codeep 3.3.3 → 3.4.1

package/dist/utils/logger.js

@@ -1,4 +1,5 @@
 import { existsSync, mkdirSync, appendFileSync } from 'fs';
+import { appendProjectFile } from './projectPaths.js';
 import { join } from 'path';
 import { homedir } from 'os';
 const GLOBAL_LOG_DIR = join(homedir(), '.codeep', 'logs');
@@ -18,11 +19,7 @@ export function setLogProjectPath(projectPath) {
  * Get local log directory for project
  */
 function getLocalLogDir(projectPath) {
-    const logDir = join(projectPath, '.codeep', 'logs');
-    if (!existsSync(logDir)) {
-        mkdirSync(logDir, { recursive: true });
-    }
-    return logDir;
+    return join(projectPath, '.codeep', 'logs');
 }
 /**
  * Check if path is a project directory
@@ -43,6 +40,7 @@ function getLogFilePaths() {
     if (currentProjectPath && isProjectDirectory(currentProjectPath)) {
         const localLogDir = getLocalLogDir(currentProjectPath);
         paths.local = join(localLogDir, filename);
+        paths.project = currentProjectPath;
     }
     return paths;
 }
@@ -71,8 +69,9 @@ function writeLog(level, message, data, localOnly = false) {
             appendFileSync(paths.global, logLine, 'utf-8');
         }
         // Write to local log if available
-        if (paths.local) {
-            appendFileSync(paths.local, logLine, 'utf-8');
+        // .codeep/ can come with a cloned repo: never append through a symlink.
+        if (paths.local && paths.project) {
+            appendProjectFile(paths.project, paths.local, logLine);
         }
     }
     catch {

package/dist/utils/mcpConfig.d.ts

@@ -69,6 +69,30 @@ export declare function untrustWorkspaceMcp(workspaceRoot: string): void;
  * "skip" file-based ones).
  */
 export declare function mergeMcpServers(fromConfig: McpServer[], fromAcp: McpServer[] | undefined): McpServer[];
+/**
+ * The MCP servers a session runs. Every place that (re)starts a session's
+ * servers goes through here, so they all apply the same rule:
+ *
+ *   - global (~/.codeep) entries always run — they are the user's own —
+ *     unless a workspace entry of the same name runs in their place;
+ *   - workspace entries run only once the workspace is trusted, because
+ *     they arrive with the repo. `userAdded` names entries the user has
+ *     just added by hand (`/mcp add`, `/mcp install`); those need no
+ *     further consent;
+ *   - `fromClient` — the servers the editor passed for the session — run
+ *     too and win on name collisions, as in `mergeMcpServers`.
+ *
+ * `skipped` lists the workspace entries left out, so callers can say why.
+ * Registering replaces a session's whole set of servers, which is why the
+ * editor's servers have to be part of every selection.
+ */
+export declare function selectSessionMcpServers(workspaceRoot: string | undefined, opts?: {
+    fromClient?: McpServer[];
+    userAdded?: string[];
+}): {
+    servers: McpServer[];
+    skipped: McpServer[];
+};
 /**
  * Add or replace a server entry in the project config file. Used by the
  * interactive `/mcp add` command. Project file is created if missing.

package/dist/utils/mcpConfig.js

@@ -25,8 +25,9 @@
  * A flat array form (`{"mcpServers": [{...}, ...]}`) is also accepted because
  * that's the shape ACP passes over JSON-RPC.
  */
-import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'fs';
-import { join, dirname } from 'path';
+import { existsSync, readFileSync } from 'fs';
+import { writeProjectFile } from './projectPaths.js';
+import { join } from 'path';
 import { homedir } from 'os';
 import { config } from '../config/index.js';
 const PROJECT_CONFIG_PATH = '.codeep/mcp_servers.json';
@@ -216,6 +217,36 @@ export function mergeMcpServers(fromConfig, fromAcp) {
         byName.set(s.name, s);
     return [...byName.values()];
 }
+/**
+ * The MCP servers a session runs. Every place that (re)starts a session's
+ * servers goes through here, so they all apply the same rule:
+ *
+ *   - global (~/.codeep) entries always run — they are the user's own —
+ *     unless a workspace entry of the same name runs in their place;
+ *   - workspace entries run only once the workspace is trusted, because
+ *     they arrive with the repo. `userAdded` names entries the user has
+ *     just added by hand (`/mcp add`, `/mcp install`); those need no
+ *     further consent;
+ *   - `fromClient` — the servers the editor passed for the session — run
+ *     too and win on name collisions, as in `mergeMcpServers`.
