@corbat-tech/coco 2.25.6 → 2.25.8

package/dist/cli/index.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import * as fs5 from 'fs';
 import fs5__default, { accessSync, readFileSync, constants } from 'fs';
-import * as path38 from 'path';
-import path38__default, { join, dirname, resolve, basename } from 'path';
+import * as path39 from 'path';
+import path39__default, { join, dirname, resolve, basename } from 'path';
 import { URL as URL$1, fileURLToPath } from 'url';
 import { z } from 'zod';
 import * as os4 from 'os';
@@ -612,7 +612,7 @@ function deepMergeConfig(base, override) {
   };
 }
 function getProjectConfigPath() {
-  return path38__default.join(process.cwd(), ".coco", "config.json");
+  return path39__default.join(process.cwd(), ".coco", "config.json");
 }
 async function saveConfig(config, configPath, global = false) {
   const result = CocoConfigSchema.safeParse(config);
@@ -627,7 +627,7 @@ async function saveConfig(config, configPath, global = false) {
     });
   }
   const resolvedPath = configPath || (global ? CONFIG_PATHS.config : getProjectConfigPath());
-  const dir = path38__default.dirname(resolvedPath);
+  const dir = path39__default.dirname(resolvedPath);
   await fs35__default.mkdir(dir, { recursive: true });
   const content = JSON.stringify(result.data, null, 2);
   await fs35__default.writeFile(resolvedPath, content, "utf-8");
@@ -645,7 +645,7 @@ async function findConfigPath(cwd) {
     }
   }
   const basePath = cwd || process.cwd();
-  const projectConfigPath = path38__default.join(basePath, ".coco", "config.json");
+  const projectConfigPath = path39__default.join(basePath, ".coco", "config.json");
   try {
     await fs35__default.access(projectConfigPath);
     return projectConfigPath;
@@ -666,7 +666,7 @@ async function findAllConfigPaths(cwd) {
   } catch {
   }
   const basePath = cwd || process.cwd();
-  const projectConfigPath = path38__default.join(basePath, ".coco", "config.json");
+  const projectConfigPath = path39__default.join(basePath, ".coco", "config.json");
   try {
     await fs35__default.access(projectConfigPath);
     result.project = projectConfigPath;
@@ -879,11 +879,11 @@ async function refreshAccessToken(provider, refreshToken) {
 }
 function getTokenStoragePath(provider) {
   const home = process.env.HOME || process.env.USERPROFILE || "";
-  return path38.join(home, ".coco", "tokens", `${provider}.json`);
+  return path39.join(home, ".coco", "tokens", `${provider}.json`);
 }
 async function saveTokens(provider, tokens) {
   const filePath = getTokenStoragePath(provider);
-  const dir = path38.dirname(filePath);
+  const dir = path39.dirname(filePath);
   await fs35.mkdir(dir, { recursive: true, mode: 448 });
   await fs35.writeFile(filePath, JSON.stringify(tokens, null, 2), { mode: 384 });
 }
@@ -1479,11 +1479,11 @@ function getCopilotBaseUrl(accountType) {
 }
 function getCopilotCredentialsPath() {
   const home = process.env.HOME || process.env.USERPROFILE || "";
-  return path38.join(home, ".coco", "tokens", "copilot.json");
+  return path39.join(home, ".coco", "tokens", "copilot.json");
 }
 async function saveCopilotCredentials(creds) {
   const filePath = getCopilotCredentialsPath();
-  const dir = path38.dirname(filePath);
+  const dir = path39.dirname(filePath);
   await fs35.mkdir(dir, { recursive: true, mode: 448 });
   await fs35.writeFile(filePath, JSON.stringify(creds, null, 2), { mode: 384 });
 }
@@ -2239,7 +2239,7 @@ function getADCPath() {
   if (process.env.GOOGLE_APPLICATION_CREDENTIALS) {
     return process.env.GOOGLE_APPLICATION_CREDENTIALS;
   }
-  return path38.join(home, ".config", "gcloud", "application_default_credentials.json");
+  return path39.join(home, ".config", "gcloud", "application_default_credentials.json");
 }
 async function isGcloudInstalled() {
   try {
@@ -2395,7 +2395,7 @@ function loadGlobalCocoEnv() {
   try {
     const home = process.env.HOME || process.env.USERPROFILE || "";
     if (!home) return;
-    const globalEnvPath = path38.join(home, ".coco", ".env");
+    const globalEnvPath = path39.join(home, ".coco", ".env");
     const content = fs5.readFileSync(globalEnvPath, "utf-8");
     for (const line of content.split("\n")) {
       const trimmed = line.trim();
@@ -2633,7 +2633,7 @@ async function updateEnvProvider(provider) {
   try {
     const home = process.env.HOME || process.env.USERPROFILE || "";
     if (!home) return;
-    const envPath = path38.join(home, ".coco", ".env");
+    const envPath = path39.join(home, ".coco", ".env");
     let content;
     try {
       content = await fs5.promises.readFile(envPath, "utf-8");
@@ -2660,7 +2660,7 @@ async function removeEnvProvider() {
   try {
     const home = process.env.HOME || process.env.USERPROFILE || "";
     if (!home) return;
-    const envPath = path38.join(home, ".coco", ".env");
+    const envPath = path39.join(home, ".coco", ".env");
     let content;
     try {
       content = await fs5.promises.readFile(envPath, "utf-8");
@@ -2679,7 +2679,7 @@ async function migrateOldPreferences() {
   try {
     const home = process.env.HOME || process.env.USERPROFILE || "";
     if (!home) return;
