Skip to content

Codeep

v2.5.0 Feature

This release adds 2 notable features for engineering teams evaluating rollout.

✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

ai ai-agent ai-agents ai-tools cli-app

Summary

AI summary

Fixed corrupted writes when edits or skill parameters contain a $.

Changes in this release

Feature Medium

Adds `codeep review` for headless, CI-friendly code review.

Adds `codeep review` for headless, CI-friendly code review.

Source: llm_adapter@2026-06-05

Confidence: high

Feature Medium

Adds "Continue" to resume paused runs after safety limits.

Adds "Continue" to resume paused runs after safety limits.

Source: llm_adapter@2026-06-05

Confidence: high

Bugfix Medium

Fixes corrupted writes when file edits contain `$`.

Fixes corrupted writes when file edits contain `$`.

Source: llm_adapter@2026-06-05

Confidence: high

Bugfix Medium

Fixes unsafe `$` handling in skill parameter expansion.

Fixes unsafe `$` handling in skill parameter expansion.

Source: llm_adapter@2026-06-05

Confidence: high

Full changelog

New: codeep review (offline, CI-friendly code review) and Continue (a paused-at-the-limit run resumes when you say "continue" instead of dead-ending). Plus a fix where file edits or skill params containing a $ could be written corrupted.

Added

  • codeep review — a headless, deterministic code review you can drop into
    CI (no API key, no TUI). Reviews the files you pass (or your unstaged git
    changes, falling back to a src/ scan), prints a markdown report or --json,
    and exits non-zero when an issue at or above --fail-on <error|warning|info|none>
    is found (default error). Pairs with a GitHub Action to gate PRs.
  • Continue after a safety limit. When the agent reaches its step or time
    limit it no longer dead-ends — the run pauses with a clear, resumable notice
    (⏸ Paused … say **continue** to pick up where it left off) instead of looking
    like a failure, and saying continue resumes it with full context. Works in
    the TUI and in ACP clients (Zed, the VS Code extension).

Fixed

  • Edits containing $ are written literally. edit_file (and the diff
    preview) applied replacements with String.replace(text, newText), which
    interprets $&, $$, $1 etc. in the replacement — so any edit whose new
    text contained $ (template literals, shell variables, regex) was silently
    corrupted on write. Replacements are now inserted verbatim.
  • Skill parameter expansion is $-safe and literal. ${param} substitution
    had the same $-interpretation bug in the value, and interpolated the param
    name into a regex unescaped (so a . over-matched and a ( could throw).
    Both are fixed.

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track Codeep

Get notified when new releases ship.

Sign up free

About Codeep

All releases →

Related context

Earlier breaking changes

  • v2.8.0 `codeep account push` and `account sync` no longer transfer API keys unless `/keysync on` is enabled
  • v2.4.1 MiniMax M3 replaces MiniMax-M2.7 as default model across all providers.
  • v2.0.0 McpServer protocol now optional fields `command`, `args`, plus new `url` and `headers`; version bumped to 2.0.0.

Beta — feedback welcome: [email protected]