@corbat-tech/coco 1.2.2 → 1.2.3

package/dist/index.js

@@ -3,10 +3,12 @@ import * as path14 from 'path';
 import path14__default, { dirname, join, basename } from 'path';
 import * as fs4 from 'fs';
 import fs4__default, { readFileSync, constants } from 'fs';
-import { fileURLToPath } from 'url';
-import { randomUUID } from 'crypto';
 import * as fs14 from 'fs/promises';
 import fs14__default, { readFile, access, readdir } from 'fs/promises';
+import chalk3 from 'chalk';
+import * as p3 from '@clack/prompts';
+import { fileURLToPath } from 'url';
+import { randomUUID } from 'crypto';
 import { execa } from 'execa';
 import { parse } from '@typescript-eslint/typescript-estree';
 import { glob } from 'glob';
@@ -17,8 +19,6 @@ import { Logger } from 'tslog';
 import Anthropic from '@anthropic-ai/sdk';
 import OpenAI from 'openai';
 import 'http';
-import '@clack/prompts';
-import chalk3 from 'chalk';
 import { GoogleGenerativeAI, FunctionCallingMode } from '@google/generative-ai';
 import JSON5 from 'json5';
 import 'events';
@@ -38,10 +38,15 @@ import typescript from 'highlight.js/lib/languages/typescript';
 import xml from 'highlight.js/lib/languages/xml';
 import yaml from 'highlight.js/lib/languages/yaml';
 
+var __defProp = Object.defineProperty;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __esm = (fn, res) => function __init() {
   return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
 };
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
 var COCO_HOME, CONFIG_PATHS;
 var init_paths = __esm({
   "src/config/paths.ts"() {
@@ -171,6 +176,119 @@ var init_env = __esm({
     });
   }
 });
+function getAllowedPaths() {
+  return [...sessionAllowedPaths];
+}
+function isWithinAllowedPath(absolutePath, operation) {
+  const normalizedTarget = path14__default.normalize(absolutePath);
+  for (const entry of sessionAllowedPaths) {
+    const normalizedAllowed = path14__default.normalize(entry.path);
+    if (normalizedTarget === normalizedAllowed || normalizedTarget.startsWith(normalizedAllowed + path14__default.sep)) {
+      if (operation === "read") return true;
+      if (entry.level === "write") return true;
+    }
+  }
+  return false;
+}
+function addAllowedPathToSession(dirPath, level) {
+  const absolute = path14__default.resolve(dirPath);
+  if (sessionAllowedPaths.some((e) => path14__default.normalize(e.path) === path14__default.normalize(absolute))) {
+    return;
+  }
+  sessionAllowedPaths.push({
+    path: absolute,
+    authorizedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    level
+  });
+}
+async function persistAllowedPath(dirPath, level) {
+  if (!currentProjectPath) return;
+  const absolute = path14__default.resolve(dirPath);
+  const store = await loadStore();
+  if (!store.projects[currentProjectPath]) {
+    store.projects[currentProjectPath] = [];
+  }
+  const entries = store.projects[currentProjectPath];
+  const normalized = path14__default.normalize(absolute);
+  if (entries.some((e) => path14__default.normalize(e.path) === normalized)) {
+    return;
+  }
+  entries.push({
+    path: absolute,
+    authorizedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    level
+  });
+  await saveStore(store);
+}
+async function loadStore() {
+  try {
+    const content = await fs14__default.readFile(STORE_FILE, "utf-8");
+    return { ...DEFAULT_STORE, ...JSON.parse(content) };
+  } catch {
+    return { ...DEFAULT_STORE };
+  }
+}
+async function saveStore(store) {
+  try {
+    await fs14__default.mkdir(path14__default.dirname(STORE_FILE), { recursive: true });
+    await fs14__default.writeFile(STORE_FILE, JSON.stringify(store, null, 2), "utf-8");
+  } catch {
+  }
+}
+var STORE_FILE, DEFAULT_STORE, sessionAllowedPaths, currentProjectPath;
+var init_allowed_paths = __esm({
+  "src/tools/allowed-paths.ts"() {
+    init_paths();
+    STORE_FILE = path14__default.join(CONFIG_PATHS.home, "allowed-paths.json");
+    DEFAULT_STORE = {
+      version: 1,
+      projects: {}
+    };
+    sessionAllowedPaths = [];
+    currentProjectPath = "";
+  }
+});
+
+// src/cli/repl/allow-path-prompt.ts
+var allow_path_prompt_exports = {};
+__export(allow_path_prompt_exports, {
+  promptAllowPath: () => promptAllowPath
+});
+async function promptAllowPath(dirPath) {
+  const absolute = path14__default.resolve(dirPath);
+  console.log();
+  console.log(chalk3.yellow("  \u26A0 Access denied \u2014 path is outside the project directory"));
+  console.log(chalk3.dim(`  \u{1F4C1} ${absolute}`));
+  console.log();
+  const action = await p3.select({
+    message: "Grant access to this directory?",
+    options: [
+      { value: "session-write", label: "\u2713 Allow write (this session)" },
+      { value: "session-read", label: "\u25D0 Allow read-only (this session)" },
+      { value: "persist-write", label: "\u26A1 Allow write (remember for this project)" },
+      { value: "persist-read", label: "\u{1F4BE} Allow read-only (remember for this project)" },
+      { value: "no", label: "\u2717 Deny" }
+    ]
+  });
+  if (p3.isCancel(action) || action === "no") {
+    return false;
+  }
+  const level = action.includes("read") ? "read" : "write";
+  const persist = action.startsWith("persist");
+  addAllowedPathToSession(absolute, level);
+  if (persist) {
+    await persistAllowedPath(absolute, level);
+  }
+  const levelLabel = level === "write" ? "write" : "read-only";
+  const persistLabel = persist ? " (remembered)" : "";
+  console.log(chalk3.green(`  \u2713 Access granted: ${levelLabel}${persistLabel}`));
+  return true;
+}
+var init_allow_path_prompt = __esm({
+  "src/cli/repl/allow-path-prompt.ts"() {
+    init_allowed_paths();
+  }
+});
 function findPackageJson() {
   let dir = dirname(fileURLToPath(import.meta.url));
   for (let i = 0; i < 10; i++) {
@@ -3776,10 +3894,10 @@ var CoverageAnalyzer = class {
       join(this.projectPath, ".coverage", "coverage-summary.json"),
       join(this.projectPath, "coverage", "lcov-report", "coverage-summary.json")
