@corbat-tech/coco 2.2.5 → 2.4.0

package/dist/cli/index.js

@@ -4001,8 +4001,10 @@ var init_pricing = __esm({
       deepseek: { inputPerMillion: 0.14, outputPerMillion: 0.28, contextWindow: 128e3 },
       // Very cheap
       together: { inputPerMillion: 0.2, outputPerMillion: 0.2, contextWindow: 32768 },
-      huggingface: { inputPerMillion: 0, outputPerMillion: 0, contextWindow: 32768 }
+      huggingface: { inputPerMillion: 0, outputPerMillion: 0, contextWindow: 32768 },
       // Free tier
+      qwen: { inputPerMillion: 0.3, outputPerMillion: 1.2, contextWindow: 131072 }
+      // qwen-coder-plus pricing
     };
   }
 });
@@ -4496,6 +4498,8 @@ function getApiKey(provider) {
       return process.env["TOGETHER_API_KEY"];
     case "huggingface":
       return process.env["HF_TOKEN"] ?? process.env["HUGGINGFACE_API_KEY"];
+    case "qwen":
+      return process.env["DASHSCOPE_API_KEY"] ?? process.env["QWEN_API_KEY"];
     default:
       return void 0;
   }
@@ -4528,6 +4532,8 @@ function getBaseUrl(provider) {
       return process.env["TOGETHER_BASE_URL"] ?? "https://api.together.xyz/v1";
     case "huggingface":
       return process.env["HF_BASE_URL"] ?? "https://api-inference.huggingface.co/v1";
+    case "qwen":
+      return process.env["DASHSCOPE_BASE_URL"] ?? "https://dashscope.aliyuncs.com/compatible-mode/v1";
     default:
       return void 0;
   }
@@ -4562,6 +4568,8 @@ function getDefaultModel(provider) {
       return process.env["TOGETHER_MODEL"] ?? "Qwen/Qwen2.5-Coder-32B-Instruct";
     case "huggingface":
       return process.env["HF_MODEL"] ?? "Qwen/Qwen2.5-Coder-32B-Instruct";
+    case "qwen":
+      return process.env["QWEN_MODEL"] ?? "qwen-coder-plus";
     default:
       return "gpt-5.3-codex";
   }
@@ -4669,7 +4677,8 @@ var init_env = __esm({
       "mistral",
       "deepseek",
       "together",
-      "huggingface"
+      "huggingface",
+      "qwen"
     ];
     cachedPreferences = null;
     env = {
@@ -4780,6 +4789,10 @@ async function createProvider(type, config = {}) {
       provider = new OpenAIProvider("huggingface", "HuggingFace Inference");
       mergedConfig.baseUrl = mergedConfig.baseUrl ?? "https://api-inference.huggingface.co/v1";
       break;
+    case "qwen":
+      provider = new OpenAIProvider("qwen", "Alibaba Qwen");
+      mergedConfig.baseUrl = mergedConfig.baseUrl ?? "https://dashscope.aliyuncs.com/compatible-mode/v1";
+      break;
     default:
       throw new ProviderError(`Unknown provider type: ${type}`, {
         provider: type
@@ -4812,6 +4825,7 @@ function listProviders() {
     { id: "deepseek", name: "DeepSeek", configured: !!getApiKey("deepseek") },
     { id: "together", name: "Together AI", configured: !!getApiKey("together") },
     { id: "huggingface", name: "HuggingFace Inference", configured: !!getApiKey("huggingface") },
+    { id: "qwen", name: "Alibaba Qwen (DashScope)", configured: !!getApiKey("qwen") },
     { id: "lmstudio", name: "LM Studio (Local)", configured: true },
     { id: "ollama", name: "Ollama (Local)", configured: true }
   ];
@@ -24175,6 +24189,70 @@ var PROVIDER_DEFINITIONS = {
       }
     ]
   },
+  // Alibaba Qwen - DashScope API (OpenAI-compatible)
+  qwen: {
+    id: "qwen",
+    name: "Alibaba Qwen",
+    emoji: "\u{1F7E6}",
+    description: "Qwen models via Alibaba DashScope \u2014 strong coding at low cost",
+    envVar: "DASHSCOPE_API_KEY",
+    apiKeyUrl: "https://dashscope.aliyuncs.com",
+    docsUrl: "https://help.aliyun.com/zh/model-studio/developer-reference/",
+    baseUrl: "https://dashscope.aliyuncs.com/compatible-mode/v1",
+    supportsCustomModels: true,
+    openaiCompatible: true,
+    paymentType: "api",
+    features: {
+      streaming: true,
+      functionCalling: true,
+      vision: true
+    },