-    const oldPrefsPath = path38.join(home, ".coco", "preferences.json");
+    const oldPrefsPath = path39.join(home, ".coco", "preferences.json");
     let oldPrefs = null;
     try {
       const content = await fs5.promises.readFile(oldPrefsPath, "utf-8");
@@ -2871,7 +2871,7 @@ function setupFileLogging(logger2, logDir, name) {
   if (!fs5__default.existsSync(logDir)) {
     fs5__default.mkdirSync(logDir, { recursive: true });
   }
-  const logFile = path38__default.join(logDir, `${name}.log`);
+  const logFile = path39__default.join(logDir, `${name}.log`);
   logger2.attachTransport((logObj) => {
     const line = JSON.stringify(logObj) + "\n";
     fs5__default.appendFileSync(logFile, line);
@@ -2890,7 +2890,7 @@ function setLogger(logger2) {
   globalLogger = logger2;
 }
 function initializeLogging(projectPath, level = "info") {
-  const logDir = path38__default.join(projectPath, ".coco", "logs");
+  const logDir = path39__default.join(projectPath, ".coco", "logs");
   const logger2 = createLogger({
     name: "coco",
     level,
@@ -7186,6 +7186,251 @@ var init_config = __esm({
   }
 });
 
+// src/mcp/config-loader.ts
+var config_loader_exports = {};
+__export(config_loader_exports, {
+  loadMCPConfigFile: () => loadMCPConfigFile,
+  loadMCPServersFromCOCOConfig: () => loadMCPServersFromCOCOConfig,
+  loadProjectMCPFile: () => loadProjectMCPFile,
+  mergeMCPConfigs: () => mergeMCPConfigs
+});
+function expandEnvVar(value) {
+  return value.replace(/\$\{([^}]+)\}/g, (match, name) => process.env[name] ?? match);
+}
+function expandEnvObject(env2) {
+  const result = {};
+  for (const [k, v] of Object.entries(env2)) {
+    result[k] = expandEnvVar(v);
+  }
+  return result;
+}
+function expandHeaders(headers) {
+  const result = {};
+  for (const [k, v] of Object.entries(headers)) {
+    result[k] = expandEnvVar(v);
+  }
+  return result;
+}
+function convertStandardEntry(name, entry) {
+  if (entry.command) {
+    return {
+      name,
+      transport: "stdio",
+      enabled: entry.enabled ?? true,
+      stdio: {
+        command: entry.command,
+        args: entry.args,
+        env: entry.env ? expandEnvObject(entry.env) : void 0
+      }
+    };
+  }
+  if (entry.url) {
+    const headers = entry.headers ? expandHeaders(entry.headers) : void 0;
+    const authHeader = headers?.["Authorization"] ?? headers?.["authorization"];
+    let auth;
+    if (authHeader) {
+      if (authHeader.startsWith("Bearer ")) {
+        auth = { type: "bearer", token: authHeader.slice(7) };
+      } else {
+        auth = { type: "apikey", token: authHeader };
+      }
+    }
+    return {
+      name,
+      transport: "http",
+      enabled: entry.enabled ?? true,
+      http: {
+        url: entry.url,
+        ...headers && Object.keys(headers).length > 0 ? { headers } : {},
+        ...auth ? { auth } : {}
+      }
+    };
+  }
+  throw new Error(`Server "${name}" must have either "command" (stdio) or "url" (http) defined`);
+}
+async function loadMCPConfigFile(configPath) {
+  try {
+    await access(configPath);
+  } catch {
+    throw new MCPError(-32003 /* CONNECTION_ERROR */, `Config file not found: ${configPath}`);
+  }
+  let content;
+  try {
+    content = await readFile(configPath, "utf-8");
+  } catch (error) {
+    throw new MCPError(
+      -32003 /* CONNECTION_ERROR */,
+      `Failed to read config file: ${error instanceof Error ? error.message : "Unknown error"}`
+    );
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(content);
+  } catch {
+    throw new MCPError(-32700 /* PARSE_ERROR */, "Invalid JSON in config file");
+  }
+  const obj = parsed;
+  if (obj.mcpServers && typeof obj.mcpServers === "object" && !Array.isArray(obj.mcpServers)) {
+    return loadStandardFormat(obj, configPath);
+  }
+  if (obj.servers && Array.isArray(obj.servers)) {
+    return loadCocoFormat(obj, configPath);
+  }
+  throw new MCPError(
+    -32602 /* INVALID_PARAMS */,
+    'Config file must have either a "mcpServers" object (standard) or a "servers" array (Coco format)'
+  );
+}
+function loadStandardFormat(config, configPath) {
+  const validServers = [];
+  const errors = [];
+  for (const [name, entry] of Object.entries(config.mcpServers)) {
+    if (name.startsWith("_")) continue;
+    try {
+      const converted = convertStandardEntry(name, entry);
+      validateServerConfig(converted);
+      validServers.push(converted);
+    } catch (error) {
+      const message = error instanceof Error ? error.message : "Unknown error";
+      errors.push(`Server '${name}': ${message}`);
+    }
+  }
+  if (errors.length > 0) {
+    getLogger().warn(`[MCP] Some servers in ${configPath} failed to load: ${errors.join("; ")}`);
+  }
+  return validServers;
+}
+async function loadProjectMCPFile(projectPath) {
+  const mcpJsonPath = path39__default.join(projectPath, ".mcp.json");
+  try {
+    await access(mcpJsonPath);
+  } catch {
+    return [];
+  }
+  try {
+    return await loadMCPConfigFile(mcpJsonPath);
+  } catch (error) {
+    getLogger().warn(
+      `[MCP] Failed to load .mcp.json: ${error instanceof Error ? error.message : String(error)}`
+    );
+    return [];
+  }
+}
