@corbat-tech/coco 1.2.2 → 1.3.0

package/dist/index.js

@@ -3,10 +3,12 @@ import * as path14 from 'path';
 import path14__default, { dirname, join, basename } from 'path';
 import * as fs4 from 'fs';
 import fs4__default, { readFileSync, constants } from 'fs';
-import { fileURLToPath } from 'url';
-import { randomUUID } from 'crypto';
 import * as fs14 from 'fs/promises';
 import fs14__default, { readFile, access, readdir } from 'fs/promises';
+import chalk3 from 'chalk';
+import * as p3 from '@clack/prompts';
+import { fileURLToPath } from 'url';
+import { randomUUID } from 'crypto';
 import { execa } from 'execa';
 import { parse } from '@typescript-eslint/typescript-estree';
 import { glob } from 'glob';
@@ -17,8 +19,6 @@ import { Logger } from 'tslog';
 import Anthropic from '@anthropic-ai/sdk';
 import OpenAI from 'openai';
 import 'http';
-import '@clack/prompts';
-import chalk3 from 'chalk';
 import { GoogleGenerativeAI, FunctionCallingMode } from '@google/generative-ai';
 import JSON5 from 'json5';
 import 'events';
@@ -38,10 +38,15 @@ import typescript from 'highlight.js/lib/languages/typescript';
 import xml from 'highlight.js/lib/languages/xml';
 import yaml from 'highlight.js/lib/languages/yaml';
 
+var __defProp = Object.defineProperty;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __esm = (fn, res) => function __init() {
   return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
 };
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
 var COCO_HOME, CONFIG_PATHS;
 var init_paths = __esm({
   "src/config/paths.ts"() {
@@ -112,6 +117,8 @@ function getApiKey(provider) {
       return process.env["KIMI_API_KEY"] ?? process.env["MOONSHOT_API_KEY"];
     case "lmstudio":
       return process.env["LMSTUDIO_API_KEY"] ?? "lm-studio";
+    case "ollama":
+      return process.env["OLLAMA_API_KEY"] ?? "ollama";
     case "codex":
       return void 0;
     default:
@@ -128,6 +135,8 @@ function getBaseUrl(provider) {
       return process.env["KIMI_BASE_URL"] ?? "https://api.moonshot.ai/v1";
     case "lmstudio":
       return process.env["LMSTUDIO_BASE_URL"] ?? "http://localhost:1234/v1";
+    case "ollama":
+      return process.env["OLLAMA_BASE_URL"] ?? "http://localhost:11434/v1";
     case "codex":
       return "https://chatgpt.com/backend-api/codex/responses";
     default:
@@ -139,22 +148,24 @@ function getDefaultModel(provider) {
     case "anthropic":
       return process.env["ANTHROPIC_MODEL"] ?? "claude-opus-4-6-20260115";
     case "openai":
-      return process.env["OPENAI_MODEL"] ?? "gpt-5.2-codex";
+      return process.env["OPENAI_MODEL"] ?? "gpt-5.3-codex";
     case "gemini":
       return process.env["GEMINI_MODEL"] ?? "gemini-3-flash-preview";
     case "kimi":
       return process.env["KIMI_MODEL"] ?? "kimi-k2.5";
     case "lmstudio":
       return process.env["LMSTUDIO_MODEL"] ?? "local-model";
+    case "ollama":
+      return process.env["OLLAMA_MODEL"] ?? "llama3.1";
     case "codex":
-      return process.env["CODEX_MODEL"] ?? "gpt-5.2-codex";
+      return process.env["CODEX_MODEL"] ?? "gpt-5.3-codex";
     default:
-      return "gpt-5.2-codex";
+      return "gpt-5.3-codex";
   }
 }
 function getDefaultProvider() {
   const provider = process.env["COCO_PROVIDER"]?.toLowerCase();
-  if (provider && ["anthropic", "openai", "codex", "gemini", "kimi", "lmstudio"].includes(provider)) {
+  if (provider && ["anthropic", "openai", "codex", "gemini", "kimi", "lmstudio", "ollama"].includes(provider)) {
     return provider;
   }
   return "anthropic";
@@ -171,6 +182,119 @@ var init_env = __esm({
     });
   }
 });
+function getAllowedPaths() {
+  return [...sessionAllowedPaths];
+}
+function isWithinAllowedPath(absolutePath, operation) {
+  const normalizedTarget = path14__default.normalize(absolutePath);
+  for (const entry of sessionAllowedPaths) {
+    const normalizedAllowed = path14__default.normalize(entry.path);
+    if (normalizedTarget === normalizedAllowed || normalizedTarget.startsWith(normalizedAllowed + path14__default.sep)) {
+      if (operation === "read") return true;
+      if (entry.level === "write") return true;
+    }
+  }
+  return false;
+}
+function addAllowedPathToSession(dirPath, level) {
+  const absolute = path14__default.resolve(dirPath);
+  if (sessionAllowedPaths.some((e) => path14__default.normalize(e.path) === path14__default.normalize(absolute))) {
+    return;
+  }
+  sessionAllowedPaths.push({
+    path: absolute,
+    authorizedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    level
+  });
+}
+async function persistAllowedPath(dirPath, level) {
+  if (!currentProjectPath) return;
+  const absolute = path14__default.resolve(dirPath);
+  const store = await loadStore();
+  if (!store.projects[currentProjectPath]) {
+    store.projects[currentProjectPath] = [];
+  }
+  const entries = store.projects[currentProjectPath];
+  const normalized = path14__default.normalize(absolute);
+  if (entries.some((e) => path14__default.normalize(e.path) === normalized)) {
+    return;
+  }
+  entries.push({
+    path: absolute,
+    authorizedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    level
+  });
+  await saveStore(store);
+}
+async function loadStore() {
+  try {
+    const content = await fs14__default.readFile(STORE_FILE, "utf-8");
+    return { ...DEFAULT_STORE, ...JSON.parse(content) };
+  } catch {
+    return { ...DEFAULT_STORE };
+  }
+}
+async function saveStore(store) {
+  try {
+    await fs14__default.mkdir(path14__default.dirname(STORE_FILE), { recursive: true });
+    await fs14__default.writeFile(STORE_FILE, JSON.stringify(store, null, 2), "utf-8");
+  } catch {
+  }
+}
+var STORE_FILE, DEFAULT_STORE, sessionAllowedPaths, currentProjectPath;
+var init_allowed_paths = __esm({
+  "src/tools/allowed-paths.ts"() {
+    init_paths();
+    STORE_FILE = path14__default.join(CONFIG_PATHS.home, "allowed-paths.json");
+    DEFAULT_STORE = {
+      version: 1,
+      projects: {}
+    };
+    sessionAllowedPaths = [];
+    currentProjectPath = "";
+  }
+});
+
+// src/cli/repl/allow-path-prompt.ts
+var allow_path_prompt_exports = {};
+__export(allow_path_prompt_exports, {
+  promptAllowPath: () => promptAllowPath
+});
+async function promptAllowPath(dirPath) {
+  const absolute = path14__default.resolve(dirPath);
+  console.log();
+  console.log(chalk3.yellow("  \u26A0 Access denied \u2014 path is outside the project directory"));
+  console.log(chalk3.dim(`  \u{1F4C1} ${absolute}`));
+  console.log();
+  const action = await p3.select({
+    message: "Grant access to this directory?",
+    options: [
+      { value: "session-write", label: "\u2713 Allow write (this session)" },
+      { value: "session-read", label: "\u25D0 Allow read-only (this session)" },
+      { value: "persist-write", label: "\u26A1 Allow write (remember for this project)" },
+      { value: "persist-read", label: "\u{1F4BE} Allow read-only (remember for this project)" },
+      { value: "no", label: "\u2717 Deny" }
+    ]
+  });
+  if (p3.isCancel(action) || action === "no") {
+    return false;
+  }
+  const level = action.includes("read") ? "read" : "write";
+  const persist = action.startsWith("persist");
+  addAllowedPathToSession(absolute, level);
+  if (persist) {
+    await persistAllowedPath(absolute, level);
+  }
+  const levelLabel = level === "write" ? "write" : "read-only";
+  const persistLabel = persist ? " (remembered)" : "";
+  console.log(chalk3.green(`  \u2713 Access granted: ${levelLabel}${persistLabel}`));
+  return true;
+}
+var init_allow_path_prompt = __esm({
+  "src/cli/repl/allow-path-prompt.ts"() {
+    init_allowed_paths();
+  }
+});
 function findPackageJson() {
   let dir = dirname(fileURLToPath(import.meta.url));
   for (let i = 0; i < 10; i++) {
@@ -3776,10 +3900,10 @@ var CoverageAnalyzer = class {
       join(this.projectPath, ".coverage", "coverage-summary.json"),
       join(this.projectPath, "coverage", "lcov-report", "coverage-summary.json")
     ];
-    for (const path32 of possiblePaths) {
+    for (const path37 of possiblePaths) {
       try {
-        await access(path32, constants.R_OK);
-        const content = await readFile(path32, "utf-8");
+        await access(path37, constants.R_OK);
+        const content = await readFile(path37, "utf-8");
         const report = JSON.parse(content);
         return parseCoverageSummary(report);
       } catch {
@@ -10208,7 +10332,7 @@ function createAnthropicProvider(config) {
   }
   return provider;
 }
-var DEFAULT_MODEL2 = "gpt-5.2-codex";
+var DEFAULT_MODEL2 = "gpt-5.3-codex";
 var CONTEXT_WINDOWS2 = {
   // OpenAI models
   "gpt-4o": 128e3,
@@ -10219,6 +10343,10 @@ var CONTEXT_WINDOWS2 = {
   o1: 2e5,
