codeep 3.3.3 → 3.4.1

package/dist/utils/telegramApproval.d.ts

@@ -37,8 +37,13 @@ export { nextOffset } from './telegramUpdates';
  * be mangled by Markdown parsing into something that is not what will run — and
  * approving a command you were shown incorrectly is the one failure this whole
  * feature must not have.
+ *
+ * `reason` is what the file being written decides — "this file controls what
+ * commands git runs". The terminal dialog shows it, and someone answering from
+ * a phone is the one with the least context, so a message without it asks them
+ * to approve on less than the person at the desk had.
  */
-export declare function composeMessage(command: string, toolName: string, isDestructive: boolean): string;
+export declare function composeMessage(command: string, toolName: string, isDestructive: boolean, reason?: string): string;
 /**
  * Only the configured chat may decide.
  *
@@ -102,8 +107,11 @@ export declare class TelegramApproval {
      * Resolves `null` when no answer arrived — the terminal was used instead, the
      * caller aborted, or Telegram could not be reached. **A null is never
      * approval**: the caller keeps its own gate and decides for itself.
+     *
+     * `reason` says what the file being written decides, when it decides
+     * anything, so the phone shows what the terminal shows.
      */
-    ask(command: string, toolName: string, isDestructive: boolean, signal?: AbortSignal): Promise<TelegramAnswer | null>;
+    ask(command: string, toolName: string, isDestructive: boolean, signal?: AbortSignal, reason?: string): Promise<TelegramAnswer | null>;
     /**
      * The terminal answered first. Close the question on the phone so nobody taps
      * a button that would do nothing, and say where it was decided.

package/dist/utils/telegramApproval.js

@@ -32,6 +32,15 @@ export { nextOffset } from './telegramUpdates.js';
  *  text; this keeps room for the heading and the fences, and a command longer
  *  than this is not something anyone reads off a phone anyway. */
 const MAX_COMMAND_CHARS = 300;
+/**
+ * Markdown markers neutralised.
+ *
+ * Telegram rejects a WHOLE message whose markup is unbalanced (these go out
+ * with `parse_mode: 'Markdown'`), so a single stray underscore in the text
+ * would mean the question never arrives at all. A visible backslash beats a
+ * phone that stayed silent.
+ */
+const escapeMarkdown = (text) => text.replace(/([_*`[])/g, '\\$1');
 /**
  * The message text.
  *
@@ -39,18 +48,24 @@ const MAX_COMMAND_CHARS = 300;
  * be mangled by Markdown parsing into something that is not what will run — and
  * approving a command you were shown incorrectly is the one failure this whole
  * feature must not have.
+ *
+ * `reason` is what the file being written decides — "this file controls what
+ * commands git runs". The terminal dialog shows it, and someone answering from
+ * a phone is the one with the least context, so a message without it asks them
+ * to approve on less than the person at the desk had.
  */
-export function composeMessage(command, toolName, isDestructive) {
+export function composeMessage(command, toolName, isDestructive, reason) {
     const head = isDestructive
         ? '⚠️ Codeep wants to run a destructive tool'
         : 'Codeep needs approval';
+    const why = reason ? `\n\n⚠️ ${escapeMarkdown(reason)}` : '';
     const trimmed = command.length > MAX_COMMAND_CHARS
         ? command.slice(0, MAX_COMMAND_CHARS - 1) + '…'
         : command;
     // A fence inside the command would close ours early and leak the rest as
     // prose. Neutralise it rather than trusting the input.
     const safe = trimmed.replace(/```/g, "'''");
-    return `${head}\n\n\`${toolName}\`\n\n\`\`\`\n${safe}\n\`\`\``;
+    return `${head}${why}\n\n\`${toolName}\`\n\n\`\`\`\n${safe}\n\`\`\``;
 }
 /**
  * Only the configured chat may decide.
@@ -179,10 +194,13 @@ export class TelegramApproval {
      * Resolves `null` when no answer arrived — the terminal was used instead, the
      * caller aborted, or Telegram could not be reached. **A null is never
      * approval**: the caller keeps its own gate and decides for itself.
+     *
+     * `reason` says what the file being written decides, when it decides
+     * anything, so the phone shows what the terminal shows.
      */
-    async ask(command, toolName, isDestructive, signal) {
+    async ask(command, toolName, isDestructive, signal, reason) {
         const token = randomToken();
-        const messageID = await this.sendQuestion(composeMessage(command, toolName, isDestructive), token);
+        const messageID = await this.sendQuestion(composeMessage(command, toolName, isDestructive, reason), token);
         if (messageID === null) {
             // Say it once, here, rather than leaving the caller to guess from a null
             // that also means "answered elsewhere" and "cancelled".

