codeep 3.4.0 → 3.4.1

package/dist/renderer/agentExecution.js

@@ -14,6 +14,8 @@ import { takeRunFromPhone } from '../utils/telegramInbox.js';
 import { isFlatFeeProvider } from '../config/providers.js';
 import { raceApproval } from '../utils/approvalRace.js';
 import { describeAuditTarget } from '../utils/auditLog.js';
+import { trustBearingWrite, forgetHooksDirectory } from '../utils/toolExecution.js';
+import { shellCommandEnv } from '../utils/shell.js';
 import { charWidth } from './ansi.js';
 import { config, autoSaveSession, getCurrentSessionId } from '../config/index.js';
 import { reportStats, syncSession, generateProjectId } from '../utils/codeepCloud.js';
@@ -235,75 +237,95 @@ export async function executeAgentTask(task, dryRun, ctx) {
         const asksPerTool = confirmationMode === 'dangerous' || confirmationMode === 'always';
         // Read the Telegram credentials once for the whole run rather than per tool
         // call: they come from the OS keychain, and paying that on every dangerous
-        // tool would put a keychain round-trip in front of each confirmation.
-        // Null means the feature is off or half-configured, and the terminal is
-        // then the only place the question appears — exactly as before.
-        const telegramCredentials = asksPerTool
-            ? await loadTelegramCredentials()
-            : null;
-        // The finish notice does not depend on the confirmation mode — a run with
-        // confirmations off is exactly the one you are most likely to walk away
-        // from. Reuse the credentials already read above when there are any, so
-        // this costs a second keychain round-trip only when there are not.
-        const noticeCredentials = telegramCredentials ?? await loadTelegramCredentials();
+        // tool would put a keychain round-trip in front of each confirmation. Read
+        // in every mode, for the finish notice — and because 'never' now asks
+        // about a file that decides what runs later, which is exactly the kind of
+        // run someone has walked away from. Null means the feature is off or
+        // half-configured, and the terminal is then the only place the question
+        // appears — exactly as before.
+        const telegramCredentials = await loadTelegramCredentials();
         const runStartedAt = Date.now();
-        const onRequestPermission = asksPerTool
-            ? async (toolCall) => {
-                // `parameters.command` is the binary alone — `git`, not `git status`.
-                // Showing that asks someone to approve a command they have not been
-                // shown, which is the one thing this gate must not do. The audit
-                // record already joins the binary with its arguments; reuse it rather
-                // than writing a second, subtly different answer.
-                const target = describeAuditTarget(toolCall);
-                // Indented by two in the dialog.
-                const targetLines = wrapConfirmTarget(target, (process.stdout.columns || 80) - 4)
-                    .map(line => `  ${line}`);
-                const inTerminal = {
-                    answer: new Promise((resolve) => {
-                        app.showConfirm({
-                            title: '⚠️  Confirm Action',
-                            message: [
-                                'The agent wants to execute:',
-                                '',
-                                `  ${showControls(toolCall.tool)}`,
-                                ...targetLines,
-                                '',
-                                telegramCredentials ? 'Allow this action? (or answer on Telegram)' : 'Allow this action?',
-                            ],
-                            confirmLabel: 'Allow',
-                            cancelLabel: 'Deny',
-                            extraOption: { label: 'Always Allow', onSelect: () => resolve('allow_always') },
-                            onConfirm: () => resolve('allow_once'),
-                            onCancel: () => resolve('reject_always'),
-                        });
-                    }),
-                    // Answered on the phone: take the dialog down without running either
-                    // callback, since the decision is already made and taken.
-                    withdraw: (winner) => app.dismissConfirm(`Answered on Telegram — ${winner}.`),
+        // 'never' still gets a callback. A write to a file that decides what runs
+        // later — `.git/config`, a hook, an MCP server list — is asked about in
+        // every mode (the agent gate decides which calls those are), and "never
+        // ask" is then answered here for everything else, exactly as before:
+        // without a callback the agent would have to refuse those writes instead.
+        const onRequestPermission = async (toolCall, 