     ];
-    for (const path32 of possiblePaths) {
+    for (const path36 of possiblePaths) {
       try {
-        await access(path32, constants.R_OK);
-        const content = await readFile(path32, "utf-8");
+        await access(path36, constants.R_OK);
+        const content = await readFile(path36, "utf-8");
         const report = JSON.parse(content);
         return parseCoverageSummary(report);
       } catch {
@@ -11893,9 +12011,9 @@ function createInitialState(config) {
 }
 async function loadExistingState(projectPath) {
   try {
-    const fs33 = await import('fs/promises');
+    const fs35 = await import('fs/promises');
     const statePath = `${projectPath}/.coco/state/project.json`;
-    const content = await fs33.readFile(statePath, "utf-8");
+    const content = await fs35.readFile(statePath, "utf-8");
     const data = JSON.parse(content);
     data.createdAt = new Date(data.createdAt);
     data.updatedAt = new Date(data.updatedAt);
@@ -11905,13 +12023,13 @@ async function loadExistingState(projectPath) {
   }
 }
 async function saveState(state) {
-  const fs33 = await import('fs/promises');
+  const fs35 = await import('fs/promises');
   const statePath = `${state.path}/.coco/state`;
-  await fs33.mkdir(statePath, { recursive: true });
+  await fs35.mkdir(statePath, { recursive: true });
   const filePath = `${statePath}/project.json`;
   const tmpPath = `${filePath}.tmp.${Date.now()}`;
-  await fs33.writeFile(tmpPath, JSON.stringify(state, null, 2), "utf-8");
-  await fs33.rename(tmpPath, filePath);
+  await fs35.writeFile(tmpPath, JSON.stringify(state, null, 2), "utf-8");
+  await fs35.rename(tmpPath, filePath);
 }
 function getPhaseExecutor(phase) {
   switch (phase) {
@@ -11970,20 +12088,20 @@ async function createPhaseContext(config, state) {
   };
   const tools = {
     file: {
-      async read(path32) {
-        const fs33 = await import('fs/promises');
-        return fs33.readFile(path32, "utf-8");
+      async read(path36) {
+        const fs35 = await import('fs/promises');
+        return fs35.readFile(path36, "utf-8");
       },
-      async write(path32, content) {
-        const fs33 = await import('fs/promises');
+      async write(path36, content) {
+        const fs35 = await import('fs/promises');
         const nodePath = await import('path');
-        await fs33.mkdir(nodePath.dirname(path32), { recursive: true });
-        await fs33.writeFile(path32, content, "utf-8");
+        await fs35.mkdir(nodePath.dirname(path36), { recursive: true });
+        await fs35.writeFile(path36, content, "utf-8");
       },
-      async exists(path32) {
-        const fs33 = await import('fs/promises');
+      async exists(path36) {
+        const fs35 = await import('fs/promises');
         try {
-          await fs33.access(path32);
+          await fs35.access(path36);
           return true;
         } catch {
           return false;
@@ -12132,9 +12250,9 @@ async function createSnapshot(state) {
 var MAX_CHECKPOINT_VERSIONS = 5;
 async function getCheckpointFiles(state, phase) {
   try {
-    const fs33 = await import('fs/promises');
+    const fs35 = await import('fs/promises');
     const checkpointDir = `${state.path}/.coco/checkpoints`;
-    const files = await fs33.readdir(checkpointDir);
+    const files = await fs35.readdir(checkpointDir);
     const phaseFiles = files.filter((f) => f.startsWith(`snapshot-pre-${phase}-`) && f.endsWith(".json")).sort((a, b) => {
       const tsA = parseInt(a.split("-").pop()?.replace(".json", "") ?? "0", 10);
       const tsB = parseInt(b.split("-").pop()?.replace(".json", "") ?? "0", 10);
@@ -12147,11 +12265,11 @@ async function getCheckpointFiles(state, phase) {
 }
 async function cleanupOldCheckpoints(state, phase) {
   try {
-    const fs33 = await import('fs/promises');
+    const fs35 = await import('fs/promises');
     const files = await getCheckpointFiles(state, phase);
     if (files.length > MAX_CHECKPOINT_VERSIONS) {
       const filesToDelete = files.slice(MAX_CHECKPOINT_VERSIONS);
-      await Promise.all(filesToDelete.map((f) => fs33.unlink(f).catch(() => {
+      await Promise.all(filesToDelete.map((f) => fs35.unlink(f).catch(() => {
       })));
     }
   } catch {
@@ -12159,13 +12277,13 @@ async function cleanupOldCheckpoints(state, phase) {
 }
 async function saveSnapshot(state, snapshotId) {
   try {
-    const fs33 = await import('fs/promises');
+    const fs35 = await import('fs/promises');
     const snapshotPath = `${state.path}/.coco/checkpoints/snapshot-${snapshotId}.json`;
     const snapshotDir = `${state.path}/.coco/checkpoints`;
-    await fs33.mkdir(snapshotDir, { recursive: true });
+    await fs35.mkdir(snapshotDir, { recursive: true });
     const createdAt = state.createdAt instanceof Date ? state.createdAt.toISOString() : String(state.createdAt);
     const updatedAt = state.updatedAt instanceof Date ? state.updatedAt.toISOString() : String(state.updatedAt);
-    await fs33.writeFile(
+    await fs35.writeFile(
       snapshotPath,
       JSON.stringify(
         {
@@ -12540,24 +12658,7 @@ z.string().regex(
   /^\d+\.\d+\.\d+$/,
   "Version must be in semver format (e.g., 1.0.0)"
 );
-
-// src/tools/allowed-paths.ts
-init_paths();
-path14__default.join(CONFIG_PATHS.home, "allowed-paths.json");
-var sessionAllowedPaths = [];
-function isWithinAllowedPath(absolutePath, operation) {
-  const normalizedTarget = path14__default.normalize(absolutePath);
-  for (const entry of sessionAllowedPaths) {
-    const normalizedAllowed = path14__default.normalize(entry.path);
-    if (normalizedTarget === normalizedAllowed || normalizedTarget.startsWith(normalizedAllowed + path14__default.sep)) {
-      if (operation === "read") return true;
-      if (entry.level === "write") return true;
-    }
-  }
-  return false;
-}
-
-// src/tools/file.ts
+init_allowed_paths();
 var SENSITIVE_PATTERNS = [
   /\.env(?:\.\w+)?$/,
   // .env, .env.local, etc.
