codeep 3.3.3 → 3.4.1

package/dist/utils/agentChat.js

@@ -11,9 +11,11 @@
  *   AgentChatResponse        — response type (re-export from agentStream)
  *   TimeoutError             — distinguishes timeout from user abort
  */
-import { existsSync, readFileSync, writeFileSync } from 'fs';
+import { existsSync, readFileSync, statSync, openSync, readSync, closeSync } from 'fs';
 import { join } from 'path';
+import { StringDecoder } from 'string_decoder';
 import { createHash } from 'crypto';
+import { UnsafeProjectPathError, leadsOutsideProject, writeProjectFile } from './projectPaths.js';
 import { config, getApiKey, resolveBaseUrl } from '../config/index.js';
 import { loadProjectIntelligence, generateContextFromIntelligence } from './projectIntelligence.js';
 import { formatCommandIndex } from './commandIndex.js';
@@ -41,6 +43,41 @@ export class TimeoutError extends Error {
         this.name = 'TimeoutError';
     }
 }
+/**
+ * Read at most `maxBytes` of a project file, or null when it isn't a regular
+ * file inside the project. Rules and progress files arrive with a cloned
+ * repo, and statSync follows symlinks: a committed `AGENTS.md -> /dev/zero`
+ * (or a FIFO) never comes back from readFileSync, and every agent run would
+ * hang on it; `CODEEP.md -> ~/.aws/credentials` would put the user's
+ * credentials into every system prompt.
+ */
+function readProjectFile(filePath, maxBytes, projectRoot) {
+    if (leadsOutsideProject(filePath, projectRoot))
+        return null;
+    const stat = statSync(filePath, { throwIfNoEntry: false });
+    if (stat && !stat.isFile())
+        return null;
+    // A path that vanished since the caller's existsSync is left to
+    // readFileSync to report.
+    if (!stat || stat.size <= maxBytes)
+        return { text: readFileSync(filePath, 'utf-8'), truncated: false };
+    const fd = openSync(filePath, 'r');
+    try {
+        const buf = Buffer.alloc(maxBytes);
+        let read = 0;
+        while (read < maxBytes) {
+            const n = readSync(fd, buf, read, maxBytes - read, read);
+            if (n === 0)
+                break;
+            read += n;
+        }
+        // StringDecoder holds back a multi-byte character split by the cut.
+        return { text: new StringDecoder('utf8').write(buf.subarray(0, read)), truncated: true };
+    }
+    finally {
+        closeSync(fd);
+    }
+}
 /**
  * Load project rules from .codeep/rules.md or CODEEP.md
  */
@@ -69,12 +106,14 @@ export function loadProjectRules(projectRoot) {
     for (const filePath of candidates) {
         if (existsSync(filePath)) {
             try {
-                let content = readFileSync(filePath, 'utf-8').trim();
+                const file = readProjectFile(filePath, MAX_RULES_BYTES, projectRoot);
+                if (!file)
+                    continue;
+                let content = file.text.trim();
                 if (content) {
-                    if (content.length > MAX_RULES_BYTES) {
-                        debug('Project rules truncated', filePath, `${content.length} > ${MAX_RULES_BYTES}`);
-                        content = content.slice(0, MAX_RULES_BYTES)
-                            + '\n\n[Rules truncated by Codeep — file exceeds the 64KB inline limit.]';
+                    if (file.truncated) {
+                        debug('Project rules truncated', filePath, `> ${MAX_RULES_BYTES} bytes`);
+                        content += '\n\n[Rules truncated by Codeep — file exceeds the 64KB inline limit.]';
                     }
                     debug('Loaded project rules from', filePath);
                     return `\n\n## Project Rules\nThe following rules are defined by the project owner. You MUST follow these rules:\n\n${content}`;
@@ -87,6 +126,8 @@ export function loadProjectRules(projectRoot) {
     }
     return '';
 }
+/** Largest progress log we'll inject (64 KB). */
+const MAX_PROGRESS_BYTES = 64 * 1024;
 /**
  * Load agent progress log from .codeep/progress.md
  * Injected into system prompt so agent knows what was previously done.