+ *
+ * `skipped` lists the workspace entries left out, so callers can say why.
+ * Registering replaces a session's whole set of servers, which is why the
+ * editor's servers have to be part of every selection.
+ */
+export function selectSessionMcpServers(workspaceRoot, opts = {}) {
+    const { workspace } = loadMcpServerConfigSplit(workspaceRoot);
+    const trusted = workspaceRoot !== undefined && isWorkspaceMcpTrusted(workspaceRoot);
+    const allowed = trusted ? workspace : workspace.filter(s => opts.userAdded?.includes(s.name));
+    const skipped = workspace.filter(s => !allowed.includes(s));
+    // The split list has already dropped every global entry a workspace entry
+    // names. Only an entry that is going to run may take the place of one of
+    // the user's own servers; one left out must not stop it.
+    const allowedNames = new Set(allowed.map(s => s.name));
+    const globalServers = loadFromFile(join(homedir(), GLOBAL_CONFIG_PATH))
+        .filter(s => !allowedNames.has(s.name));
+    return { servers: mergeMcpServers([...globalServers, ...allowed], opts.fromClient), skipped };
+}
 /**
  * Add or replace a server entry in the project config file. Used by the
  * interactive `/mcp add` command. Project file is created if missing.
@@ -247,8 +278,8 @@ export function addProjectMcpServer(workspaceRoot, server) {
     const { name, ...rest } = server;
     map[name] = rest;
     parsed.mcpServers = map;
-    mkdirSync(dirname(path), { recursive: true });
-    writeFileSync(path, JSON.stringify(parsed, null, 2) + '\n');
+    // .codeep/ can come with a cloned repo: never write through a symlink.
+    writeProjectFile(workspaceRoot, path, JSON.stringify(parsed, null, 2) + '\n');
 }
 /**
  * Remove a server entry from the project config file. Returns true if a
@@ -277,6 +308,6 @@ export function removeProjectMcpServer(workspaceRoot, name) {
     else {
         return false;
     }
-    writeFileSync(path, JSON.stringify(parsed, null, 2) + '\n');
+    writeProjectFile(workspaceRoot, path, JSON.stringify(parsed, null, 2) + '\n');
     return true;
 }

package/dist/utils/mentions.d.ts

@@ -8,7 +8,7 @@
  *
  * Supported mention forms (case-sensitive `@`):
  *   @src/index.ts          → relative-to-project-root file
- *   @./local.ts            → relative-to-cwd file
+ *   @./local.ts            → relative-to-project-root file too
  *   @/abs/path.ts          → absolute path
  *   @"path with space.ts"  → quoted (spaces/special chars allowed)
  *   @'path with space.ts'  → single-quoted variant
@@ -77,9 +77,8 @@ export declare const MENTION_BOUNDARY: RegExp;
 export declare function extractMentions(text: string): MentionToken[];
 export interface MentionExpansionOptions {
     /**
-     * The root directory mentions are resolved against when they're
-     * relative (not starting with `/` or `.`). Usually the project root
-     * or `process.cwd()`.
+     * The root directory relative mentions (`src/a.ts`, `./a.ts`, `.`) are
+     * resolved against. Usually the project root or `process.cwd()`.
