@corbat-tech/coco 2.25.3 → 2.25.5

package/dist/cli/index.js

@@ -3764,6 +3764,8 @@ var init_openai = __esm({
       "o3",
       "o3-mini",
       "o4-mini",
+      "gpt-5",
+      "codex",
       "kimi-k2.5",
       "kimi-k2-0324",
       "kimi-latest"
@@ -4458,12 +4460,13 @@ var init_openai = __esm({
           try {
             const model = options?.model ?? this.config.model ?? DEFAULT_MODEL2;
             const { input, instructions } = this.convertToResponsesInput(messages, options?.system);
+            const supportsTemp = this.supportsTemperature(model);
             const response = await this.client.responses.create({
               model,
               input,
               instructions: instructions ?? void 0,
               max_output_tokens: options?.maxTokens ?? this.config.maxTokens ?? 8192,
-              temperature: options?.temperature ?? this.config.temperature ?? 0,
+              ...supportsTemp && { temperature: options?.temperature ?? this.config.temperature ?? 0 },
               store: false
             });
             return {
@@ -4491,13 +4494,14 @@ var init_openai = __esm({
             const model = options?.model ?? this.config.model ?? DEFAULT_MODEL2;
             const { input, instructions } = this.convertToResponsesInput(messages, options?.system);
             const tools = this.convertToolsForResponses(options.tools);
+            const supportsTemp = this.supportsTemperature(model);
             const response = await this.client.responses.create({
               model,
               input,
               instructions: instructions ?? void 0,
               tools,
               max_output_tokens: options?.maxTokens ?? this.config.maxTokens ?? 8192,
-              temperature: options?.temperature ?? this.config.temperature ?? 0,
+              ...supportsTemp && { temperature: options?.temperature ?? this.config.temperature ?? 0 },
               store: false
             });
             let content = "";
@@ -4542,12 +4546,13 @@ var init_openai = __esm({
         try {
           const model = options?.model ?? this.config.model ?? DEFAULT_MODEL2;
           const { input, instructions } = this.convertToResponsesInput(messages, options?.system);
+          const supportsTemp = this.supportsTemperature(model);
           const stream = await this.client.responses.create({
             model,
             input,
             instructions: instructions ?? void 0,
             max_output_tokens: options?.maxTokens ?? this.config.maxTokens ?? 8192,
-            temperature: options?.temperature ?? this.config.temperature ?? 0,
+            ...supportsTemp && { temperature: options?.temperature ?? this.config.temperature ?? 0 },
             store: false,
             stream: true
           });
@@ -4604,12 +4609,13 @@ var init_openai = __esm({
           const model = options?.model ?? this.config.model ?? DEFAULT_MODEL2;
           const { input, instructions } = this.convertToResponsesInput(messages, options?.system);
           const tools = options.tools.length > 0 ? this.convertToolsForResponses(options.tools) : void 0;
+          const supportsTemp = this.supportsTemperature(model);
           const requestParams = {
             model,
             input,
             instructions: instructions ?? void 0,
             max_output_tokens: options?.maxTokens ?? this.config.maxTokens ?? 8192,
-            temperature: options?.temperature ?? this.config.temperature ?? 0,
+            ...supportsTemp && { temperature: options?.temperature ?? this.config.temperature ?? 0 },
             store: false,
             stream: true
           };
@@ -21112,15 +21118,23 @@ async function authenticateMcpOAuth(params) {
       `MCP server '${params.serverName}' requires interactive OAuth in a TTY session. Run Coco in a terminal, or use mcp-remote (e.g. npx -y mcp-remote@latest ${resource}) for IDE bridge workflows.`
     );
   }
-  const protectedMetadata = await discoverProtectedResourceMetadata(
-    resource,
-    params.wwwAuthenticateHeader
-  );
-  const authorizationServer = protectedMetadata.authorization_servers?.[0];
-  if (!authorizationServer) {
-    throw new Error("Protected resource metadata does not include authorization_servers");
+  let authorizationServer;
+  let authorizationMetadata;
+  try {
+    const protectedMetadata = await discoverProtectedResourceMetadata(
+      resource,
+      params.wwwAuthenticateHeader
+    );
+    authorizationServer = protectedMetadata.authorization_servers?.[0];
+    if (authorizationServer) {
+      authorizationMetadata = await discoverAuthorizationServerMetadata(authorizationServer);
+    }
+  } catch {
   }
-  const authorizationMetadata = await discoverAuthorizationServerMetadata(authorizationServer);
+  if (!authorizationMetadata) {
+    authorizationMetadata = await discoverAuthorizationServerMetadata(resource);
+  }
+  authorizationServer = authorizationServer ?? authorizationMetadata.issuer ?? new URL(resource).origin;
   if (stored && isTokenExpired2(stored) && stored.refreshToken && stored.clientId) {
     try {
       const refreshed = await refreshAccessToken2({
@@ -21295,12 +21309,29 @@ var init_http = __esm({
         });
         let response = await doFetch();
         if (response.status !== 401 || !this.shouldAttemptOAuth()) {
+          if (this.shouldAttemptOAuth() && !this.oauthToken && response.headers.get("www-authenticate")) {
+            await this.ensureOAuthToken(response.headers.get("www-authenticate"));
+            response = await doFetch();
+          }
           return response;
         }
         await this.ensureOAuthToken(response.headers.get("www-authenticate"));
         response = await doFetch();
         return response;
       }
+      looksLikeAuthErrorMessage(message) {
+        if (!message) return false;
+        const msg = message.toLowerCase();
+        const hasStrongAuthSignal = msg.includes("unauthorized") || msg.includes("unauthorised") || msg.includes("authentication") || msg.includes("oauth") || msg.includes("access token") || msg.includes("bearer") || msg.includes("not authenticated") || msg.includes("not logged") || msg.includes("login") || msg.includes("generate") && msg.includes("token");
+        const hasVendorHint = msg.includes("gemini cli") || msg.includes("jira") || msg.includes("confluence") || msg.includes("atlassian");
+        const hasWeakAuthSignal = msg.includes("authenticate") || msg.includes("token") || msg.includes("authorization");
+        return hasStrongAuthSignal || // Vendor-specific hints alone are not enough; require an auth-related token too.
