@corbat-tech/coco 1.1.0 → 1.2.0

package/dist/index.js

@@ -5973,17 +5973,17 @@ var QualityEvaluator = class {
       maintainabilityResult
     ] = await Promise.all([
       this.coverageAnalyzer.analyze().catch(() => null),
-      this.securityScanner.scan(fileContents),
-      this.complexityAnalyzer.analyze(targetFiles),
-      this.duplicationAnalyzer.analyze(targetFiles),
+      this.securityScanner.scan(fileContents).catch(() => ({ score: 0, vulnerabilities: [] })),
+      this.complexityAnalyzer.analyze(targetFiles).catch(() => ({ score: 0, files: [] })),
+      this.duplicationAnalyzer.analyze(targetFiles).catch(() => ({ score: 0, percentage: 0 })),
       this.correctnessAnalyzer.analyze().catch(() => ({ score: 0 })),
       this.completenessAnalyzer.analyze(targetFiles).catch(() => ({ score: 0 })),
       this.robustnessAnalyzer.analyze(targetFiles).catch(() => ({ score: 0 })),
       this.testQualityAnalyzer.analyze().catch(() => ({ score: 0 })),
       this.documentationAnalyzer.analyze(targetFiles).catch(() => ({ score: 0 })),
-      this.styleAnalyzer.analyze().catch(() => ({ score: 50 })),
-      this.readabilityAnalyzer.analyze(targetFiles).catch(() => ({ score: 50 })),
-      this.maintainabilityAnalyzer.analyze(targetFiles).catch(() => ({ score: 50 }))
+      this.styleAnalyzer.analyze().catch(() => ({ score: 0 })),
+      this.readabilityAnalyzer.analyze(targetFiles).catch(() => ({ score: 0 })),
+      this.maintainabilityAnalyzer.analyze(targetFiles).catch(() => ({ score: 0 }))
     ]);
     const dimensions = {
       testCoverage: coverageResult?.lines.percentage ?? 0,
@@ -9992,6 +9992,9 @@ var AnthropicProvider = class {
             try {
               currentToolCall.input = currentToolInputJson ? JSON.parse(currentToolInputJson) : {};
             } catch {
+              console.warn(
+                `[Anthropic] Failed to parse tool call arguments: ${currentToolInputJson?.slice(0, 100)}`
+              );
               currentToolCall.input = {};
             }
             yield {
@@ -10532,6 +10535,9 @@ var OpenAIProvider = class {
           try {
             input = builder.arguments ? JSON.parse(builder.arguments) : {};
           } catch {
+            console.warn(
+              `[OpenAI] Failed to parse tool call arguments: ${builder.arguments?.slice(0, 100)}`
+            );
           }
           yield {
             type: "tool_use_end",
@@ -10820,7 +10826,16 @@ var OpenAIProvider = class {
     ).map((tc) => ({
       id: tc.id,
       name: tc.function.name,
-      input: JSON.parse(tc.function.arguments || "{}")
+      input: (() => {
+        try {
+          return JSON.parse(tc.function.arguments || "{}");
+        } catch {
+          console.warn(
+            `[OpenAI] Failed to parse tool call arguments: ${tc.function.arguments?.slice(0, 100)}`
+          );
+          return {};
+        }
+      })()
     }));
   }
   /**
@@ -11475,7 +11490,10 @@ var GeminiProvider = class {
           for (const part of candidate.content.parts) {
             if ("functionCall" in part && part.functionCall) {
               const funcCall = part.functionCall;
-              const callKey = `${funcCall.name}-${JSON.stringify(funcCall.args)}`;
+              const sortedArgs = funcCall.args ? Object.keys(funcCall.args).sort().map(
+                (k) => `${k}:${JSON.stringify(funcCall.args[k])}`
+              ).join(",") : "";
+              const callKey = `${funcCall.name}-${sortedArgs}`;
               if (!emittedToolCalls.has(callKey)) {
                 emittedToolCalls.add(callKey);
                 const toolCall = {
@@ -11507,9 +11525,18 @@ var GeminiProvider = class {
   }
   /**
    * Count tokens (approximate)
+   *
+   * Gemini uses a SentencePiece tokenizer. The average ratio varies:
+   * - English text: ~4 characters per token
+   * - Code: ~3.2 characters per token
+   * - Mixed content: ~3.5 characters per token
+   *
+   * Using 3.5 as the default provides a better estimate for typical
+   * coding agent workloads which mix code and natural language.