@@ -98,7 +139,12 @@ export function loadProgressLog(projectRoot) {
     if (!existsSync(progressFile))
         return '';
     try {
-        const content = readFileSync(progressFile, 'utf-8').trim();
+        // Capped like the rules: this file can arrive with the repo too.
+        const file = readProjectFile(progressFile, MAX_PROGRESS_BYTES, projectRoot);
+        let content = file ? file.text.trim() : '';
+        if (content && file?.truncated) {
+            content += '\n\n[Progress log truncated by Codeep — file exceeds the 64KB inline limit.]';
+        }
         if (content) {
             return `\n\n## Previous Session Progress\nThe agent has previously worked on this project. Read this to understand what was already done and what still needs to be done:\n\n${content}`;
         }
@@ -108,6 +154,28 @@ export function loadProgressLog(projectRoot) {
     }
     return '';
 }
+/** How much of the task the progress log keeps, split between its start and end. */
+const MAX_PROGRESS_TASK_CHARS = 4000;
+/**
+ * The task as the progress log records it. Callers pass the enriched prompt,
+ * with attached files in front of the user's words, so a long one keeps its
+ * start and its end: written whole, it filled the 64KB read budget and the
+ * Status and Summary sections below it never reached the next session.
+ */
+function progressTask(prompt) {
+    if (prompt.length <= MAX_PROGRESS_TASK_CHARS)
+        return prompt;
+    const half = MAX_PROGRESS_TASK_CHARS / 2;
+    // Don't cut a surrogate pair in two.
+    let head = half;
+    if (/[\uD800-\uDBFF]/.test(prompt[head - 1]))
+        head--;
+    let tail = prompt.length - half;
+    if (/[\uDC00-\uDFFF]/.test(prompt[tail]))
+        tail++;
+    const omitted = tail - head;
+    return `${prompt.slice(0, head)}\n[… ${omitted} characters of the task omitted …]\n${prompt.slice(tail)}`;
+}
 /**
  * Write agent progress log to .codeep/progress.md
  * Called after each agent run so the next session has context.
@@ -129,7 +197,7 @@ export function writeProgressLog(projectRoot, prompt, result, projectName) {
             `## Last Session: ${now}`,
             ``,
             `### Task`,
-            `${prompt}`,
+            progressTask(prompt),
             ``,
             `### Status`,
             result.success ? `✓ Completed (${result.iterations} iterations)` : `⚠ Incomplete — task may need to be continued`,
@@ -161,13 +229,15 @@ export function writeProgressLog(projectRoot, prompt, result, projectName) {
             lines.push('');
         }
         const content = lines.join('\n');
-        writeFileSync(join(codeepDir, 'progress.md'), content, 'utf-8');
+        // .codeep/ comes with the repo: a symlinked progress.md (or .codeep) would
+        // have this overwrite whatever file the repo pointed it at.
+        writeProjectFile(projectRoot, join(codeepDir, 'progress.md'), content);
         if (projectName && projectRoot) {
             syncProgress({ projectName, projectId: generateProjectId(projectRoot), content });
         }
     }
     catch (err) {
-        debug('Failed to write progress log:', err);
+        debug(err instanceof UnsafeProjectPathError ? 'Not writing progress log:' : 'Failed to write progress log:', err);
     }
 }
 /**
@@ -451,6 +521,8 @@ additionalTools, runtime) {
                     temperature: requiresDefaultTemperature(providerId) ? undefined : Number(config.get('temperature')),
                     timeoutMs,
                     onChunk: useStreaming ? onChunk : undefined,
+                    // Carries the user's Stop as well as this request's own timeout.
+                    signal: controller.signal,
                 });
                 if (res.promptTokens != null && res.completionTokens != null) {
                     recordTokenUsage({ promptTokens: res.promptTokens, completionTokens: res.completionTokens, totalTokens: res.promptTokens + res.completionTokens }, model, providerId);

package/dist/utils/agents.d.ts

@@ -10,7 +10,8 @@
  *   - **Built-in**: hardcoded below (researcher, reviewer, tester).
  *   - **Project**: `<workspace>/.codeep/agents/<name>.md`
  *   - **Global**:  `~/.codeep/agents/<name>.md`
- * Project shadows global shadows built-in, by name.