+        // What the agent gate already worked out about this call, passed rather
+        // than worked out twice: trustBearingWrite() stats the path, resolves a
+        // symlinked ancestor and may ask git where this repo keeps its hooks.
+        // Undefined means the question came from somewhere that has not looked
+        // — a skill's shell line asks through this same callback — so it is
+        // only then that this side looks for itself. `null` is an answer.
+        known) => {
+            const trustBearing = known !== undefined ? known : trustBearingWrite(toolCall, context.root || process.cwd());
+            if (!asksPerTool && !trustBearing)
+                return 'allow_once';
+            // `parameters.command` is the binary alone — `git`, not `git status`.
+            // Showing that asks someone to approve a command they have not been
+            // shown, which is the one thing this gate must not do. The audit
+            // record already joins the binary with its arguments; reuse it rather
+            // than writing a second, subtly different answer.
+            const target = describeAuditTarget(toolCall);
+            // Indented by two in the dialog.
+            const targetLines = wrapConfirmTarget(target, (process.stdout.columns || 80) - 4)
+                .map(line => `  ${line}`);
+            const inTerminal = {
+                answer: new Promise((resolve) => {
+                    app.showConfirm({
+                        title: '⚠️  Confirm Action',
+                        message: [
+                            'The agent wants to execute:',
+                            '',
+                            `  ${showControls(toolCall.tool)}`,
+                            ...targetLines,
+                            // What the file does, not that it is "sensitive": someone
+                            // deciding in one second needs the consequence, not a label.
+                            ...(trustBearing ? ['', ...wrapConfirmTarget(`⚠️  ${trustBearing.reason}`, (process.stdout.columns || 80) - 4)] : []),
+                            '',
+                            telegramCredentials ? 'Allow this action? (or answer on Telegram)' : 'Allow this action?',
+                        ],
+                        confirmLabel: 'Allow',
+                        cancelLabel: 'Deny',
+                        // No "Always Allow" for one of those files: the agent answers
+                        // about this file only and would not remember it anyway.
+                        extraOption: trustBearing ? undefined : { label: 'Always Allow', onSelect: () => resolve('allow_always') },
+                        onConfirm: () => resolve('allow_once'),
+                        // The one "no" there is, and it answers reject_always. For one of
+                        // those files the agent remembers that against the FILE rather
+                        // than the tool, so refusing a `.git/config` prompt does not also
+                        // switch delete_file off for the rest of the run.
+                        onCancel: () => resolve('reject_always'),
+                    });
+                }),
+                // Answered on the phone: take the dialog down without running either
+                // callback, since the decision is already made and taken.
+                withdraw: (winner) => app.dismissConfirm(`Answered on Telegram — ${winner}.`),
+            };
+            let onPhone = null;
+            if (telegramCredentials) {
+                // Report a failure to *ask* once, in the terminal. Without this a
+                // wrong chat id looks exactly like a phone nobody picked up.
+                const telegram = new TelegramApproval(telegramCredentials, reason => app.notifyWarn(`Telegram: ${reason}`));
+                onPhone = {
+                    answer: telegram
+                        // The reason goes with it: a phone showing less than the terminal
+                        // asks for a decision on less than the terminal had.
+                        .ask(target, toolCall.tool, true, undefined, trustBearing?.reason)
+                        .then(answer => (answer ? outcomeForAnswer(answer) : null))
+                        // A phone that cannot be reached is not a denial. Step aside and
+                        // let the terminal decide, however long that takes.
+                        .catch(() => null),
+                    withdraw: (winner) => telegram.withdraw(winner),
                 };
-                let onPhone = null;
-                if (telegramCredentials) {
-                    // Report a failure to *ask* once, in the terminal. Without this a
-                    // wrong chat id looks exactly like a phone nobody picked up.
-                    const telegram = new TelegramApproval(telegramCredentials, reason => app.notifyWarn(`Telegram: ${reason}`));