   "o1-mini": 128e3,
   "o3-mini": 2e5,
+  "o4-mini": 2e5,
+  // GPT-4.1 series (Feb 2026)
+  "gpt-4.1": 1048576,
+  "gpt-4.1-mini": 1048576,
   // GPT-5 series (2025-2026)
   "gpt-5": 4e5,
   "gpt-5.2": 4e5,
@@ -10226,6 +10354,7 @@ var CONTEXT_WINDOWS2 = {
   "gpt-5.2-thinking": 4e5,
   "gpt-5.2-instant": 4e5,
   "gpt-5.2-pro": 4e5,
+  "gpt-5.3-codex": 4e5,
   // Kimi/Moonshot models
   "kimi-k2.5": 262144,
   "kimi-k2-0324": 131072,
@@ -11021,10 +11150,11 @@ async function getCachedADCToken() {
 
 // src/providers/codex.ts
 var CODEX_API_ENDPOINT = "https://chatgpt.com/backend-api/codex/responses";
-var DEFAULT_MODEL3 = "gpt-5.2-codex";
+var DEFAULT_MODEL3 = "gpt-5.3-codex";
 var CONTEXT_WINDOWS3 = {
-  "gpt-5-codex": 2e5,
+  "gpt-5.3-codex": 2e5,
   "gpt-5.2-codex": 2e5,
+  "gpt-5-codex": 2e5,
   "gpt-5.1-codex": 2e5,
   "gpt-5": 2e5,
   "gpt-5.2": 2e5,
@@ -11772,6 +11902,11 @@ async function createProvider(type, config = {}) {
       mergedConfig.baseUrl = mergedConfig.baseUrl ?? "http://localhost:1234/v1";
       mergedConfig.apiKey = mergedConfig.apiKey ?? "lm-studio";
       break;
+    case "ollama":
+      provider = new OpenAIProvider();
+      mergedConfig.baseUrl = mergedConfig.baseUrl ?? "http://localhost:11434/v1";
+      mergedConfig.apiKey = mergedConfig.apiKey ?? "ollama";
+      break;
     default:
       throw new ProviderError(`Unknown provider type: ${type}`, {
         provider: type
@@ -11893,9 +12028,9 @@ function createInitialState(config) {
 }
 async function loadExistingState(projectPath) {
   try {
-    const fs33 = await import('fs/promises');
+    const fs36 = await import('fs/promises');
     const statePath = `${projectPath}/.coco/state/project.json`;
-    const content = await fs33.readFile(statePath, "utf-8");
+    const content = await fs36.readFile(statePath, "utf-8");
     const data = JSON.parse(content);
     data.createdAt = new Date(data.createdAt);
     data.updatedAt = new Date(data.updatedAt);
@@ -11905,13 +12040,13 @@ async function loadExistingState(projectPath) {
   }
 }
 async function saveState(state) {
-  const fs33 = await import('fs/promises');
+  const fs36 = await import('fs/promises');
   const statePath = `${state.path}/.coco/state`;
-  await fs33.mkdir(statePath, { recursive: true });
+  await fs36.mkdir(statePath, { recursive: true });
   const filePath = `${statePath}/project.json`;
   const tmpPath = `${filePath}.tmp.${Date.now()}`;
-  await fs33.writeFile(tmpPath, JSON.stringify(state, null, 2), "utf-8");
-  await fs33.rename(tmpPath, filePath);
+  await fs36.writeFile(tmpPath, JSON.stringify(state, null, 2), "utf-8");
+  await fs36.rename(tmpPath, filePath);
 }
 function getPhaseExecutor(phase) {
   switch (phase) {
@@ -11970,20 +12105,20 @@ async function createPhaseContext(config, state) {
   };
   const tools = {
     file: {
-      async read(path32) {
-        const fs33 = await import('fs/promises');
-        return fs33.readFile(path32, "utf-8");
+      async read(path37) {
+        const fs36 = await import('fs/promises');
+        return fs36.readFile(path37, "utf-8");
       },
-      async write(path32, content) {
-        const fs33 = await import('fs/promises');
+      async write(path37, content) {
+        const fs36 = await import('fs/promises');
         const nodePath = await import('path');
-        await fs33.mkdir(nodePath.dirname(path32), { recursive: true });
-        await fs33.writeFile(path32, content, "utf-8");
+        await fs36.mkdir(nodePath.dirname(path37), { recursive: true });
+        await fs36.writeFile(path37, content, "utf-8");
       },
-      async exists(path32) {
-        const fs33 = await import('fs/promises');
+      async exists(path37) {
+        const fs36 = await import('fs/promises');
         try {
-          await fs33.access(path32);
+          await fs36.access(path37);
           return true;
         } catch {
           return false;
@@ -11996,9 +12131,9 @@ async function createPhaseContext(config, state) {
     },
     bash: {
       async exec(command, options = {}) {
-        const { execa: execa9 } = await import('execa');
+        const { execa: execa11 } = await import('execa');
         try {
-          const result = await execa9(command, {
+          const result = await execa11(command, {
             shell: true,
             cwd: options.cwd || state.path,
             timeout: options.timeout,
@@ -12021,8 +12156,8 @@ async function createPhaseContext(config, state) {
     },
     git: {
       async status() {
-        const { execa: execa9 } = await import('execa');
-        const result = await execa9("git", ["status", "--porcelain", "-b"], { cwd: state.path });
+        const { execa: execa11 } = await import('execa');
+        const result = await execa11("git", ["status", "--porcelain", "-b"], { cwd: state.path });
         const lines = result.stdout.split("\n");
         const branchLine = lines[0] || "";
         const branch = branchLine.replace("## ", "").split("...")[0] || "main";
@@ -12035,24 +12170,24 @@ async function createPhaseContext(config, state) {
         };
       },
       async commit(message, files) {
-        const { execa: execa9 } = await import('execa');
+        const { execa: execa11 } = await import('execa');
         if (files && files.length > 0) {
-          await execa9("git", ["add", ...files], { cwd: state.path });
+          await execa11("git", ["add", ...files], { cwd: state.path });
         }
-        await execa9("git", ["commit", "-m", message], { cwd: state.path });
+        await execa11("git", ["commit", "-m", message], { cwd: state.path });
       },
       async push() {
-        const { execa: execa9 } = await import('execa');
-        await execa9("git", ["push"], { cwd: state.path });
+        const { execa: execa11 } = await import('execa');
+        await execa11("git", ["push"], { cwd: state.path });
       }
     },
     test: {
       async run(pattern) {
-        const { execa: execa9 } = await import('execa');
+        const { execa: execa11 } = await import('execa');
         try {
           const args = ["test", "--reporter=json"];
           if (pattern) args.push(pattern);
-          await execa9("pnpm", args, { cwd: state.path });
+          await execa11("pnpm", args, { cwd: state.path });
           return {
             passed: 0,
             failed: 0,
@@ -12132,9 +12267,9 @@ async function createSnapshot(state) {
 var MAX_CHECKPOINT_VERSIONS = 5;
 async function getCheckpointFiles(state, phase) {
   try {
-    const fs33 = await import('fs/promises');
+    const fs36 = await import('fs/promises');
     const checkpointDir = `${state.path}/.coco/checkpoints`;
-    const files = await fs33.readdir(checkpointDir);
+    const files = await fs36.readdir(checkpointDir);
     const phaseFiles = files.filter((f) => f.startsWith(`snapshot-pre-${phase}-`) && f.endsWith(".json")).sort((a, b) => {
       const tsA = parseInt(a.split("-").pop()?.replace(".json", "") ?? "0", 10);
       const tsB = parseInt(b.split("-").pop()?.replace(".json", "") ?? "0", 10);
@@ -12147,11 +12282,11 @@ async function getCheckpointFiles(state, phase) {
 }
 async function cleanupOldCheckpoints(state, phase) {
   try {
-    const fs33 = await import('fs/promises');
+    const fs36 = await import('fs/promises');
     const files = await getCheckpointFiles(state, phase);
     if (files.length > MAX_CHECKPOINT_VERSIONS) {
       const filesToDelete = files.slice(MAX_CHECKPOINT_VERSIONS);
-      await Promise.all(filesToDelete.map((f) => fs33.unlink(f).catch(() => {
+      await Promise.all(filesToDelete.map((f) => fs36.unlink(f).catch(() => {
       })));
     }
   } catch {
@@ -12159,13 +12294,13 @@ async function cleanupOldCheckpoints(state, phase) {
 }
 async function saveSnapshot(state, snapshotId) {
   try {
-    const fs33 = await import('fs/promises');
+    const fs36 = await import('fs/promises');
     const snapshotPath = `${state.path}/.coco/checkpoints/snapshot-${snapshotId}.json`;
     const snapshotDir = `${state.path}/.coco/checkpoints`;
-    await fs33.mkdir(snapshotDir, { recursive: true });
+    await fs36.mkdir(snapshotDir, { recursive: true });
     const createdAt = state.createdAt instanceof Date ? state.createdAt.toISOString() : String(state.createdAt);
     const updatedAt = state.updatedAt instanceof Date ? state.updatedAt.toISOString() : String(state.updatedAt);
-    await fs33.writeFile(
+    await fs36.writeFile(
       snapshotPath,
       JSON.stringify(
         {
@@ -12263,7 +12398,7 @@ function generateId() {
   return `proj_${Date.now().toString(36)}_${Math.random().toString(36).slice(2, 9)}`;
 }
 var ProviderConfigSchema = z.object({