+ * Project shadows global shadows built-in, by name. A project file that
+ * shadows a built-in keeps at most the built-in's tools.
  *
  * File format — YAML-ish frontmatter + Markdown body (the role prompt):
  *   ```

package/dist/utils/agents.js

@@ -10,7 +10,8 @@
  *   - **Built-in**: hardcoded below (researcher, reviewer, tester).
  *   - **Project**: `<workspace>/.codeep/agents/<name>.md`
  *   - **Global**:  `~/.codeep/agents/<name>.md`
- * Project shadows global shadows built-in, by name.
+ * Project shadows global shadows built-in, by name. A project file that
+ * shadows a built-in keeps at most the built-in's tools.
  *
  * File format — YAML-ish frontmatter + Markdown body (the role prompt):
  *   ```
@@ -25,9 +26,10 @@
  *   You are a senior reviewer. Find correctness & security issues…
  *   ```
  */
-import { readFileSync, readdirSync, existsSync } from 'fs';
+import { readFileSync, readdirSync, existsSync, statSync } from 'fs';
 import { join } from 'path';
 import { homedir } from 'os';
+import { leadsOutsideProject } from './projectPaths.js';
 const BUILTIN = [
     {
         name: 'planner',
@@ -79,14 +81,73 @@ const BUILTIN = [
 - Final message: what you added, the command to run them, and the pass/fail result.`,
     },
 ];
-/** Parse `tools: [a, b]` or `tools: a, b` out of a frontmatter line value. */
+/** Largest agent file we'll read (64 KB). */
+const MAX_AGENT_FILE_BYTES = 64 * 1024;
+const unquote = (s) => s.trim().replace(/^["']|["']$/g, '');
+/** Drop a YAML trailing comment (`read_file  # safe`) from an unquoted value. */
+const uncomment = (s) => s.replace(/(^|\s)#.*$/, '');
+/**
+ * Parse a `tools:` value: `[a, b]`, `a, b`, or a YAML block list. A key that
+ * is present always yields a list, possibly empty. Only an absent key means
+ * "all tools", so a value we can't read denies tools rather than granting
+ * every one of them.
+ */
 function parseToolsValue(raw) {
-    const inner = raw.trim().replace(/^\[/, '').replace(/\]$/, '');
-    const list = inner.split(',').map((s) => s.trim().replace(/^["']|["']$/g, '')).filter(Boolean);
-    return list.length > 0 ? list : undefined;
+    if (Array.isArray(raw))
+        return raw.map(unquote).filter(Boolean);
+    const inline = raw.trim().match(/^\[([^\]]*)\]/);
+    const inner = inline ? inline[1] : uncomment(raw);
+    return inner.split(',').map(unquote).filter(Boolean);
+}
+/**
+ * Split an agent file into lowercase frontmatter keys and the body. A key
+ * with an empty value collects the `- item` lines under it. Returns null when
+ * the file opens a frontmatter fence that never closes: dropping the file is
+ * safer than reading its `tools:` line as part of the prompt.
+ */
+function parseAgentFile(raw) {
+    // Windows editors save CRLF and some prepend a BOM; neither may cost the
+    // file its frontmatter. Nor may a blank line above the opening fence: read
+    // as body, the `tools:` line would be dropped and every tool allowed.
+    const text = raw.replace(/^\uFEFF/, '').replace(/\r\n?/g, '\n').replace(/^(?:[ \t]*\n)+(?=---)/, '');
+    const meta = {};
+    if (!/^---[ \t]*\n/.test(text))
+        return { meta, body: text };
+    // An empty block (`---` twice) is checked first: the general pattern would
+    // take a later `---` rule in the body as the closing fence.
+    const fm = text.match(/^---[ \t]*\n()---[ \t]*(?:\n([\s\S]*))?$/)
+        ?? text.match(/^---[ \t]*\n([\s\S]*?)\n---[ \t]*(?:\n([\s\S]*))?$/);
+    if (!fm)
+        return null;
+    let list = null;
+    for (const line of fm[1].split('\n')) {
+        // YAML lets a blank line or a comment line sit inside a block list
+        if (!line.trim() || /^\s*#/.test(line))
+            continue;
+        const item = line.match(/^\s*-\s+(.*)$/);
+        if (item && list) {
+            list.push(uncomment(item[1]));
+            continue;
+        }
+        list = null;
+        const m = line.match(/^([a-zA-Z]+)\s*:\s*(.*)$/);
+        if (!m)
+            continue;
+        // `tools:  # read-only` is an empty value with a comment; the list follows.