      */
     root: string;
 }
@@ -168,8 +167,32 @@ export interface SuggestOptions {
 export declare function suggestMentions(opts: SuggestOptions): MentionSuggestion[];
 /** Clear the suggestion cache. Call between tests so fixtures don't leak. */
 export declare function clearSuggestionCache(): void;
-/** True if `fullPath`'s basename looks like it holds secrets. */
+/**
+ * True if `fullPath` looks like it holds secrets, judged by its basename and,
+ * for a symlink, by the basename of the file it points at: a repo can commit
+ * `.env.example -> .env` or `tsconfig.json -> ../.env`, and every read
+ * follows the link.
+ */
 export declare function isSensitiveFile(fullPath: string): boolean;
+/**
+ * True if a file named on its own (an @-mention, or a path smart context
+ * picks out of the prompt) must not be inlined: secrets, and committed `.env`
+ * templates, which can still hold a real value. Both paths use this one rule,
+ * so a mention the user was told is refused never reaches the provider
+ * another way.
+ */
+export declare function isRefusedMention(fullPath: string): boolean;
+/**
+ * True if `text` holds private-key material anywhere. Keys are saved under
+ * any name (`~/.ssh/github`, `deploy/prod`), so the name check alone lets
+ * them through, and a key can sit past the top of a JSON or YAML file.
+ */
+export declare function looksLikeKeyMaterial(text: string): boolean;
+/**
+ * True if `fullPath`, with symlinks resolved, lies inside `dir` (also
+ * resolved). False when either doesn't exist.
+ */
+export declare function resolvesWithin(fullPath: string, dir: string): boolean;
 /** One `@git <ref>` mention match. */
 interface GitToken {
     raw: string;

package/dist/utils/mentions.js

@@ -8,7 +8,7 @@
  *
  * Supported mention forms (case-sensitive `@`):
  *   @src/index.ts          → relative-to-project-root file
- *   @./local.ts            → relative-to-cwd file
+ *   @./local.ts            → relative-to-project-root file too
  *   @/abs/path.ts          → absolute path
  *   @"path with space.ts"  → quoted (spaces/special chars allowed)
  *   @'path with space.ts'  → single-quoted variant
@@ -22,8 +22,9 @@
  * with a warning rather than silently truncated — the user should
  * explicitly `/add` very large files if they really want them.
  */
-import { statSync, readFileSync, readdirSync } from 'fs';
+import { statSync, readFileSync, readdirSync, realpathSync } from 'fs';
 import { join, isAbsolute, relative, resolve, sep } from 'path';
+import { loadIgnoreRules, isIgnored, rulesBelow } from './gitignore.js';
 /** Max file size we'll auto-inline from a mention (100 KB). */
 export const MAX_MENTION_BYTES = 100 * 1024;
 /**
@@ -101,8 +102,8 @@ export function expandMentions(prompt, opts) {
         // pasted (an issue body, a log, model output), so `@.env` or
         // `@~/.aws/credentials` would silently ship credentials to the provider.
         // `/add` remains the explicit, deliberate path for these.
-        if (isSensitiveFile(resolved.fullPath)) {
-            failures.push({ mention: tok.raw, reason: 'looks like a secrets file — use /add to attach it deliberately' });
+        if (isRefusedMention(resolved.fullPath)) {
+            failures.push({ mention: tok.raw, reason: SECRETS_REASON });
             continue;
         }
         const stat = safeStat(resolved.fullPath);
@@ -114,6 +115,12 @@ export function expandMentions(prompt, opts) {
             failures.push({ mention: tok.raw, reason: 'not a file' });
             continue;
         }
+        // A cloned repo can commit `notes.md -> ~/.zsh_history`: a path inside
+        // the project must not read a file from outside it.
+        if (linksOutsideRoot(resolved.fullPath, opts.root)) {
+            failures.push({ mention: tok.raw, reason: LINKS_OUTSIDE_REASON });
+            continue;
+        }
         if (stat.size > MAX_MENTION_BYTES) {
             failures.push({
                 mention: tok.raw,
@@ -126,6 +133,11 @@ export function expandMentions(prompt, opts) {
             failures.push({ mention: tok.raw, reason: 'could not read (binary?)' });
             continue;
         }
+        // Keys are often saved under names no pattern knows (`~/.ssh/github`).