package/dist/utils/toolExecution.d.ts

@@ -5,6 +5,7 @@
  * executeTool() dispatches to individual tool handlers.
  * listDirectory() and htmlToText() are private helpers.
  * createActionLog() converts a ToolCall+ToolResult into a history ActionLog.
+ * trustBearingWrite() names the writes that decide what runs later.
  */
 import { ToolCall, ToolResult, ActionLog } from './tools';
 export { isBlockedIp, assertFetchUrlAllowed } from './ssrfGuard';
@@ -18,12 +19,56 @@ export declare function validatePath(path: string, projectRoot: string): {
     absolutePath: string;
     error?: string;
 };
+/** Drop the cached hook directories. Call before spawning a command line. */
+export declare function forgetHooksDirectory(): void;
+/**
+ * The tail of the refusal one of these writes gets when the run has nobody to
+ * ask — no permission callback at all, which is how `codeep review --fix`
+ * runs in CI. agent.ts builds the refusal; headlessReview.ts recognises it by
+ * this text so it can say so in the run output rather than leave it buried in
+ * the agent's tool log.
+ *
+ * One constant, in the module that owns the classification rather than in
+ * agent.ts, for two reasons: a reworded refusal that stopped matching would
+ * put CI back to failing silently, and agent.js is a module the fix-run tests
+ * replace wholesale — a constant read from there would have been undefined in
+ * exactly the test that guards this.
+ */
+export declare const NO_CONFIRMER_REFUSAL = "Nobody could be asked to confirm it, so nothing was written.";
+export interface TrustBearingWrite {
+    /** The path exactly as the tool call named it, for the prompt. */
+    path: string;
+    /** The absolute path the classification matched — one spelling per file, so
+     *  a "never again" answer given for `.git/config` also covers
+     *  `./.git/config` and the symlink that reaches it. Never shown to anyone;
+     *  it exists to key that answer (see agent.ts). */
+    file: string;
+    /** One plain sentence about what the file controls. */
+    reason: string;
+}
+/**
+ * What a tool call would write that decides what runs later, or null.
+ *
+ * Callers use this for two things: to force a confirmation the mode would
+ * otherwise skip (see agent.ts), and to tell the person answering it what
+ * they are approving.
+ *
+ * A symlink inside the project can point at one of these names — `ln -s .git
+ * tools/cfg` makes a write to `tools/cfg/config` land in the real `.git`, and
+ * validatePath allows it because it never leaves the project — so the
+ * resolved path is classified alongside the one the model asked for.
+ */
+export declare function trustBearingWrite(toolCall: ToolCall, projectRoot: string): TrustBearingWrite | null;
 /**
  * Optional filesystem delegation. When an ACP client advertises `fs`
  * capability (Zed always does, VS Code may), the server should route
  * read/write through the client instead of touching disk directly — that
  * way the client's unsaved buffers, undo history, and virtual filesystems
  * stay authoritative. Callbacks must already use absolute paths.
+ *
+ * A writeTextFile that rejects with AcpRequestError means the client
+ * answered and refused the write; the tool then fails instead of writing
+ * to disk behind the editor.
  */
 export interface FsCallbacks {
     readTextFile?: (absolutePath: string) => Promise<string>;
@@ -35,9 +80,12 @@ export interface FsCallbacks {
  * `fs` is optional — if provided and the relevant method is defined, file
  * read/write is delegated to the client. Otherwise we fall back to direct
  * disk I/O. A delegated call that throws also falls back to disk so a
- * single client hiccup doesn't kill the agent loop.
+ * single client hiccup doesn't kill the agent loop — except a write the
+ * client explicitly refused, which fails the tool (see isRefusedWrite).
+ *
+ * `signal` stops a running execute_command when it fires.
  */
-export declare function executeTool(toolCall: ToolCall, projectRoot: string, fs?: FsCallbacks, mcpSessionId?: string): Promise<ToolResult>;
+export declare function executeTool(toolCall: ToolCall, projectRoot: string, fs?: FsCallbacks, mcpSessionId?: string, signal?: AbortSignal): Promise<ToolResult>;
 /**
  * Create action log from tool result
  */