+function loadCocoFormat(config, configPath) {
+  const validServers = [];
+  const errors = [];
+  for (const server of config.servers) {
+    try {
+      const converted = convertCocoServerEntry(server);
+      validateServerConfig(converted);
+      validServers.push(converted);
+    } catch (error) {
+      const message = error instanceof Error ? error.message : "Unknown error";
+      errors.push(`Server '${server.name || "unknown"}': ${message}`);
+    }
+  }
+  if (errors.length > 0) {
+    getLogger().warn(`[MCP] Some servers in ${configPath} failed to load: ${errors.join("; ")}`);
+  }
+  return validServers;
+}
+function convertCocoServerEntry(server) {
+  const base = {
+    name: server.name,
+    description: server.description,
+    transport: server.transport,
+    enabled: server.enabled ?? true,
+    metadata: server.metadata
+  };
+  if (server.transport === "stdio" && server.stdio) {
+    return {
+      ...base,
+      stdio: {
+        command: server.stdio.command,
+        args: server.stdio.args,
+        env: server.stdio.env ? expandEnvObject(server.stdio.env) : void 0,
+        cwd: server.stdio.cwd
+      }
+    };
+  }
+  if (server.transport === "http" && server.http) {
+    return {
+      ...base,
+      http: {
+        url: server.http.url,
+        ...server.http.headers ? { headers: expandHeaders(server.http.headers) } : {},
+        ...server.http.auth ? { auth: server.http.auth } : {},
+        ...server.http.timeout !== void 0 ? { timeout: server.http.timeout } : {}
+      }
+    };
+  }
+  throw new Error(`Missing configuration for transport: ${server.transport}`);
+}
+function mergeMCPConfigs(base, ...overrides) {
+  const merged = /* @__PURE__ */ new Map();
+  for (const server of base) {
+    merged.set(server.name, server);
+  }
+  for (const override of overrides) {
+    for (const server of override) {
+      const existing = merged.get(server.name);
+      if (existing) {
+        merged.set(server.name, { ...existing, ...server });
+      } else {
+        merged.set(server.name, server);
+      }
+    }
+  }
+  return Array.from(merged.values());
+}
+async function loadMCPServersFromCOCOConfig(configPath) {
+  const { loadConfig: loadConfig3 } = await Promise.resolve().then(() => (init_loader(), loader_exports));
+  const { MCPServerConfigEntrySchema: MCPServerConfigEntrySchema2 } = await Promise.resolve().then(() => (init_schema(), schema_exports));
+  const config = await loadConfig3(configPath);
+  if (!config.mcp?.servers || config.mcp.servers.length === 0) {
+    return [];
+  }
+  const servers = [];
+  for (const entry of config.mcp.servers) {
+    try {
+      const parsed = MCPServerConfigEntrySchema2.parse(entry);
+      const serverConfig = {
+        name: parsed.name,
+        description: parsed.description,
+        transport: parsed.transport,
+        enabled: parsed.enabled,
+        ...parsed.transport === "stdio" && parsed.command && {
+          stdio: {
+            command: parsed.command,
+            args: parsed.args,
+            env: parsed.env ? expandEnvObject(parsed.env) : void 0
+          }
+        },
+        ...parsed.transport === "http" && parsed.url && {
+          http: {
+            url: parsed.url,
+            auth: parsed.auth
+          }
+        }
+      };
+      validateServerConfig(serverConfig);
+      servers.push(serverConfig);
+    } catch (error) {
+      const message = error instanceof Error ? error.message : "Unknown error";
+      getLogger().warn(`[MCP] Failed to load server '${entry.name}': ${message}`);
+    }
+  }
+  return servers;
+}
+var init_config_loader = __esm({
+  "src/mcp/config-loader.ts"() {
+    init_config();
+    init_types();
+    init_errors2();
+    init_logger();
+  }
+});
+
 // src/mcp/registry.ts
 var registry_exports = {};
 __export(registry_exports, {
@@ -7286,7 +7531,14 @@ var init_registry = __esm({
         try {
           await access(this.registryPath);
           const content = await readFile(this.registryPath, "utf-8");
-          const servers = parseRegistry(content);
+          let servers = parseRegistry(content);
+          if (servers.length === 0) {
+            try {
+              const { loadMCPConfigFile: loadMCPConfigFile2 } = await Promise.resolve().then(() => (init_config_loader(), config_loader_exports));
+              servers = await loadMCPConfigFile2(this.registryPath);
+            } catch {
+            }
+          }
           this.servers.clear();
           for (const server of servers) {
             try {
@@ -7378,7 +7630,7 @@ __export(markdown_loader_exports, {
 });
 async function isMarkdownSkill(skillDir) {
   try {
-    await fs35__default.access(path38__default.join(skillDir, SKILL_FILENAME));
+    await fs35__default.access(path39__default.join(skillDir, SKILL_FILENAME));
     return true;
   } catch {
     return false;
@@ -7386,7 +7638,7 @@ async function isMarkdownSkill(skillDir) {
 }
 async function loadMarkdownMetadata(skillDir, scope) {
   try {
-    const skillPath = path38__default.join(skillDir, SKILL_FILENAME);
+    const skillPath = path39__default.join(skillDir, SKILL_FILENAME);
