are no git changes, falls back to static analysis automatically.
 
+#### Custom rules (`.codeep/review.json`)
+
+The static reviewer (`codeep review` / `/review --static`) ships a set of
+built-in rules, but a project can tailor them — check a `.codeep/review.json`
+into the repo and the CLI **and** the [Codeep GitHub Action](https://github.com/VladoIvankovic/codeep-action)
+both pick it up automatically (zero LLM cost):
+
+```json
+{
+  "rules": [
+    {
+      "id": "no-internal-import",
+      "pattern": "from ['\"]@acme/internal",
+      "category": "best-practice",
+      "severity": "error",
+      "message": "Don't import from @acme/internal outside the platform team",
+      "suggestion": "Use the public @acme/sdk package",
+      "extensions": [".ts", ".tsx"]
+    }
+  ],
+  "disable": ["todo-comment", "anonymous-function"],
+  "include": ["src/**"],
+  "exclude": ["**/*.test.ts", "vendor/**"]
+}
+```
+
+- **`rules`** — your own checks. `id`, `pattern` (a regex string), and `message`
+  are required; `flags` (default `g`), `category`, `severity`
+  (`error|warning|info|suggestion`), `suggestion`, and `extensions` are optional.
+- **`disable`** — turn off built-in rules by id (e.g. `eval-usage`,
+  `hardcoded-password`, `todo-comment`, `any-type`, `console-statement`,
+  `long-file`, `long-function`, …).
+- **`include` / `exclude`** — glob scoping (`**`, `*`, `?`); `include` empty = all files.
+
+A missing, malformed, or partially-invalid config never breaks a review — bad
+entries are skipped and the run proceeds with whatever is valid.
+
 ### Interactive Mode
 Agent asks clarifying questions when tasks are ambiguous:
 ```

package/dist/utils/codeReview.d.ts

@@ -28,6 +28,20 @@ export interface ReviewSummary {
     byCategory: Record<ReviewCategory, number>;
     bySeverity: Record<string, number>;
 }
+/**
+ * A single deterministic review rule. Built-in rules and user rules from
+ * `.codeep/review.json` share this shape. `id` is stable so a project can
+ * disable a built-in rule by id (see utils/reviewConfig.ts).
+ */
+export interface RuleDef {
+    id: string;
+    pattern: RegExp;
+    category: ReviewCategory;
+    severity: ReviewIssue['severity'];
+    message: string;
+    suggestion?: string;
+    extensions?: string[];
+}
 /**
  * Perform code review
  */

package/dist/utils/codeReview.js

@@ -4,10 +4,13 @@
 import { existsSync, readFileSync, readdirSync } from 'fs';
 import { join, extname, relative } from 'path';
 import { getChangedFiles } from './git.js';
-// Common code patterns that indicate issues
+import { loadReviewConfig, globToRegExp } from './reviewConfig.js';
+// Built-in code patterns that indicate issues. Each has a stable `id` so it can
+// be turned off per-project via `.codeep/review.json` { "disable": ["..."] }.