-                    onPhone = {
-                        answer: telegram
-                            .ask(target, toolCall.tool, true)
-                            .then(answer => (answer ? outcomeForAnswer(answer) : null))
-                            // A phone that cannot be reached is not a denial. Step aside and
-                            // let the terminal decide, however long that takes.
-                            .catch(() => null),
-                        withdraw: (winner) => telegram.withdraw(winner),
-                    };
-                }
-                const { answer } = await raceApproval(inTerminal, onPhone, outcome => describePermissionOutcome(outcome));
-                // Nobody answered — neither side could even ask. `classifyPermissionOutcome`
-                // fails closed on anything it does not recognise, and this is spelled
-                // out rather than left to that: a question that was never put must
-                // never read as a yes.
-                return answer ?? 'reject_once';
             }
-            : undefined;
+            const { answer } = await raceApproval(inTerminal, onPhone, outcome => describePermissionOutcome(outcome));
+            // Nobody answered — neither side could even ask. `classifyPermissionOutcome`
+            // fails closed on anything it does not recognise, and this is spelled
+            // out rather than left to that: a question that was never put must
+            // never read as a yes.
+            return answer ?? 'reject_once';
+        };
         const result = await runAgent(enrichedTask, context, {
             dryRun,
             onRequestPermission,
@@ -558,7 +580,7 @@ export async function executeAgentTask(task, dryRun, ctx) {
         // Told once the run is over, and only when it ran long enough that you
         // could plausibly have stopped watching. Awaited so the process does not
         // exit from under the request, but never allowed to fail the run.
-        if (noticeCredentials) {
+        if (telegramCredentials) {
             const elapsedMs = Date.now() - runStartedAt;
             const fromPhone = startedFromPhone;
             // The one-minute threshold exists so a phone is not buzzed about work you
@@ -578,7 +600,7 @@ export async function executeAgentTask(task, dryRun, ctx) {
                     costUsd: payPerUse.reduce((sum, e) => sum + e.estimatedCost, 0),
                 });
                 for (const message of messages) {
-                    await sendTelegramNotice(noticeCredentials, message).catch(() => false);
+                    await sendTelegramNotice(telegramCredentials, message).catch(() => false);
                 }
             }
         }
@@ -657,12 +679,37 @@ export async function runSkill(nameOrShortcut, args, ctx) {
     try {
         const result = await executeSkill(skill, params, {
             onCommand: async (cmd) => {
+                const cwd = ctx.projectPath || process.cwd();
+                // A raw process.env here handed the repository's own `.git/config`
+                // back to git: `/commit` runs `git commit`, and a repo-scope
+                // `gpg.program` that Codeep's own commit path neutralises executed
+                // through this spawn instead.
+                //
+                // Built before the spawn, and caught: shellCommandEnv() refuses a git
+                // line in a repository whose config names a program no override
+                // switches off, and a refusal escaping here would abort the whole
+                // skill rather than fail the step that asked for git. A step that
+                // cannot run is reported the same way a step that failed is.
+                let env;
+                try {
+                    env = shellCommandEnv(cmd, cwd);
+                }
+                catch (error) {
+                    const why = error instanceof Error ? error.message : String(error);
+                    ctx.app.addMessage({ role: 'system', content: `\`${cmd}\` was not run:\n\`\`\`\n${why}\n\`\`\`` });
+                    throw new Error(why);
+                }
+                // A command line is the one thing in a skill that can move this
+                // repository's hooks (`git config core.hooksPath .evil`), and the
+                // write gate caches where they are for the run.
+                forgetHooksDirectory();
                 const proc = spawnSync(cmd, {
-                    cwd: ctx.projectPath || process.cwd(),
+                    cwd,
                     encoding: 'utf-8',
                     timeout: 60000,
                     shell: true,
                     stdio: ['pipe', 'pipe', 'pipe'],
+                    env,
                 });
                 const stdout = (proc.stdout || '').trim();
                 const stderr = (proc.stderr || '').trim();