     const raw = await fs35__default.readFile(skillPath, "utf-8");
     const { data } = matter(raw);
     const parsed = SkillFrontmatterSchema.safeParse(data);
@@ -7394,8 +7646,8 @@ async function loadMarkdownMetadata(skillDir, scope) {
       return null;
     }
     const fm = parsed.data;
-    const dirName = path38__default.basename(skillDir);
-    const parentDir = path38__default.basename(path38__default.dirname(skillDir));
+    const dirName = path39__default.basename(skillDir);
+    const parentDir = path39__default.basename(path39__default.dirname(skillDir));
     const namespace = isNamespaceDirectory(parentDir) ? parentDir : void 0;
     const baseId = toKebabCase(fm.name || dirName);
     const fullId = namespace ? `${namespace}/${baseId}` : baseId;
@@ -7435,7 +7687,7 @@ async function loadMarkdownMetadata(skillDir, scope) {
 }
 async function loadMarkdownContent(skillDir) {
   try {
-    const skillPath = path38__default.join(skillDir, SKILL_FILENAME);
+    const skillPath = path39__default.join(skillDir, SKILL_FILENAME);
     const raw = await fs35__default.readFile(skillPath, "utf-8");
     const { content } = matter(raw);
     const references = await listSubdirectory(skillDir, "references");
@@ -7458,9 +7710,9 @@ async function loadMarkdownContent(skillDir) {
 }
 async function listSubdirectory(skillDir, subdir) {
   try {
-    const dir = path38__default.join(skillDir, subdir);
+    const dir = path39__default.join(skillDir, subdir);
     const entries = await fs35__default.readdir(dir, { withFileTypes: true });
-    return entries.filter((e) => e.isFile()).map((e) => path38__default.join(dir, e.name));
+    return entries.filter((e) => e.isFile()).map((e) => path39__default.join(dir, e.name));
   } catch {
     return [];
   }
@@ -7537,8 +7789,8 @@ async function loadSkillFromDirectory(skillDir, scope) {
   if (await isMarkdownSkill(skillDir)) {
     return loadMarkdownMetadata(skillDir, scope);
   }
-  const hasTs = await fileExists2(path38__default.join(skillDir, "index.ts"));
-  const hasJs = await fileExists2(path38__default.join(skillDir, "index.js"));
+  const hasTs = await fileExists2(path39__default.join(skillDir, "index.ts"));
+  const hasJs = await fileExists2(path39__default.join(skillDir, "index.js"));
   if (hasTs || hasJs) {
     return null;
   }
@@ -7581,8 +7833,8 @@ function normalizeDirectories(dirs, relativeBaseDir) {
   for (const dir of dirs) {
     const trimmed = dir.trim();
     if (!trimmed) continue;
-    const expanded = trimmed === "~" ? home : trimmed.startsWith("~/") ? path38__default.join(home, trimmed.slice(2)) : trimmed;
-    const resolved = path38__default.isAbsolute(expanded) ? path38__default.resolve(expanded) : path38__default.resolve(relativeBaseDir ?? process.cwd(), expanded);
+    const expanded = trimmed === "~" ? home : trimmed.startsWith("~/") ? path39__default.join(home, trimmed.slice(2)) : trimmed;
+    const resolved = path39__default.isAbsolute(expanded) ? path39__default.resolve(expanded) : path39__default.resolve(relativeBaseDir ?? process.cwd(), expanded);
     if (seen.has(resolved)) continue;
     seen.add(resolved);
     normalized.push(resolved);
@@ -7595,7 +7847,7 @@ function resolveDiscoveryDirs(projectPath, options) {
     opts.globalDirs && opts.globalDirs.length > 0 ? opts.globalDirs : opts.globalDir ? [opts.globalDir] : GLOBAL_SKILLS_DIRS
   );
   const projectDirs = normalizeDirectories(
-    opts.projectDirs && opts.projectDirs.length > 0 ? opts.projectDirs : opts.projectDir ? [opts.projectDir] : PROJECT_SKILLS_DIRNAMES.map((d) => path38__default.join(projectPath, d)),
+    opts.projectDirs && opts.projectDirs.length > 0 ? opts.projectDirs : opts.projectDir ? [opts.projectDir] : PROJECT_SKILLS_DIRNAMES.map((d) => path39__default.join(projectPath, d)),
     projectPath
   );
   return { globalDirs, projectDirs };
@@ -7627,7 +7879,7 @@ async function scanSkillsDirectory(dir, scope) {
     const skillDirs = entries.filter((e) => e.isDirectory() && !e.isSymbolicLink());
     const results = [];
     for (const entry of skillDirs) {
-      const entryPath = path38__default.join(dir, entry.name);
+      const entryPath = path39__default.join(dir, entry.name);
       try {
         const stat2 = await fs35__default.lstat(entryPath);
         if (stat2.isSymbolicLink()) continue;
@@ -7661,7 +7913,7 @@ async function scanNestedSkills(dir, scope, depth) {
     const subDirs = subEntries.filter((e) => e.isDirectory() && !e.isSymbolicLink());
     const results = await Promise.all(
       subDirs.map(async (sub) => {
-        const subPath = path38__default.join(dir, sub.name);
+        const subPath = path39__default.join(dir, sub.name);
         try {
           const stat2 = await fs35__default.lstat(subPath);
           if (stat2.isSymbolicLink()) return null;
@@ -7691,17 +7943,17 @@ var init_discovery = __esm({
     init_paths();
     init_logger();
     GLOBAL_SKILLS_DIRS = [
-      path38__default.join(homedir(), ".codex", "skills"),
+      path39__default.join(homedir(), ".codex", "skills"),
       // Codex CLI legacy compat
-      path38__default.join(homedir(), ".gemini", "skills"),