-  type: z.enum(["anthropic", "openai", "gemini", "kimi"]).default("anthropic"),
+  type: z.enum(["anthropic", "openai", "gemini", "kimi", "lmstudio", "ollama"]).default("anthropic"),
   apiKey: z.string().optional(),
   model: z.string().default("claude-sonnet-4-20250514"),
   maxTokens: z.number().min(1).max(2e5).default(8192),
@@ -12351,6 +12486,22 @@ var ToolsConfigSchema = z.object({
     threshold: z.number().min(0).max(1).default(0.3)
   }).optional()
 });
+var ShipConfigSchema = z.object({
+  /** Default base branch for PRs */
+  defaultBaseBranch: z.string().default("main"),
+  /** Auto-detect version bump from commit history */
+  autoDetectBump: z.boolean().default(true),
+  /** Use squash merge for PRs */
+  squashMerge: z.boolean().default(true),
+  /** Delete feature branch after merge */
+  deleteBranchAfterMerge: z.boolean().default(true),
+  /** Create PRs as draft by default */
+  draftPr: z.boolean().default(false),
+  /** CI check timeout in ms (default 10 minutes) */
+  ciCheckTimeoutMs: z.number().default(6e5),
+  /** CI check poll interval in ms (default 15 seconds) */
+  ciCheckPollMs: z.number().default(15e3)
+});
 var CocoConfigSchema = z.object({
   project: ProjectConfigSchema,
   provider: ProviderConfigSchema.default({
@@ -12377,7 +12528,8 @@ var CocoConfigSchema = z.object({
   stack: StackConfigSchema.optional(),
   integrations: IntegrationsConfigSchema.optional(),
   mcp: MCPConfigSchema.optional(),
-  tools: ToolsConfigSchema.optional()
+  tools: ToolsConfigSchema.optional(),
+  ship: ShipConfigSchema.optional()
 });
 function createDefaultConfigObject(projectName, language = "typescript") {
   return {
@@ -12540,24 +12692,7 @@ z.string().regex(
   /^\d+\.\d+\.\d+$/,
   "Version must be in semver format (e.g., 1.0.0)"
 );
-
-// src/tools/allowed-paths.ts
-init_paths();
-path14__default.join(CONFIG_PATHS.home, "allowed-paths.json");
-var sessionAllowedPaths = [];
-function isWithinAllowedPath(absolutePath, operation) {
-  const normalizedTarget = path14__default.normalize(absolutePath);
-  for (const entry of sessionAllowedPaths) {
-    const normalizedAllowed = path14__default.normalize(entry.path);
-    if (normalizedTarget === normalizedAllowed || normalizedTarget.startsWith(normalizedAllowed + path14__default.sep)) {
-      if (operation === "read") return true;
-      if (entry.level === "write") return true;
-    }
-  }
-  return false;
-}
-
-// src/tools/file.ts
+init_allowed_paths();
 var SENSITIVE_PATTERNS = [
   /\.env(?:\.\w+)?$/,
   // .env, .env.local, etc.
@@ -13421,7 +13556,8 @@ function truncateOutput(output, maxLength = 5e4) {
 [Output truncated - ${output.length - maxLength} more characters]`;
 }
 function getGit(cwd) {
-  return simpleGit(cwd ?? process.cwd());
+  const baseDir = cwd ?? process.cwd();
+  return simpleGit({ baseDir });
 }
 var gitStatusTool = defineTool({
   name: "git_status",
@@ -13782,9 +13918,11 @@ var gitTools = [
   gitInitTool
 ];
 function generateSimpleCommitMessage() {
+  const cwd = process.cwd();
   try {
     const diff = execSync("git diff --cached --name-only", {
       encoding: "utf-8",
+      cwd,
       stdio: ["pipe", "pipe", "ignore"]
     });
     const files = diff.trim().split("\n").filter(Boolean);
@@ -13820,6 +13958,7 @@ var checkProtectedBranchTool = defineTool({
     try {
       const branch = execSync("git rev-parse --abbrev-ref HEAD", {
         encoding: "utf-8",
+        cwd: process.cwd(),
         stdio: ["pipe", "pipe", "ignore"]
       }).trim();
       const protected_branches = ["main", "master", "develop", "production"];
@@ -13855,7 +13994,7 @@ var simpleAutoCommitTool = defineTool({
   async execute(input) {
     try {
       try {
-        execSync("git diff --cached --quiet", { stdio: "ignore" });
+        execSync("git diff --cached --quiet", { cwd: process.cwd(), stdio: "ignore" });
         return {
           stdout: "",
           stderr: "No staged changes to commit",
@@ -13867,6 +14006,7 @@ var simpleAutoCommitTool = defineTool({
       const message = input.message || generateSimpleCommitMessage();
       execSync(`git commit -m "${message}"`, {
         encoding: "utf-8",
+        cwd: process.cwd(),
         stdio: "pipe"
       });
       return {
@@ -16468,9 +16608,17 @@ Examples:
   }
 });
 var diffTools = [showDiffTool];
-async function fileExists(path32) {
+async function fileExists(filePath) {
   try {
-    await access(path32);
+    await fs14__default.access(filePath);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function fileExists2(path37) {
+  try {
+    await access(path37);
     return true;
   } catch {
     return false;
@@ -16485,7 +16633,7 @@ async function dirHasFiles(dir) {
   }
 }
 async function detectMaturity(cwd) {
-  const hasPackageJson = await fileExists(join(cwd, "package.json"));
+  const hasPackageJson = await fileExists2(join(cwd, "package.json"));
   if (!hasPackageJson) {
     const otherManifests = [
       "go.mod",
@@ -16498,7 +16646,7 @@ async function detectMaturity(cwd) {
     ];
     let hasAnyManifest = false;
     for (const m of otherManifests) {
-      if (await fileExists(join(cwd, m))) {
+      if (await fileExists2(join(cwd, m))) {
         hasAnyManifest = true;
         break;
       }
@@ -16539,7 +16687,7 @@ async function detectMaturity(cwd) {
     cwd,
     ignore: ["node_modules/**", "dist/**", "build/**"]
   });
-  const hasCI = await fileExists(join(cwd, ".github/workflows")) && await dirHasFiles(join(cwd, ".github/workflows"));
+  const hasCI = await fileExists2(join(cwd, ".github/workflows")) && await dirHasFiles(join(cwd, ".github/workflows"));
   const lintConfigs = [
     ".eslintrc.js",
     ".eslintrc.json",
@@ -16552,7 +16700,7 @@ async function detectMaturity(cwd) {
   ];
   let hasLintConfig = false;
   for (const config of lintConfigs) {
-    if (await fileExists(join(cwd, config))) {
+    if (await fileExists2(join(cwd, config))) {
       hasLintConfig = true;
       break;
     }
@@ -16560,7 +16708,7 @@ async function detectMaturity(cwd) {
   if (!hasLintConfig && hasPackageJson) {
     try {
       const pkgRaw = await import('fs/promises').then(
-        (fs33) => fs33.readFile(join(cwd, "package.json"), "utf-8")
+        (fs36) => fs36.readFile(join(cwd, "package.json"), "utf-8")
       );
       const pkg = JSON.parse(pkgRaw);
       if (pkg.scripts?.lint || pkg.scripts?.["lint:fix"]) {
@@ -16605,7 +16753,8 @@ var SECURITY_PATTERNS2 = [
     regex: /console\.(log|debug|info)\(/,
     severity: "minor",
     category: "best-practice",
-    message: "Remove console.log \u2014 use structured logging instead"
+    message: "Remove console.log \u2014 use structured logging instead",
+    excludePaths: /\/(cli|repl|bin|scripts)\//
   }
 ];
 var CORRECTNESS_PATTERNS = [
@@ -16685,6 +16834,7 @@ function analyzePatterns(diff) {
       for (const line of hunk.lines) {
         if (line.type !== "add") continue;
         for (const pattern of ALL_PATTERNS) {
+          if (pattern.excludePaths?.test(file.path)) continue;
           if (pattern.regex.test(line.content)) {
             findings.push({
               file: file.path,
@@ -16701,7 +16851,8 @@ function analyzePatterns(diff) {
   }
   return findings;
 }
-function checkTestCoverage(diff) {
+var TEST_COVERAGE_LARGE_CHANGE_THRESHOLD = 15;
+async function checkTestCoverage(diff, cwd) {
   const findings = [];
   const changedSrc = [];
   const changedTests = /* @__PURE__ */ new Set();
@@ -16711,22 +16862,35 @@ function checkTestCoverage(diff) {
       changedTests.add(file.path);
     } else if (/\.(ts|tsx|js|jsx)$/.test(file.path)) {
       if (file.additions > 5) {
-        changedSrc.push(file.path);
+        changedSrc.push({ path: file.path, additions: file.additions });
       }
     }
   }
   for (const src of changedSrc) {
-    const baseName = src.replace(/\.(ts|tsx|js|jsx)$/, "");
+    const baseName = src.path.replace(/\.(ts|tsx|js|jsx)$/, "");
     const hasTestChange = [...changedTests].some(
       (t) => t.includes(baseName.split("/").pop()) || t.startsWith(baseName)
     );
     if (!hasTestChange) {
-      findings.push({
-        file: src,
-        severity: "minor",
-        category: "testing",
-        message: "Logic changes without corresponding test updates"
-      });
+      const ext = src.path.match(/\.(ts|tsx|js|jsx)$/)?.[0] ?? ".ts";
+      const testExists = await fileExists(path14__default.join(cwd, `${baseName}.test${ext}`)) || await fileExists(path14__default.join(cwd, `${baseName}.spec${ext}`));
+      if (testExists) {
+        if (src.additions >= TEST_COVERAGE_LARGE_CHANGE_THRESHOLD) {
+          findings.push({
+            file: src.path,
+            severity: "info",