+    models: [
+      {
+        id: "qwen-coder-plus",
+        name: "Qwen Coder Plus",
+        description: "Best coding model \u2014 Qwen3 based, 131K context",
+        contextWindow: 131072,
+        maxOutputTokens: 8192,
+        recommended: true
+      },
+      {
+        id: "qwen-max",
+        name: "Qwen Max",
+        description: "Most capable general model \u2014 32K context",
+        contextWindow: 32768,
+        maxOutputTokens: 8192
+      },
+      {
+        id: "qwen-plus",
+        name: "Qwen Plus",
+        description: "Good balance of speed and quality \u2014 131K context",
+        contextWindow: 131072,
+        maxOutputTokens: 8192
+      },
+      {
+        id: "qwen-turbo",
+        name: "Qwen Turbo",
+        description: "Fastest and cheapest \u2014 1M context",
+        contextWindow: 1e6,
+        maxOutputTokens: 8192
+      },
+      {
+        id: "qwen2.5-coder-32b-instruct",
+        name: "Qwen 2.5 Coder 32B",
+        description: "Open weights coding model \u2014 32K context",
+        contextWindow: 32768,
+        maxOutputTokens: 8192
+      },
+      {
+        id: "qwq-plus",
+        name: "QwQ Plus",
+        description: "Reasoning model \u2014 chain-of-thought, 131K context",
+        contextWindow: 131072,
+        maxOutputTokens: 8192
+      }
+    ]
+  },
   // HuggingFace Inference - Free tier for open models
   huggingface: {
     id: "huggingface",
@@ -25659,6 +25737,120 @@ async function loadAgentConfig(projectPath) {
   }
 }
 
+// src/swarm/complexity-classifier.ts
+var AGENT_ROSTERS = {
+  trivial: ["tdd-developer"],
+  simple: ["tdd-developer", "qa"],
+  moderate: ["tdd-developer", "qa", "architect"],
+  complex: ["tdd-developer", "qa", "architect", "security-auditor", "external-reviewer"]
+};
+var LEVEL_THRESHOLDS = [
+  [3, "trivial"],
+  [5, "simple"],
+  [7, "moderate"],
+  [10, "complex"]
+];
+var COMPLEX_KEYWORDS = ["auth", "security", "migration", "refactor"];
+var SIMPLE_KEYWORDS = ["fix", "typo", "style"];
+function scoreToLevel(score) {
+  for (const [threshold, level] of LEVEL_THRESHOLDS) {
+    if (score <= threshold) return level;
+  }
+  return "complex";
+}
+function classifyFeatureHeuristic(feature) {
+  const description = feature.description ?? "";
+  const criteria = feature.acceptanceCriteria ?? [];
+  const deps = feature.dependencies ?? [];
+  const wordCount = description.split(/\s+/).filter(Boolean).length;
+  const lowerDesc = description.toLowerCase();
+  let score = 1;
+  const reasons = [
+    `words=${wordCount}`,
+    `criteria=${criteria.length}`,
+    `deps=${deps.length}`
+  ];
+  if (wordCount > 50) score += 3;
+  else if (wordCount > 20) score += 2;
+  else if (wordCount > 5) score += 1;
+  if (criteria.length >= 4) score += 3;
+  else if (criteria.length >= 2) score += 2;
+  else if (criteria.length >= 1) score += 1;
+  if (deps.length >= 3) score += 8;
+  else if (deps.length >= 1) score += 4;
+  const hasComplexKeyword = COMPLEX_KEYWORDS.some((kw) => lowerDesc.includes(kw));
+  if (hasComplexKeyword) {
+    score += 8;
+    reasons.push("complex-keywords");
+  }
+  const hasSimpleKeyword = SIMPLE_KEYWORDS.some((kw) => lowerDesc.includes(kw));
+  if (hasSimpleKeyword) {
+    score -= 2;
+    reasons.push("simple-keywords");
+  }
+  score = Math.max(1, Math.min(10, score));
+  const level = scoreToLevel(score);
+  return {
+    score,
+    level,
+    agents: AGENT_ROSTERS[level],
+    reasoning: `Heuristic score ${score}: ${reasons.join(", ")}`
+  };
+}
+async function classifyFeatureComplexity(feature, provider) {
+  const criteriaCount = (feature.acceptanceCriteria ?? []).length;
+  const depsCount = (feature.dependencies ?? []).length;
+  const userMessage = `Rate the complexity of this software feature on a scale of 1-10.
