coder-agent 2.6.3 → 2.7.0

package/dist/agent.js

@@ -281,9 +281,6 @@ async function callGeminiAPIWithRotation(apiKey, params, maxRetries = 3, initial
                 let buffer = "";
                 let accumulatedContent = "";
                 let accumulatedToolCalls = [];
-                if (!silent) {
-                    stopSpinner();
-                }
                 let typewriterQueue = [];
                 let typewriterActive = false;
                 let resolveTypewriterFinished = null;
@@ -316,7 +313,13 @@ async function callGeminiAPIWithRotation(apiKey, params, maxRetries = 3, initial
                             delay = 8;
                         }
                         const chars = typewriterQueue.splice(0, batchSize).join("");
-                        process.stdout.write(chars);
+                        accumulatedContent += chars;
+                        const maxLen = (process.stdout.columns || 80) - 20;
+                        let display = accumulatedContent.replace(/\r?\n/g, " ");
+                        if (display.length > maxLen) {
+                            display = "..." + display.slice(-maxLen + 3);
+                        }
+                        updateSpinner(chalk.dim("thinking: ") + chalk.gray(display));
                         await new Promise((resolve) => setTimeout(resolve, delay));
                     }
                     typewriterActive = false;
@@ -343,10 +346,12 @@ async function callGeminiAPIWithRotation(apiKey, params, maxRetries = 3, initial
                                     continue;
                                 const content = choice.delta?.content;
                                 if (content) {
-                                    accumulatedContent += content;
                                     if (!silent) {
                                         pushToTypewriter(content);
                                     }
+                                    else {
+                                        accumulatedContent += content;
+                                    }
                                 }
                                 const toolCalls = choice.delta?.tool_calls;
                                 if (toolCalls) {
@@ -408,6 +413,12 @@ async function callGeminiAPIWithRotation(apiKey, params, maxRetries = 3, initial
                         resolveTypewriterFinished = resolve;
                     });
                 }
+                if (!silent) {
+                    stopSpinner();
+                    if (accumulatedToolCalls.length === 0 && accumulatedContent.trim() !== "") {
+                        console.log(formatResponseText(accumulatedContent));
+                    }
+                }
                 const finalResponse = {
                     choices: [
                         {

package/dist/index.js

@@ -294,6 +294,20 @@ async function main() {
             return;
         }
         currentAbortController = new AbortController();
+        // Hijack stdin data listeners during agent execution to allow Ctrl+C to abort the agent immediately
+        const originalListeners = process.stdin.listeners("data");
+        for (const listener of originalListeners) {
+            process.stdin.removeListener("data", listener);
+        }
+        const tempSigintHandler = (data) => {
+            if (data.includes(3)) { // Ctrl+C byte
+                if (currentAbortController) {
+                    currentAbortController.abort();
+                }
+            }
+        };
+        process.stdin.on("data", tempSigintHandler);
+        process.stdin.resume();
         try {
             await agent.chat(trimmed, currentAbortController.signal);
         }
@@ -315,6 +329,10 @@ async function main() {
             }
         }
         finally {
+            process.stdin.removeListener("data", tempSigintHandler);
+            for (const listener of originalListeners) {
+                process.stdin.on("data", listener);
+            }
             currentAbortController = null;
         }
         rl.resume();

package/dist/tools.js

@@ -12,6 +12,17 @@ function normalizeFilePath(p) {
     }
     return path.normalize(normalized);
 }
+function isPathSafe(filePath) {
+    try {
+        const resolvedPath = path.resolve(normalizeFilePath(filePath));
+        const cwd = path.resolve(process.cwd());
+        const relative = path.relative(cwd, resolvedPath);
+        return !relative.startsWith('..') && !path.isAbsolute(relative);
+    }
+    catch {
+        return false;
+    }
+}
 function isProtectedPath(filePath) {
     const normalized = path.resolve(normalizeFilePath(filePath));
     const relativePath = path.relative(process.cwd(), normalized);
@@ -179,6 +190,9 @@ export const TOOL_DEFINITIONS = [
 // ─── Tool Implementations ────────────────────────────────────────────────────
 export async function read_file({ file_path }) {
     try {
+        if (!isPathSafe(file_path)) {
+            return `ERROR: Access to files outside the project workspace is denied for security reasons.`;
+        }
         const targetPath = normalizeFilePath(file_path);
         const content = await fs.readFile(targetPath, "utf-8");
         return content;
@@ -189,6 +203,9 @@ export async function read_file({ file_path }) {
 }
 export async function write_file({ file_path, content }) {
     try {
+        if (!isPathSafe(file_path)) {
+            return `ERROR: Access to files outside the project workspace is denied for security reasons.`;
+        }
         if (isProtectedPath(file_path)) {
             return `ERROR: Modification of agent system files is strictly forbidden for security reasons.`;
         }
@@ -203,6 +220,9 @@ export async function write_file({ file_path, content }) {
 }
 export async function list_directory({ dir_path = "." }) {
     try {
+        if (!isPathSafe(dir_path)) {
+            return `ERROR: Access to directory outside the project workspace is denied for security reasons.`;
+        }
         const targetPath = normalizeFilePath(dir_path);
         const entries = await fs.readdir(targetPath, { withFileTypes: true });
         const lines = entries.map((e) => `${e.isDirectory() ? "📁" : "📄"} ${e.name}`);
@@ -216,6 +236,9 @@ export async function run_shell({ command, cwd }, confirmHandler, signal) {
     try {
         let targetCwd = process.cwd();
         if (cwd) {
+            if (!isPathSafe(cwd)) {
+                return `ERROR: Access to directory outside the project workspace is denied for security reasons.`;
+            }
             const targetCwdPath = normalizeFilePath(cwd);
             try {
                 const stats = await fs.stat(targetCwdPath);
@@ -317,6 +340,9 @@ async function walkDir(dir, fileList = []) {
 export async function find_files({ query, dir_path = "." }) {
     try {
         const targetPath = normalizeFilePath(dir_path);
+        if (!isPathSafe(targetPath)) {
+            return `ERROR: Access to directory outside the project workspace is denied for security reasons.`;
+        }
         const allFiles = await walkDir(targetPath);
         const lowercaseQuery = query.toLowerCase();
         const matches = allFiles
@@ -333,6 +359,9 @@ export async function find_files({ query, dir_path = "." }) {
 }
 export async function read_file_lines({ file_path, start_line, end_line }) {
     try {
+        if (!isPathSafe(file_path)) {
+            return `ERROR: Access to files outside the project workspace is denied for security reasons.`;
+        }
         const targetPath = normalizeFilePath(file_path);
         const content = await fs.readFile(targetPath, "utf-8");
         const lines = content.split(/\r?\n/);
@@ -386,6 +415,9 @@ export async function search_grep({ query, is_regex = false }) {
 }
 export async function patch_file({ file_path, target_code, replacement_code }) {
     try {
+        if (!isPathSafe(file_path)) {
+            return `ERROR: Access to files outside the project workspace is denied for security reasons.`;
+        }
         if (isProtectedPath(file_path)) {
             return `ERROR: Modification of agent system files is strictly forbidden for security reasons.`;
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "coder-agent",
-  "version": "2.6.3",
+  "version": "2.7.0",
   "description": "CLI coding agent powered by Google Gemini",
   "type": "module",
   "main": "dist/index.js",