+      path39__default.join(homedir(), ".gemini", "skills"),
       // Gemini CLI compat
-      path38__default.join(homedir(), ".opencode", "skills"),
+      path39__default.join(homedir(), ".opencode", "skills"),
       // OpenCode compat
-      path38__default.join(homedir(), ".claude", "skills"),
+      path39__default.join(homedir(), ".claude", "skills"),
       // Claude Code compat
-      path38__default.join(homedir(), ".agents", "skills"),
+      path39__default.join(homedir(), ".agents", "skills"),
       // shared cross-agent standard
-      path38__default.join(COCO_HOME, "skills")
+      path39__default.join(COCO_HOME, "skills")
       // Coco native global directory (authoritative for Coco)
     ];
     PROJECT_SKILLS_DIRNAMES = [
@@ -9089,7 +9341,7 @@ var init_loader3 = __esm({
           const rawContent = await fs35.readFile(resolvedPath, "utf-8");
           const { content, imports } = await this.resolveImports(
             rawContent,
-            path38.dirname(resolvedPath),
+            path39.dirname(resolvedPath),
             0
           );
           const sections = this.parseSections(content);
@@ -9116,16 +9368,16 @@ var init_loader3 = __esm({
         if (this.config.includeUserLevel) {
           const userDir = this.resolvePath(USER_CONFIG_DIR);
           for (const pattern of this.config.filePatterns) {
-            const userPath = path38.join(userDir, pattern);
+            const userPath = path39.join(userDir, pattern);
             if (await this.fileExists(userPath)) {
               result.user = userPath;
               break;
             }
           }
         }
-        const absoluteProjectPath = path38.resolve(projectPath);
+        const absoluteProjectPath = path39.resolve(projectPath);
         for (const pattern of this.config.filePatterns) {
-          const projectFilePath = path38.join(absoluteProjectPath, pattern);
+          const projectFilePath = path39.join(absoluteProjectPath, pattern);
           if (await this.fileExists(projectFilePath)) {
             result.project = projectFilePath;
             break;
@@ -9133,14 +9385,14 @@ var init_loader3 = __esm({
         }
         const cwd = currentDir ?? process.cwd();
         if (cwd.startsWith(absoluteProjectPath) && cwd !== absoluteProjectPath) {
-          const relativePath = path38.relative(absoluteProjectPath, cwd);
-          const parts = relativePath.split(path38.sep);
+          const relativePath = path39.relative(absoluteProjectPath, cwd);
+          const parts = relativePath.split(path39.sep);
           const dirFiles = [];
           let currentDir2 = absoluteProjectPath;
           for (const part of parts) {
-            currentDir2 = path38.join(currentDir2, part);
+            currentDir2 = path39.join(currentDir2, part);
             for (const pattern of this.config.filePatterns) {
-              const dirFilePath = path38.join(currentDir2, pattern);
+              const dirFilePath = path39.join(currentDir2, pattern);
               if (await this.fileExists(dirFilePath)) {
                 dirFiles.push(dirFilePath);
                 break;
@@ -9154,7 +9406,7 @@ var init_loader3 = __esm({
         for (const pattern of this.config.filePatterns) {
           const baseName = pattern.replace(/\.md$/, "");
           const localFileName = `${baseName}${LOCAL_SUFFIX}`;
-          const localPath = path38.join(absoluteProjectPath, localFileName);
+          const localPath = path39.join(absoluteProjectPath, localFileName);
           if (await this.fileExists(localPath)) {
             result.local = localPath;
             break;
@@ -9208,7 +9460,7 @@ var init_loader3 = __esm({
                 const importedContent = await fs35.readFile(resolvedPath, "utf-8");
                 const nestedResult = await this.resolveImports(
                   importedContent,
-                  path38.dirname(resolvedPath),
+                  path39.dirname(resolvedPath),
                   depth + 1
                 );
                 processedLines.push(`<!-- Imported from: ${importPath} -->`);
@@ -9249,7 +9501,7 @@ var init_loader3 = __esm({
         const parts = [];
         for (const file of files) {
           if (file.exists && file.content.trim()) {
-            const label = file.level === "directory" ? `directory level (${path38.dirname(file.path)}/${path38.basename(file.path)})` : `${file.level} level (${path38.basename(file.path)})`;
+            const label = file.level === "directory" ? `directory level (${path39.dirname(file.path)}/${path39.basename(file.path)})` : `${file.level} level (${path39.basename(file.path)})`;
             parts.push(`<!-- Memory: ${label} -->`);
             parts.push(file.content);
             parts.push("");
@@ -9312,9 +9564,9 @@ var init_loader3 = __esm({
        */
       resolvePath(filePath) {
         if (filePath.startsWith("~")) {
-          return path38.join(os4.homedir(), filePath.slice(1));
+          return path39.join(os4.homedir(), filePath.slice(1));
         }
-        return path38.resolve(filePath);
+        return path39.resolve(filePath);
       }
       /**
        * Resolve an import path relative to a base directory.