+
+Feature: ${feature.name}
+Description: ${feature.description ?? ""}
+Acceptance Criteria count: ${criteriaCount}
+Dependencies count: ${depsCount}
+
+Complexity guidelines:
+- 1-3 (trivial): Fix, typo, style change \u2014 short description, 0-1 criteria, 0 deps
+- 4-5 (simple): Small enhancement \u2014 medium description, 2-3 criteria
+- 6-7 (moderate): Feature with logic \u2014 longer description, 4+ criteria or 1+ deps
+- 8-10 (complex): Security, auth, migration, heavy refactor \u2014 many deps or critical path
+
+Return only JSON: { "score": <number 1-10>, "reasoning": "<brief explanation>" }`;
+  try {
+    const response = await provider.chat([{ role: "user", content: userMessage }], {
+      maxTokens: 256,
+      temperature: 0.2
+    });
+    const json2 = extractJsonScore(response.content);
+    if (json2 !== null && typeof json2.score === "number") {
+      const score = Math.max(1, Math.min(10, Math.round(json2.score)));
+      const level = scoreToLevel(score);
+      return {
+        score,
+        level,
+        agents: AGENT_ROSTERS[level],
+        reasoning: json2.reasoning ?? `LLM score: ${score}`
+      };
+    }
+  } catch {
+  }
+  return classifyFeatureHeuristic(feature);
+}
+function extractJsonScore(text13) {
+  try {
+    const stripped = text13.replace(/^```(?:json)?\s*\n?/, "").replace(/\n?```\s*$/, "").trim();
+    return JSON.parse(stripped);
+  } catch {
+    const match = text13.match(/\{[\s\S]*?\}/);
+    if (match) {
+      try {
+        return JSON.parse(match[0]);
+      } catch {
+        return null;
+      }
+    }
+    return null;
+  }
+}
+
 // src/swarm/task-board.ts
 async function createBoard(projectPath, spec) {
   const now = (/* @__PURE__ */ new Date()).toISOString();
@@ -26199,6 +26391,12 @@ var AGENT_DEFINITIONS = {
 };
 
 // src/swarm/lifecycle.ts
+var COMPLEXITY_RANK = {
+  trivial: 0,
+  simple: 1,
+  moderate: 2,
+  complex: 3
+};
 async function runSwarmLifecycle(options) {
   const ctx = {
     options,
@@ -26415,17 +26613,33 @@ async function processFeature(ctx, feature) {
       );
       continue;
     }
+    const classified = ctx.options.skipComplexityCheck ? {
+      score: 10,
+      level: "complex",
+      agents: AGENT_ROSTERS.complex} : await classifyFeatureComplexity(feature, provider);
+    const threshold = ctx.options.complexityThreshold;
+    const roster = threshold !== void 0 && COMPLEXITY_RANK[classified.level] >= COMPLEXITY_RANK[threshold] ? {
+      score: 10,
+      level: "complex",
+      agents: AGENT_ROSTERS.complex,
+      reasoning: `complexityThreshold=${threshold} (feature classified as ${classified.level})`
+    } : classified;
+    progress(
+      ctx.options,
+      "feature_loop",
+      `Feature: ${feature.name} \u2014 complexity=${roster.level} (score=${roster.score}) roster=[${roster.agents.join(",")}]`
+    );
     const [archReview, secReview, qaReview] = await Promise.all([
-      runArchReview(feature, provider, agentConfig.architect),
-      runSecurityAudit(feature, provider, agentConfig["security-auditor"]),
-      runQAReview(feature, provider, agentConfig.qa)
+      roster.agents.includes("architect") ? runArchReview(feature, provider, agentConfig.architect) : Promise.resolve(void 0),
+      roster.agents.includes("security-auditor") ? runSecurityAudit(feature, provider, agentConfig["security-auditor"]) : Promise.resolve(void 0),
+      roster.agents.includes("qa") ? runQAReview(feature, provider, agentConfig.qa) : Promise.resolve(void 0)
     ]);
-    const extReview = await runExternalReviewer(
+    const extReview = roster.agents.includes("external-reviewer") ? await runExternalReviewer(
       feature,
       { arch: archReview, security: secReview, qa: qaReview },
       provider,
       agentConfig["external-reviewer"]
-    );
+    ) : synthesizeLocalReviews({ arch: archReview, security: secReview, qa: qaReview });
     lastReviewScore = extReview.score;
     await emitGate(
       projectPath,
@@ -26720,13 +26934,17 @@ Return JSON with: { "score": number, "issues": ["..."], "summary": "..." }`;
 }
 async function runExternalReviewer(feature, reviews, provider, _config) {
   const prompt = AGENT_DEFINITIONS["external-reviewer"].systemPrompt;
+  const reviewLines = [
+    reviews.arch ? `Architecture review: ${JSON.stringify(reviews.arch)}` : null,
+    reviews.security ? `Security audit: ${JSON.stringify(reviews.security)}` : null,
+    reviews.qa ? `QA review: ${JSON.stringify(reviews.qa)}` : null
+  ].filter(Boolean).join("\n");
   const userMessage = `Synthesize these reviews for feature: ${feature.name}
 
-Architecture review: ${JSON.stringify(reviews.arch)}
-Security audit: ${JSON.stringify(reviews.security)}