@@ -13421,7 +13522,8 @@ function truncateOutput(output, maxLength = 5e4) {
 [Output truncated - ${output.length - maxLength} more characters]`;
 }
 function getGit(cwd) {
-  return simpleGit(cwd ?? process.cwd());
+  const baseDir = cwd ?? process.cwd();
+  return simpleGit({ baseDir });
 }
 var gitStatusTool = defineTool({
   name: "git_status",
@@ -13782,9 +13884,11 @@ var gitTools = [
   gitInitTool
 ];
 function generateSimpleCommitMessage() {
+  const cwd = process.cwd();
   try {
     const diff = execSync("git diff --cached --name-only", {
       encoding: "utf-8",
+      cwd,
       stdio: ["pipe", "pipe", "ignore"]
     });
     const files = diff.trim().split("\n").filter(Boolean);
@@ -13820,6 +13924,7 @@ var checkProtectedBranchTool = defineTool({
     try {
       const branch = execSync("git rev-parse --abbrev-ref HEAD", {
         encoding: "utf-8",
+        cwd: process.cwd(),
         stdio: ["pipe", "pipe", "ignore"]
       }).trim();
       const protected_branches = ["main", "master", "develop", "production"];
@@ -13855,7 +13960,7 @@ var simpleAutoCommitTool = defineTool({
   async execute(input) {
     try {
       try {
-        execSync("git diff --cached --quiet", { stdio: "ignore" });
+        execSync("git diff --cached --quiet", { cwd: process.cwd(), stdio: "ignore" });
         return {
           stdout: "",
           stderr: "No staged changes to commit",
@@ -13867,6 +13972,7 @@ var simpleAutoCommitTool = defineTool({
       const message = input.message || generateSimpleCommitMessage();
       execSync(`git commit -m "${message}"`, {
         encoding: "utf-8",
+        cwd: process.cwd(),
         stdio: "pipe"
       });
       return {
@@ -16468,9 +16574,17 @@ Examples:
   }
 });
 var diffTools = [showDiffTool];
-async function fileExists(path32) {
+async function fileExists(filePath) {
+  try {
+    await fs14__default.access(filePath);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function fileExists2(path36) {
   try {
-    await access(path32);
+    await access(path36);
     return true;
   } catch {
     return false;
@@ -16485,7 +16599,7 @@ async function dirHasFiles(dir) {
   }
 }
 async function detectMaturity(cwd) {
-  const hasPackageJson = await fileExists(join(cwd, "package.json"));
+  const hasPackageJson = await fileExists2(join(cwd, "package.json"));
   if (!hasPackageJson) {
     const otherManifests = [
       "go.mod",
@@ -16498,7 +16612,7 @@ async function detectMaturity(cwd) {
     ];
     let hasAnyManifest = false;
     for (const m of otherManifests) {
-      if (await fileExists(join(cwd, m))) {
+      if (await fileExists2(join(cwd, m))) {
         hasAnyManifest = true;
         break;
       }
@@ -16539,7 +16653,7 @@ async function detectMaturity(cwd) {
     cwd,
     ignore: ["node_modules/**", "dist/**", "build/**"]
   });
-  const hasCI = await fileExists(join(cwd, ".github/workflows")) && await dirHasFiles(join(cwd, ".github/workflows"));
+  const hasCI = await fileExists2(join(cwd, ".github/workflows")) && await dirHasFiles(join(cwd, ".github/workflows"));
   const lintConfigs = [
     ".eslintrc.js",
     ".eslintrc.json",
@@ -16552,7 +16666,7 @@ async function detectMaturity(cwd) {
   ];
   let hasLintConfig = false;
   for (const config of lintConfigs) {
-    if (await fileExists(join(cwd, config))) {
+    if (await fileExists2(join(cwd, config))) {
       hasLintConfig = true;
       break;
     }
@@ -16560,7 +16674,7 @@ async function detectMaturity(cwd) {
   if (!hasLintConfig && hasPackageJson) {
     try {
       const pkgRaw = await import('fs/promises').then(
-        (fs33) => fs33.readFile(join(cwd, "package.json"), "utf-8")
+        (fs35) => fs35.readFile(join(cwd, "package.json"), "utf-8")
       );
       const pkg = JSON.parse(pkgRaw);
       if (pkg.scripts?.lint || pkg.scripts?.["lint:fix"]) {
@@ -16605,7 +16719,8 @@ var SECURITY_PATTERNS2 = [
     regex: /console\.(log|debug|info)\(/,
     severity: "minor",
     category: "best-practice",
-    message: "Remove console.log \u2014 use structured logging instead"
+    message: "Remove console.log \u2014 use structured logging instead",
+    excludePaths: /\/(cli|repl|bin|scripts)\//
   }
 ];
 var CORRECTNESS_PATTERNS = [
@@ -16685,6 +16800,7 @@ function analyzePatterns(diff) {
       for (const line of hunk.lines) {
         if (line.type !== "add") continue;
         for (const pattern of ALL_PATTERNS) {
+          if (pattern.excludePaths?.test(file.path)) continue;
           if (pattern.regex.test(line.content)) {
             findings.push({
               file: file.path,
@@ -16701,7 +16817,8 @@ function analyzePatterns(diff) {
   }
   return findings;
 }
-function checkTestCoverage(diff) {
+var TEST_COVERAGE_LARGE_CHANGE_THRESHOLD = 15;
+async function checkTestCoverage(diff, cwd) {
   const findings = [];
   const changedSrc = [];
   const changedTests = /* @__PURE__ */ new Set();
@@ -16711,22 +16828,35 @@ function checkTestCoverage(diff) {
       changedTests.add(file.path);
     } else if (/\.(ts|tsx|js|jsx)$/.test(file.path)) {
       if (file.additions > 5) {
-        changedSrc.push(file.path);
+        changedSrc.push({ path: file.path, additions: file.additions });
       }
     }
   }
   for (const src of changedSrc) {
-    const baseName = src.replace(/\.(ts|tsx|js|jsx)$/, "");
+    const baseName = src.path.replace(/\.(ts|tsx|js|jsx)$/, "");
     const hasTestChange = [...changedTests].some(
       (t) => t.includes(baseName.split("/").pop()) || t.startsWith(baseName)
     );
     if (!hasTestChange) {
-      findings.push({
-        file: src,
-        severity: "minor",
-        category: "testing",
-        message: "Logic changes without corresponding test updates"
-      });
+      const ext = src.path.match(/\.(ts|tsx|js|jsx)$/)?.[0] ?? ".ts";
+      const testExists = await fileExists(path14__default.join(cwd, `${baseName}.test${ext}`)) || await fileExists(path14__default.join(cwd, `${baseName}.spec${ext}`));
+      if (testExists) {
+        if (src.additions >= TEST_COVERAGE_LARGE_CHANGE_THRESHOLD) {
+          findings.push({