    */
   countTokens(text) {
-    return Math.ceil(text.length / 4);
+    if (!text) return 0;
+    return Math.ceil(text.length / 3.5);
   }
   /**
    * Get context window size
@@ -11800,6 +11827,19 @@ function createOrchestrator(config) {
     },
     async transitionTo(phase) {
       const previousPhase = state.currentPhase;
+      const validTransitions = {
+        idle: ["converge"],
+        converge: ["orchestrate"],
+        orchestrate: ["complete"],
+        complete: ["output"],
+        output: []
+      };
+      const allowed = validTransitions[previousPhase];
+      if (allowed && !allowed.includes(phase)) {
+        throw new Error(
+          `Invalid phase transition: ${previousPhase} \u2192 ${phase}. Allowed: ${allowed.join(", ") || "none"}`
+        );
+      }
       state.phaseHistory.push({
         from: previousPhase,
         to: phase,
@@ -11868,7 +11908,10 @@ async function saveState(state) {
   const fs33 = await import('fs/promises');
   const statePath = `${state.path}/.coco/state`;
   await fs33.mkdir(statePath, { recursive: true });
-  await fs33.writeFile(`${statePath}/project.json`, JSON.stringify(state, null, 2), "utf-8");
+  const filePath = `${statePath}/project.json`;
+  const tmpPath = `${filePath}.tmp.${Date.now()}`;
+  await fs33.writeFile(tmpPath, JSON.stringify(state, null, 2), "utf-8");
+  await fs33.rename(tmpPath, filePath);
 }
 function getPhaseExecutor(phase) {
   switch (phase) {
@@ -12145,7 +12188,10 @@ async function saveSnapshot(state, snapshotId) {
   }
 }
 function restoreFromSnapshot(target, snapshot) {
-  Object.assign(target, snapshot);
+  const deep = JSON.parse(JSON.stringify(snapshot));
+  deep.createdAt = new Date(deep.createdAt);
+  deep.updatedAt = new Date(deep.updatedAt);
+  Object.assign(target, deep);
 }
 async function executePhase(phase, state, config) {
   const executor = getPhaseExecutor(phase);
@@ -12234,9 +12280,6 @@ var QualityConfigSchema = z.object({
 }).refine((data) => data.minIterations <= data.maxIterations, {
   message: "minIterations must be <= maxIterations",
   path: ["minIterations"]
-}).refine((data) => data.convergenceThreshold < data.minScore, {
-  message: "convergenceThreshold must be < minScore",
-  path: ["convergenceThreshold"]
 });
 var PersistenceConfigSchema = z.object({
   checkpointInterval: z.number().min(6e4).default(3e5),
@@ -12429,7 +12472,17 @@ function deepMergeConfig(base, override) {
     project: { ...base.project, ...override.project },
     provider: { ...base.provider, ...override.provider },
     quality: { ...base.quality, ...override.quality },
-    persistence: { ...base.persistence, ...override.persistence }
+    persistence: { ...base.persistence, ...override.persistence },
+    // Merge optional sections only if present in either base or override
+    ...base.stack || override.stack ? { stack: { ...base.stack, ...override.stack } } : {},
+    ...base.integrations || override.integrations ? {
+      integrations: {
+        ...base.integrations,
+        ...override.integrations
+      }
+    } : {},
+    ...base.mcp || override.mcp ? { mcp: { ...base.mcp, ...override.mcp } } : {},
+    ...base.tools || override.tools ? { tools: { ...base.tools, ...override.tools } } : {}
   };
 }
 function getProjectConfigPath() {