 const CODE_PATTERNS = [
     // Security issues
     {
+        id: 'eval-usage',
         pattern: /eval\s*\(/g,
         category: 'security',
         severity: 'error',
@@ -16,6 +19,7 @@ const CODE_PATTERNS = [
         extensions: ['.js', '.ts', '.jsx', '.tsx'],
     },
     {
+        id: 'inner-html',
         pattern: /innerHTML\s*=/g,
         category: 'security',
         severity: 'warning',
@@ -24,6 +28,7 @@ const CODE_PATTERNS = [
         extensions: ['.js', '.ts', '.jsx', '.tsx'],
     },
     {
+        id: 'dangerously-set-inner-html',
         pattern: /dangerouslySetInnerHTML/g,
         category: 'security',
         severity: 'warning',
@@ -32,6 +37,7 @@ const CODE_PATTERNS = [
         extensions: ['.jsx', '.tsx'],
     },
     {
+        id: 'hardcoded-password',
         pattern: /password\s*=\s*['"][^'"]+['"]/gi,
         category: 'security',
         severity: 'error',
@@ -39,6 +45,7 @@ const CODE_PATTERNS = [
         suggestion: 'Use environment variables for sensitive data',
     },
     {
+        id: 'hardcoded-api-key',
         pattern: /api[_-]?key\s*=\s*['"][^'"]+['"]/gi,
         category: 'security',
         severity: 'error',
@@ -47,6 +54,7 @@ const CODE_PATTERNS = [
     },
     // Performance issues
     {
+        id: 'foreach-await',
         pattern: /\.forEach\s*\([^)]*\)\s*{\s*await/g,
         category: 'performance',
         severity: 'warning',
@@ -55,6 +63,7 @@ const CODE_PATTERNS = [
         extensions: ['.js', '.ts', '.jsx', '.tsx'],
     },
     {
+        id: 'await-in-loop',
         pattern: /for\s*\([^)]+\)\s*{\s*await/g,
         category: 'performance',
         severity: 'info',
@@ -63,6 +72,7 @@ const CODE_PATTERNS = [
         extensions: ['.js', '.ts', '.jsx', '.tsx'],
     },
     {
+        id: 'select-star',
         pattern: /SELECT\s+\*/gi,
         category: 'performance',
         severity: 'warning',
@@ -71,6 +81,7 @@ const CODE_PATTERNS = [
     },
     // Bug-prone patterns
     {
+        id: 'loose-null-check',
         pattern: /==\s*null|null\s*==/g,
         category: 'bug',
         severity: 'info',
@@ -79,6 +90,7 @@ const CODE_PATTERNS = [
         extensions: ['.js', '.ts', '.jsx', '.tsx'],
     },
     {
+        id: 'empty-catch',
         pattern: /catch\s*\(\s*\w*\s*\)\s*{\s*}/g,
         category: 'bug',
         severity: 'warning',
@@ -86,6 +98,7 @@ const CODE_PATTERNS = [
         suggestion: 'Log the error or handle it appropriately',
     },
     {
+        id: 'console-statement',
         pattern: /console\.(log|debug|info|warn|error)\s*\(/g,
         category: 'maintainability',
         severity: 'info',
@@ -94,6 +107,7 @@ const CODE_PATTERNS = [
         extensions: ['.js', '.ts', '.jsx', '.tsx'],
     },
     {
+        id: 'todo-comment',
         pattern: /TODO|FIXME|HACK|XXX/g,
         category: 'maintainability',
         severity: 'info',
@@ -102,6 +116,7 @@ const CODE_PATTERNS = [
     },
     // Type safety
     {
+        id: 'any-type',
         pattern: /:\s*any\b/g,
         category: 'types',
         severity: 'warning',
@@ -110,6 +125,7 @@ const CODE_PATTERNS = [
         extensions: ['.ts', '.tsx'],
     },
     {
+        id: 'ts-ignore',
         pattern: /@ts-ignore/g,
         category: 'types',
         severity: 'warning',
@@ -118,6 +134,7 @@ const CODE_PATTERNS = [
         extensions: ['.ts', '.tsx'],
     },
     {
+        id: 'as-any',
         pattern: /as\s+any\b/g,
         category: 'types',
         severity: 'warning',
@@ -127,6 +144,7 @@ const CODE_PATTERNS = [
     },
     // Best practices
     {
+        id: 'var-usage',
         pattern: /var\s+\w+/g,
         category: 'best-practice',
         severity: 'info',
@@ -135,6 +153,7 @@ const CODE_PATTERNS = [
         extensions: ['.js', '.jsx'],
     },
     {
+        id: 'anonymous-function',
         pattern: /function\s*\(/g,
         category: 'style',
         severity: 'info',
@@ -144,6 +163,7 @@ const CODE_PATTERNS = [
     },
     // Documentation
     {
+        id: 'missing-jsdoc',
         pattern: /export\s+(default\s+)?(?:function|class|const)\s+\w+/g,
         category: 'documentation',
         severity: 'suggestion',
@@ -155,22 +175,31 @@ const CODE_PATTERNS = [
 /**
  * Analyze a single file for issues
  */
-function analyzeFile(filePath, content, projectRoot) {
+function analyzeFile(filePath, content, projectRoot, rules, disabled) {
     const issues = [];
     const ext = extname(filePath);
     const relativePath = relative(projectRoot, filePath);
     const lines = content.split('\n');
-    for (const pattern of CODE_PATTERNS) {
+    // Skip the regex pass on very large files (the cheap line-count heuristics
+    // below still run) so an oversized file can't stall the reviewer. NOTE: this
+    // bounds input SIZE only, not regex run-time — catastrophic backtracking is a
+    // function of pattern shape. Untrusted custom rules from .codeep/review.json
+    // are additionally screened at load (utils/reviewConfig.ts) and the GitHub
+    // Action caps wall-clock, but a zero-width match is guarded right here.