+            file: src.path,
+            severity: "info",
+            category: "testing",
+            message: "Test file exists but was not updated \u2014 verify existing tests cover these changes"
+          });
+        }
+      } else {
+        findings.push({
+          file: src.path,
+          severity: "minor",
+          category: "testing",
+          message: "Logic changes without corresponding test updates"
+        });
+      }
     }
   }
   return findings;
@@ -16876,7 +17006,7 @@ Examples:
       const maturity = maturityInfo.level;
       let allFindings = [];
       allFindings.push(...analyzePatterns(diff));
-      allFindings.push(...checkTestCoverage(diff));
+      allFindings.push(...await checkTestCoverage(diff, projectDir));
       allFindings.push(...checkDocumentation(diff));
       if (runLinter) {
         try {
@@ -16927,8 +17057,8 @@ Examples:
   }
 });
 var reviewTools = [reviewCodeTool];
-var fs22 = await import('fs/promises');
-var path22 = await import('path');
+var fs23 = await import('fs/promises');
+var path24 = await import('path');
 var { glob: glob12 } = await import('glob');
 var DEFAULT_MAX_FILES = 200;
 var LANGUAGE_EXTENSIONS = {
@@ -16954,7 +17084,7 @@ var DEFAULT_EXCLUDES = [
   "**/*.d.ts"
 ];
 function detectLanguage2(filePath) {
-  const ext = path22.extname(filePath).toLowerCase();
+  const ext = path24.extname(filePath).toLowerCase();
   for (const [lang, extensions] of Object.entries(LANGUAGE_EXTENSIONS)) {
     if (extensions.includes(ext)) return lang;
   }
@@ -17363,9 +17493,9 @@ Examples:
   }),
   async execute({ path: rootPath, include, exclude, languages, maxFiles, depth }) {
     const startTime = performance.now();
-    const absPath = path22.resolve(rootPath);
+    const absPath = path24.resolve(rootPath);
     try {
-      const stat2 = await fs22.stat(absPath);
+      const stat2 = await fs23.stat(absPath);
       if (!stat2.isDirectory()) {
         throw new ToolError(`Path is not a directory: ${absPath}`, {
           tool: "codebase_map"
@@ -17402,14 +17532,14 @@ Examples:
     let totalDefinitions = 0;
     let exportedSymbols = 0;
     for (const file of limitedFiles) {
-      const fullPath = path22.join(absPath, file);
+      const fullPath = path24.join(absPath, file);
       const language = detectLanguage2(file);
       if (!language) continue;
       if (languages && !languages.includes(language)) {
         continue;
       }
       try {
-        const content = await fs22.readFile(fullPath, "utf-8");
+        const content = await fs23.readFile(fullPath, "utf-8");
         const lineCount = content.split("\n").length;
         const parsed = parseFile(content, language);
         const definitions = depth === "overview" ? parsed.definitions.filter((d) => d.exported) : parsed.definitions;
@@ -17442,23 +17572,23 @@ Examples:
 });
 var codebaseMapTools = [codebaseMapTool];
 init_paths();
-var fs23 = await import('fs/promises');
-var path23 = await import('path');
-var crypto2 = await import('crypto');
-var GLOBAL_MEMORIES_DIR = path23.join(COCO_HOME, "memories");
+var fs24 = await import('fs/promises');
+var path25 = await import('path');
+var crypto3 = await import('crypto');
+var GLOBAL_MEMORIES_DIR = path25.join(COCO_HOME, "memories");
 var PROJECT_MEMORIES_DIR = ".coco/memories";
 var DEFAULT_MAX_MEMORIES = 1e3;
 async function ensureDir(dirPath) {
-  await fs23.mkdir(dirPath, { recursive: true });
+  await fs24.mkdir(dirPath, { recursive: true });
 }
 function getMemoriesDir(scope) {
   return scope === "global" ? GLOBAL_MEMORIES_DIR : PROJECT_MEMORIES_DIR;
 }
 async function loadIndex(scope) {
   const dir = getMemoriesDir(scope);
-  const indexPath = path23.join(dir, "index.json");
+  const indexPath = path25.join(dir, "index.json");
   try {
-    const content = await fs23.readFile(indexPath, "utf-8");
+    const content = await fs24.readFile(indexPath, "utf-8");
     return JSON.parse(content);
   } catch {
     return [];
@@ -17467,14 +17597,14 @@ async function loadIndex(scope) {
 async function saveIndex(scope, index) {
   const dir = getMemoriesDir(scope);
   await ensureDir(dir);
-  const indexPath = path23.join(dir, "index.json");
-  await fs23.writeFile(indexPath, JSON.stringify(index, null, 2), "utf-8");
+  const indexPath = path25.join(dir, "index.json");
+  await fs24.writeFile(indexPath, JSON.stringify(index, null, 2), "utf-8");
 }
 async function loadMemory(scope, id) {
   const dir = getMemoriesDir(scope);
-  const memPath = path23.join(dir, `${id}.json`);
+  const memPath = path25.join(dir, `${id}.json`);
   try {
-    const content = await fs23.readFile(memPath, "utf-8");
+    const content = await fs24.readFile(memPath, "utf-8");
     return JSON.parse(content);
   } catch {
     return null;
@@ -17483,8 +17613,8 @@ async function loadMemory(scope, id) {
 async function saveMemory(scope, memory) {
   const dir = getMemoriesDir(scope);
   await ensureDir(dir);
-  const memPath = path23.join(dir, `${memory.id}.json`);
-  await fs23.writeFile(memPath, JSON.stringify(memory, null, 2), "utf-8");
+  const memPath = path25.join(dir, `${memory.id}.json`);
+  await fs24.writeFile(memPath, JSON.stringify(memory, null, 2), "utf-8");
 }
 var createMemoryTool = defineTool({
   name: "create_memory",
@@ -17526,7 +17656,7 @@ Examples:
         { tool: "create_memory" }
       );
     }
-    const id = crypto2.randomUUID();
+    const id = crypto3.randomUUID();
     const memory = {
       id,
       key,
@@ -17636,17 +17766,17 @@ Examples:
   }
 });
 var memoryTools = [createMemoryTool, recallMemoryTool, listMemoriesTool];
-var fs24 = await import('fs/promises');
-var crypto3 = await import('crypto');
+var fs25 = await import('fs/promises');
+var crypto4 = await import('crypto');
 var CHECKPOINT_FILE = ".coco/checkpoints.json";
 var DEFAULT_MAX_CHECKPOINTS = 50;
 var STASH_PREFIX = "coco-cp";
 async function ensureCocoDir() {
-  await fs24.mkdir(".coco", { recursive: true });
+  await fs25.mkdir(".coco", { recursive: true });
 }
 async function loadCheckpoints() {
   try {
-    const content = await fs24.readFile(CHECKPOINT_FILE, "utf-8");