package/dist/renderer/commands.js

@@ -1215,9 +1215,25 @@ Format: use headers per category, only include categories where you found issues
                 ctx.app.notify('Usage: /git-commit <message>');
                 return;
             }
-            // Use execFile to avoid shell injection — pass commit message as a direct argument
-            import('child_process').then(({ execFile }) => {
-                execFile('git', ['commit', '-m', message], { cwd: ctx.projectPath, encoding: 'utf-8' }, (err) => {
+            // Use execFile to avoid shell injection — pass commit message as a direct argument.
+            // hardenedGitEnv() on top of that: the repo's own .git/config can name programs
+            // git would run for this commit (core.fsmonitor, core.hooksPath, …).
+            Promise.all([import('child_process'), import('../utils/git.js')]).then(([{ execFile }, { hardenedGitEnv }]) => {
+                // The SAME cwd the commit runs in. Called with no argument, the scan
+                // read process.cwd() instead — so a project opened anywhere other
+                // than the directory Codeep was launched from was "hardened" against
+                // a different repository's config entirely.
+                let env;
+                try {
+                    env = hardenedGitEnv({ cwd: ctx.projectPath });
+                }
+                catch (error) {
+                    // It refuses rather than hand git a half-scanned environment, and
+                    // its message names the key and what to do about it.
+                    ctx.app.notify(error instanceof Error ? error.message : 'Commit failed');
+                    return;
+                }
+                execFile('git', ['commit', '-m', message], { cwd: ctx.projectPath, encoding: 'utf-8', env }, (err) => {
                     if (err) {
                         ctx.app.notify(`Commit failed: ${err.message}`);
                     }