+            category: "testing",
+            message: "Test file exists but was not updated \u2014 verify existing tests cover these changes"
+          });
+        }
+      } else {
+        findings.push({
+          file: src.path,
+          severity: "minor",
+          category: "testing",
+          message: "Logic changes without corresponding test updates"
+        });
+      }
     }
   }
   return findings;
@@ -16876,7 +17040,7 @@ Examples:
       const maturity = maturityInfo.level;
       let allFindings = [];
       allFindings.push(...analyzePatterns(diff));
-      allFindings.push(...checkTestCoverage(diff));
+      allFindings.push(...await checkTestCoverage(diff, projectDir));
       allFindings.push(...checkDocumentation(diff));
       if (runLinter) {
         try {
@@ -16927,8 +17091,8 @@ Examples:
   }
 });
 var reviewTools = [reviewCodeTool];
-var fs22 = await import('fs/promises');
-var path22 = await import('path');
+var fs23 = await import('fs/promises');
+var path24 = await import('path');
 var { glob: glob12 } = await import('glob');
 var DEFAULT_MAX_FILES = 200;
 var LANGUAGE_EXTENSIONS = {
@@ -16954,7 +17118,7 @@ var DEFAULT_EXCLUDES = [
   "**/*.d.ts"
 ];
 function detectLanguage2(filePath) {
-  const ext = path22.extname(filePath).toLowerCase();
+  const ext = path24.extname(filePath).toLowerCase();
   for (const [lang, extensions] of Object.entries(LANGUAGE_EXTENSIONS)) {
     if (extensions.includes(ext)) return lang;
   }
@@ -17363,9 +17527,9 @@ Examples:
   }),
   async execute({ path: rootPath, include, exclude, languages, maxFiles, depth }) {
     const startTime = performance.now();
-    const absPath = path22.resolve(rootPath);
+    const absPath = path24.resolve(rootPath);
     try {
-      const stat2 = await fs22.stat(absPath);
+      const stat2 = await fs23.stat(absPath);
       if (!stat2.isDirectory()) {
         throw new ToolError(`Path is not a directory: ${absPath}`, {
           tool: "codebase_map"
@@ -17402,14 +17566,14 @@ Examples:
     let totalDefinitions = 0;
     let exportedSymbols = 0;
     for (const file of limitedFiles) {
-      const fullPath = path22.join(absPath, file);
+      const fullPath = path24.join(absPath, file);
       const language = detectLanguage2(file);
       if (!language) continue;
       if (languages && !languages.includes(language)) {
         continue;
       }
       try {
-        const content = await fs22.readFile(fullPath, "utf-8");
+        const content = await fs23.readFile(fullPath, "utf-8");
         const lineCount = content.split("\n").length;
         const parsed = parseFile(content, language);
         const definitions = depth === "overview" ? parsed.definitions.filter((d) => d.exported) : parsed.definitions;
@@ -17442,23 +17606,23 @@ Examples:
 });
 var codebaseMapTools = [codebaseMapTool];
 init_paths();
-var fs23 = await import('fs/promises');
-var path23 = await import('path');
-var crypto2 = await import('crypto');
-var GLOBAL_MEMORIES_DIR = path23.join(COCO_HOME, "memories");
+var fs24 = await import('fs/promises');
+var path25 = await import('path');
+var crypto3 = await import('crypto');
+var GLOBAL_MEMORIES_DIR = path25.join(COCO_HOME, "memories");
 var PROJECT_MEMORIES_DIR = ".coco/memories";
 var DEFAULT_MAX_MEMORIES = 1e3;
 async function ensureDir(dirPath) {
-  await fs23.mkdir(dirPath, { recursive: true });
+  await fs24.mkdir(dirPath, { recursive: true });
 }
 function getMemoriesDir(scope) {
   return scope === "global" ? GLOBAL_MEMORIES_DIR : PROJECT_MEMORIES_DIR;
 }
 async function loadIndex(scope) {
   const dir = getMemoriesDir(scope);
-  const indexPath = path23.join(dir, "index.json");
+  const indexPath = path25.join(dir, "index.json");
   try {
-    const content = await fs23.readFile(indexPath, "utf-8");
+    const content = await fs24.readFile(indexPath, "utf-8");
     return JSON.parse(content);
   } catch {
     return [];
@@ -17467,14 +17631,14 @@ async function loadIndex(scope) {
 async function saveIndex(scope, index) {
   const dir = getMemoriesDir(scope);
   await ensureDir(dir);
-  const indexPath = path23.join(dir, "index.json");
-  await fs23.writeFile(indexPath, JSON.stringify(index, null, 2), "utf-8");
+  const indexPath = path25.join(dir, "index.json");
+  await fs24.writeFile(indexPath, JSON.stringify(index, null, 2), "utf-8");
 }
 async function loadMemory(scope, id) {
   const dir = getMemoriesDir(scope);
-  const memPath = path23.join(dir, `${id}.json`);
+  const memPath = path25.join(dir, `${id}.json`);
   try {
-    const content = await fs23.readFile(memPath, "utf-8");
+    const content = await fs24.readFile(memPath, "utf-8");
     return JSON.parse(content);
   } catch {
     return null;
@@ -17483,8 +17647,8 @@ async function loadMemory(scope, id) {
 async function saveMemory(scope, memory) {
   const dir = getMemoriesDir(scope);
   await ensureDir(dir);
-  const memPath = path23.join(dir, `${memory.id}.json`);
-  await fs23.writeFile(memPath, JSON.stringify(memory, null, 2), "utf-8");
+  const memPath = path25.join(dir, `${memory.id}.json`);
+  await fs24.writeFile(memPath, JSON.stringify(memory, null, 2), "utf-8");
 }
 var createMemoryTool = defineTool({
   name: "create_memory",
@@ -17526,7 +17690,7 @@ Examples:
         { tool: "create_memory" }
       );
     }
-    const id = crypto2.randomUUID();
+    const id = crypto3.randomUUID();
     const memory = {
       id,
       key,
@@ -17636,17 +17800,17 @@ Examples:
   }
 });
 var memoryTools = [createMemoryTool, recallMemoryTool, listMemoriesTool];
-var fs24 = await import('fs/promises');
-var crypto3 = await import('crypto');
+var fs25 = await import('fs/promises');
+var crypto4 = await import('crypto');
 var CHECKPOINT_FILE = ".coco/checkpoints.json";
 var DEFAULT_MAX_CHECKPOINTS = 50;
 var STASH_PREFIX = "coco-cp";
 async function ensureCocoDir() {
-  await fs24.mkdir(".coco", { recursive: true });
+  await fs25.mkdir(".coco", { recursive: true });
 }
 async function loadCheckpoints() {
   try {
-    const content = await fs24.readFile(CHECKPOINT_FILE, "utf-8");
+    const content = await fs25.readFile(CHECKPOINT_FILE, "utf-8");
     return JSON.parse(content);
   } catch {
     return [];
@@ -17654,7 +17818,7 @@ async function loadCheckpoints() {
 }
 async function saveCheckpoints(checkpoints) {
   await ensureCocoDir();
-  await fs24.writeFile(CHECKPOINT_FILE, JSON.stringify(checkpoints, null, 2), "utf-8");
+  await fs25.writeFile(CHECKPOINT_FILE, JSON.stringify(checkpoints, null, 2), "utf-8");
 }
 async function execGit(args) {
   const { execaCommand } = await import('execa');
@@ -17692,7 +17856,7 @@ Examples:
     description: z.string().min(1).max(200).describe("Description of this checkpoint")
   }),
   async execute({ description }) {
-    const id = crypto3.randomUUID().slice(0, 8);
+    const id = crypto4.randomUUID().slice(0, 8);
     const timestamp = (/* @__PURE__ */ new Date()).toISOString();
     const stashMessage = `${STASH_PREFIX}-${id}-${description.replace(/\s+/g, "-").slice(0, 50)}`;
     const changedFiles = await getChangedFiles();
@@ -17814,8 +17978,8 @@ Examples:
   }
 });
 var checkpointTools = [createCheckpointTool, restoreCheckpointTool, listCheckpointsTool];
-var fs25 = await import('fs/promises');
-var path24 = await import('path');
+var fs26 = await import('fs/promises');
+var path26 = await import('path');
 var { glob: glob13 } = await import('glob');
 var INDEX_DIR = ".coco/search-index";
 var DEFAULT_CHUNK_SIZE = 20;
@@ -17941,20 +18105,20 @@ async function getEmbedding(text) {
 }
 async function loadIndex2(indexDir) {
   try {
-    const indexPath = path24.join(indexDir, "index.json");
-    const content = await fs25.readFile(indexPath, "utf-8");
+    const indexPath = path26.join(indexDir, "index.json");
+    const content = await fs26.readFile(indexPath, "utf-8");
     return JSON.parse(content);
   } catch {
     return null;
   }
 }
 async function saveIndex2(indexDir, index) {
-  await fs25.mkdir(indexDir, { recursive: true });
-  const indexPath = path24.join(indexDir, "index.json");
-  await fs25.writeFile(indexPath, JSON.stringify(index), "utf-8");
+  await fs26.mkdir(indexDir, { recursive: true });
+  const indexPath = path26.join(indexDir, "index.json");
+  await fs26.writeFile(indexPath, JSON.stringify(index), "utf-8");
 }
 function isBinary(filePath) {
-  return BINARY_EXTENSIONS.has(path24.extname(filePath).toLowerCase());
+  return BINARY_EXTENSIONS.has(path26.extname(filePath).toLowerCase());
 }
 var semanticSearchTool = defineTool({
   name: "semantic_search",
@@ -17979,8 +18143,8 @@ Examples:
     const effectivePath = rootPath ?? ".";
     const effectiveMaxResults = maxResults ?? 10;