-QA review: ${JSON.stringify(reviews.qa)}
+${reviewLines}
 
 Return JSON with: { "verdict": "APPROVE|REQUEST_CHANGES|REJECT", "score": number, "blockers": ["..."], "summary": "..." }`;
+  const fallback = synthesizeLocalReviews(reviews);
   try {
     const response = await provider.chat([{ role: "user", content: userMessage }], {
       system: prompt,
@@ -26734,27 +26952,24 @@ Return JSON with: { "verdict": "APPROVE|REQUEST_CHANGES|REJECT", "score": number
       temperature: 0.4
     });
     const json2 = extractJson(response.content);
-    const avgScore = Math.round(
-      (reviews.arch.score + reviews.security.score + reviews.qa.score) / 3
-    );
-    return json2 ?? {
-      verdict: avgScore >= 85 ? "APPROVE" : "REQUEST_CHANGES",
-      score: avgScore,
-      blockers: [],
-      summary: `Synthesized review score: ${avgScore}`
-    };
+    return json2 ?? fallback;
   } catch {
-    const avgScore = Math.round(
-      (reviews.arch.score + reviews.security.score + reviews.qa.score) / 3
-    );
-    return {
-      verdict: avgScore >= 85 ? "APPROVE" : "REQUEST_CHANGES",
-      score: avgScore,
-      blockers: [],
-      summary: `External review score: ${avgScore}`
-    };
+    return fallback;
   }
 }
+function synthesizeLocalReviews(reviews) {
+  const scores = [reviews.arch?.score, reviews.security?.score, reviews.qa?.score].filter(
+    (s) => s !== void 0
+  );
+  const avgScore = scores.length > 0 ? Math.round(scores.reduce((a, b) => a + b, 0) / scores.length) : 85;
+  const reviewCount = scores.length;
+  return {
+    verdict: avgScore >= 85 ? "APPROVE" : "REQUEST_CHANGES",
+    score: avgScore,
+    blockers: [],
+    summary: `Local synthesis (${reviewCount} review${reviewCount !== 1 ? "s" : ""}): score ${avgScore}`
+  };
+}
 async function runIntegratorAgent(spec, featureResults, provider, _config) {
   const prompt = AGENT_DEFINITIONS.integrator.systemPrompt;
   const results = Array.from(featureResults.values());
@@ -26810,14 +27025,20 @@ async function emitGate(projectPath, gate, passed, reason) {
 function topologicalSort(features) {
   const sorted = [];
   const visited = /* @__PURE__ */ new Set();
+  const inProgress = /* @__PURE__ */ new Set();
   const featureMap = new Map(features.map((f) => [f.id, f]));
   function visit(featureId) {
     if (visited.has(featureId)) return;
+    if (inProgress.has(featureId)) {
+      throw new Error(`Circular dependency detected involving feature "${featureId}"`);
+    }
     const feature = featureMap.get(featureId);
     if (!feature) return;
+    inProgress.add(featureId);
     for (const depId of feature.dependencies) {
       visit(depId);
     }
+    inProgress.delete(featureId);
     visited.add(featureId);
     sorted.push(feature);
   }
@@ -26984,7 +27205,7 @@ var helpCommand = {
         title: "Quality Mode",
         commands: [
           {
-            cmd: "/coco [on|off]",
+            cmd: "/quality [on|off]",
             desc: "Auto-test, self-review, iterate until quality \u2265 85/100",
             highlight: true
           }
@@ -28582,7 +28803,6 @@ async function selectProviderInteractively(providers, currentProviderId) {
     let lastTotalLines = 0;
     const clearPrevious = () => {
       if (lastTotalLines === 0) return;
-      process.stdout.write("\x1B[2K\r");
       for (let i = 0; i < lastTotalLines; i++) {
         process.stdout.write("\x1B[1A\x1B[2K");
       }
@@ -28725,6 +28945,7 @@ async function switchProvider(initialProvider, session) {
   const userFacingProviderId = initialProvider.id;
   let internalProviderId = initialProvider.id;
   let selectedAuthMethod = "apikey";
+  let newApiKeyForSaving = null;
   if (newProvider.id === "lmstudio" || newProvider.id === "ollama") {
     const result = newProvider.id === "ollama" ? await setupOllamaProvider() : await setupLMStudioProvider();
     if (!result) {
@@ -28870,6 +29091,7 @@ Using existing API key...`));
           }
           process.env[newProvider.envVar] = key;
           selectedAuthMethod = "apikey";
+          newApiKeyForSaving = key;
         }
       } else if (authChoice === "remove") {
         const removeOptions = [];
@@ -28927,6 +29149,7 @@ ${newProvider.emoji} ${newProvider.name} is not configured.`));
       }
       process.env[newProvider.envVar] = key;
       selectedAuthMethod = "apikey";
+      newApiKeyForSaving = key;
     }
   }
   const recommendedModel = getRecommendedModel(newProvider.id);
@@ -28948,16 +29171,25 @@ ${newProvider.emoji} ${newProvider.name} is not configured.`));
     spinner19.stop(chalk25.green("Connected!"));
     session.config.provider.type = userFacingProviderId;
     session.config.provider.model = newModel;
-    await saveProviderPreference(