+        const value = m[2].trim().startsWith('#') ? '' : m[2].trim();
+        if (value) {
+            meta[m[1].toLowerCase()] = value;
+        }
+        else {
+            list = [];
+            meta[m[1].toLowerCase()] = list;
+        }
+    }
+    return { meta, body: fm[2] ?? '' };
 }
+const str = (v) => (typeof v === 'string' && v ? v : undefined);
 /** Load custom agents from a `.codeep/agents/` directory. */
-function loadFromDir(dir, scope) {
+function loadFromDir(dir, scope, projectRoot) {
     if (!existsSync(dir))
         return [];
     const out = [];
@@ -104,32 +165,33 @@ function loadFromDir(dir, scope) {
         if (!/^[a-z0-9][a-z0-9-]*$/.test(slug))
             continue;
         try {
-            const raw = readFileSync(join(dir, entry), 'utf8');
-            if (raw.length > 64 * 1024)
+            const file = join(dir, entry);
+            // A project's files come with the repo: a link out of it would put an
+            // arbitrary file of the user's (credentials, history) into the prompt.
+            if (projectRoot && leadsOutsideProject(file, projectRoot))
                 continue;
-            const fm = raw.match(/^---\n([\s\S]*?)\n---\n?([\s\S]*)$/);
-            const meta = {};
-            let body = raw;
-            if (fm) {
-                body = fm[2];
-                for (const line of fm[1].split('\n')) {
-                    const m = line.match(/^([a-zA-Z]+):\s*(.*)$/);
-                    if (m)
-                        meta[m[1].toLowerCase()] = m[2].trim();
-                }
-            }
-            const displayName = meta.name || slug;
-            const description = meta.description || `Custom agent from ${entry}`;
-            const tools = meta.tools ? parseToolsValue(meta.tools) : undefined;
-            const maxIterations = meta.maxiterations ? parseInt(meta.maxiterations, 10) : undefined;
+            // statSync follows symlinks: a committed link to /dev/zero or a FIFO
+            // never comes back from readFileSync, so check kind and size first.
+            const stat = statSync(file);
+            if (!stat.isFile() || stat.size > MAX_AGENT_FILE_BYTES)
+                continue;
+            const parsed = parseAgentFile(readFileSync(file, 'utf8'));
+            if (!parsed)
+                continue;
+            const { meta, body } = parsed;
+            const displayName = str(meta.name) || slug;
+            const description = str(meta.description) || `Custom agent from ${entry}`;
+            const tools = meta.tools !== undefined ? parseToolsValue(meta.tools) : undefined;
+            const iterations = str(meta.maxiterations);
+            const maxIterations = iterations ? parseInt(iterations, 10) : undefined;
             out.push({
                 name: slug,
                 displayName,
                 description: description.length > 200 ? description.slice(0, 197) + '…' : description,
                 prompt: body.trim(),
                 tools,
-                model: meta.model || undefined,
-                personality: meta.personality || undefined,
+                model: str(meta.model),
+                personality: str(meta.personality),
                 maxIterations: Number.isFinite(maxIterations) ? maxIterations : undefined,
                 scope,
             });
@@ -141,15 +203,24 @@ function loadFromDir(dir, scope) {
     return out;
 }
 export function loadAgents(workspaceRoot) {
-    const project = workspaceRoot ? loadFromDir(join(workspaceRoot, '.codeep', 'agents'), 'project') : [];
+    const project = workspaceRoot ? loadFromDir(join(workspaceRoot, '.codeep', 'agents'), 'project', workspaceRoot) : [];
     const global = loadFromDir(join(homedir(), '.codeep', 'agents'), 'global');
     const byName = new Map();
     for (const a of BUILTIN)
         byName.set(a.name, a);
     for (const a of global)
         byName.set(a.name, a);
-    for (const a of project)
+    for (const a of project) {
+        // A cloned repo can replace a built-in's prompt, but not hand it more
+        // tools than it ships with: auto-review delegates to `reviewer` after
+        // every write, so that allowlist must hold whatever `.codeep/agents/` says.