+    const content = await fs25.readFile(CHECKPOINT_FILE, "utf-8");
     return JSON.parse(content);
   } catch {
     return [];
@@ -17654,7 +17784,7 @@ async function loadCheckpoints() {
 }
 async function saveCheckpoints(checkpoints) {
   await ensureCocoDir();
-  await fs24.writeFile(CHECKPOINT_FILE, JSON.stringify(checkpoints, null, 2), "utf-8");
+  await fs25.writeFile(CHECKPOINT_FILE, JSON.stringify(checkpoints, null, 2), "utf-8");
 }
 async function execGit(args) {
   const { execaCommand } = await import('execa');
@@ -17692,7 +17822,7 @@ Examples:
     description: z.string().min(1).max(200).describe("Description of this checkpoint")
   }),
   async execute({ description }) {
-    const id = crypto3.randomUUID().slice(0, 8);
+    const id = crypto4.randomUUID().slice(0, 8);
     const timestamp = (/* @__PURE__ */ new Date()).toISOString();
     const stashMessage = `${STASH_PREFIX}-${id}-${description.replace(/\s+/g, "-").slice(0, 50)}`;
     const changedFiles = await getChangedFiles();
@@ -17814,8 +17944,8 @@ Examples:
   }
 });
 var checkpointTools = [createCheckpointTool, restoreCheckpointTool, listCheckpointsTool];
-var fs25 = await import('fs/promises');
-var path24 = await import('path');
+var fs26 = await import('fs/promises');
+var path26 = await import('path');
 var { glob: glob13 } = await import('glob');
 var INDEX_DIR = ".coco/search-index";
 var DEFAULT_CHUNK_SIZE = 20;
@@ -17941,20 +18071,20 @@ async function getEmbedding(text) {
 }
 async function loadIndex2(indexDir) {
   try {
-    const indexPath = path24.join(indexDir, "index.json");
-    const content = await fs25.readFile(indexPath, "utf-8");
+    const indexPath = path26.join(indexDir, "index.json");
+    const content = await fs26.readFile(indexPath, "utf-8");
     return JSON.parse(content);
   } catch {
     return null;
   }
 }
 async function saveIndex2(indexDir, index) {
-  await fs25.mkdir(indexDir, { recursive: true });
-  const indexPath = path24.join(indexDir, "index.json");
-  await fs25.writeFile(indexPath, JSON.stringify(index), "utf-8");
+  await fs26.mkdir(indexDir, { recursive: true });
+  const indexPath = path26.join(indexDir, "index.json");
+  await fs26.writeFile(indexPath, JSON.stringify(index), "utf-8");
 }
 function isBinary(filePath) {
-  return BINARY_EXTENSIONS.has(path24.extname(filePath).toLowerCase());
+  return BINARY_EXTENSIONS.has(path26.extname(filePath).toLowerCase());
 }
 var semanticSearchTool = defineTool({
   name: "semantic_search",
@@ -17979,8 +18109,8 @@ Examples:
     const effectivePath = rootPath ?? ".";
     const effectiveMaxResults = maxResults ?? 10;
     const effectiveThreshold = threshold ?? 0.3;
-    const absPath = path24.resolve(effectivePath);
-    const indexDir = path24.join(absPath, INDEX_DIR);
+    const absPath = path26.resolve(effectivePath);
+    const indexDir = path26.join(absPath, INDEX_DIR);
     let index = reindex ? null : await loadIndex2(indexDir);
     if (!index) {
       const pattern = include ?? "**/*";
@@ -17993,10 +18123,10 @@ Examples:
       const chunks = [];
       for (const file of files) {
         if (isBinary(file)) continue;
-        const fullPath = path24.join(absPath, file);
+        const fullPath = path26.join(absPath, file);
         try {
-          const stat2 = await fs25.stat(fullPath);
-          const content = await fs25.readFile(fullPath, "utf-8");
+          const stat2 = await fs26.stat(fullPath);
+          const content = await fs26.readFile(fullPath, "utf-8");
           if (content.length > 1e5) continue;
           const fileChunks = chunkContent(content, DEFAULT_CHUNK_SIZE);
           for (const chunk of fileChunks) {
@@ -18055,8 +18185,8 @@ Examples:
   }
 });
 var semanticSearchTools = [semanticSearchTool];
-var fs26 = await import('fs/promises');
-var path25 = await import('path');
+var fs27 = await import('fs/promises');
+var path27 = await import('path');
 var { glob: glob14 } = await import('glob');
 async function parseClassRelationships(rootPath, include) {
   const pattern = include ?? "**/*.{ts,tsx,js,jsx}";
@@ -18069,7 +18199,7 @@ async function parseClassRelationships(rootPath, include) {
   const interfaces = [];
   for (const file of files.slice(0, 100)) {
     try {
-      const content = await fs26.readFile(path25.join(rootPath, file), "utf-8");
+      const content = await fs27.readFile(path27.join(rootPath, file), "utf-8");
       const lines = content.split("\n");
       for (let i = 0; i < lines.length; i++) {
         const line = lines[i];
@@ -18188,14 +18318,14 @@ async function generateClassDiagram(rootPath, include) {
   };
 }
 async function generateArchitectureDiagram(rootPath) {
-  const entries = await fs26.readdir(rootPath, { withFileTypes: true });
+  const entries = await fs27.readdir(rootPath, { withFileTypes: true });
   const dirs = entries.filter(
     (e) => e.isDirectory() && !e.name.startsWith(".") && !["node_modules", "dist", "build", "coverage", "__pycache__", "target"].includes(e.name)
   );
   const lines = ["graph TD"];
   let nodeCount = 0;
   let edgeCount = 0;
-  const rootName = path25.basename(rootPath);
+  const rootName = path27.basename(rootPath);
   lines.push(`  ROOT["${rootName}"]`);
   nodeCount++;
   for (const dir of dirs) {
@@ -18205,7 +18335,7 @@ async function generateArchitectureDiagram(rootPath) {
     nodeCount++;
     edgeCount++;
     try {
-      const subEntries = await fs26.readdir(path25.join(rootPath, dir.name), {
+      const subEntries = await fs27.readdir(path27.join(rootPath, dir.name), {
         withFileTypes: true
       });
       const subDirs = subEntries.filter(
@@ -18328,7 +18458,7 @@ Examples:
         tool: "generate_diagram"
       });
     }
-    const absPath = rootPath ? path25.resolve(rootPath) : process.cwd();
+    const absPath = rootPath ? path27.resolve(rootPath) : process.cwd();
     switch (type) {
       case "class":
         return generateClassDiagram(absPath, include);
@@ -18389,8 +18519,8 @@ Examples:
   }
 });
 var diagramTools = [generateDiagramTool];
-var fs27 = await import('fs/promises');