-      userFacingProviderId,
-      newModel,
-      selectedAuthMethod
-    );
+    if (newApiKeyForSaving) {
+      await saveConfiguration({
+        type: userFacingProviderId,
+        model: newModel,
+        apiKey: newApiKeyForSaving
+      });
+    } else {
+      await saveProviderPreference(
+        userFacingProviderId,
+        newModel,
+        selectedAuthMethod
+      );
+    }
     console.log(chalk25.green(`
 \u2713 Switched to ${newProvider.emoji} ${newProvider.name}`));
     console.log(chalk25.dim(`  Model: ${newModel}`));
     if (selectedAuthMethod === "oauth") {
-      console.log(chalk25.dim(`  Auth: ChatGPT subscription (OAuth)`));
+      const authLabel = newProvider.id === "gemini" ? "Google account (OAuth)" : "ChatGPT subscription (OAuth)";
+      console.log(chalk25.dim(`  Auth: ${authLabel}`));
     }
     console.log(chalk25.dim(`  Use /model to change models
 `));
@@ -32654,7 +32886,6 @@ var RECOMMENDED_PROJECT = [
   "copy_file",
   "move_file",
   "git_add",
-  "git_commit",
   "run_tests",
   "run_test_file",
   "run_script",
@@ -32673,12 +32904,28 @@ var RECOMMENDED_PROJECT = [
   "bash:npm:test",
   "bash:npm:ci",
   "bash:pnpm:install",
+  "bash:pnpm:i",
   "bash:pnpm:run",
   "bash:pnpm:test",
+  "bash:pnpm:typecheck",
+  "bash:pnpm:lint",
+  "bash:pnpm:build",
+  "bash:pnpm:check",
+  "bash:pnpm:format",
+  "bash:pnpm:dev",
+  "bash:pnpm:add",
+  "bash:pnpm:remove",
+  "bash:pnpm:update",
+  "bash:pnpm:exec",
+  "bash:pnpm:rebuild",
   "bash:yarn:install",
   "bash:yarn:run",
   "bash:yarn:test",
   "bash:node",
+  "bash:vitest",
+  "bash:tsc",
+  "bash:tsx",
+  "bash:oxlint",
   // ── Bash: JVM toolchain ──
   "bash:java",
   "bash:javac",
@@ -32706,11 +32953,13 @@ var RECOMMENDED_PROJECT = [
   "bash:go:test",
   "bash:go:vet",
   "bash:pip:install",
-  // ── Bash: git local (staging only — push is in ASK) ──
-  "bash:git:add",
-  "bash:git:commit"
+  // ── Bash: git local (staging only — commit and push are in ASK) ──
+  "bash:git:add"
 ];
 var ALWAYS_ASK = [
+  // ── Git commit — always ask by default; use /permissions allow-commits to opt in ──
+  "git_commit",
+  "bash:git:commit",
   // ── Coco native (risky) ──
   "delete_file",
   "git_push",
@@ -32787,6 +33036,7 @@ var RECOMMENDED_DENY = [
   // ── Package publishing ──
   "bash:npm:publish",
   "bash:yarn:publish",
+  "bash:pnpm:publish",
   "bash:cargo:publish",
   // ── Disk / low-level destructive ──
   "bash:dd",
@@ -32835,8 +33085,10 @@ async function showPermissionSuggestion() {
   console.log(chalk25.magenta.bold("  \u{1F4CB} Recommended Permissions"));
   console.log();
   console.log(chalk25.dim("  Coco has a curated set of tool permissions for developers:"));
-  console.log(chalk25.dim("  \u2022 Allow: file read/write, search, git (local), build, tests..."));
-  console.log(chalk25.dim("  \u2022 Ask each time: curl, rm, git pull, docker exec, cloud..."));
+  console.log(chalk25.dim("  \u2022 Allow: file read/write, search, git staging, build, tests..."));
+  console.log(
+    chalk25.dim("  \u2022 Ask each time: git commit, curl, rm, git pull, docker exec, cloud...")
+  );
   console.log(chalk25.dim("  \u2022 Deny: sudo, git push, git rebase, docker push, k8s apply..."));
   console.log();
   console.log(chalk25.dim("  Stored in ~/.coco/trusted-tools.json \u2014 edit manually or let"));
@@ -32927,7 +33179,7 @@ var permissionsCommand = {
   name: "permissions",
   aliases: ["perms"],
   description: "Manage tool permissions and recommended allowlist",
-  usage: "/permissions [apply|view|reset]",
+  usage: "/permissions [apply|view|reset|allow-commits|revoke-commits]",
   async execute(args, session) {
     const subcommand = args[0]?.toLowerCase() ?? "status";
     switch (subcommand) {
@@ -32940,6 +33192,12 @@ var permissionsCommand = {
       case "reset":
         await resetPermissions(session);
         return false;
+      case "allow-commits":
+        await allowCommits(session);
+        return false;
+      case "revoke-commits":
+        await revokeCommits(session);
+        return false;
       case "status":
       default:
         await showStatus(session);
@@ -32984,9 +33242,15 @@ async function showStatus(session) {
     }
   }
   console.log();
-  console.log(chalk25.dim("  /permissions apply  \u2014 Apply recommended permissions"));
-  console.log(chalk25.dim("  /permissions view   \u2014 View recommended template"));
-  console.log(chalk25.dim("  /permissions reset  \u2014 Reset to empty"));
+  console.log(chalk25.dim("  /permissions apply          \u2014 Apply recommended permissions"));
+  console.log(chalk25.dim("  /permissions view           \u2014 View recommended template"));