@@ -9329,22 +9581,22 @@ var init_loader3 = __esm({
       resolveImportPath(importPath, basePath) {
         let resolved;
         if (importPath.startsWith("~")) {
-          resolved = path38.join(os4.homedir(), importPath.slice(1));
+          resolved = path39.join(os4.homedir(), importPath.slice(1));
           const userConfigDir = this.resolvePath(USER_CONFIG_DIR);
-          if (!resolved.startsWith(userConfigDir + path38.sep) && resolved !== userConfigDir) {
+          if (!resolved.startsWith(userConfigDir + path39.sep) && resolved !== userConfigDir) {
             throw new Error(`Import path escapes user config directory: @${importPath}`);
           }
           return resolved;
         }
-        if (path38.isAbsolute(importPath)) {
-          resolved = path38.resolve(importPath);
-          if (!resolved.startsWith(basePath + path38.sep) && resolved !== basePath) {
+        if (path39.isAbsolute(importPath)) {
+          resolved = path39.resolve(importPath);
+          if (!resolved.startsWith(basePath + path39.sep) && resolved !== basePath) {
             throw new Error(`Import path escapes project directory: @${importPath}`);
           }
           return resolved;
         }
-        resolved = path38.resolve(basePath, importPath);
-        if (!resolved.startsWith(basePath + path38.sep) && resolved !== basePath) {
+        resolved = path39.resolve(basePath, importPath);
+        if (!resolved.startsWith(basePath + path39.sep) && resolved !== basePath) {
           throw new Error(`Import path escapes project directory: @${importPath}`);
         }
         return resolved;
@@ -9511,7 +9763,7 @@ function generateToolCatalog(registry) {
   const tools = registry.getAll();
   const byCategory = /* @__PURE__ */ new Map();
   for (const tool of tools) {
-    const cat = tool.category;
+    const cat = tool.name.startsWith("mcp_") ? "mcp" : tool.category;
     if (!byCategory.has(cat)) byCategory.set(cat, []);
     byCategory.get(cat).push({ name: tool.name, description: tool.description });
   }
@@ -9932,9 +10184,10 @@ var init_session = __esm({
     init_manager();
     init_compactor();
     MAX_SKILL_INSTRUCTIONS_CHARS = 16e3;
-    TRUST_SETTINGS_DIR = path38__default.dirname(CONFIG_PATHS.trustedTools);
+    TRUST_SETTINGS_DIR = path39__default.dirname(CONFIG_PATHS.trustedTools);
     TRUST_SETTINGS_FILE = CONFIG_PATHS.trustedTools;
     CATEGORY_LABELS = {
+      mcp: "MCP Connected Services",
       file: "File Operations",
       bash: "Shell Commands",
       git: "Git & Version Control",
@@ -9964,6 +10217,8 @@ Rules:
 - NEVER show code blocks instead of writing files. NEVER describe actions instead of performing them.
 - NEVER ask "should I?" or "do you want me to?" \u2014 the user already told you. JUST DO IT.
 - If you need real-time data, CALL web_search. NEVER say "I don't have access to real-time data."
+- If an MCP tool exists for a service (tool names like \`mcp_<service>_...\`), prefer that MCP tool over generic \`web_fetch\` or \`http_fetch\`.
+- Use \`mcp_list_servers\` to inspect configured or connected MCP services. Do NOT use \`bash_exec\` to run \`coco mcp ...\` unless the user explicitly asked for that CLI command.
 - Before answering "I can't do that", check your full tool catalog below \u2014 you likely have a tool for it.
 - NEVER claim you cannot run a command because you lack credentials, access, or connectivity. bash_exec runs in the user's own shell environment and inherits their full PATH, kubeconfig, gcloud auth, AWS profiles, SSH keys, and every other tool installed on their machine. kubectl, gcloud, aws, docker, and any other CLI available to the user are available to you. ALWAYS attempt the command with bash_exec; report failure only if it actually returns a non-zero exit code.