     const effectiveThreshold = threshold ?? 0.3;
-    const absPath = path24.resolve(effectivePath);
-    const indexDir = path24.join(absPath, INDEX_DIR);
+    const absPath = path26.resolve(effectivePath);
+    const indexDir = path26.join(absPath, INDEX_DIR);
     let index = reindex ? null : await loadIndex2(indexDir);
     if (!index) {
       const pattern = include ?? "**/*";
@@ -17993,10 +18157,10 @@ Examples:
       const chunks = [];
       for (const file of files) {
         if (isBinary(file)) continue;
-        const fullPath = path24.join(absPath, file);
+        const fullPath = path26.join(absPath, file);
         try {
-          const stat2 = await fs25.stat(fullPath);
-          const content = await fs25.readFile(fullPath, "utf-8");
+          const stat2 = await fs26.stat(fullPath);
+          const content = await fs26.readFile(fullPath, "utf-8");
           if (content.length > 1e5) continue;
           const fileChunks = chunkContent(content, DEFAULT_CHUNK_SIZE);
           for (const chunk of fileChunks) {
@@ -18055,8 +18219,8 @@ Examples:
   }
 });
 var semanticSearchTools = [semanticSearchTool];
-var fs26 = await import('fs/promises');
-var path25 = await import('path');
+var fs27 = await import('fs/promises');
+var path27 = await import('path');
 var { glob: glob14 } = await import('glob');
 async function parseClassRelationships(rootPath, include) {
   const pattern = include ?? "**/*.{ts,tsx,js,jsx}";
@@ -18069,7 +18233,7 @@ async function parseClassRelationships(rootPath, include) {
   const interfaces = [];
   for (const file of files.slice(0, 100)) {
     try {
-      const content = await fs26.readFile(path25.join(rootPath, file), "utf-8");
+      const content = await fs27.readFile(path27.join(rootPath, file), "utf-8");
       const lines = content.split("\n");
       for (let i = 0; i < lines.length; i++) {
         const line = lines[i];
@@ -18188,14 +18352,14 @@ async function generateClassDiagram(rootPath, include) {
   };
 }
 async function generateArchitectureDiagram(rootPath) {
-  const entries = await fs26.readdir(rootPath, { withFileTypes: true });
+  const entries = await fs27.readdir(rootPath, { withFileTypes: true });
   const dirs = entries.filter(
     (e) => e.isDirectory() && !e.name.startsWith(".") && !["node_modules", "dist", "build", "coverage", "__pycache__", "target"].includes(e.name)
   );
   const lines = ["graph TD"];
   let nodeCount = 0;
   let edgeCount = 0;
-  const rootName = path25.basename(rootPath);
+  const rootName = path27.basename(rootPath);
   lines.push(`  ROOT["${rootName}"]`);
   nodeCount++;
   for (const dir of dirs) {
@@ -18205,7 +18369,7 @@ async function generateArchitectureDiagram(rootPath) {
     nodeCount++;
     edgeCount++;
     try {
-      const subEntries = await fs26.readdir(path25.join(rootPath, dir.name), {
+      const subEntries = await fs27.readdir(path27.join(rootPath, dir.name), {
         withFileTypes: true
       });
       const subDirs = subEntries.filter(
@@ -18328,7 +18492,7 @@ Examples:
         tool: "generate_diagram"
       });
     }
-    const absPath = rootPath ? path25.resolve(rootPath) : process.cwd();
+    const absPath = rootPath ? path27.resolve(rootPath) : process.cwd();
     switch (type) {
       case "class":
         return generateClassDiagram(absPath, include);
@@ -18389,8 +18553,8 @@ Examples:
   }
 });
 var diagramTools = [generateDiagramTool];
-var fs27 = await import('fs/promises');
-var path26 = await import('path');
+var fs28 = await import('fs/promises');
+var path28 = await import('path');
 var DEFAULT_MAX_PAGES = 20;
 var MAX_FILE_SIZE = 50 * 1024 * 1024;
 function parsePageRange(rangeStr, totalPages) {
@@ -18425,9 +18589,9 @@ Examples:
   }),
   async execute({ path: filePath, pages, maxPages }) {
     const startTime = performance.now();
-    const absPath = path26.resolve(filePath);
+    const absPath = path28.resolve(filePath);
     try {
-      const stat2 = await fs27.stat(absPath);
+      const stat2 = await fs28.stat(absPath);
       if (!stat2.isFile()) {
         throw new ToolError(`Path is not a file: ${absPath}`, {
           tool: "read_pdf"
@@ -18458,7 +18622,7 @@ Examples:
     }
     try {
       const pdfParse = await import('pdf-parse');
-      const dataBuffer = await fs27.readFile(absPath);
+      const dataBuffer = await fs28.readFile(absPath);
       const pdfData = await pdfParse.default(dataBuffer, {
         max: maxPages
       });
@@ -18504,8 +18668,8 @@ Examples:
   }
 });
 var pdfTools = [readPdfTool];
-var fs28 = await import('fs/promises');
-var path27 = await import('path');
+var fs29 = await import('fs/promises');
+var path29 = await import('path');
 var SUPPORTED_FORMATS = /* @__PURE__ */ new Set([".png", ".jpg", ".jpeg", ".gif", ".webp", ".bmp"]);
 var MAX_IMAGE_SIZE = 20 * 1024 * 1024;
 var MIME_TYPES = {
@@ -18533,15 +18697,15 @@ Examples:
   async execute({ path: filePath, prompt, provider }) {
     const startTime = performance.now();
     const effectivePrompt = prompt ?? "Describe this image in detail. If it's code or a UI, identify the key elements.";
-    const absPath = path27.resolve(filePath);
+    const absPath = path29.resolve(filePath);
     const cwd = process.cwd();
-    if (!absPath.startsWith(cwd + path27.sep) && absPath !== cwd) {
+    if (!absPath.startsWith(cwd + path29.sep) && absPath !== cwd) {
       throw new ToolError(
         `Path traversal denied: '${filePath}' resolves outside the project directory`,
         { tool: "read_image" }
       );
     }
-    const ext = path27.extname(absPath).toLowerCase();
+    const ext = path29.extname(absPath).toLowerCase();
     if (!SUPPORTED_FORMATS.has(ext)) {
       throw new ToolError(
         `Unsupported image format '${ext}'. Supported: ${Array.from(SUPPORTED_FORMATS).join(", ")}`,
@@ -18549,7 +18713,7 @@ Examples:
       );
     }
     try {
-      const stat2 = await fs28.stat(absPath);
+      const stat2 = await fs29.stat(absPath);
       if (!stat2.isFile()) {
         throw new ToolError(`Path is not a file: ${absPath}`, {
           tool: "read_image"
@@ -18570,7 +18734,7 @@ Examples:
       if (error instanceof ToolError) throw error;
       throw error;
     }
-    const imageBuffer = await fs28.readFile(absPath);
+    const imageBuffer = await fs29.readFile(absPath);
     const base64 = imageBuffer.toString("base64");
     const mimeType = MIME_TYPES[ext] ?? "image/png";
     const selectedProvider = provider ?? "anthropic";
@@ -18683,7 +18847,7 @@ Examples:
   }
 });
 var imageTools = [readImageTool];
-var path28 = await import('path');
+var path30 = await import('path');
 var DANGEROUS_PATTERNS2 = [
   /\bDROP\s+(?:TABLE|DATABASE|INDEX|VIEW)\b/i,
   /\bTRUNCATE\b/i,
@@ -18714,7 +18878,7 @@ Examples:
   async execute({ database, query, params, readonly: isReadonlyParam }) {
     const isReadonly = isReadonlyParam ?? true;
     const startTime = performance.now();
-    const absPath = path28.resolve(database);
+    const absPath = path30.resolve(database);
     if (isReadonly && isDangerousSql(query)) {
       throw new ToolError(
         "Write operations (INSERT, UPDATE, DELETE, DROP, ALTER, TRUNCATE, CREATE) are blocked in readonly mode. Set readonly: false to allow writes.",
@@ -18787,7 +18951,7 @@ Examples:
   }),
   async execute({ database, table }) {
     const startTime = performance.now();
-    const absPath = path28.resolve(database);
+    const absPath = path30.resolve(database);
     try {
       const { default: Database } = await import('better-sqlite3');
       const db = new Database(absPath, { readonly: true, fileMustExist: true });
@@ -18840,14 +19004,14 @@ Examples:
   }
 });
 var databaseTools = [sqlQueryTool, inspectSchemaTool];
-var fs29 = await import('fs/promises');
-var path29 = await import('path');
+var fs30 = await import('fs/promises');
+var path31 = await import('path');
 var AnalyzeFileSchema = z.object({
   filePath: z.string().describe("Path to file to analyze"),
   includeAst: z.boolean().default(false).describe("Include AST in result")
 });
 async function analyzeFile(filePath, includeAst = false) {
-  const content = await fs29.readFile(filePath, "utf-8");
+  const content = await fs30.readFile(filePath, "utf-8");
   const lines = content.split("\n").length;
   const functions = [];
   const classes = [];
@@ -18951,10 +19115,10 @@ async function analyzeDirectory(dirPath) {
     try {
       const analysis = await analyzeFile(file, false);
       totalLines += analysis.lines;
-      const ext = path29.extname(file);
+      const ext = path31.extname(file);
       filesByType[ext] = (filesByType[ext] || 0) + 1;
       fileStats.push({
-        file: path29.relative(dirPath, file),