+        const builtin = BUILTIN.find((b) => b.name === a.name);
+        if (builtin?.tools) {
+            const allowed = builtin.tools;
+            a.tools = a.tools ? a.tools.filter((t) => allowed.includes(t)) : [...allowed];
+        }
         byName.set(a.name, a);
+    }
     return [...byName.values()].sort((a, b) => a.name.localeCompare(b.name));
 }
 export function findAgent(name, workspaceRoot) {
@@ -180,7 +251,7 @@ export function formatAgentList(workspaceRoot) {
     const lines = ['## Sub-agents', '', 'The agent can `delegate` self-contained sub-tasks to these. Each runs in its own context and returns a summary.', '', '| Name | Scope | Tools | Description |', '|---|---|---|---|'];
     for (const a of list) {
         const tag = a.scope === 'builtin' ? 'built-in' : a.scope;
-        const tools = a.tools ? `${a.tools.length} scoped` : 'all';
+        const tools = !a.tools ? 'all' : a.tools.length ? `${a.tools.length} scoped` : 'none';
         lines.push(`| \`${a.name}\` | ${tag} | ${tools} | ${a.description} |`);
     }
     lines.push('', 'Add your own: drop a `<name>.md` with frontmatter (name, description, tools, model, personality) in `.codeep/agents/` (project) or `~/.codeep/agents/` (global).');

package/dist/utils/auditLog.d.ts

@@ -14,9 +14,10 @@
  * Format is JSON Lines. Appending one line per event survives a crash mid-run,
  * needs no read-modify-write, and stays greppable without a parser.
  *
- * PRIVACY: entries carry command lines and file paths, not file contents. A
- * command can still contain a secret someone typed into it, exactly as shell
- * history can — treat the directory like shell history, not like source.
+ * PRIVACY: entries carry command lines, file paths and MCP tool arguments, not
+ * file contents. A command or an argument can still contain a secret someone
+ * typed into it, exactly as shell history can — treat the directory like shell
+ * history, not like source.
  *
  * It sits under `.codeep/`, which most projects already ignore, but Codeep does
  * not edit anyone's `.gitignore` and this module must not claim otherwise. If a

package/dist/utils/auditLog.js

@@ -14,24 +14,109 @@
  * Format is JSON Lines. Appending one line per event survives a crash mid-run,
  * needs no read-modify-write, and stays greppable without a parser.
  *
- * PRIVACY: entries carry command lines and file paths, not file contents. A
- * command can still contain a secret someone typed into it, exactly as shell
- * history can — treat the directory like shell history, not like source.
+ * PRIVACY: entries carry command lines, file paths and MCP tool arguments, not
+ * file contents. A command or an argument can still contain a secret someone
+ * typed into it, exactly as shell history can — treat the directory like shell
+ * history, not like source.
  *
  * It sits under `.codeep/`, which most projects already ignore, but Codeep does
  * not edit anyone's `.gitignore` and this module must not claim otherwise. If a
  * project tracks `.codeep/`, the audit log will be committed with it.
  */
-import { existsSync, mkdirSync, appendFileSync, readFileSync, readdirSync, statSync } from 'fs';
+import { existsSync, readFileSync, readdirSync, statSync } from 'fs';
+import { appendProjectFile } from './projectPaths.js';
 import { join } from 'path';
 import { randomBytes } from 'crypto';
 import { config } from '../config/index.js';
+/** Arguments that carry a file body. They are never part of a target. Names
+ *  are compared without `_`/`-` and case, so `newText` is `new_text`. */
+const CONTENT_ARGUMENTS = new Set([
+    'content', 'contents', 'filecontent', 'filecontents', 'filetext', 'body',
+    'oldstring', 'newstring', 'oldstr', 'newstr', 'oldtext', 'newtext',
+    'oldcontent', 'newcontent', 'replacement', 'patch', 'diff',
+]);
+/** Argument names whose value is a credential, compared without `_`/`-` and
+ *  case. `token` is judged separately: most `*_token` arguments are secrets,
+ *  but a page or continuation token is a cursor the user should see. */
+const SECRET_ARGUMENT = /passw|passphrase|secret|apikey|accesskey|privatekey|authorization|credential|cookie/;
+const CURSOR_TOKEN_QUALIFIERS = new Set(['page', 'next', 'prev', 'previous', 'continuation', 'cursor', 'sync', 'max', 'min', 'num', 'total', 'count']);
+/**
+ * Values shaped like a well-known credential, whatever the argument is called.