 
@@ -10072,6 +10327,7 @@ Suggest 1-2 brief, actionable next steps:
 ## File Access
 File operations are restricted to the project directory by default.
 Use **authorize_path** to access paths outside the project \u2014 it prompts the user interactively.
+Exception: Coco's own config area under \`~/.coco/\` is first-party product state. You may read safe config files there, especially \`~/.coco/mcp.json\` and \`~/.coco/config.json\`, without using \`authorize_path\`.
 
 ## Tone and Brevity
 
@@ -10215,7 +10471,7 @@ var init_types4 = __esm({
   }
 });
 function getStatePath(projectPath) {
-  return path38.join(projectPath, ".coco", "state.json");
+  return path39.join(projectPath, ".coco", "state.json");
 }
 function createStateManager() {
   async function load(projectPath) {
@@ -10240,7 +10496,7 @@ function createStateManager() {
   }
   async function save(state) {
     const statePath = getStatePath(state.path);
-    await fs35.mkdir(path38.dirname(statePath), { recursive: true });
+    await fs35.mkdir(path39.dirname(statePath), { recursive: true });
     const file = {
       version: STATE_VERSION,
       state: {
@@ -12884,7 +13140,7 @@ var init_build_verifier = __esm({
       async verifyTypes() {
         const startTime = Date.now();
         try {
-          const hasTsConfig = await this.fileExists(path38.join(this.projectPath, "tsconfig.json"));
+          const hasTsConfig = await this.fileExists(path39.join(this.projectPath, "tsconfig.json"));
           if (!hasTsConfig) {
             return {
               success: true,
@@ -12934,18 +13190,18 @@ var init_build_verifier = __esm({
        * Checks Maven, Gradle, and Node.js in that order.
        */
       async detectBuildCommand() {
-        if (await this.fileExists(path38.join(this.projectPath, "pom.xml"))) {
-          const wrapper = path38.join(this.projectPath, "mvnw");
+        if (await this.fileExists(path39.join(this.projectPath, "pom.xml"))) {
+          const wrapper = path39.join(this.projectPath, "mvnw");
           return await this.fileExists(wrapper) ? "./mvnw compile -B -q" : "mvn compile -B -q";
         }
         for (const f of ["build.gradle", "build.gradle.kts"]) {
-          if (await this.fileExists(path38.join(this.projectPath, f))) {
-            const wrapper = path38.join(this.projectPath, "gradlew");
+          if (await this.fileExists(path39.join(this.projectPath, f))) {
+            const wrapper = path39.join(this.projectPath, "gradlew");
             return await this.fileExists(wrapper) ? "./gradlew classes -q" : "gradle classes -q";
           }
         }
         try {
-          const packageJsonPath = path38.join(this.projectPath, "package.json");
+          const packageJsonPath = path39.join(this.projectPath, "package.json");
           const content = await fs35.readFile(packageJsonPath, "utf-8");
           const packageJson = JSON.parse(content);
           if (packageJson.scripts?.build) {
@@ -14680,9 +14936,9 @@ function detectProjectLanguage(files) {
   return { language: dominant, confidence, evidence };
 }
 function getFileExtension(filePath) {
-  const base = path38.basename(filePath);
+  const base = path39.basename(filePath);
   if (base.endsWith(".d.ts")) return ".d.ts";
-  return path38.extname(filePath).toLowerCase();
+  return path39.extname(filePath).toLowerCase();
 }
 function buildEvidence(dominant, counts, totalSourceFiles, files) {
   const evidence = [];
@@ -14690,7 +14946,7 @@ function buildEvidence(dominant, counts, totalSourceFiles, files) {
   evidence.push(`${dominantCount} of ${totalSourceFiles} source files are ${dominant}`);
   const configFiles = ["tsconfig.json", "pom.xml", "build.gradle", "Cargo.toml", "go.mod"];
   for (const cfg of configFiles) {
-    if (files.some((f) => path38.basename(f) === cfg)) {
+    if (files.some((f) => path39.basename(f) === cfg)) {
       evidence.push(`Found ${cfg}`);
     }
   }
@@ -16185,19 +16441,19 @@ var init_evaluator = __esm({
 });
 async function detectLinter2(cwd) {
   try {
-    await fs35__default.access(path38__default.join(cwd, "pom.xml"));
+    await fs35__default.access(path39__default.join(cwd, "pom.xml"));
     return "maven-checkstyle";
   } catch {
   }
   for (const f of ["build.gradle", "build.gradle.kts"]) {
     try {
-      await fs35__default.access(path38__default.join(cwd, f));
+      await fs35__default.access(path39__default.join(cwd, f));
       return "gradle-checkstyle";
     } catch {
     }
   }
   try {
-    const pkgPath = path38__default.join(cwd, "package.json");
+    const pkgPath = path39__default.join(cwd, "package.json");
     const pkgContent = await fs35__default.readFile(pkgPath, "utf-8");
     const pkg = JSON.parse(pkgContent);
     const deps = {
@@ -16214,7 +16470,7 @@ async function detectLinter2(cwd) {
 }
 async function mavenExec(cwd) {
   try {