+        file: path31.relative(dirPath, file),
         lines: analysis.lines,
         complexity: analysis.complexity.cyclomatic
       });
@@ -19277,13 +19441,13 @@ ${completed.map((r) => `- ${r.agentId}: Success`).join("\n")}`;
   }
 });
 var agentCoordinatorTools = [createAgentPlanTool, delegateTaskTool, aggregateResultsTool];
-var fs30 = await import('fs/promises');
+var fs31 = await import('fs/promises');
 var SuggestImprovementsSchema = z.object({
   filePath: z.string().describe("File to analyze for improvement suggestions"),
   context: z.string().optional().describe("Additional context about the code")
 });
 async function analyzeAndSuggest(filePath, _context) {
-  const content = await fs30.readFile(filePath, "utf-8");
+  const content = await fs31.readFile(filePath, "utf-8");
   const lines = content.split("\n");
   const suggestions = [];
   for (let i = 0; i < lines.length; i++) {
@@ -19375,7 +19539,7 @@ async function analyzeAndSuggest(filePath, _context) {
     if (filePath.endsWith(".ts") && !filePath.includes("test") && !filePath.includes(".d.ts") && line.includes("export ")) {
       const testPath = filePath.replace(".ts", ".test.ts");
       try {
-        await fs30.access(testPath);
+        await fs31.access(testPath);
       } catch {
         suggestions.push({
           type: "testing",
@@ -19432,7 +19596,7 @@ var calculateCodeScoreTool = defineTool({
   async execute(input) {
     const { filePath } = input;
     const suggestions = await analyzeAndSuggest(filePath);
-    const content = await fs30.readFile(filePath, "utf-8");
+    const content = await fs31.readFile(filePath, "utf-8");
     const lines = content.split("\n");
     const nonEmptyLines = lines.filter((l) => l.trim()).length;
     let score = 100;
@@ -19466,8 +19630,8 @@ var calculateCodeScoreTool = defineTool({
   }
 });
 var smartSuggestionsTools = [suggestImprovementsTool, calculateCodeScoreTool];
-var fs31 = await import('fs/promises');
-var path30 = await import('path');
+var fs32 = await import('fs/promises');
+var path32 = await import('path');
 var ContextMemoryStore = class {
   items = /* @__PURE__ */ new Map();
   learnings = /* @__PURE__ */ new Map();
@@ -19479,7 +19643,7 @@ var ContextMemoryStore = class {
   }
   async load() {
     try {
-      const content = await fs31.readFile(this.storePath, "utf-8");
+      const content = await fs32.readFile(this.storePath, "utf-8");
       const data = JSON.parse(content);
       this.items = new Map(Object.entries(data.items || {}));
       this.learnings = new Map(Object.entries(data.learnings || {}));
@@ -19487,15 +19651,15 @@ var ContextMemoryStore = class {
     }
   }
   async save() {
-    const dir = path30.dirname(this.storePath);
-    await fs31.mkdir(dir, { recursive: true });
+    const dir = path32.dirname(this.storePath);
+    await fs32.mkdir(dir, { recursive: true });
     const data = {
       sessionId: this.sessionId,
       items: Object.fromEntries(this.items),
       learnings: Object.fromEntries(this.learnings),
       savedAt: Date.now()
     };
-    await fs31.writeFile(this.storePath, JSON.stringify(data, null, 2));
+    await fs32.writeFile(this.storePath, JSON.stringify(data, null, 2));
   }
   addContext(id, item) {
     this.items.set(id, item);
@@ -19645,11 +19809,11 @@ var getLearnedPatternsTool = defineTool({
     const patterns = store.getFrequentPatterns(typedInput.limit);
     return {
       totalPatterns: patterns.length,
-      patterns: patterns.map((p3) => ({
-        pattern: p3.pattern,
-        preference: p3.userPreference,
-        frequency: p3.frequency,
-        lastUsed: new Date(p3.lastUsed).toISOString()
+      patterns: patterns.map((p4) => ({
+        pattern: p4.pattern,
+        preference: p4.userPreference,
+        frequency: p4.frequency,
+        lastUsed: new Date(p4.lastUsed).toISOString()
       }))
     };
   }
@@ -19660,11 +19824,11 @@ var contextEnhancerTools = [
   recordLearningTool,
   getLearnedPatternsTool
 ];
-var fs32 = await import('fs/promises');
-var path31 = await import('path');
+var fs33 = await import('fs/promises');
+var path33 = await import('path');
 async function discoverSkills(skillsDir) {
   try {
-    const files = await fs32.readdir(skillsDir);
+    const files = await fs33.readdir(skillsDir);
     return files.filter((f) => f.endsWith(".ts") || f.endsWith(".js"));
   } catch {
     return [];
@@ -19672,12 +19836,12 @@ async function discoverSkills(skillsDir) {
 }
 async function loadSkillMetadata(skillPath) {
   try {
-    const content = await fs32.readFile(skillPath, "utf-8");
+    const content = await fs33.readFile(skillPath, "utf-8");
     const nameMatch = content.match(/@name\s+(\S+)/);
     const descMatch = content.match(/@description\s+(.+)/);
     const versionMatch = content.match(/@version\s+(\S+)/);
     return {
-      name: nameMatch?.[1] || path31.basename(skillPath, path31.extname(skillPath)),
+      name: nameMatch?.[1] || path33.basename(skillPath, path33.extname(skillPath)),
       description: descMatch?.[1] || "No description",
       version: versionMatch?.[1] || "1.0.0",
       dependencies: []
@@ -19721,7 +19885,7 @@ var discoverSkillsTool = defineTool({
     const { skillsDir } = input;
     const skills = await discoverSkills(skillsDir);
     const metadata = await Promise.all(
-      skills.map((s) => loadSkillMetadata(path31.join(skillsDir, s)))
+      skills.map((s) => loadSkillMetadata(path33.join(skillsDir, s)))
     );
     return {
       skillsDir,
@@ -19844,14 +20008,17 @@ export const ${typedInput.name}Tool = defineTool({
   }
 });
 var skillEnhancerTools = [discoverSkillsTool, validateSkillTool, createCustomToolTool];
+function gitExec(cmd, opts = {}) {
+  return execSync(cmd, { encoding: "utf-8", cwd: process.cwd(), ...opts });
+}
 function analyzeRepoHealth() {
   const issues = [];
   const recommendations = [];
   let score = 100;
   try {
     try {
-      execSync("git status --porcelain", { stdio: "pipe" });
-      const status = execSync("git status --porcelain", { encoding: "utf-8" });
+      gitExec("git status --porcelain", { stdio: "pipe" });
+      const status = gitExec("git status --porcelain");
       if (status.trim()) {
         issues.push("Uncommitted changes present");
         score -= 10;
@@ -19859,7 +20026,7 @@ function analyzeRepoHealth() {
     } catch {
     }
     try {
-      const untracked = execSync("git ls-files --others --exclude-standard", { encoding: "utf-8" });
+      const untracked = gitExec("git ls-files --others --exclude-standard");
       if (untracked.trim()) {
         const count = untracked.trim().split("\n").length;
         issues.push(`${count} untracked files`);
@@ -19869,9 +20036,9 @@ function analyzeRepoHealth() {
     } catch {
     }
     try {
-      const branch = execSync("git rev-parse --abbrev-ref HEAD", { encoding: "utf-8" }).trim();
-      const local = execSync("git rev-parse HEAD", { encoding: "utf-8" }).trim();
-      const remote = execSync(`git rev-parse origin/${branch}`, { encoding: "utf-8" }).trim();
+      const branch = gitExec("git rev-parse --abbrev-ref HEAD").trim();
+      const local = gitExec("git rev-parse HEAD").trim();
+      const remote = gitExec(`git rev-parse origin/${branch}`).trim();
       if (local !== remote) {
         issues.push("Branch is not up-to-date with remote");
         score -= 15;
@@ -19880,14 +20047,14 @@ function analyzeRepoHealth() {
     } catch {
     }
     try {
-      const files = execSync("git ls-files", { encoding: "utf-8" }).trim().split("\n");
+      const files = gitExec("git ls-files").trim().split("\n");
       if (files.length > 1e3) {
         recommendations.push("Repository has many files, consider using .gitignore");
       }
     } catch {
     }
     try {
-      const conflicts = execSync("git diff --name-only --diff-filter=U", { encoding: "utf-8" });
+      const conflicts = gitExec("git diff --name-only --diff-filter=U");
       if (conflicts.trim()) {
         issues.push("Merge conflicts present");
         score -= 30;
@@ -19903,12 +20070,11 @@ function analyzeRepoHealth() {
 }
 function getCommitStats() {
   try {
-    const count = execSync("git rev-list --count HEAD", { encoding: "utf-8" }).trim();
-    const authors = execSync('git log --format="%an" | sort -u', {
-      encoding: "utf-8",
+    const count = gitExec("git rev-list --count HEAD").trim();
+    const authors = gitExec('git log --format="%an" | sort -u', {
       shell: "/bin/bash"
     }).trim().split("\n");
-    const lastCommit = execSync('git log -1 --format="%cr"', { encoding: "utf-8" }).trim();
+    const lastCommit = gitExec('git log -1 --format="%cr"').trim();