package/dist/renderer/main.d.ts

@@ -6,7 +6,31 @@
  * commands.ts and agent execution in agentExecution.ts.
  */
 import { App } from './App';
+import { type GitStatus } from '../utils/git';
 import type { McpServer } from '../acp/protocol';
+/**
+ * What to tell the user when git would not run in this project, or null when
+ * there is nothing to tell them.
+ *
+ * Without it the only symptom is the branch quietly missing from the header,
+ * which reads as "not a repository" — so a repository whose own `.git/config`
+ * names a program git would run looks like an ordinary folder, and the one
+ * thing the user has to do (remove that key) is never said anywhere. The
+ * refusal names the key and the `git config --unset` that clears it, so it is
+ * passed through verbatim rather than summarised into "git failed".
+ *
+ * Read off `refusal` and NOT off `error`, which is the field an earlier cut
+ * of this used. `error` is every way git can fail in a repository, and the
+ * commonest of them is a brand-new `git init` with no commit yet: `git
+ * rev-parse --abbrev-ref HEAD` answers `fatal: ambiguous argument 'HEAD'`
+ * there (git 2.54), so the first thing a user does in a new project met a
+ * warning made of git internals telling them to remove a config key that does
+ * not exist. `refusal` is filled on the hardening path and nowhere else, so
+ * an ordinary git failure stays as silent as it was before this notice
+ * existed — the branch is simply missing from the header, which is what it
+ * has always done.
+ */
+export declare function gitRefusalNotice(status: GitStatus): string | null;
 /** Derive a short display name from a user message (first ~5 words, max 48 chars). */
 export declare function deriveSessionName(message: string): string;
 /**