-var path26 = await import('path');
+var fs28 = await import('fs/promises');
+var path28 = await import('path');
 var DEFAULT_MAX_PAGES = 20;
 var MAX_FILE_SIZE = 50 * 1024 * 1024;
 function parsePageRange(rangeStr, totalPages) {
@@ -18425,9 +18555,9 @@ Examples:
   }),
   async execute({ path: filePath, pages, maxPages }) {
     const startTime = performance.now();
-    const absPath = path26.resolve(filePath);
+    const absPath = path28.resolve(filePath);
     try {
-      const stat2 = await fs27.stat(absPath);
+      const stat2 = await fs28.stat(absPath);
       if (!stat2.isFile()) {
         throw new ToolError(`Path is not a file: ${absPath}`, {
           tool: "read_pdf"
@@ -18458,7 +18588,7 @@ Examples:
     }
     try {
       const pdfParse = await import('pdf-parse');
-      const dataBuffer = await fs27.readFile(absPath);
+      const dataBuffer = await fs28.readFile(absPath);
       const pdfData = await pdfParse.default(dataBuffer, {
         max: maxPages
       });
@@ -18504,8 +18634,8 @@ Examples:
   }
 });
 var pdfTools = [readPdfTool];
-var fs28 = await import('fs/promises');
-var path27 = await import('path');
+var fs29 = await import('fs/promises');
+var path29 = await import('path');
 var SUPPORTED_FORMATS = /* @__PURE__ */ new Set([".png", ".jpg", ".jpeg", ".gif", ".webp", ".bmp"]);
 var MAX_IMAGE_SIZE = 20 * 1024 * 1024;
 var MIME_TYPES = {
@@ -18533,15 +18663,15 @@ Examples:
   async execute({ path: filePath, prompt, provider }) {
     const startTime = performance.now();
     const effectivePrompt = prompt ?? "Describe this image in detail. If it's code or a UI, identify the key elements.";
-    const absPath = path27.resolve(filePath);
+    const absPath = path29.resolve(filePath);
     const cwd = process.cwd();
-    if (!absPath.startsWith(cwd + path27.sep) && absPath !== cwd) {
+    if (!absPath.startsWith(cwd + path29.sep) && absPath !== cwd) {
       throw new ToolError(
         `Path traversal denied: '${filePath}' resolves outside the project directory`,
         { tool: "read_image" }
       );
     }
-    const ext = path27.extname(absPath).toLowerCase();
+    const ext = path29.extname(absPath).toLowerCase();
     if (!SUPPORTED_FORMATS.has(ext)) {
       throw new ToolError(
         `Unsupported image format '${ext}'. Supported: ${Array.from(SUPPORTED_FORMATS).join(", ")}`,
@@ -18549,7 +18679,7 @@ Examples:
       );
     }
     try {
-      const stat2 = await fs28.stat(absPath);
+      const stat2 = await fs29.stat(absPath);
       if (!stat2.isFile()) {
         throw new ToolError(`Path is not a file: ${absPath}`, {
           tool: "read_image"
@@ -18570,7 +18700,7 @@ Examples:
       if (error instanceof ToolError) throw error;
       throw error;
     }
-    const imageBuffer = await fs28.readFile(absPath);
+    const imageBuffer = await fs29.readFile(absPath);
     const base64 = imageBuffer.toString("base64");
     const mimeType = MIME_TYPES[ext] ?? "image/png";
     const selectedProvider = provider ?? "anthropic";
@@ -18683,7 +18813,7 @@ Examples:
   }
 });
 var imageTools = [readImageTool];
-var path28 = await import('path');
+var path30 = await import('path');
 var DANGEROUS_PATTERNS2 = [
   /\bDROP\s+(?:TABLE|DATABASE|INDEX|VIEW)\b/i,
   /\bTRUNCATE\b/i,
@@ -18714,7 +18844,7 @@ Examples:
   async execute({ database, query, params, readonly: isReadonlyParam }) {
     const isReadonly = isReadonlyParam ?? true;
     const startTime = performance.now();
-    const absPath = path28.resolve(database);
+    const absPath = path30.resolve(database);
     if (isReadonly && isDangerousSql(query)) {
       throw new ToolError(
         "Write operations (INSERT, UPDATE, DELETE, DROP, ALTER, TRUNCATE, CREATE) are blocked in readonly mode. Set readonly: false to allow writes.",
@@ -18787,7 +18917,7 @@ Examples:
   }),
   async execute({ database, table }) {
     const startTime = performance.now();
-    const absPath = path28.resolve(database);
+    const absPath = path30.resolve(database);
     try {
       const { default: Database } = await import('better-sqlite3');
       const db = new Database(absPath, { readonly: true, fileMustExist: true });
@@ -18840,14 +18970,14 @@ Examples:
   }
 });
 var databaseTools = [sqlQueryTool, inspectSchemaTool];
-var fs29 = await import('fs/promises');
-var path29 = await import('path');
+var fs30 = await import('fs/promises');
+var path31 = await import('path');
 var AnalyzeFileSchema = z.object({
   filePath: z.string().describe("Path to file to analyze"),
   includeAst: z.boolean().default(false).describe("Include AST in result")
 });
 async function analyzeFile(filePath, includeAst = false) {
-  const content = await fs29.readFile(filePath, "utf-8");
+  const content = await fs30.readFile(filePath, "utf-8");
   const lines = content.split("\n").length;
   const functions = [];
   const classes = [];
@@ -18951,10 +19081,10 @@ async function analyzeDirectory(dirPath) {
     try {
       const analysis = await analyzeFile(file, false);
       totalLines += analysis.lines;
-      const ext = path29.extname(file);
+      const ext = path31.extname(file);
       filesByType[ext] = (filesByType[ext] || 0) + 1;
       fileStats.push({
-        file: path29.relative(dirPath, file),
+        file: path31.relative(dirPath, file),
         lines: analysis.lines,
         complexity: analysis.complexity.cyclomatic
       });
@@ -19277,13 +19407,13 @@ ${completed.map((r) => `- ${r.agentId}: Success`).join("\n")}`;
   }
 });
 var agentCoordinatorTools = [createAgentPlanTool, delegateTaskTool, aggregateResultsTool];
-var fs30 = await import('fs/promises');
+var fs31 = await import('fs/promises');
 var SuggestImprovementsSchema = z.object({
   filePath: z.string().describe("File to analyze for improvement suggestions"),
   context: z.string().optional().describe("Additional context about the code")
 });
 async function analyzeAndSuggest(filePath, _context) {
-  const content = await fs30.readFile(filePath, "utf-8");
+  const content = await fs31.readFile(filePath, "utf-8");
   const lines = content.split("\n");