+ * Each alternative consumes the whole credential, because only the matched
+ * text is replaced: a pattern that stopped after the prefix would leave the
+ * rest of the key on screen.
+ */
+const SECRET_VALUE = /\b[sr]k[-_](?:live|test|proj|ant)[-_][\w-]+|\bsk-[\w-]{20,}|\bgh[pousr]_\w{20,}|\bgithub_pat_\w{20,}|\bAKIA[0-9A-Z]{16}\b|\bxox[abprs]-[\w-]{10,}|-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?(?:-----END [A-Z ]*PRIVATE KEY-----|$)|\bBearer\s+[\w.~+/=-]{16,}/gi;
+/** Longest single argument shown. The permission prompt lays out what is
+ *  left and says what it drops, so this only bounds a pathological value. */
+const MAX_ARGUMENT = 2000;
+/** The words of an argument name: `page_token`, `pageToken`, `PAGE-TOKEN`. */
+function nameWords(key) {
+    return key.replace(/([a-z0-9])([A-Z])/g, '$1 $2').toLowerCase().split(/[\s_-]+/).filter(Boolean);
+}
+/** True when an argument's name says its value is a credential. */
+function isCredentialName(key) {
+    const words = nameWords(key);
+    if (SECRET_ARGUMENT.test(words.join('')))
+        return true;
+    return words.some((w, i) => (w === 'token' || w === 'tokens') && !(i > 0 && CURSOR_TOKEN_QUALIFIERS.has(words[i - 1])));
+}
+/** A plain value as it should appear: flattened, known credential shapes
+ *  replaced where they occur, the rest left readable. */
+function showValue(value) {
+    let text = String(value).replace(SECRET_VALUE, '[redacted]').replace(/\s+/g, ' ').trim();
+    if (text.length > MAX_ARGUMENT)
+        text = `${text.slice(0, MAX_ARGUMENT)}…[+${text.length - MAX_ARGUMENT} chars]`;
+    return text;
+}
+function isPlain(value) {
+    return typeof value === 'string' || typeof value === 'number' || typeof value === 'boolean';
+}
+/**
+ * An MCP tool's arguments, as `name=value` pairs in the order given. The
+ * argument names are the server's, not the built-in `command`/`path`/`url`
+ * ones: `postgres__query` carries its SQL in `sql`, and a call described by
+ * its name alone would be approved in the permission prompt unseen.
+ *
+ * Plain values and lists of plain values are shown — an exec tool's `args`
+ * is what it will run. A list holding objects, or an object, is where servers
+ * put file bodies under names of their own (`files[].content`,
+ * `edits[].newText`), so it is counted, never printed.
+ */
+function describeMcpArguments(p) {
+    const parts = [];
+    for (const [key, value] of Object.entries(p)) {
+        const name = key.toLowerCase().replace(/[-_]/g, '');
+        if (CONTENT_ARGUMENTS.has(name) || value === undefined || value === null)
+            continue;
+        if (isCredentialName(key) && (isPlain(value) || Array.isArray(value))) {
+            parts.push(`${key}=[redacted]`);
+            continue;
+        }
+        if (Array.isArray(value)) {
+            parts.push(value.every(isPlain)
+                ? `${key}=${value.map(showValue).join(' ')}`
+                : `${key}=[${value.length} ${value.length === 1 ? 'item' : 'items'}]`);
+            continue;
+        }
+        if (typeof value === 'object') {
+            const size = Object.keys(value).length;
+            parts.push(`${key}={${size} ${size === 1 ? 'key' : 'keys'}}`);
+            continue;
+        }
+        parts.push(`${key}=${showValue(value)}`);
+    }
+    return parts.join(', ');
+}
 /** A one-line, content-free description of what a tool call was aimed at.