     return {
       totalCommits: parseInt(count, 10),
       authors,
@@ -19981,7 +20147,7 @@ var recommendBranchTool = defineTool({
     const branchName = `${prefix}/${slug}`;
     let exists = false;
     try {
-      execSync(`git rev-parse --verify ${branchName}`, { stdio: "ignore" });
+      execSync(`git rev-parse --verify ${branchName}`, { cwd: process.cwd(), stdio: "ignore" });
       exists = true;
     } catch {
       exists = false;
@@ -19996,6 +20162,449 @@ var recommendBranchTool = defineTool({
   }
 });
 var gitEnhancedTools = [analyzeRepoHealthTool, getCommitStatsTool, recommendBranchTool];
+async function ghExec(args, cwd) {
+  try {
+    const result = await execa("gh", args, {
+      cwd: cwd ?? process.cwd(),
+      timeout: 6e4
+    });
+    return { stdout: result.stdout, stderr: result.stderr };
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    throw new ToolError(`gh command failed: ${message}`, {
+      tool: "github",
+      cause: error instanceof Error ? error : void 0
+    });
+  }
+}
+var ghCheckAuthTool = defineTool({
+  name: "gh_check_auth",
+  description: "Check if the GitHub CLI is installed and authenticated.",
+  category: "git",
+  parameters: z.object({
+    cwd: z.string().optional()
+  }),
+  async execute({ cwd }) {
+    try {
+      const { stdout } = await ghExec(["auth", "status"], cwd);
+      const userMatch = stdout.match(/Logged in to .+ as (\S+)/);
+      return {
+        authenticated: true,
+        user: userMatch?.[1]
+      };
+    } catch {
+      return { authenticated: false, error: "gh CLI not authenticated. Run: gh auth login" };
+    }
+  }
+});
+var ghRepoInfoTool = defineTool({
+  name: "gh_repo_info",
+  description: "Get GitHub repository information (name, default branch, URL).",
+  category: "git",
+  parameters: z.object({
+    cwd: z.string().optional()
+  }),
+  async execute({ cwd }) {
+    const { stdout } = await ghExec(
+      ["repo", "view", "--json", "name,nameWithOwner,defaultBranchRef,url,isPrivate"],
+      cwd
+    );
+    const data = JSON.parse(stdout);
+    return {
+      name: data.name,
+      fullName: data.nameWithOwner,
+      defaultBranch: data.defaultBranchRef.name,
+      url: data.url,
+      private: data.isPrivate
+    };
+  }
+});
+var ghPrCreateTool = defineTool({
+  name: "gh_pr_create",
+  description: "Create a GitHub pull request.",
+  category: "git",
+  parameters: z.object({
+    title: z.string().describe("PR title"),
+    body: z.string().describe("PR body (markdown)"),
+    base: z.string().optional().describe("Base branch (default: repo default)"),
+    draft: z.boolean().optional().default(false),
+    cwd: z.string().optional()
+  }),
+  async execute({ title, body, base, draft, cwd }) {
+    const args = ["pr", "create", "--title", title, "--body", body];
+    if (base) args.push("--base", base);
+    if (draft) args.push("--draft");
+    const { stdout } = await ghExec(args, cwd);
+    const url = stdout.trim();
+    const numberMatch = url.match(/\/pull\/(\d+)/);
+    return {
+      number: numberMatch ? parseInt(numberMatch[1], 10) : 0,
+      url
+    };
+  }
+});
+var ghPrMergeTool = defineTool({
+  name: "gh_pr_merge",
+  description: "Merge a GitHub pull request.",
+  category: "git",
+  parameters: z.object({
+    number: z.number().describe("PR number"),
+    method: z.enum(["squash", "merge", "rebase"]).optional().default("squash"),
+    deleteBranch: z.boolean().optional().default(true),
+    subject: z.string().optional().describe("Merge commit subject line"),
+    body: z.string().optional().describe("Merge commit body"),
+    cwd: z.string().optional()
+  }),
+  async execute({ number, method, deleteBranch, subject, body, cwd }) {
+    const args = ["pr", "merge", String(number), `--${method}`];
+    if (deleteBranch) args.push("--delete-branch");
+    if (subject) args.push("--subject", subject);
+    if (body) args.push("--body", body);
+    await ghExec(args, cwd);
+    return { merged: true, method };
+  }
+});
+var ghPrChecksTool = defineTool({
+  name: "gh_pr_checks",
+  description: "Get CI check statuses for a pull request.",
+  category: "git",
+  parameters: z.object({
+    number: z.number().describe("PR number"),
+    cwd: z.string().optional()
+  }),
+  async execute({ number, cwd }) {
+    const { stdout } = await ghExec(
+      ["pr", "checks", String(number), "--json", "name,state,conclusion,detailsUrl"],
+      cwd
+    );
+    const raw = JSON.parse(stdout);
+    const checks = raw.map((c) => {
+      let status = "pending";
+      if (c.state === "SUCCESS" || c.conclusion === "SUCCESS") status = "pass";
+      else if (c.state === "FAILURE" || c.conclusion === "FAILURE") status = "fail";
+      else if (c.state === "SKIPPED" || c.conclusion === "SKIPPED") status = "skipping";
+      return {
+        name: c.name,
+        status,
+        conclusion: c.conclusion || c.state,
+        url: c.detailsUrl
+      };
+    });
+    return {
+      checks,
+      allPassed: checks.length > 0 && checks.every((c) => c.status === "pass" || c.status === "skipping"),
+      anyFailed: checks.some((c) => c.status === "fail"),
+      anyPending: checks.some((c) => c.status === "pending")
+    };
+  }
+});
+var ghPrListTool = defineTool({
+  name: "gh_pr_list",
+  description: "List pull requests, optionally filtered by head branch.",
+  category: "git",
+  parameters: z.object({
+    head: z.string().optional().describe("Filter by head branch name"),
+    state: z.string().optional().default("open"),
+    cwd: z.string().optional()
+  }),
+  async execute({ head, state, cwd }) {
+    const args = ["pr", "list", "--json", "number,title,url,state", "--state", state];
+    if (head) args.push("--head", head);
+    const { stdout } = await ghExec(args, cwd);
+    const raw = JSON.parse(stdout);
+    return { prs: raw };
+  }
+});
+var ghReleaseCreateTool = defineTool({
+  name: "gh_release_create",
+  description: "Create a GitHub release with notes.",
+  category: "git",
+  parameters: z.object({
+    tag: z.string().describe("Tag name (e.g., v1.2.3)"),
+    title: z.string().optional().describe("Release title"),
+    notes: z.string().optional().describe("Release notes (markdown)"),
+    draft: z.boolean().optional().default(false),
+    prerelease: z.boolean().optional().default(false),
+    cwd: z.string().optional()
+  }),
+  async execute({ tag, title, notes, draft, prerelease, cwd }) {
+    const args = ["release", "create", tag];
+    if (title) args.push("--title", title);
+    if (notes) args.push("--notes", notes);
+    if (draft) args.push("--draft");
+    if (prerelease) args.push("--prerelease");
+    const { stdout } = await ghExec(args, cwd);
+    return { url: stdout.trim(), tag };
+  }
+});
+var githubTools = [
+  ghCheckAuthTool,
+  ghRepoInfoTool,
+  ghPrCreateTool,
+  ghPrMergeTool,
+  ghPrChecksTool,
+  ghPrListTool,
+  ghReleaseCreateTool
+];
+var INTERPRETER_MAP = {
+  ".py": ["python3"],
+  ".sh": ["bash"],
+  ".bash": ["bash"],
+  ".zsh": ["zsh"],
+  ".js": ["node"],
+  ".ts": ["npx", "tsx"],
+  ".rb": ["ruby"],
+  ".pl": ["perl"],
+  ".lua": ["lua"],
+  ".php": ["php"]
+};
+var BLOCKED_PATHS2 = ["/etc", "/var", "/usr", "/root", "/sys", "/proc", "/boot", "/dev"];
+var BLOCKED_EXEC_PATTERNS = [
+  /\.env(?:\.\w+)?$/,
+  /\.pem$/,
+  /\.key$/,
+  /id_rsa/,
+  /credentials\.\w+$/i,
+  /secrets?\.\w+$/i
+];
+var DANGEROUS_ARG_PATTERNS = [
+  /\brm\s+-rf\s+\/(?!\w)/,
+  /\bsudo\s+rm/,
+  /\bdd\s+if=.*of=\/dev\//,
+  /`[^`]+`/,
+  /\$\([^)]+\)/,
+  /\beval\s+/,
+  /\bcurl\s+.*\|\s*(ba)?sh/
+];
+function getSystemOpenCommand() {
+  return process.platform === "darwin" ? "open" : "xdg-open";
+}
+function hasNullByte2(str) {
+  return str.includes("\0");
+}
+function isBlockedPath(absolute) {
+  for (const blocked of BLOCKED_PATHS2) {
+    const normalizedBlocked = path14__default.normalize(blocked);
+    if (absolute === normalizedBlocked || absolute.startsWith(normalizedBlocked + path14__default.sep)) {
+      return blocked;
+    }
+  }
+  return void 0;
+}
+function isBlockedExecFile(filePath) {
+  return BLOCKED_EXEC_PATTERNS.some((p4) => p4.test(filePath));
+}
+function hasDangerousArgs(args) {
+  const joined = args.join(" ");
+  return DANGEROUS_ARG_PATTERNS.some((p4) => p4.test(joined));
+}
+function getInterpreter(ext) {
+  return INTERPRETER_MAP[ext.toLowerCase()];
+}
+async function isExecutable(filePath) {
+  try {
+    await fs14__default.access(filePath, fs14__default.constants.X_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+var openFileTool = defineTool({
+  name: "open_file",
+  description: `Open a file with the system application or execute a script/binary.