@@ -14536,7 +14589,17 @@ Examples:
         regexPattern = `\\b${pattern}\\b`;
       }
       const flags = caseSensitive ? "g" : "gi";
-      const regex = new RegExp(regexPattern, flags);
+      let regex;
+      try {
+        regex = new RegExp(regexPattern, flags);
+      } catch {
+        throw new ToolError(`Invalid regex pattern: ${pattern}`, { tool: "grep" });
+      }
+      if (/(\.\*|\.\+|\[.*\][*+])\s*(\.\*|\.\+|\[.*\][*+])/.test(regexPattern)) {
+        throw new ToolError(`Regex pattern rejected: nested quantifiers may cause slow matching`, {
+          tool: "grep"
+        });
+      }
       const stats = await fs14__default.stat(targetPath);
       let filesToSearch;
       if (stats.isFile()) {
@@ -16116,9 +16179,11 @@ function parseDiff(raw) {
 function parseFileBlock(lines, start) {
   const diffLine = lines[start];
   let i = start + 1;
-  const pathMatch = diffLine.match(/^diff --git a\/(.+?) b\/(.+)$/);
-  const oldPath = pathMatch?.[1] ?? "";
-  const newPath = pathMatch?.[2] ?? oldPath;
+  const gitPrefix = "diff --git a/";
+  const pathPart = diffLine.slice(gitPrefix.length);
+  const lastBSlash = pathPart.lastIndexOf(" b/");
+  const oldPath = lastBSlash >= 0 ? pathPart.slice(0, lastBSlash) : pathPart;
+  const newPath = lastBSlash >= 0 ? pathPart.slice(lastBSlash + 3) : oldPath;
   let fileType = "modified";
   while (i < lines.length && !lines[i].startsWith("diff --git ")) {
     const current = lines[i];
@@ -16264,7 +16329,7 @@ function renderDiff(diff, options) {
 function renderFileBlock(file, opts) {
   const { maxWidth, showLineNumbers, compact } = opts;
   const lang = detectLanguage(file.path);
-  const contentWidth = maxWidth - 4;
+  const contentWidth = Math.max(1, maxWidth - 4);
   const typeLabel = file.type === "modified" ? "modified" : file.type === "added" ? "new file" : file.type === "deleted" ? "deleted" : `renamed from ${file.oldPath}`;
   const statsLabel = ` +${file.additions} -${file.deletions}`;
   const title = ` ${file.path} (${typeLabel}${statsLabel}) `;
@@ -16311,12 +16376,8 @@ function renderFileBlock(file, opts) {
 }
 function formatLineNo(line, show) {
   if (!show) return "";
-  if (line.type === "add") {
-    return chalk3.dim(`${String(line.newLineNo ?? "").padStart(4)} `);
-  } else if (line.type === "delete") {
-    return chalk3.dim(`${String(line.oldLineNo ?? "").padStart(4)} `);
-  }
-  return chalk3.dim(`${String(line.newLineNo ?? "").padStart(4)} `);
+  const lineNo = line.type === "delete" ? line.oldLineNo : line.newLineNo;
+  return chalk3.dim(`${String(lineNo ?? "").padStart(5)} `);
 }
 function getChangedLines(diff) {
   const result = /* @__PURE__ */ new Map();
@@ -18473,6 +18534,13 @@ Examples:
     const startTime = performance.now();
     const effectivePrompt = prompt ?? "Describe this image in detail. If it's code or a UI, identify the key elements.";
     const absPath = path27.resolve(filePath);
+    const cwd = process.cwd();
+    if (!absPath.startsWith(cwd + path27.sep) && absPath !== cwd) {
+      throw new ToolError(
+        `Path traversal denied: '${filePath}' resolves outside the project directory`,
+        { tool: "read_image" }
+      );
+    }
     const ext = path27.extname(absPath).toLowerCase();
     if (!SUPPORTED_FORMATS.has(ext)) {
       throw new ToolError(