+        if (looksLikeKeyMaterial(content)) {
+            failures.push({ mention: tok.raw, reason: SECRETS_REASON });
+            continue;
+        }
         loaded.push({ fullPath: resolved.fullPath, relativePath: resolved.relativePath, content });
     }
     // Build the enriched prompt: strip the `@` prefix from each mention so
@@ -219,15 +231,15 @@ export function expandFolderMentions(prompt, opts) {
             failures.push({ mention: tok.raw, reason: 'not a directory (use @file)' });
             continue;
         }
-        const walked = walkDirectory(resolved.fullPath, opts.root, seen);
-        if (walked.files.length === 0) {
-            failures.push({ mention: tok.raw, reason: walked.capped ? `stopped at ${MAX_FOLDER_BYTES / 1024}KB cap` : 'no source files found' });
+        // Same rule as a single file: a committed `docs -> ~` must not be walked.
+        if (linksOutsideRoot(resolved.fullPath, opts.root)) {
+            failures.push({ mention: tok.raw, reason: LINKS_OUTSIDE_REASON });
             continue;
         }
+        const walked = walkDirectory(resolved.fullPath, opts.root, seen);
         loaded.push(...walked.files);
-        if (walked.capped) {
-            failures.push({ mention: tok.raw, reason: `stopped at ${MAX_FOLDER_BYTES / 1024}KB cap, loaded ${walked.files.length} file(s)` });
-        }
+        for (const reason of walkNotes(walked))
+            failures.push({ mention: tok.raw, reason });
     }
     // Strip the `@folder <path>` tokens from the visible prompt, leaving
     // the bare path so the agent still sees what was referenced.
@@ -275,15 +287,14 @@ export function expandFileAndFolderMentions(prompt, opts) {
             folderFailures.push({ mention: tok.raw, reason: 'not a directory (use @file)' });
             continue;
         }
-        const walked = walkDirectory(resolved.fullPath, opts.root, seen);
-        if (walked.files.length === 0) {
-            folderFailures.push({ mention: tok.raw, reason: walked.capped ? `stopped at ${MAX_FOLDER_BYTES / 1024}KB cap` : 'no source files found' });
+        if (linksOutsideRoot(resolved.fullPath, opts.root)) {
+            folderFailures.push({ mention: tok.raw, reason: LINKS_OUTSIDE_REASON });
             continue;
         }
+        const walked = walkDirectory(resolved.fullPath, opts.root, seen);
         folderLoaded.push(...walked.files);
-        if (walked.capped) {
-            folderFailures.push({ mention: tok.raw, reason: `stopped at ${MAX_FOLDER_BYTES / 1024}KB cap, loaded ${walked.files.length} file(s)` });
-        }
+        for (const reason of walkNotes(walked))
+            folderFailures.push({ mention: tok.raw, reason });
     }
     // Strip the `@folder` tokens from the prompt before running `@file`
     // expansion, so `@folder src/x` isn't re-matched as a file mention.
@@ -318,8 +329,20 @@ export function expandFileAndFolderMentions(prompt, opts) {
  */
 function walkDirectory(dir, root, seen) {
     const files = [];
+    const skipped = { secrets: 0, ignored: 0, ignoredDirs: 0, outside: 0, outsideDirs: 0 };
     let totalBytes = 0;
     let capped = false;
+    // Honour the project's .gitignore beneath the named directory: that is
+    // where local secrets and build output live. The directory itself was named
+    // deliberately, so the rules that ignore it or everything in it (`dist/`,
+    // `dist/*`) are dropped, the same way DEFAULT_IGNORE_DIRS only applies
+    // below it. A directory outside the project has no rules of its own here.
+    const insideRoot = computeRelativePath(dir, root) !== dir;
+    const ignore = insideRoot ? rulesBelow(dir, loadIgnoreRules(root)) : null;
+    // A symlink may only lead somewhere the user already chose to share: the
+    // named directory or the project. A cloned repo can commit
+    // `docs/notes.md -> ~/.zsh_history`, and the loaded file list is never shown.