+  console.log(chalk25.dim("  /permissions reset          \u2014 Reset to empty"));
+  console.log(
+    chalk25.dim("  /permissions allow-commits  \u2014 Auto-approve git commit for this project")
+  );
+  console.log(
+    chalk25.dim("  /permissions revoke-commits \u2014 Require confirmation for git commit again")
+  );
   console.log();
 }
 async function applyRecommended(session) {
@@ -33000,6 +33264,25 @@ async function applyRecommended(session) {
   console.log(chalk25.green("  \u2713 Recommended permissions applied!"));
   console.log(chalk25.dim("  Use /permissions to review."));
 }
+async function allowCommits(session) {
+  const commitTools = ["git_commit", "bash:git:commit"];
+  for (const tool of commitTools) {
+    session.trustedTools.add(tool);
+    await saveTrustedTool(tool, session.projectPath, false);
+  }
+  console.log(chalk25.green("  \u2713 git commit will be auto-approved for this project"));
+  console.log(chalk25.dim("  Use /permissions revoke-commits to require confirmation again."));
+}
+async function revokeCommits(session) {
+  const commitTools = ["git_commit", "bash:git:commit"];
+  for (const tool of commitTools) {
+    session.trustedTools.delete(tool);
+    await removeTrustedTool(tool, session.projectPath, false);
+    await removeTrustedTool(tool, session.projectPath, true);
+  }
+  console.log(chalk25.yellow("  \u25CB git commit will now require confirmation for this project"));
+  console.log(chalk25.dim("  Use /permissions allow-commits to enable auto-approve again."));
+}
 async function resetPermissions(session) {
   const confirmed = await p25.confirm({
     message: "Reset all tool permissions? This removes all trusted tools.",
@@ -33024,15 +33307,15 @@ async function resetPermissions(session) {
   console.log(chalk25.green("  \u2713 All tool permissions reset."));
 }
 
-// src/cli/repl/coco-mode.ts
+// src/cli/repl/quality-loop.ts
 init_paths();
-var cocoModeEnabled = true;
+var qualityLoopEnabled = true;
 var hintShown = false;
-function isCocoMode() {
-  return cocoModeEnabled;
+function isQualityLoop() {
+  return qualityLoopEnabled;
 }
-function setCocoMode(enabled) {
-  cocoModeEnabled = enabled;
+function setQualityLoop(enabled) {
+  qualityLoopEnabled = enabled;
 }
 function wasHintShown() {
   return hintShown;
@@ -33063,8 +33346,8 @@ function looksLikeFeatureRequest(input) {
   ];
   return featureKeywords.some((re) => re.test(trimmed));
 }
-function formatCocoHint() {
-  return chalk25.dim("  tip: ") + chalk25.magenta("/coco") + chalk25.dim(" enables auto-test & iterate until quality converges");
+function formatQualityLoopHint() {
+  return chalk25.dim("  tip: ") + chalk25.magenta("/quality") + chalk25.dim(" enables auto-test & iterate until quality converges");
 }
 function formatQualityResult(result) {
   const lines = [];
@@ -33097,19 +33380,20 @@ function formatQualityResult(result) {
   lines.push("");
   return lines.join("\n");
 }
-async function loadCocoModePreference() {
+async function loadQualityLoopPreference() {
   try {
     const content = await fs32__default.readFile(CONFIG_PATHS.config, "utf-8");
     const config = JSON.parse(content);
-    if (typeof config.cocoMode === "boolean") {
-      cocoModeEnabled = config.cocoMode;
-      return config.cocoMode;
+    const value = config.qualityLoop ?? config.cocoMode;
+    if (typeof value === "boolean") {
+      qualityLoopEnabled = value;
+      return value;
     }
   } catch {
   }
   return true;
 }
-async function saveCocoModePreference(enabled) {
+async function saveQualityLoopPreference(enabled) {
   try {
     let config = {};
     try {
@@ -33117,13 +33401,13 @@ async function saveCocoModePreference(enabled) {
       config = JSON.parse(content);
     } catch {
     }
-    config.cocoMode = enabled;
+    config.qualityLoop = enabled;
     await fs32__default.writeFile(CONFIG_PATHS.config, JSON.stringify(config, null, 2) + "\n");
   } catch {
   }
 }
-function parseCocoQualityReport(content) {
-  const marker = "COCO_QUALITY_REPORT";
+function parseQualityLoopReport(content) {
+  const marker = "QUALITY_LOOP_REPORT";
   const idx = content.indexOf(marker);
   if (idx === -1) return null;
   const block = content.slice(idx);
@@ -33152,11 +33436,11 @@ function parseCocoQualityReport(content) {
     securityScore: isNaN(security) ? void 0 : security
   };
 }
-function getCocoModeSystemPrompt() {
+function getQualityLoopSystemPrompt() {
   return `
-## COCO Quality Mode (ACTIVE)
+## Quality Loop Mode (ACTIVE)
 
-You are operating in COCO quality mode. After implementing code changes, you MUST follow this iteration cycle:
+You are operating in quality loop mode. After implementing code changes, you MUST follow this iteration cycle:
 