  *  Paths, commands and URLs are the point of the record; file bodies are not,
  *  and `content`/`old_string` style arguments are never read here. */
 export function describeAuditTarget(call) {
     const p = call.parameters ?? {};
     const str = (k) => (typeof p[k] === 'string' ? p[k] : undefined);
+    // MCP tools (`<server>__<tool>`; no built-in name contains `__`).
+    if (call.tool.includes('__'))
+        return describeMcpArguments(p) || call.tool;
     const command = str('command');
     if (command) {
         const args = Array.isArray(p.args) ? p.args.map(String) : [];
@@ -71,9 +156,6 @@ export function recordAuditEvent(projectRoot, event) {
     if (!isAuditEnabled())
         return;
     try {
-        const dir = auditDir(projectRoot);
-        if (!existsSync(dir))
-            mkdirSync(dir, { recursive: true });
         const line = {
             ...event,
             target: clip(event.target, MAX_TARGET),
@@ -82,10 +164,11 @@ export function recordAuditEvent(projectRoot, event) {
         };
         // Drop undefined keys so a line stays small and diffs stay readable.
         const compact = Object.fromEntries(Object.entries(line).filter(([, v]) => v !== undefined));
-        appendFileSync(auditFile(projectRoot), JSON.stringify(compact) + '\n');
+        // .codeep/ can come with a cloned repo: never append through a symlink.
+        appendProjectFile(projectRoot, auditFile(projectRoot), JSON.stringify(compact) + '\n');
     }
     catch {
-        /* an unwritable audit log must never fail the run */
+        /* an unwritable (or symlinked) audit log must never fail the run */
     }
 }
 /** Open a run and return its id. Records the agent and the capabilities it was

package/dist/utils/checkpoints.js

@@ -33,15 +33,14 @@
  *   "gitHead": "abcdef0"        // optional, recorded only if cwd is a git repo
  * }
  */
-import { existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync, unlinkSync, statSync } from 'fs';
+import { existsSync, readdirSync, readFileSync, unlinkSync, statSync } from 'fs';
+import { isSafeProjectWriteTarget, writeProjectFile } from './projectPaths.js';
 import { join } from 'path';
 import { randomUUID } from 'crypto';
 import { execSync } from 'child_process';
+import { hardenedGitEnv } from './git.js';
 function getCheckpointsDir(workspaceRoot) {
-    const dir = join(workspaceRoot, '.codeep', 'checkpoints');
-    if (!existsSync(dir))
-        mkdirSync(dir, { recursive: true });
-    return dir;
+    return join(workspaceRoot, '.codeep', 'checkpoints');
 }
 function readGitHead(workspaceRoot) {
     try {
@@ -51,6 +50,8 @@ function readGitHead(workspaceRoot) {
             encoding: 'utf-8',
             stdio: ['ignore', 'pipe', 'ignore'],
             timeout: 2000,
+            // Read-only and Codeep's own, so the repository's hooks stay out of it.
+            env: hardenedGitEnv({ cwd: workspaceRoot, noHooks: true }),
         }).trim();
         return out || undefined;
     }
@@ -83,7 +84,8 @@ export function createCheckpoint(opts) {
         gitHead: readGitHead(opts.workspaceRoot),
     };
     const dir = getCheckpointsDir(opts.workspaceRoot);
-    writeFileSync(join(dir, `${checkpoint.id}.json`), JSON.stringify(checkpoint, null, 2));
+    // .codeep/ can come with a cloned repo: never write through a symlink.
+    writeProjectFile(opts.workspaceRoot, join(dir, `${checkpoint.id}.json`), JSON.stringify(checkpoint, null, 2));
     return checkpoint;
 }
 /**
@@ -150,6 +152,9 @@ export function deleteCheckpoint(workspaceRoot, id) {
     const file = join(getCheckpointsDir(workspaceRoot), `${id}.json`);
     if (!existsSync(file))
         return false;
+    // Through a symlinked .codeep/ the path would name a file elsewhere.