+
+Mode "open" (default): Opens the file with the OS default application.
+- HTML files \u2192 browser
+- Images \u2192 image viewer
+- PDFs \u2192 PDF reader
+- Directories \u2192 file manager
+
+Mode "exec": Executes a script or binary.
+- .py \u2192 python3, .sh \u2192 bash, .js \u2192 node, .ts \u2192 npx tsx
+- .rb \u2192 ruby, .pl \u2192 perl, .lua \u2192 lua, .php \u2192 php
+- Binaries with +x permissions \u2192 direct execution
+
+Examples:
+- Open in browser: { "path": "docs/index.html" }
+- View image: { "path": "screenshot.png" }
+- Run script: { "path": "scripts/setup.sh", "mode": "exec" }
+- Run with args: { "path": "deploy.py", "mode": "exec", "args": ["--env", "staging"] }`,
+  category: "bash",
+  parameters: z.object({
+    path: z.string().describe("File path to open or execute"),
+    mode: z.enum(["open", "exec"]).optional().default("open").describe("open = system app, exec = run script"),
+    args: z.array(z.string()).optional().default([]).describe("Arguments for exec mode"),
+    cwd: z.string().optional().describe("Working directory"),
+    timeout: z.number().optional().describe("Timeout in ms for exec mode (default 120000)")
+  }),
+  async execute({ path: filePath, mode = "open", args = [], cwd, timeout }) {
+    const start = performance.now();
+    if (!filePath || hasNullByte2(filePath)) {
+      throw new ToolError("Invalid file path", { tool: "open_file" });
+    }
+    const workDir = cwd ?? process.cwd();
+    const absolute = path14__default.isAbsolute(filePath) ? path14__default.normalize(filePath) : path14__default.resolve(workDir, filePath);
+    const blockedBy = isBlockedPath(absolute);
+    if (blockedBy) {
+      throw new ToolError(`Access to system path '${blockedBy}' is not allowed`, {
+        tool: "open_file"
+      });
+    }
+    try {
+      await fs14__default.access(absolute);
+    } catch {
+      throw new ToolError(`File not found: ${absolute}`, { tool: "open_file" });
+    }
+    if (mode === "open") {
+      const cmd = getSystemOpenCommand();
+      await execa(cmd, [absolute], { timeout: 1e4 });
+      return {
+        action: "opened",
+        path: absolute,
+        resolvedCommand: cmd,
+        duration: performance.now() - start
+      };
+    }
+    if (isBlockedExecFile(absolute)) {
+      throw new ToolError(`Execution of sensitive file is blocked: ${path14__default.basename(absolute)}`, {
+        tool: "open_file"
+      });
+    }
+    if (args.length > 0 && hasDangerousArgs(args)) {
+      throw new ToolError("Arguments contain dangerous patterns", { tool: "open_file" });
+    }
+    const ext = path14__default.extname(absolute);
+    const interpreter = getInterpreter(ext);
+    const executable = await isExecutable(absolute);
+    let command;
+    let cmdArgs;
+    if (interpreter) {
+      command = interpreter[0];
+      cmdArgs = [...interpreter.slice(1), absolute, ...args];
+    } else if (executable) {
+      command = absolute;
+      cmdArgs = [...args];
+    } else {
+      throw new ToolError(
+        `Cannot execute '${path14__default.basename(absolute)}': no known interpreter for '${ext || "(no extension)"}' and file is not executable`,
+        { tool: "open_file" }
+      );
+    }
+    const result = await execa(command, cmdArgs, {
+      cwd: workDir,
+      timeout: timeout ?? 12e4,
+      reject: false
+    });
+    return {
+      action: "executed",
+      path: absolute,
+      resolvedCommand: interpreter ? interpreter.join(" ") : absolute,
+      stdout: result.stdout || void 0,
+      stderr: result.stderr || void 0,
+      exitCode: result.exitCode ?? 0,
+      duration: performance.now() - start
+    };
+  }
+});
+var openTools = [openFileTool];
+init_allowed_paths();
+var BLOCKED_SYSTEM_PATHS = [
+  "/etc",
+  "/var",
+  "/usr",
+  "/root",
+  "/sys",
+  "/proc",
+  "/boot",
+  "/bin",
+  "/sbin"
+];
+var authorizePathTool = defineTool({
+  name: "authorize_path",
+  description: `Request user permission to access a directory outside the project root.
+
+Use this BEFORE attempting file operations on external directories. The user will see
+an interactive prompt where they choose to allow or deny access.
+
+Returns whether the path was authorized. If authorized, subsequent file operations
+on that directory will succeed.
+
+Examples:
+- Need to read config from another project: authorize_path({ path: "/home/user/other-project" })
+- Need to access shared libraries: authorize_path({ path: "/opt/shared/libs", reason: "Read shared type definitions" })`,
+  category: "config",
+  parameters: z.object({
+    path: z.string().min(1).describe("Absolute path to the directory to authorize"),
+    reason: z.string().optional().describe("Why access is needed (shown to user for context)")
+  }),
+  async execute({ path: dirPath, reason }) {
+    const absolute = path14__default.resolve(dirPath);
+    if (isWithinAllowedPath(absolute, "read")) {
+      return {
+        authorized: true,
+        path: absolute,
+        message: "Path is already authorized."
+      };
+    }
+    for (const blocked of BLOCKED_SYSTEM_PATHS) {
+      const normalizedBlocked = path14__default.normalize(blocked);
+      if (absolute === normalizedBlocked || absolute.startsWith(normalizedBlocked + path14__default.sep)) {
+        return {
+          authorized: false,
+          path: absolute,
+          message: `System path '${blocked}' cannot be authorized for security reasons.`
+        };
+      }
+    }
+    const cwd = process.cwd();
+    if (absolute === path14__default.normalize(cwd) || absolute.startsWith(path14__default.normalize(cwd) + path14__default.sep)) {
+      return {
+        authorized: true,
+        path: absolute,
+        message: "Path is within the project directory \u2014 already accessible."
+      };
+    }
+    try {
+      const stat2 = await fs14__default.stat(absolute);
+      if (!stat2.isDirectory()) {
+        return {
+          authorized: false,
+          path: absolute,
+          message: `Not a directory: ${absolute}`
+        };
+      }
+    } catch {
+      return {
+        authorized: false,
+        path: absolute,
+        message: `Directory not found: ${absolute}`
+      };
+    }
+    const existing = getAllowedPaths();
+    if (existing.some((e) => path14__default.normalize(e.path) === path14__default.normalize(absolute))) {
+      return {
+        authorized: true,
+        path: absolute,
+        message: "Path is already authorized."
+      };
+    }
+    const { promptAllowPath: promptAllowPath2 } = await Promise.resolve().then(() => (init_allow_path_prompt(), allow_path_prompt_exports));
+    const wasAuthorized = await promptAllowPath2(absolute);
+    if (wasAuthorized) {
+      return {
+        authorized: true,
+        path: absolute,
+        message: `Access granted to ${absolute}.${reason ? ` Reason: ${reason}` : ""}`
+      };
+    }
+    return {
+      authorized: false,
+      path: absolute,
+      message: "User denied access to this directory."
+    };
+  }
+});
+var authorizePathTools = [authorizePathTool];
 
 // src/tools/index.ts
 function registerAllTools(registry) {
@@ -20028,7 +20637,10 @@ function registerAllTools(registry) {
     ...smartSuggestionsTools,
     ...contextEnhancerTools,
     ...skillEnhancerTools,
-    ...gitEnhancedTools
+    ...gitEnhancedTools,
+    ...githubTools,
+    ...openTools,
+    ...authorizePathTools
   ];
   for (const tool of allTools) {
     registry.register(tool);