package/dist/renderer/main.js

@@ -31,8 +31,13 @@ import { symlinkedCodeepNotice } from '../utils/projectPaths.js';
 // ─── Global state ─────────────────────────────────────────────────────────────
 let projectPath = process.cwd();
 /** Cached header branch. Resolved on first use so `--version`/`--help` never
- *  shell out to git, and cached because getStatus runs on every render frame. */
+ *  shell out to git, and cached because getStatus runs on every render frame.
+ *  `refusal` is the message getGitStatus carries back when git would not run
+ *  here at all — see reportGitRefusal(). */
 let gitBranchCache = null;
+/** Projects whose refusal has already been put in the transcript, so a cache
+ *  dropped after every agent run does not repeat it once a minute. */
+const gitRefusalReported = new Set();
 let projectContext = null;
 let hasWriteAccess = false;
 let sessionId = getCurrentSessionId();
@@ -51,10 +56,60 @@ const addedFiles = new Map();
  *  or an agent run finished (an agent can check out a different branch). */
 function getHeaderBranch() {
     if (!gitBranchCache || gitBranchCache.path !== projectPath) {
-        gitBranchCache = { path: projectPath, branch: getGitStatus(projectPath).branch };
+        const status = getGitStatus(projectPath);
+        const refusal = gitRefusalNotice(status);
+        gitBranchCache = { path: projectPath, branch: status.branch, refusal: refusal ?? undefined };
+        reportGitRefusal(projectPath, refusal);
     }
     return gitBranchCache.branch;
 }
+/**
+ * What to tell the user when git would not run in this project, or null when
+ * there is nothing to tell them.
+ *
+ * Without it the only symptom is the branch quietly missing from the header,
+ * which reads as "not a repository" — so a repository whose own `.git/config`
+ * names a program git would run looks like an ordinary folder, and the one
+ * thing the user has to do (remove that key) is never said anywhere. The
+ * refusal names the key and the `git config --unset` that clears it, so it is
+ * passed through verbatim rather than summarised into "git failed".
+ *
+ * Read off `refusal` and NOT off `error`, which is the field an earlier cut
+ * of this used. `error` is every way git can fail in a repository, and the
+ * commonest of them is a brand-new `git init` with no commit yet: `git
+ * rev-parse --abbrev-ref HEAD` answers `fatal: ambiguous argument 'HEAD'`
+ * there (git 2.54), so the first thing a user does in a new project met a
+ * warning made of git internals telling them to remove a config key that does
+ * not exist. `refusal` is filled on the hardening path and nowhere else, so
+ * an ordinary git failure stays as silent as it was before this notice
+ * existed — the branch is simply missing from the header, which is what it
+ * has always done.
+ */
+export function gitRefusalNotice(status) {
+    const refusal = status.isRepo ? status.refusal : undefined;
+    if (!refusal)
+        return null;
+    return `⚠️  ${refusal}\n\nUntil then the header shows no branch, and everything Codeep does with git here — the status line, \`@git\`, \`/commit\`, the review hook — is off.`;
+}
+/**
+ * Put that message in the transcript once per project.
+ *
+ * A transcript message and not notify(): a toast is gone in three seconds,
+ * and this is a thing to act on, not a thing to glance at. Once per project
+ * because the cache it rides on is dropped after every agent run, and a
+ * warning repeated after each run is one the user learns to scroll past.
+ *
+ * Queued rather than added inline because the only caller runs inside
+ * getStatus(), which the render loop calls — pushing a message onto the list
+ * the frame is reading would tear that frame. The microtask lands before the
+ * next one.
+ */
+function reportGitRefusal(path, notice) {
+    if (!notice || gitRefusalReported.has(path))
+        return;
+    gitRefusalReported.add(path);
+    queueMicrotask(() => { app?.addMessage({ role: 'system', content: notice }); });
+}
 /** Derive a short display name from a user message (first ~5 words, max 48 chars). */
 export function deriveSessionName(message) {
     const clean = message.replace(/\s+/g, ' ').trim();

package/dist/utils/agent.d.ts

@@ -10,6 +10,7 @@ import { type Personality } from './personalities';
 export { loadProjectRules, loadProgressLog, writeProgressLog, formatChatHistoryForAgent };
 export type { AgentChatResponse };
 import { ToolCall, ToolResult, ActionLog } from './tools';
+import { type TrustBearingWrite } from './toolExecution';
 import { undoLastAction, undoAllActions, getCurrentSession, getRecentSessions, formatSession, ActionSession } from './history';
 import { VerifyResult } from './verify';
 import { TaskPlan, SubTask } from './taskPlanner';
@@ -65,7 +66,18 @@ export interface AgentOptions {
     onVerification?: (results: VerifyResult[]) => void;
     onTaskPlan?: (plan: TaskPlan) => void;
     onTaskUpdate?: (task: SubTask) => void;
-    onRequestPermission?: (toolCall: ToolCall) => Promise<PermissionOutcome>;
+    /**
+     * Ask the user about one tool call.
+     *
+     * `trustBearing` is what this run already worked out about the call — the
+     * file it would write that decides what runs later, or null when it writes
+     * no such file. It is passed so the side putting up the dialog can word it
+     * without calling trustBearingWrite() a second time: that call stats the
+     * path, follows a symlink and may ask git where the repo's hooks live.
+     * Optional, so a caller that would rather work it out itself (or was not
+     * called from the gate below) still type-checks.
+     */
+    onRequestPermission?: (toolCall: ToolCall, trustBearing?: TrustBearingWrite | null) => Promise<PermissionOutcome>;
     /** Tool names to force into the per-run dangerous set, on top of the global
      *  agentConfirm* settings. ACP manual mode passes ['write_file','edit_file']
      *  here to gate them for THIS run only, instead of mutating global config. */
@@ -123,10 +135,13 @@ export interface AgentOptions {
     roleAddendum?: string;
     /** "Always allow" / "always deny" answers shared with a delegating parent,
      *  so a sub-agent neither asks again about a tool the user already decided
-     *  on nor runs one the user refused. */
+     *  on nor runs one the user refused. `alwaysRejectedPaths` holds the same
+     *  for a single file that decides what runs later, which is refused by name
+     *  rather than by tool. */
     permissionMemory?: {
         alwaysAllowed: Set<string>;
         alwaysRejected: Set<string>;
+        alwaysRejectedPaths?: Set<string>;
     };
     /** Provider/model for this run only, used in place of the global selection.
      *  A sub-agent with its own `model:` runs on it this way; the global config