+    if (!isSafeProjectWriteTarget(workspaceRoot, file))
+        return false;
     try {
         unlinkSync(file);
         return true;

package/dist/utils/codeReview.js

@@ -3,7 +3,7 @@
  */
 import { existsSync, readFileSync, readdirSync } from 'fs';
 import { join, extname, relative } from 'path';
-import { getChangedFiles } from './git.js';
+import { getChangedFilesResult } from './git.js';
 import { loadReviewConfig, globToRegExp } from './reviewConfig.js';
 // Built-in code patterns that indicate issues. Each has a stable `id` so it can
 // be turned off per-project via `.codeep/review.json` { "disable": ["..."] }.
@@ -274,26 +274,24 @@ function analyzeFile(filePath, content, projectRoot, rules, disabled) {
     }
     return issues;
 }
-/**
- * Get files to review
- */
 function getFilesToReview(projectRoot, specificFiles) {
     if (specificFiles && specificFiles.length > 0) {
-        return specificFiles
-            .map(f => join(projectRoot, f))
-            .filter(f => existsSync(f));
+        return {
+            files: specificFiles.map(f => join(projectRoot, f)).filter(f => existsSync(f)),
+            source: 'specific',
+        };
     }
-    // Get changed files from git
-    const changedFiles = getChangedFiles(projectRoot);
-    if (changedFiles.length > 0) {
-        return changedFiles.map(f => join(projectRoot, f));
+    // Get changed files from git. Called ONCE — the scope line below used to
+    // call getChangedFiles() a second time, which is a second `git config
+    // --list` plus a second `git status` on every review.
+    const changed = getChangedFilesResult(projectRoot);
+    if (changed.files.length > 0) {
+        return { files: changed.files.map(f => join(projectRoot, f)), source: 'git' };
     }
     // Otherwise, review src directory
     const srcDir = join(projectRoot, 'src');
-    if (existsSync(srcDir)) {
-        return getAllSourceFiles(srcDir);
-    }
-    return getAllSourceFiles(projectRoot);
+    const files = existsSync(srcDir) ? getAllSourceFiles(srcDir) : getAllSourceFiles(projectRoot);
+    return { files, source: 'scan', gitError: changed.error };
 }
 /**
  * Get all source files in directory
@@ -341,7 +339,8 @@ export function performCodeReview(projectContext, specificFiles) {
         ...CODE_PATTERNS.filter((p) => !disabled.has(p.id)),
         ...(config?.rules ?? []),
     ];
-    let filesToReview = getFilesToReview(projectRoot, specificFiles);
+    const selection = getFilesToReview(projectRoot, specificFiles);
+    let filesToReview = selection.files;
     // Apply include/exclude globs (posix-relative paths). Empty include = all.
     if (config && (config.include.length > 0 || config.exclude.length > 0)) {
         const inc = config.include.map(globToRegExp);
@@ -356,17 +355,23 @@ export function performCodeReview(projectContext, specificFiles) {
         });
     }
     const allIssues = [];
-    // Determine scope — mirrors the branching in getFilesToReview so the user
-    // sees exactly which branch ran.
+    // Determine scope — reports the branch getFilesToReview actually took,
+    // rather than re-deriving it, so the two can no longer disagree.
+    const count = `${filesToReview.length} file${filesToReview.length === 1 ? '' : 's'}`;
     let scope;
-    if (specificFiles && specificFiles.length > 0) {
-        scope = `specific file${specificFiles.length === 1 ? '' : 's'} (${filesToReview.length})`;
+    if (selection.source === 'specific') {
+        scope = `specific file${specificFiles?.length === 1 ? '' : 's'} (${filesToReview.length})`;
+    }
+    else if (selection.source === 'git') {
+        scope = `unstaged git changes (${count})`;
     }
-    else if (getChangedFiles(projectRoot).length > 0) {
-        scope = `unstaged git changes (${filesToReview.length} file${filesToReview.length === 1 ? '' : 's'})`;
+    else if (selection.gitError) {
+        // Not "no git changes": git would not run here, so nobody knows whether
+        // there are any. Say which, and say why — the message carries the fix.
+        scope = `full src/ scan — git could not list the changes: ${selection.gitError} (${count})`;
     }
     else {
-        scope = `full src/ scan — no git changes (${filesToReview.length} file${filesToReview.length === 1 ? '' : 's'})`;
+        scope = `full src/ scan — no git changes (${count})`;
     }
     for (const filePath of filesToReview) {
         try {