+        hasVendorHint && hasWeakAuthSignal;
+      }
+      isJsonRpcAuthError(payload) {
+        if (!payload.error) return false;
+        return this.looksLikeAuthErrorMessage(payload.error.message);
+      }
       /**
        * Connect to the HTTP transport
        */
@@ -21364,6 +21395,22 @@ var init_http = __esm({
               throw new MCPTransportError(`HTTP error ${response.status}: ${response.statusText}`);
             }
             const data = await response.json();
+            if (this.shouldAttemptOAuth() && this.isJsonRpcAuthError(data)) {
+              await this.ensureOAuthToken(response.headers.get("www-authenticate"));
+              const retryResponse = await this.sendRequestWithOAuthRetry(
+                "POST",
+                JSON.stringify(message),
+                abortController.signal
+              );
+              if (!retryResponse.ok) {
+                throw new MCPTransportError(
+                  `HTTP error ${retryResponse.status}: ${retryResponse.statusText}`
+                );
+              }
+              const retryData = await retryResponse.json();
+              this.messageCallback?.(retryData);
+              return;
+            }
             this.messageCallback?.(data);
             return;
           } catch (error) {
@@ -38211,9 +38258,6 @@ async function savePermissionPreference(key, value) {
 }
 async function shouldShowPermissionSuggestion() {
   const prefs = await loadPermissionPreferences();
-  if (prefs.recommendedAllowlistPrompted) {
-    return false;
-  }
   if (prefs.recommendedAllowlistDismissed) {
     return false;
   }
@@ -38229,7 +38273,6 @@ async function applyRecommendedPermissions() {
   await savePermissionPreference("recommendedAllowlistApplied", true);
 }
 async function showPermissionSuggestion() {
-  await savePermissionPreference("recommendedAllowlistPrompted", true);
   console.log();
   console.log(chalk.magenta.bold("  \u{1F4CB} Recommended Permissions"));
   console.log();
@@ -38256,6 +38299,7 @@ async function showPermissionSuggestion() {
     return;
   }
   if (action === "dismiss") {
+    await savePermissionPreference("recommendedAllowlistPrompted", true);
     await savePermissionPreference("recommendedAllowlistDismissed", true);
     console.log(chalk.dim("  Won't show again. Use /permissions to apply later."));
     return;
@@ -38271,6 +38315,7 @@ async function showPermissionSuggestion() {
     }
   }
   await applyRecommendedPermissions();
+  await savePermissionPreference("recommendedAllowlistPrompted", true);
   console.log(chalk.green("  \u2713 Recommended permissions applied"));
   console.log(chalk.dim("  Use /permissions to review or modify anytime."));
 }
@@ -52795,10 +52840,12 @@ async function startRepl(options = {}) {
     const mcpRegistry = new MCPRegistryImpl2();
     await mcpRegistry.load();
     const registryServers = mcpRegistry.listEnabledServers();
-    const { loadProjectMCPFile: loadProjectMCPFile2, mergeMCPConfigs: mergeMCPConfigs2 } = await Promise.resolve().then(() => (init_config_loader(), config_loader_exports));
-    const projectServers = await loadProjectMCPFile2(process.cwd());
+    const { loadProjectMCPFile: loadProjectMCPFile2, loadMCPServersFromCOCOConfig: loadMCPServersFromCOCOConfig2, mergeMCPConfigs: mergeMCPConfigs2 } = await Promise.resolve().then(() => (init_config_loader(), config_loader_exports));
+    const projectServers = await loadProjectMCPFile2(projectPath);
+    const cocoConfigServers = await loadMCPServersFromCOCOConfig2();
     const enabledServers = mergeMCPConfigs2(
       registryServers,
+      cocoConfigServers.filter((s) => s.enabled !== false),
       projectServers.filter((s) => s.enabled !== false)
     );
     if (enabledServers.length > 0) {
@@ -52819,7 +52866,12 @@ async function startRepl(options = {}) {
       }
       for (const connection of connections.values()) {
         try {
-          await registerMCPTools2(toolRegistry, connection.name, connection.client);
+          const wrapped = await registerMCPTools2(toolRegistry, connection.name, connection.client);
+          if (wrapped.length === 0) {
+            logger2.warn(
+              `[MCP] Server '${connection.name}' connected but exposed 0 tools (check server auth/scopes).`
+            );
+          }
         } catch (toolError) {
           logger2.warn(
             `[MCP] Failed to register tools for server '${connection.name}': ${toolError instanceof Error ? toolError.message : String(toolError)}`
@@ -52830,6 +52882,13 @@ async function startRepl(options = {}) {
       if (activeCount > 0) {
         logger2.info(`[MCP] ${activeCount} MCP server(s) active`);
       }
+      const failedServers = enabledServers.map((s) => s.name).filter((name) => !connections.has(name));
+      if (failedServers.length > 0) {
+        p26.log.warn(
+          `MCP startup check: ${failedServers.length} server(s) failed to connect: ${failedServers.join(", ")}`
+        );
+        p26.log.message(chalk.dim("Run /mcp health <name> to inspect details."));
+      }
     }
   } catch (mcpError) {
     logger2.warn(