+    const allowed = [realPathOf(dir), realPathOf(root)].filter((p) => p !== null);
     const walk = (d, depth) => {
         if (capped || depth > 6)
             return;
@@ -342,36 +365,90 @@ function walkDirectory(dir, root, seen) {
             catch {
                 continue;
             }
+            if (isDir && DEFAULT_IGNORE_DIRS.has(name))
+                continue;
+            if (!isDir && (!shouldSuggest(name) || seen.has(full)))
+                continue;
+            if (ignore && isIgnored(full, ignore)) {
+                if (isDir)
+                    skipped.ignoredDirs++;
+                else
+                    skipped.ignored++;
+                continue;
+            }
+            const real = realPathOf(full);
+            if (real === null)
+                continue;
+            if (!allowed.some((base) => isWithin(real, base))) {
+                if (isDir)
+                    skipped.outsideDirs++;
+                else
+                    skipped.outside++;
+                continue;
+            }
             if (isDir) {
-                if (DEFAULT_IGNORE_DIRS.has(name))
-                    continue;
                 walk(full, depth + 1);
+                continue;
             }
-            else {
-                if (!shouldSuggest(name))
-                    continue;
-                if (seen.has(full))
-                    continue;
-                const fstat = safeStat(full);
-                if (!fstat.exists || !fstat.isFile)
-                    continue;
-                if (fstat.size > MAX_MENTION_BYTES)
-                    continue;
-                const content = safeRead(full);
-                if (content === null)
-                    continue;
-                if (totalBytes + content.length > MAX_FOLDER_BYTES) {
-                    capped = true;
-                    return;
-                }
-                totalBytes += content.length;
-                seen.add(full);
-                files.push({ fullPath: full, relativePath: relative(root, full), content });
+            // Same rule as a single-file mention: `@dir ~/.ssh` or `@dir config`
+            // must not ship the private key that `@config/server.key` refuses.
+            if (isSensitiveFile(full)) {
+                skipped.secrets++;
+                continue;
             }
+            const fstat = safeStat(full);
+            if (!fstat.exists || !fstat.isFile)
+                continue;
+            if (fstat.size > MAX_MENTION_BYTES)
+                continue;
+            const content = safeRead(full);
+            if (content === null)
+                continue;
+            if (looksLikeKeyMaterial(content)) {
+                skipped.secrets++;
+                continue;
+            }
+            if (totalBytes + content.length > MAX_FOLDER_BYTES) {
+                capped = true;
+                return;
+            }
+            totalBytes += content.length;
+            seen.add(full);
+            files.push({ fullPath: full, relativePath: relative(root, full), content });
         }
     };
     walk(dir, 0);
-    return { files, capped };
+    return { files, capped, skipped };
+}
+/** The notes a folder mention reports back: the cap, and what was left out. */
+function walkNotes(walked) {
+    const { secrets, ignored, ignoredDirs, outside, outsideDirs } = walked.skipped;
+    const count = (n, noun) => `${n} ${noun}${n === 1 ? '' : 's'}`;
+    const parts = [];
+    if (secrets)
+        parts.push(count(secrets, 'secret-looking file'));
+    if (ignored)
+        parts.push(count(ignored, 'ignored file'));
+    if (ignoredDirs)
+        parts.push(count(ignoredDirs, 'ignored folder'));
+    if (outside)
+        parts.push(`${count(outside, 'file')} linked from outside the project`);
+    if (outsideDirs)
+        parts.push(`${count(outsideDirs, 'folder')} linked from outside the project`);
+    const skippedNote = parts.length
+        ? `skipped ${parts.join(', ')}; use /add to attach one deliberately`
+        : '';
+    const capNote = `stopped at ${MAX_FOLDER_BYTES / 1024}KB cap`;
+    if (walked.files.length === 0) {
+        const reason = walked.capped ? capNote : 'no source files found';
+        return [skippedNote ? `${reason}; ${skippedNote}` : reason];
+    }
+    const notes = [];
+    if (walked.capped)
+        notes.push(`${capNote}, loaded ${walked.files.length} file(s)`);
+    if (skippedNote)
+        notes.push(skippedNote);
+    return notes;
 }
 /**
  * Resolve a mention's path to an absolute filesystem path and a
@@ -379,7 +456,8 @@ function walkDirectory(dir, root, seen) {
  *
  * Rules:
  *   `/abs/...`   → used as-is, relativePath computed from root.