+    const scannable = content.length <= 2_000_000 ? content : '';
+    const MAX_MATCHES_PER_RULE = 1000;
+    for (const pattern of rules) {
         // Skip if pattern doesn't apply to this file type
         if (pattern.extensions && !pattern.extensions.includes(ext)) {
             continue;
         }
         // Find all matches
         let match;
+        let count = 0;
         const regex = new RegExp(pattern.pattern.source, pattern.pattern.flags);
-        while ((match = regex.exec(content)) !== null) {
+        while ((match = regex.exec(scannable)) !== null) {
             // Find line number
-            const beforeMatch = content.slice(0, match.index);
+            const beforeMatch = scannable.slice(0, match.index);
             const lineNumber = beforeMatch.split('\n').length;
             issues.push({
                 file: relativePath,
@@ -180,10 +209,17 @@ function analyzeFile(filePath, content, projectRoot) {
                 message: pattern.message,
                 suggestion: pattern.suggestion,
             });
+            // A zero-width match (e.g. a custom rule like `a?` or `(?:)`) leaves
+            // lastIndex unchanged, so exec() would return it forever — advance past it.
+            if (match.index === regex.lastIndex)
+                regex.lastIndex++;
+            // Bound pathological match floods (also caps the per-match work above).
+            if (++count >= MAX_MATCHES_PER_RULE)
+                break;
         }
     }
     // Check for long files
-    if (lines.length > 500) {
+    if (!disabled.has('long-file') && lines.length > 500) {
         issues.push({
             file: relativePath,
             severity: 'info',
@@ -194,7 +230,8 @@ function analyzeFile(filePath, content, projectRoot) {
     // Check for long functions (basic heuristic)
     let braceDepth = 0;
     let functionStart = -1;
-    for (let i = 0; i < lines.length; i++) {
+    const checkLongFunctions = !disabled.has('long-function');
+    for (let i = 0; checkLongFunctions && i < lines.length; i++) {
         const line = lines[i];
         if (/function\s+\w+|=>\s*{|\)\s*{/.test(line)) {
             if (braceDepth === 0) {
@@ -278,7 +315,28 @@ function getAllSourceFiles(dir, maxFiles = 50) {
  */
 export function performCodeReview(projectContext, specificFiles) {
     const projectRoot = projectContext.root || process.cwd();
-    const filesToReview = getFilesToReview(projectRoot, specificFiles);
+    // Project-level config (.codeep/review.json): custom rules, disabled built-in
+    // ids, and include/exclude globs. Absent/invalid → defaults (built-ins only).
+    const config = loadReviewConfig(projectRoot);
+    const disabled = config?.disabled ?? new Set();
+    const effectiveRules = [
+        ...CODE_PATTERNS.filter((p) => !disabled.has(p.id)),
+        ...(config?.rules ?? []),
+    ];
+    let filesToReview = getFilesToReview(projectRoot, specificFiles);
+    // Apply include/exclude globs (posix-relative paths). Empty include = all.