 1. **Implement** the requested changes (code + tests)
 2. **Run tests** using the run_tests or bash_exec tool
@@ -33171,7 +33455,7 @@ You are operating in COCO quality mode. After implementing code changes, you MUS
 After completing the cycle, output a quality summary in this exact format:
 
 \`\`\`
-COCO_QUALITY_REPORT
+QUALITY_LOOP_REPORT
 score_history: [first_score, ..., final_score]
 tests_passed: X
 tests_total: Y
@@ -33190,12 +33474,12 @@ Key rules:
 - Report honestly - don't inflate scores`;
 }
 
-// src/cli/repl/commands/coco.ts
-var cocoCommand = {
-  name: "coco",
-  aliases: [],
+// src/cli/repl/commands/quality.ts
+var qualityCommand = {
+  name: "quality",
+  aliases: ["coco"],
   description: "Toggle quality mode \u2014 auto-test, self-review, iterate until converged",
-  usage: "/coco [on|off]",
+  usage: "/quality [on|off]",
   async execute(args, session) {
     const arg = args[0]?.toLowerCase();
     let newState;
@@ -33204,12 +33488,12 @@ var cocoCommand = {
     } else if (arg === "off") {
       newState = false;
     } else if (arg === "status") {
-      const state = isCocoMode();
+      const state = isQualityLoop();
       const skillAvailable = session.skillRegistry?.has("coco-fix-iterate");
       const modeType = state && skillAvailable ? chalk25.cyan(" (skill-based)") : state ? chalk25.dim(" (prompt-based)") : "";
       console.log();
       console.log(
-        chalk25.magenta("  COCO quality mode: ") + (state ? chalk25.green.bold("ON") : chalk25.dim("OFF")) + modeType
+        chalk25.magenta("  Quality loop: ") + (state ? chalk25.green.bold("ON") : chalk25.dim("OFF")) + modeType
       );
       console.log();
       if (state) {
@@ -33225,24 +33509,24 @@ var cocoCommand = {
         console.log(chalk25.dim("  3. Self-review against 12 quality dimensions"));
         console.log(chalk25.dim("  4. Iterate until quality converges (\u226585/100)"));
       } else {
-        console.log(chalk25.dim("  Enable with /coco on for quality-driven development"));
+        console.log(chalk25.dim("  Enable with /quality on for quality-driven development"));
       }
       console.log();
       return false;
     } else {
-      newState = !isCocoMode();
+      newState = !isQualityLoop();
     }
-    setCocoMode(newState);
-    saveCocoModePreference(newState).catch(() => {
+    setQualityLoop(newState);
+    saveQualityLoopPreference(newState).catch(() => {
     });
     console.log();
     if (newState) {
-      console.log(chalk25.magenta("  COCO quality mode: ") + chalk25.green.bold("ON"));
+      console.log(chalk25.magenta("  Quality loop: ") + chalk25.green.bold("ON"));
       console.log(
         chalk25.dim("  Agent will auto-test, self-review, and iterate until quality \u2265 85/100")
       );
     } else {
-      console.log(chalk25.magenta("  COCO quality mode: ") + chalk25.dim("OFF"));
+      console.log(chalk25.magenta("  Quality loop: ") + chalk25.dim("OFF"));
       console.log(chalk25.dim("  Fast mode \u2014 agent responds without quality iteration"));
     }
     console.log();
@@ -33447,7 +33731,7 @@ var tutorialCommand = {
       {
         step: "3",
         title: "Enable quality mode",
-        desc: "Type /coco to enable auto-iteration: test \u2192 analyze \u2192 fix \u2192 repeat until score \u2265 85"
+        desc: "Type /quality to enable auto-iteration: test \u2192 analyze \u2192 fix \u2192 repeat until score \u2265 85"
       },
       {
         step: "4",
@@ -33467,7 +33751,7 @@ var tutorialCommand = {
     }
     console.log(chalk25.bold("Useful commands:"));
     console.log(
-      `  ${chalk25.yellow("/coco")}       ${chalk25.dim("Toggle quality mode (auto-iteration)")}`
+      `  ${chalk25.yellow("/quality")}    ${chalk25.dim("Toggle quality mode (auto-iteration)")}`
     );
     console.log(`  ${chalk25.yellow("/init")}       ${chalk25.dim("Initialize a new project")}`);
     console.log(`  ${chalk25.yellow("/help")}       ${chalk25.dim("See all available commands")}`);
@@ -40741,7 +41025,7 @@ var commands = [
   copyCommand,
   allowPathCommand,
   permissionsCommand,
-  cocoCommand,
+  qualityCommand,
   fullAccessCommand,
   updateCocoCommand,
   imageCommand,
@@ -40890,11 +41174,11 @@ function createInputHandler(_session) {
   const getPrompt = () => {
     const imageIndicator = hasPendingImage() ? chalk25.cyan(" \u{1F4CE} 1 image") : "";
     const imageIndicatorLen = hasPendingImage() ? 10 : 0;
-    if (isCocoMode()) {
+    if (isQualityLoop()) {
       return {
-        str: "\u{1F965} " + chalk25.magenta("[coco]") + " \u203A " + imageIndicator,
-        // 🥥=2 + space=1 + [coco]=6 + space=1 + ›=1 + space=1 = 12 + image indicator
-        visualLen: 12 + imageIndicatorLen