- *   `./rel/...`  → resolved against cwd (not root), like a normal import.
+ *   `./rel/...`  → resolved against root too. In ACP the process cwd is not
+ *                  the workspace, so `@dir .` walked the wrong directory.
  *   `rel/...`    → resolved against root (project root).
  *   `~/...`      → expanded to the home directory.
  */
@@ -394,7 +472,7 @@ function resolveMentionPath(mentionPath, root) {
         fullPath = resolve(mentionPath);
     }
     else if (mentionPath.startsWith('./') || mentionPath.startsWith('.\\') || mentionPath === '.') {
-        fullPath = resolve(process.cwd(), mentionPath);
+        fullPath = resolve(root, mentionPath);
     }
     else {
         fullPath = resolve(join(root, mentionPath));
@@ -526,12 +604,142 @@ const IGNORED_DOTFILES = new Set(['.DS_Store', '.env']);
  * Filenames that typically hold credentials. Mentions never auto-inline
  * these — see the guard in `expandMentions`. Matched on the basename so it
  * catches the file wherever it lives (project root, `~/.aws/`, …).
+ * Committed templates (`.env.example`) are left to `ENV_TEMPLATE_RE`;
+ * SSH keys match with any suffix (`id_ed25519_work`) except `.pub`.
+ */
+const SENSITIVE_FILE_RE = /^(\.env(?!\.(?:example|sample|template)$)(\..*)?|\.netrc|\.npmrc|\.pgpass|\.git-credentials|\.pypirc|\.dockercfg|credentials|id_(?!.*\.pub$)(rsa|dsa|ecdsa|ed25519)(_sk)?([_.-].*)?|.*\.(pem|key|p12|pfx|keystore|ppk))$/i;
+/**
+ * Credential files whose own name is generic, recognised by the directory
+ * they sit in: `~/.docker/config.json`, `~/.kube/config`,
+ * `~/.config/gh/hosts.yml`.
+ */
+const SENSITIVE_PATH_RE = /(^|[\\/])(\.docker[\\/]config\.json|\.kube[\\/]config|gh[\\/]hosts\.ya?ml)$/i;
+const SECRETS_REASON = 'looks like a secrets file — use /add to attach it deliberately';
+/**
+ * Committed `.env` templates. A walk and smart context include them, but a
+ * single `@.env.example` is refused as it always was: a template can still
+ * hold a real value.
+ */
+const ENV_TEMPLATE_RE = /^\.env\.(?:example|sample|template)$/i;
+/**
+ * True if `fullPath` looks like it holds secrets, judged by its basename and,
+ * for a symlink, by the basename of the file it points at: a repo can commit
+ * `.env.example -> .env` or `tsconfig.json -> ../.env`, and every read
+ * follows the link.
  */
-const SENSITIVE_FILE_RE = /^(\.env(\..*)?|\.netrc|\.npmrc|\.pgpass|credentials|id_(rsa|dsa|ecdsa|ed25519)|.*\.(pem|key|p12|pfx|keystore))$/i;
-/** True if `fullPath`'s basename looks like it holds secrets. */
 export function isSensitiveFile(fullPath) {
-    const name = fullPath.split(sep).pop() ?? fullPath;
-    return SENSITIVE_FILE_RE.test(name);
+    if (nameMatches(fullPath, SENSITIVE_FILE_RE))
+        return true;
+    if (SENSITIVE_PATH_RE.test(fullPath))
+        return true;
+    const real = realPathOf(fullPath);
+    return real !== null && SENSITIVE_PATH_RE.test(real);
+}
+/**
+ * True if a file named on its own (an @-mention, or a path smart context
+ * picks out of the prompt) must not be inlined: secrets, and committed `.env`
+ * templates, which can still hold a real value. Both paths use this one rule,
+ * so a mention the user was told is refused never reaches the provider
+ * another way.