package/dist/utils/agent.js

@@ -37,6 +37,7 @@ function calculateDynamicTimeout(iteration, baseTimeout) {
     return Math.max(calculatedTimeout, 120000);
 }
 import { parseToolCalls, executeTool, createActionLog } from './tools.js';
+import { trustBearingWrite, forgetHooksDirectory, NO_CONFIRMER_REFUSAL } from './toolExecution.js';
 import { config } from '../config/index.js';
 import { supportsNativeTools } from '../config/providers.js';
 import { isMcpToolName, isVirtualMcpToolName } from './mcpRegistry.js';
@@ -568,6 +569,13 @@ export async function runAgent(prompt, projectContext, options = {}) {
     const alwaysAllowedTools = opts.permissionMemory?.alwaysAllowed ?? new Set();
     // Track tools permanently rejected this session via reject_always
     const alwaysRejectedTools = opts.permissionMemory?.alwaysRejected ?? new Set();
+    // Files that decide what runs later and were refused for good this session.
+    // Kept apart from the tool set on purpose: the TUI's only "no" button answers
+    // reject_always, so saying no to one `.git/config` prompt would otherwise
+    // turn off delete_file — and every other use of that tool — for the rest of
+    // the run. Keyed by the resolved path, so one answer covers every spelling
+    // of the same file.
+    const alwaysRejectedPaths = opts.permissionMemory?.alwaysRejectedPaths ?? new Set();
     // Tools that require permission when onRequestPermission is set (configurable)
     const dangerousTools = buildDangerousTools(opts.extraDangerousTools);
     // Delegation handler: run a named (or generic) sub-agent in its own fresh
@@ -634,7 +642,7 @@ export async function runAgent(prompt, projectContext, options = {}) {
                 dryRun: opts.dryRun,
                 onRequestPermission: opts.onRequestPermission,
                 extraDangerousTools: opts.extraDangerousTools,
-                permissionMemory: { alwaysAllowed: alwaysAllowedTools, alwaysRejected: alwaysRejectedTools },
+                permissionMemory: { alwaysAllowed: alwaysAllowedTools, alwaysRejected: alwaysRejectedTools, alwaysRejectedPaths },
                 modelOverride,
                 onExecuteCommand: opts.onExecuteCommand,
                 fs: opts.fs,
@@ -690,13 +698,56 @@ export async function runAgent(prompt, projectContext, options = {}) {
         if (opts.allowedTools && !opts.allowedTools.includes(toolCall.tool)) {
             return refuse(`Tool "${toolCall.tool}" is not available to this sub-agent.`, `Tool ${toolCall.tool} is not allowed for this sub-agent. Use only: ${opts.allowedTools.join(', ')}.`);
         }
-        // Permission check for dangerous tools (only when callback is provided, e.g. ACP/Zed)
-        if (opts.onRequestPermission && requiresPermission(toolCall.tool, dangerousTools) && !alwaysAllowedTools.has(toolCall.tool)) {
-            const denied = () => refuse(`User rejected permission for ${toolCall.tool}`, `Tool ${toolCall.tool} was denied by user. Do not attempt this action again.`);
+        const denied = () => refuse(`User rejected permission for ${toolCall.tool}`, `Tool ${toolCall.tool} was denied by user. Do not attempt this action again.`);
+        // Writing a file that decides what runs later is code execution on a
+        // delay, not an edit: git runs `core.fsmonitor` itself on the next
+        // `git status` the status line makes, a `.codeep/hooks/` script runs on
+        // the next tool call, an MCP entry spawns a process. A prompt injection
+        // that gets one of these written has walked around every other gate, so
+        // the write is confirmed in EVERY confirmation mode — not only the tiers
+        // that happen to list write_file — and an "always allow" answer given for
+        // the tool never covers it. With nobody to ask, it fails the way a write
+        // the editor refused fails: proceeding quietly is the one outcome that
+        // cannot be taken back.
+        const trustBearing = trustBearingWrite(toolCall, projectContext.root || process.cwd());
+        if (trustBearing) {
+            if (!opts.onRequestPermission) {
+                const refusal = refuse(`Refused ${toolCall.tool} on ${trustBearing.path}: ${trustBearing.reason} ${NO_CONFIRMER_REFUSAL}`, `Tool ${toolCall.tool} was refused on ${trustBearing.path}. ${trustBearing.reason} Nobody could be asked to confirm it. Do not try again — tell the user to edit that file themselves.`);
+                recordAuditEvent(auditRoot, {
+                    ts: Date.now(), run: auditRun, tool: toolCall.tool, action: 'refused',
+                    target: describeAuditTarget(toolCall), outcome: 'refused',
+                    detail: `${trustBearing.path} decides what runs later and no confirmation was possible`,
+                });
+                return refusal;
+            }
+            // An "always deny" already given: for the tool, when the user really
+            // chose that in an ordinary prompt, or for this file.
+            if (alwaysRejectedTools.has(toolCall.tool) || alwaysRejectedPaths.has(trustBearing.file))
+                return denied();
+            const decision = classifyPermissionOutcome(await opts.onRequestPermission(toolCall, trustBearing));
+            // Neither answer is remembered for the TOOL. "Always allow" is not
+            // remembered at all: it was an answer about THIS file, and the next
+            // `.git/config` write must be asked about again. "Always deny" is
+            // remembered against the file — the fail-closed half of the same rule.
+            // Against the tool it would be a trap: the TUI offers Allow, Always
+            // Allow and Deny, and that Deny answers reject_always, so refusing one
+            // `.git/config` prompt would silently disable delete_file for the rest
+            // of the run.
+            if (decision !== 'allow-once' && decision !== 'allow-always') {
+                if (decision === 'deny-always')
+                    alwaysRejectedPaths.add(trustBearing.file);
+                return denied();
+            }
+        }
+        else if (opts.onRequestPermission && requiresPermission(toolCall.tool, dangerousTools) && !alwaysAllowedTools.has(toolCall.tool)) {
+            // Every other tool: the run's dangerous set decides, and only when
+            // there is a callback to ask through (e.g. ACP/Zed).
             // Skip without asking if permanently rejected this session
             if (alwaysRejectedTools.has(toolCall.tool))
                 return denied();
-            const outcome = await opts.onRequestPermission(toolCall);
+            // `null` and not nothing: this branch runs only when the call writes no
+            // such file, and saying so spares the dialog the second lookup.
+            const outcome = await opts.onRequestPermission(toolCall, null);
             // Fail CLOSED: allow ONLY on an explicit allow outcome; reject_* and
             // any malformed/unknown outcome deny (see classifyPermissionOutcome).
             const decision = classifyPermissionOutcome(outcome);
@@ -740,6 +791,12 @@ export async function runAgent(prompt, projectContext, options = {}) {
             }
             else {
                 try {
+                    // Runs in the editor's terminal instead of ours, so executeTool's
+                    // own invalidation never fires — but `git config core.hooksPath
+                    // .evil` moves this repository's hooks just the same. Drop the
+                    // cached answer here too, or the next write to the new hook
+                    // directory goes through unasked.
+                    forgetHooksDirectory();
                     const commandResult = await opts.onExecuteCommand(command, args, cwd);
                     toolResult = {
                         success: commandResult.exitCode === 0,