   const suggestions = [];
   for (let i = 0; i < lines.length; i++) {
@@ -19375,7 +19505,7 @@ async function analyzeAndSuggest(filePath, _context) {
     if (filePath.endsWith(".ts") && !filePath.includes("test") && !filePath.includes(".d.ts") && line.includes("export ")) {
       const testPath = filePath.replace(".ts", ".test.ts");
       try {
-        await fs30.access(testPath);
+        await fs31.access(testPath);
       } catch {
         suggestions.push({
           type: "testing",
@@ -19432,7 +19562,7 @@ var calculateCodeScoreTool = defineTool({
   async execute(input) {
     const { filePath } = input;
     const suggestions = await analyzeAndSuggest(filePath);
-    const content = await fs30.readFile(filePath, "utf-8");
+    const content = await fs31.readFile(filePath, "utf-8");
     const lines = content.split("\n");
     const nonEmptyLines = lines.filter((l) => l.trim()).length;
     let score = 100;
@@ -19466,8 +19596,8 @@ var calculateCodeScoreTool = defineTool({
   }
 });
 var smartSuggestionsTools = [suggestImprovementsTool, calculateCodeScoreTool];
-var fs31 = await import('fs/promises');
-var path30 = await import('path');
+var fs32 = await import('fs/promises');
+var path32 = await import('path');
 var ContextMemoryStore = class {
   items = /* @__PURE__ */ new Map();
   learnings = /* @__PURE__ */ new Map();
@@ -19479,7 +19609,7 @@ var ContextMemoryStore = class {
   }
   async load() {
     try {
-      const content = await fs31.readFile(this.storePath, "utf-8");
+      const content = await fs32.readFile(this.storePath, "utf-8");
       const data = JSON.parse(content);
       this.items = new Map(Object.entries(data.items || {}));
       this.learnings = new Map(Object.entries(data.learnings || {}));
@@ -19487,15 +19617,15 @@ var ContextMemoryStore = class {
     }
   }
   async save() {
-    const dir = path30.dirname(this.storePath);
-    await fs31.mkdir(dir, { recursive: true });
+    const dir = path32.dirname(this.storePath);
+    await fs32.mkdir(dir, { recursive: true });
     const data = {
       sessionId: this.sessionId,
       items: Object.fromEntries(this.items),
       learnings: Object.fromEntries(this.learnings),
       savedAt: Date.now()
     };
-    await fs31.writeFile(this.storePath, JSON.stringify(data, null, 2));
+    await fs32.writeFile(this.storePath, JSON.stringify(data, null, 2));
   }
   addContext(id, item) {
     this.items.set(id, item);
@@ -19645,11 +19775,11 @@ var getLearnedPatternsTool = defineTool({
     const patterns = store.getFrequentPatterns(typedInput.limit);
     return {
       totalPatterns: patterns.length,
-      patterns: patterns.map((p3) => ({
-        pattern: p3.pattern,
-        preference: p3.userPreference,
-        frequency: p3.frequency,
-        lastUsed: new Date(p3.lastUsed).toISOString()
+      patterns: patterns.map((p4) => ({
+        pattern: p4.pattern,
+        preference: p4.userPreference,
+        frequency: p4.frequency,
+        lastUsed: new Date(p4.lastUsed).toISOString()
       }))
     };
   }
@@ -19660,11 +19790,11 @@ var contextEnhancerTools = [
   recordLearningTool,
   getLearnedPatternsTool
 ];
-var fs32 = await import('fs/promises');
-var path31 = await import('path');
+var fs33 = await import('fs/promises');
+var path33 = await import('path');
 async function discoverSkills(skillsDir) {
   try {
-    const files = await fs32.readdir(skillsDir);
+    const files = await fs33.readdir(skillsDir);
     return files.filter((f) => f.endsWith(".ts") || f.endsWith(".js"));
   } catch {
     return [];
@@ -19672,12 +19802,12 @@ async function discoverSkills(skillsDir) {
 }
 async function loadSkillMetadata(skillPath) {
   try {
-    const content = await fs32.readFile(skillPath, "utf-8");
+    const content = await fs33.readFile(skillPath, "utf-8");
     const nameMatch = content.match(/@name\s+(\S+)/);
     const descMatch = content.match(/@description\s+(.+)/);
     const versionMatch = content.match(/@version\s+(\S+)/);
     return {
-      name: nameMatch?.[1] || path31.basename(skillPath, path31.extname(skillPath)),
+      name: nameMatch?.[1] || path33.basename(skillPath, path33.extname(skillPath)),
       description: descMatch?.[1] || "No description",
       version: versionMatch?.[1] || "1.0.0",
       dependencies: []
@@ -19721,7 +19851,7 @@ var discoverSkillsTool = defineTool({
     const { skillsDir } = input;
     const skills = await discoverSkills(skillsDir);
     const metadata = await Promise.all(
-      skills.map((s) => loadSkillMetadata(path31.join(skillsDir, s)))
+      skills.map((s) => loadSkillMetadata(path33.join(skillsDir, s)))
     );
     return {
       skillsDir,
@@ -19844,14 +19974,17 @@ export const ${typedInput.name}Tool = defineTool({
   }
 });
 var skillEnhancerTools = [discoverSkillsTool, validateSkillTool, createCustomToolTool];
+function gitExec(cmd, opts = {}) {
+  return execSync(cmd, { encoding: "utf-8", cwd: process.cwd(), ...opts });
+}
 function analyzeRepoHealth() {
   const issues = [];
   const recommendations = [];
   let score = 100;
   try {
     try {
-      execSync("git status --porcelain", { stdio: "pipe" });
-      const status = execSync("git status --porcelain", { encoding: "utf-8" });
+      gitExec("git status --porcelain", { stdio: "pipe" });
+      const status = gitExec("git status --porcelain");
       if (status.trim()) {
         issues.push("Uncommitted changes present");
         score -= 10;
@@ -19859,7 +19992,7 @@ function analyzeRepoHealth() {
     } catch {
     }
     try {
-      const untracked = execSync("git ls-files --others --exclude-standard", { encoding: "utf-8" });
+      const untracked = gitExec("git ls-files --others --exclude-standard");
       if (untracked.trim()) {
         const count = untracked.trim().split("\n").length;
         issues.push(`${count} untracked files`);
@@ -19869,9 +20002,9 @@ function analyzeRepoHealth() {
     } catch {
     }
     try {
-      const branch = execSync("git rev-parse --abbrev-ref HEAD", { encoding: "utf-8" }).trim();
-      const local = execSync("git rev-parse HEAD", { encoding: "utf-8" }).trim();