+ */
+export function isRefusedMention(fullPath) {
+    return isSensitiveFile(fullPath) || nameMatches(fullPath, ENV_TEMPLATE_RE);
+}
+/** True if the basename of `fullPath`, or of the file it links to, matches `re`. */
+function nameMatches(fullPath, re) {
+    const nameOf = (p) => p.split(sep).pop() ?? p;
+    if (re.test(nameOf(fullPath)))
+        return true;
+    const real = realPathOf(fullPath);
+    return real !== null && re.test(nameOf(real));
+}
+/**
+ * A PEM / OpenSSH / PGP private-key block, or a PuTTY key header. The armour
+ * line must be followed by a line break, real or escaped (a service account
+ * JSON holds the key inside a string), then optional `Proc-Type:` /
+ * `Version:` headers and a blank line, then a line of base64. Code and docs
+ * that only name the armour (`"-----BEGIN RSA PRIVATE KEY-----"`, a regex,
+ * `'…-----\n' + body`, a `...` placeholder) don't match.
+ */
+const PRIVATE_KEY_RE = new RegExp(String.raw `-----BEGIN (?:[A-Z0-9]+ )*PRIVATE KEY(?: BLOCK)?-----[ \t]*(?:\r?\n|\\(?:r\\)?n)` +
+    String.raw `(?:[ \t]*[A-Za-z][\w-]*:[^\r\n\\]*(?:\r?\n|\\(?:r\\)?n))*` +
+    String.raw `(?:[ \t]*(?:\r?\n|\\(?:r\\)?n))?` +
+    String.raw `[ \t]*[A-Za-z0-9+/]+=*[ \t]*(?:\\(?:r\\)?n|$)` +
+    String.raw `|^PuTTY-User-Key-File-\d+:`, 'm');
+/**
+ * True if `text` holds private-key material anywhere. Keys are saved under
+ * any name (`~/.ssh/github`, `deploy/prod`), so the name check alone lets
+ * them through, and a key can sit past the top of a JSON or YAML file.
+ */
+export function looksLikeKeyMaterial(text) {
+    return PRIVATE_KEY_RE.test(text) || hasPrivateKeyBlock(text);
+}
+const KEY_ARMOUR_RE = /-----BEGIN ((?:[A-Z0-9]+ )*)PRIVATE KEY( BLOCK)?-----/g;
+/** How far past an armour line a key body is looked for. */
+const KEY_BLOCK_WINDOW = 20 * 1024;
+/**
+ * A complete private key block written the way code and config write it: on
+ * one line with spaces for breaks (YAML, CI variables), as concatenated or
+ * joined string literals, with `\n` or `\\n` escapes, or with the body glued
+ * to the armour line. The line-shaped pattern above misses those.
+ *
+ * Plain string work rather than one regex: a pattern that spans BEGIN, a body
+ * and END backtracks badly on a file full of BEGIN lines with no END.
+ */
+function hasPrivateKeyBlock(text) {
+    for (const m of text.matchAll(KEY_ARMOUR_RE)) {
+        const start = (m.index ?? 0) + m[0].length;
+        const nextBegin = text.indexOf('-----BEGIN ', start);
+        const limit = Math.min(nextBegin < 0 ? text.length : nextBegin, start + KEY_BLOCK_WINDOW);
+        const window = text.slice(start, limit);
+        const endAt = window.indexOf(`-----END ${m[1]}PRIVATE KEY${m[2] ?? ''}-----`);
+        if (endAt < 0)
+            continue;
+        const body = window.slice(0, endAt)
+            .replace(/\\\\?[rn]/g, '\n') // \n and \\n escapes are line breaks
+            .replace(/\\\//g, '/') // JSON writes / as \/
+            .split(/\r?\n/)
+            // Armour headers (Proc-Type:, Comment:) are not base64, which has no colon.
+            .filter((line) => !line.includes(':'))
+            .join('')
+            .replace(/[\s"'`+,[\]]/g, '');
+        const run = /^[A-Za-z0-9/=]{40,}/.exec(body)?.[0];
+        // A real body mixes many characters; a placeholder like xxxx… does not.