package/dist/utils/checkpoints.js

@@ -38,6 +38,7 @@ import { isSafeProjectWriteTarget, writeProjectFile } from './projectPaths.js';
 import { join } from 'path';
 import { randomUUID } from 'crypto';
 import { execSync } from 'child_process';
+import { hardenedGitEnv } from './git.js';
 function getCheckpointsDir(workspaceRoot) {
     return join(workspaceRoot, '.codeep', 'checkpoints');
 }
@@ -49,6 +50,8 @@ function readGitHead(workspaceRoot) {
             encoding: 'utf-8',
             stdio: ['ignore', 'pipe', 'ignore'],
             timeout: 2000,
+            // Read-only and Codeep's own, so the repository's hooks stay out of it.
+            env: hardenedGitEnv({ cwd: workspaceRoot, noHooks: true }),
         }).trim();
         return out || undefined;
     }

package/dist/utils/codeReview.js

@@ -3,7 +3,7 @@
  */
 import { existsSync, readFileSync, readdirSync } from 'fs';
 import { join, extname, relative } from 'path';
-import { getChangedFiles } from './git.js';
+import { getChangedFilesResult } from './git.js';
 import { loadReviewConfig, globToRegExp } from './reviewConfig.js';
 // Built-in code patterns that indicate issues. Each has a stable `id` so it can
 // be turned off per-project via `.codeep/review.json` { "disable": ["..."] }.
@@ -274,26 +274,24 @@ function analyzeFile(filePath, content, projectRoot, rules, disabled) {
     }
     return issues;
 }
-/**
- * Get files to review
- */
 function getFilesToReview(projectRoot, specificFiles) {
     if (specificFiles && specificFiles.length > 0) {
-        return specificFiles
-            .map(f => join(projectRoot, f))
-            .filter(f => existsSync(f));
+        return {
+            files: specificFiles.map(f => join(projectRoot, f)).filter(f => existsSync(f)),
+            source: 'specific',
+        };
     }
-    // Get changed files from git
-    const changedFiles = getChangedFiles(projectRoot);
-    if (changedFiles.length > 0) {
-        return changedFiles.map(f => join(projectRoot, f));
+    // Get changed files from git. Called ONCE — the scope line below used to
+    // call getChangedFiles() a second time, which is a second `git config
+    // --list` plus a second `git status` on every review.
+    const changed = getChangedFilesResult(projectRoot);
+    if (changed.files.length > 0) {
+        return { files: changed.files.map(f => join(projectRoot, f)), source: 'git' };
     }
     // Otherwise, review src directory
     const srcDir = join(projectRoot, 'src');
-    if (existsSync(srcDir)) {
-        return getAllSourceFiles(srcDir);
-    }
-    return getAllSourceFiles(projectRoot);
+    const files = existsSync(srcDir) ? getAllSourceFiles(srcDir) : getAllSourceFiles(projectRoot);
+    return { files, source: 'scan', gitError: changed.error };
 }
 /**
  * Get all source files in directory
@@ -341,7 +339,8 @@ export function performCodeReview(projectContext, specificFiles) {
         ...CODE_PATTERNS.filter((p) => !disabled.has(p.id)),
         ...(config?.rules ?? []),
     ];
-    let filesToReview = getFilesToReview(projectRoot, specificFiles);
+    const selection = getFilesToReview(projectRoot, specificFiles);
+    let filesToReview = selection.files;
     // Apply include/exclude globs (posix-relative paths). Empty include = all.
     if (config && (config.include.length > 0 || config.exclude.length > 0)) {
         const inc = config.include.map(globToRegExp);
@@ -356,17 +355,23 @@ export function performCodeReview(projectContext, specificFiles) {
         });
     }
     const allIssues = [];
-    // Determine scope — mirrors the branching in getFilesToReview so the user
-    // sees exactly which branch ran.
+    // Determine scope — reports the branch getFilesToReview actually took,
+    // rather than re-deriving it, so the two can no longer disagree.
+    const count = `${filesToReview.length} file${filesToReview.length === 1 ? '' : 's'}`;
     let scope;
-    if (specificFiles && specificFiles.length > 0) {
-        scope = `specific file${specificFiles.length === 1 ? '' : 's'} (${filesToReview.length})`;
+    if (selection.source === 'specific') {
+        scope = `specific file${specificFiles?.length === 1 ? '' : 's'} (${filesToReview.length})`;
+    }
+    else if (selection.source === 'git') {
+        scope = `unstaged git changes (${count})`;
     }
-    else if (getChangedFiles(projectRoot).length > 0) {
-        scope = `unstaged git changes (${filesToReview.length} file${filesToReview.length === 1 ? '' : 's'})`;
+    else if (selection.gitError) {
+        // Not "no git changes": git would not run here, so nobody knows whether
+        // there are any. Say which, and say why — the message carries the fix.
+        scope = `full src/ scan — git could not list the changes: ${selection.gitError} (${count})`;
     }
     else {
-        scope = `full src/ scan — no git changes (${filesToReview.length} file${filesToReview.length === 1 ? '' : 's'})`;
+        scope = `full src/ scan — no git changes (${count})`;
     }
     for (const filePath of filesToReview) {
         try {