-      const remote = execSync(`git rev-parse origin/${branch}`, { encoding: "utf-8" }).trim();
+      const branch = gitExec("git rev-parse --abbrev-ref HEAD").trim();
+      const local = gitExec("git rev-parse HEAD").trim();
+      const remote = gitExec(`git rev-parse origin/${branch}`).trim();
       if (local !== remote) {
         issues.push("Branch is not up-to-date with remote");
         score -= 15;
@@ -19880,14 +20013,14 @@ function analyzeRepoHealth() {
     } catch {
     }
     try {
-      const files = execSync("git ls-files", { encoding: "utf-8" }).trim().split("\n");
+      const files = gitExec("git ls-files").trim().split("\n");
       if (files.length > 1e3) {
         recommendations.push("Repository has many files, consider using .gitignore");
       }
     } catch {
     }
     try {
-      const conflicts = execSync("git diff --name-only --diff-filter=U", { encoding: "utf-8" });
+      const conflicts = gitExec("git diff --name-only --diff-filter=U");
       if (conflicts.trim()) {
         issues.push("Merge conflicts present");
         score -= 30;
@@ -19903,12 +20036,11 @@ function analyzeRepoHealth() {
 }
 function getCommitStats() {
   try {
-    const count = execSync("git rev-list --count HEAD", { encoding: "utf-8" }).trim();
-    const authors = execSync('git log --format="%an" | sort -u', {
-      encoding: "utf-8",
+    const count = gitExec("git rev-list --count HEAD").trim();
+    const authors = gitExec('git log --format="%an" | sort -u', {
       shell: "/bin/bash"
     }).trim().split("\n");
-    const lastCommit = execSync('git log -1 --format="%cr"', { encoding: "utf-8" }).trim();
+    const lastCommit = gitExec('git log -1 --format="%cr"').trim();
     return {
       totalCommits: parseInt(count, 10),
       authors,
@@ -19981,7 +20113,7 @@ var recommendBranchTool = defineTool({
     const branchName = `${prefix}/${slug}`;
     let exists = false;
     try {
-      execSync(`git rev-parse --verify ${branchName}`, { stdio: "ignore" });
+      execSync(`git rev-parse --verify ${branchName}`, { cwd: process.cwd(), stdio: "ignore" });
       exists = true;
     } catch {
       exists = false;
@@ -19996,6 +20128,104 @@ var recommendBranchTool = defineTool({
   }
 });
 var gitEnhancedTools = [analyzeRepoHealthTool, getCommitStatsTool, recommendBranchTool];
+init_allowed_paths();
+var BLOCKED_SYSTEM_PATHS = [
+  "/etc",
+  "/var",
+  "/usr",
+  "/root",
+  "/sys",
+  "/proc",
+  "/boot",
+  "/bin",
+  "/sbin"
+];
+var authorizePathTool = defineTool({
+  name: "authorize_path",
+  description: `Request user permission to access a directory outside the project root.
+
+Use this BEFORE attempting file operations on external directories. The user will see
+an interactive prompt where they choose to allow or deny access.
+
+Returns whether the path was authorized. If authorized, subsequent file operations
+on that directory will succeed.
+
+Examples:
+- Need to read config from another project: authorize_path({ path: "/home/user/other-project" })
+- Need to access shared libraries: authorize_path({ path: "/opt/shared/libs", reason: "Read shared type definitions" })`,
+  category: "config",
+  parameters: z.object({
+    path: z.string().min(1).describe("Absolute path to the directory to authorize"),
+    reason: z.string().optional().describe("Why access is needed (shown to user for context)")
+  }),
+  async execute({ path: dirPath, reason }) {
+    const absolute = path14__default.resolve(dirPath);
+    if (isWithinAllowedPath(absolute, "read")) {
+      return {
+        authorized: true,
+        path: absolute,
+        message: "Path is already authorized."
+      };
+    }
+    for (const blocked of BLOCKED_SYSTEM_PATHS) {
+      const normalizedBlocked = path14__default.normalize(blocked);
+      if (absolute === normalizedBlocked || absolute.startsWith(normalizedBlocked + path14__default.sep)) {
+        return {
+          authorized: false,
+          path: absolute,
+          message: `System path '${blocked}' cannot be authorized for security reasons.`
+        };
+      }
+    }
+    const cwd = process.cwd();
+    if (absolute === path14__default.normalize(cwd) || absolute.startsWith(path14__default.normalize(cwd) + path14__default.sep)) {
+      return {
+        authorized: true,
+        path: absolute,
+        message: "Path is within the project directory \u2014 already accessible."
+      };
+    }
+    try {
+      const stat2 = await fs14__default.stat(absolute);
+      if (!stat2.isDirectory()) {
+        return {
+          authorized: false,
+          path: absolute,
+          message: `Not a directory: ${absolute}`
+        };
+      }
+    } catch {
+      return {
+        authorized: false,
+        path: absolute,
+        message: `Directory not found: ${absolute}`
+      };
+    }
+    const existing = getAllowedPaths();
+    if (existing.some((e) => path14__default.normalize(e.path) === path14__default.normalize(absolute))) {
+      return {
+        authorized: true,
+        path: absolute,
+        message: "Path is already authorized."
+      };
+    }
+    const { promptAllowPath: promptAllowPath2 } = await Promise.resolve().then(() => (init_allow_path_prompt(), allow_path_prompt_exports));
+    const wasAuthorized = await promptAllowPath2(absolute);
+    if (wasAuthorized) {
+      return {
+        authorized: true,
+        path: absolute,
+        message: `Access granted to ${absolute}.${reason ? ` Reason: ${reason}` : ""}`
+      };
+    }
+    return {
+      authorized: false,
+      path: absolute,
+      message: "User denied access to this directory."
+    };
+  }
+});
+var authorizePathTools = [authorizePathTool];
 
 // src/tools/index.ts
 function registerAllTools(registry) {
@@ -20028,7 +20258,8 @@ function registerAllTools(registry) {
     ...smartSuggestionsTools,
     ...contextEnhancerTools,
     ...skillEnhancerTools,
-    ...gitEnhancedTools
+    ...gitEnhancedTools,
+    ...authorizePathTools
   ];
   for (const tool of allTools) {
     registry.register(tool);