+        if (run && new Set(run).size >= 10)
+            return true;
+    }
+    return false;
+}
+/** `fullPath` with every symlink resolved, or null when it doesn't resolve. */
+function realPathOf(fullPath) {
+    try {
+        return realpathSync(fullPath);
+    }
+    catch {
+        return null;
+    }
+}
+const LINKS_OUTSIDE_REASON = 'links outside the project — use /add to attach it deliberately';
+/**
+ * True if `fullPath` names a place inside `root` but, with symlinks resolved,
+ * leads outside it. A path outside the project by name (`~/.ssh`) was chosen
+ * on purpose and is not judged here.
+ */
+function linksOutsideRoot(fullPath, root) {
+    return isWithin(fullPath, resolve(root)) && !resolvesWithin(fullPath, root);
+}
+/** True if `child` is `parent` or lies beneath it. */
+function isWithin(child, parent) {
+    return child === parent || child.startsWith(parent.endsWith(sep) ? parent : parent + sep);
+}
+/**
+ * True if `fullPath`, with symlinks resolved, lies inside `dir` (also
+ * resolved). False when either doesn't exist.
+ */
+export function resolvesWithin(fullPath, dir) {
+    const real = realPathOf(fullPath);
+    const realDir = realPathOf(dir);
+    return real !== null && realDir !== null && isWithin(real, realDir);
 }
 /** True if a filename looks like a suggestible source file. */
 function shouldSuggest(name) {

package/dist/utils/personalities.js

@@ -34,9 +34,10 @@
  *     personality is active.
  *   - Persists across sessions until cleared with `/personality off`.
  */
-import { readFileSync, readdirSync, existsSync } from 'fs';
+import { readFileSync, readdirSync, existsSync, statSync } from 'fs';
 import { basename, join } from 'path';
 import { homedir } from 'os';
+import { leadsOutsideProject } from './projectPaths.js';
 import { config } from '../config/index.js';
 import { getProvider } from '../config/providers.js';
 const CAPABILITIES = new Set([
@@ -323,7 +324,7 @@ The user wants this merged today:
     },
 ];
 /** Load custom personalities from a `.codeep/personalities/` directory. */
-function loadFromDir(dir, scope) {
+function loadFromDir(dir, scope, projectRoot) {
     if (!existsSync(dir))
         return [];
     const out = [];
@@ -341,9 +342,18 @@ function loadFromDir(dir, scope) {
         if (!/^[a-z0-9][a-z0-9-]*$/.test(name))
             continue; // skip weirdly-named files
         try {
-            const raw = readFileSync(join(dir, entry), 'utf8');
-            if (raw.length > 64 * 1024)
-                continue; // cap at 64 KB
+            const file = join(dir, entry);
+            // A project's files come with the repo: a link out of it would put an
+            // arbitrary file of the user's (credentials, history) into the prompt.
+            if (projectRoot && leadsOutsideProject(file, projectRoot))
+                continue;
+            // Cap at 64 KB, and check before reading: statSync follows symlinks,
+            // and a committed link to /dev/zero (or a FIFO) never comes back from
+            // readFileSync.
+            const stat = statSync(file);
+            if (!stat.isFile() || stat.size > 64 * 1024)
+                continue;
+            const raw = readFileSync(file, 'utf8');
             out.push(parsePersonalityMarkdown(raw, name, scope));
         }
         catch {
@@ -684,7 +694,7 @@ export function resolvePersonalityRuntimeModel(personality, current) {
 }
 export function loadAllPersonalities(workspaceRoot) {
     const project = workspaceRoot
-        ? loadFromDir(join(workspaceRoot, '.codeep', 'personalities'), 'project')
+        ? loadFromDir(join(workspaceRoot, '.codeep', 'personalities'), 'project', workspaceRoot)
         : [];
     const global = loadFromDir(join(homedir(), '.codeep', 'personalities'), 'global');
     // Merge with scope priority: project > global > builtin.