+        str: "\u{1F965} " + chalk25.magenta("[quality]") + " \u203A " + imageIndicator,
+        // 🥥=2 + space=1 + [quality]=9 + space=1 + ›=1 + space=1 = 15 + image indicator
+        visualLen: 15 + imageIndicatorLen
       };
     }
     return {
@@ -43194,8 +43478,8 @@ function formatStatusBar(projectPath, config, gitCtx) {
   const providerName = config.provider.type;
   const modelName = config.provider.model || "default";
   parts.push(chalk25.dim(`${providerName}/`) + chalk25.cyan(modelName));
-  if (isCocoMode()) {
-    parts.push(chalk25.green("\u{1F504} coco"));
+  if (isQualityLoop()) {
+    parts.push(chalk25.green("\u{1F504} quality loop"));
   }
   if (isFullAccessMode()) {
     parts.push(chalk25.yellow("\u26A1 full-access"));
@@ -43268,7 +43552,7 @@ async function startRepl(options = {}) {
   const { loadFullAccessPreference: loadFullAccessPreference2 } = await Promise.resolve().then(() => (init_full_access_mode(), full_access_mode_exports));
   const { loadFullPowerRiskPreference: loadFullPowerRiskPreference2 } = await Promise.resolve().then(() => (init_full_power_risk_mode(), full_power_risk_mode_exports));
   await Promise.all([
-    loadCocoModePreference(),
+    loadQualityLoopPreference(),
     loadFullAccessPreference2(),
     loadFullPowerRiskPreference2()
   ]);
@@ -43530,13 +43814,13 @@ async function startRepl(options = {}) {
     };
     let originalSystemPrompt;
     try {
-      if (typeof agentMessage === "string" && !isCocoMode() && !wasHintShown() && looksLikeFeatureRequest(agentMessage)) {
+      if (typeof agentMessage === "string" && !isQualityLoop() && !wasHintShown() && looksLikeFeatureRequest(agentMessage)) {
         markHintShown();
-        console.log(formatCocoHint());
+        console.log(formatQualityLoopHint());
       }
       console.log();
       let cocoForkPrompt;
-      if (isCocoMode()) {
+      if (isQualityLoop()) {
         const skillId = "coco-fix-iterate";
         const skillAvailable = session.skillRegistry?.has(skillId);
         if (skillAvailable && typeof agentMessage === "string") {
@@ -43550,7 +43834,7 @@ async function startRepl(options = {}) {
           }
         } else {
           originalSystemPrompt = session.config.agent.systemPrompt;
-          session.config.agent.systemPrompt = originalSystemPrompt + "\n" + getCocoModeSystemPrompt();
+          session.config.agent.systemPrompt = originalSystemPrompt + "\n" + getQualityLoopSystemPrompt();
         }
       }
       const effectiveMessage = cocoForkPrompt ?? agentMessage;
@@ -43628,7 +43912,7 @@ async function startRepl(options = {}) {
           }
           renderToolStart(result2.name, result2.input);
           renderToolEnd(result2);
-          if (isCocoMode()) {
+          if (isQualityLoop()) {
             setSpinner("Processing results & checking quality...");
           } else {
             setSpinner("Processing...");
@@ -43645,7 +43929,7 @@ async function startRepl(options = {}) {
             if (!thinkingStartTime) return;
             const elapsed = Math.floor((Date.now() - thinkingStartTime) / 1e3);
             if (elapsed < 4) return;
-            if (isCocoMode()) {
+            if (isQualityLoop()) {
               if (elapsed < 8) setSpinner("Analyzing request...");
               else if (elapsed < 15) setSpinner("Running quality checks...");
               else if (elapsed < 25) setSpinner("Iterating for quality...");
@@ -43732,8 +44016,8 @@ async function startRepl(options = {}) {
         continue;
       }
       console.log();
-      if (isCocoMode() && result.content) {
-        const qualityResult = parseCocoQualityReport(result.content);
+      if (isQualityLoop() && result.content) {
+        const qualityResult = parseQualityLoopReport(result.content);
         if (qualityResult) {
           console.log(formatQualityResult(qualityResult));
         }
@@ -43854,7 +44138,7 @@ async function printWelcome(session, gitCtx, mcpManager) {
   if (gitCtx) {
     console.log(`  ${formatGitLine(gitCtx)}`);
   }
-  const cocoStatus = isCocoMode() ? chalk25.magenta("  \u{1F504} quality mode: ") + chalk25.green.bold("on") + chalk25.dim(" \u2014 iterates until quality \u2265 85. /coco to disable") : chalk25.dim("  \u{1F4A1} /coco on \u2014 enable auto-test & quality iteration");
+  const cocoStatus = isQualityLoop() ? chalk25.magenta("  \u{1F504} quality mode: ") + chalk25.green.bold("on") + chalk25.dim(" \u2014 iterates until quality \u2265 85. /quality to disable") : chalk25.dim("  \u{1F4A1} /quality on \u2014 enable auto-test & quality iteration");
   console.log(cocoStatus);
   const skillTotal = session.skillRegistry?.size ?? 0;
   const mcpServers = mcpManager?.getConnectedServers() ?? [];