+    if (config && (config.include.length > 0 || config.exclude.length > 0)) {
+        const inc = config.include.map(globToRegExp);
+        const exc = config.exclude.map(globToRegExp);
+        filesToReview = filesToReview.filter((f) => {
+            const rel = relative(projectRoot, f).split('\\').join('/');
+            if (inc.length > 0 && !inc.some((re) => re.test(rel)))
+                return false;
+            if (exc.some((re) => re.test(rel)))
+                return false;
+            return true;
+        });
+    }
     const allIssues = [];
     // Determine scope — mirrors the branching in getFilesToReview so the user
     // sees exactly which branch ran.
@@ -295,7 +353,7 @@ export function performCodeReview(projectContext, specificFiles) {
     for (const filePath of filesToReview) {
         try {
             const content = readFileSync(filePath, 'utf-8');
-            const issues = analyzeFile(filePath, content, projectRoot);
+            const issues = analyzeFile(filePath, content, projectRoot, effectiveRules, disabled);
             allIssues.push(...issues);
         }
         catch { }

package/dist/utils/reviewConfig.d.ts

@@ -0,0 +1,10 @@
+import type { RuleDef } from './codeReview';
+export interface ReviewConfig {
+    rules: RuleDef[];
+    disabled: Set<string>;
+    include: string[];
+    exclude: string[];
+}
+/** Convert a simple glob (`**`, `*`, `?`) into an anchored RegExp over posix paths. */
+export declare function globToRegExp(glob: string): RegExp;
+export declare function loadReviewConfig(projectRoot: string): ReviewConfig | null;

package/dist/utils/reviewConfig.js

@@ -0,0 +1,129 @@
+/**
+ * Project-level review configuration: `.codeep/review.json`.
+ *
+ * Lets a repo extend the deterministic reviewer with its own rules, disable
+ * built-in rules by id, and scope which files are reviewed — all checked into
+ * the repo so the CLI (`codeep review`) and the GitHub Action enforce the same
+ * conventions with zero LLM cost. Loading is fully defensive: a missing,
+ * malformed, or partially-invalid config never throws — bad entries are skipped
+ * with a warning and the review proceeds with whatever is valid.
+ *
+ * Shape:
+ *   {
+ *     "rules": [
+ *       { "id": "no-foo", "pattern": "\\bfoo\\(", "flags": "gi",
+ *         "category": "bug", "severity": "warning",
+ *         "message": "Avoid foo()", "suggestion": "Use bar()",
+ *         "extensions": [".ts", ".js"] }
+ *     ],
+ *     "disable": ["eval-usage", "todo-comment"],
+ *     "include": ["src/**"],
+ *     "exclude": ["vendor/**", "dist/**"]
+ *   }
+ */
+import { existsSync, readFileSync } from 'fs';
+import { join } from 'path';
+const CONFIG_PATH = '.codeep/review.json';
+const MAX_RULES = 200;
+const VALID_CATEGORIES = [
+    'security', 'performance', 'maintainability', 'bug', 'style', 'types', 'best-practice', 'documentation',
+];
+const VALID_SEVERITIES = ['error', 'warning', 'info', 'suggestion'];
+/** Convert a simple glob (`**`, `*`, `?`) into an anchored RegExp over posix paths. */
+export function globToRegExp(glob) {
+    // Escape regex metacharacters but keep the glob wildcards * ? for translation.
+    // Function replacer (not `$&`) so a literal `$` in a path can't be mangled.
+    const escaped = glob.replace(/[.+^${}()|[\]\\]/g, (m) => '\\' + m);
+    // Plain ASCII sentinels that won't appear in a real glob; split/join avoids
+    // any `$`-replacement pitfalls when substituting the regex fragments.
+    const DSTAR_SLASH = '__CODEEP_DSTAR_SLASH__';
+    const DSTAR = '__CODEEP_DSTAR__';
+    const body = escaped
+        .replace(/\*\*\//g, DSTAR_SLASH) // **/ → zero or more directory segments
+        .replace(/\*\*/g, DSTAR) // **  → anything, including slashes
+        .replace(/\*/g, '[^/]*') // *   → within a single path segment
+        .replace(/\?/g, '[^/]') // ?   → a single non-slash char
+        .split(DSTAR_SLASH).join('(?:.*/)?')
+        .split(DSTAR).join('.*');
+    return new RegExp('^' + body + '$');
+}
+function asStringArray(v) {
+    return Array.isArray(v)
+        ? v.filter((x) => typeof x === 'string' && x.length > 0)
+        : [];
+}
+export function loadReviewConfig(projectRoot) {
+    const filePath = join(projectRoot, CONFIG_PATH);
+    if (!existsSync(filePath))
+        return null;
+    let data;
+    try {
+        data = JSON.parse(readFileSync(filePath, 'utf-8'));
+    }
+    catch {
+        console.warn(`[codeep] Ignoring ${CONFIG_PATH}: not valid JSON.`);
+        return null;
+    }
+    if (!data || typeof data !== 'object' || Array.isArray(data)) {
+        console.warn(`[codeep] Ignoring ${CONFIG_PATH}: expected a JSON object.`);
+        return null;
+    }
+    const cfg = data;
+    const disabled = new Set(asStringArray(cfg.disable));
+    const include = asStringArray(cfg.include);
+    const exclude = asStringArray(cfg.exclude);
+    const rules = [];
+    const rawRules = Array.isArray(cfg.rules) ? cfg.rules.slice(0, MAX_RULES) : [];
+    for (const raw of rawRules) {
+        if (!raw || typeof raw !== 'object')
+            continue;
+        const r = raw;
+        const id = typeof r.id === 'string' && r.id.trim() ? r.id.trim() : null;
+        const message = typeof r.message === 'string' && r.message.trim() ? r.message.trim() : null;
+        const patternSrc = typeof r.pattern === 'string' && r.pattern ? r.pattern : null;
+        if (!id || !message || !patternSrc) {
+            console.warn(`[codeep] Skipping a rule in ${CONFIG_PATH}: each rule needs id, pattern and message.`);
+            continue;
+        }
+        // Reject oversized patterns outright — keeps regex compilation/run bounded.
+        if (patternSrc.length > 1000) {
+            console.warn(`[codeep] Skipping rule "${id}" in ${CONFIG_PATH}: pattern is too long (>1000 chars).`);
+            continue;
+        }
+        // Conservative ReDoS screen: reject the classic catastrophic shape — a group
+        // ending in an unbounded quantifier that is itself quantified, e.g. (a+)+,
+        // (\d*)*, (.*)+, (x+){2,}. Not exhaustive (the GitHub Action also bounds
+        // wall-clock), but it blocks the common foot-guns in an untrusted review.json.
+        if (/\([^)]*[+*]\)\s*[+*{]/.test(patternSrc)) {
+            console.warn(`[codeep] Skipping rule "${id}" in ${CONFIG_PATH}: nested quantifiers risk catastrophic backtracking (ReDoS).`);
+            continue;
+        }
+        // Always include the global flag so every match in a file is found.
+        let flags = typeof r.flags === 'string' && /^[gimsuy]*$/.test(r.flags) ? r.flags : '';
+        if (!flags.includes('g'))
+            flags += 'g';
+        let pattern;
+        try {
+            pattern = new RegExp(patternSrc, flags);
+        }
+        catch {
+            console.warn(`[codeep] Skipping rule "${id}" in ${CONFIG_PATH}: invalid regex.`);
+            continue;
+        }
+        const category = VALID_CATEGORIES.includes(r.category)
+            ? r.category : 'best-practice';
+        const severity = VALID_SEVERITIES.includes(r.severity)
+            ? r.severity : 'warning';
+        const extensions = asStringArray(r.extensions);
+        rules.push({
+            id,
+            pattern,
+            category,
+            severity,
+            message,
+            suggestion: typeof r.suggestion === 'string' ? r.suggestion : undefined,
+            extensions: extensions.length ? extensions : undefined,
+        });
+    }
+    return { rules, disabled, include, exclude };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeep",
-  "version": "2.5.2",
+  "version": "2.6.0",
   "description": "AI-powered coding assistant built for the terminal. Multiple LLM providers, project-aware context, and a seamless development workflow.",
   "type": "module",
   "main": "dist/index.js",