-    await fs35__default.access(path38__default.join(cwd, "mvnw"));
+    await fs35__default.access(path39__default.join(cwd, "mvnw"));
     return "./mvnw";
   } catch {
     return "mvn";
@@ -16222,7 +16478,7 @@ async function mavenExec(cwd) {
 }
 async function gradleExec(cwd) {
   try {
-    await fs35__default.access(path38__default.join(cwd, "gradlew"));
+    await fs35__default.access(path39__default.join(cwd, "gradlew"));
     return "./gradlew";
   } catch {
     return "gradle";
@@ -16291,14 +16547,14 @@ async function findSourceFiles(cwd) {
   const { glob: glob17 } = await import('glob');
   let isJava = false;
   try {
-    await fs35__default.access(path38__default.join(cwd, "pom.xml"));
+    await fs35__default.access(path39__default.join(cwd, "pom.xml"));
     isJava = true;
   } catch {
   }
   if (!isJava) {
     for (const f of ["build.gradle", "build.gradle.kts"]) {
       try {
-        await fs35__default.access(path38__default.join(cwd, f));
+        await fs35__default.access(path39__default.join(cwd, f));
         isJava = true;
         break;
       } catch {
@@ -16653,7 +16909,7 @@ async function checkTestCoverage(diff, cwd) {
     );
     if (!hasTestChange) {
       const ext = src.path.match(/\.(ts|tsx|js|jsx)$/)?.[0] ?? ".ts";
-      const testExists = await fileExists3(path38__default.join(cwd, `${baseName}.test${ext}`)) || await fileExists3(path38__default.join(cwd, `${baseName}.spec${ext}`));
+      const testExists = await fileExists3(path39__default.join(cwd, `${baseName}.test${ext}`)) || await fileExists3(path39__default.join(cwd, `${baseName}.spec${ext}`));
       if (testExists) {
         if (src.additions >= TEST_COVERAGE_LARGE_CHANGE_THRESHOLD) {
           findings.push({
@@ -18334,7 +18590,7 @@ var init_github = __esm({
 });
 async function detectVersionFile(cwd) {
   for (const { file, stack, field } of VERSION_FILES) {
-    const fullPath = path38__default.join(cwd, file);
+    const fullPath = path39__default.join(cwd, file);
     if (await fileExists3(fullPath)) {
       const version = await readVersionFromFile(fullPath, stack, field);
       if (version) {
@@ -18380,7 +18636,7 @@ function bumpVersion(current, bump) {
   }
 }
 async function writeVersion(cwd, versionFile, newVersion) {
-  const fullPath = path38__default.join(cwd, versionFile.path);
+  const fullPath = path39__default.join(cwd, versionFile.path);
   const content = await readFile(fullPath, "utf-8");
   let updated;
   switch (versionFile.stack) {
@@ -18439,7 +18695,7 @@ var init_version_detector = __esm({
 });
 async function detectChangelog(cwd) {
   for (const name of CHANGELOG_NAMES) {
-    const fullPath = path38__default.join(cwd, name);
+    const fullPath = path39__default.join(cwd, name);
     if (await fileExists3(fullPath)) {
       const content = await readFile(fullPath, "utf-8");
       const format = detectFormat(content);
@@ -18461,7 +18717,7 @@ function detectFormat(content) {
   return "custom";
 }
 async function insertChangelogEntry(cwd, changelog, version, entries, date) {
-  const fullPath = path38__default.join(cwd, changelog.path);
+  const fullPath = path39__default.join(cwd, changelog.path);
   const content = await readFile(fullPath, "utf-8");
   const dateStr = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
   const entry = buildEntry(changelog.format, version, entries, dateStr);
@@ -18522,11 +18778,11 @@ var init_changelog = __esm({
   }
 });
 async function detectStack(cwd) {
-  if (await fileExists3(path38__default.join(cwd, "package.json"))) return "node";
-  if (await fileExists3(path38__default.join(cwd, "Cargo.toml"))) return "rust";
-  if (await fileExists3(path38__default.join(cwd, "pyproject.toml"))) return "python";
-  if (await fileExists3(path38__default.join(cwd, "go.mod"))) return "go";
-  if (await fileExists3(path38__default.join(cwd, "pom.xml"))) return "java";
+  if (await fileExists3(path39__default.join(cwd, "package.json"))) return "node";
+  if (await fileExists3(path39__default.join(cwd, "Cargo.toml"))) return "rust";
+  if (await fileExists3(path39__default.join(cwd, "pyproject.toml"))) return "python";
+  if (await fileExists3(path39__default.join(cwd, "go.mod"))) return "go";
+  if (await fileExists3(path39__default.join(cwd, "pom.xml"))) return "java";
   return "unknown";
 }
 async function detectPackageManager(cwd, stack) {
@@ -18534,15 +18790,15 @@ async function detectPackageManager(cwd, stack) {
   if (stack === "python") return "pip";
   if (stack === "go") return "go";
   if (stack === "node") {
-    if (await fileExists3(path38__default.join(cwd, "pnpm-lock.yaml"))) return "pnpm";
-    if (await fileExists3(path38__default.join(cwd, "yarn.lock"))) return "yarn";
-    if (await fileExists3(path38__default.join(cwd, "bun.lockb"))) return "bun";
+    if (await fileExists3(path39__default.join(cwd, "pnpm-lock.yaml"))) return "pnpm";
+    if (await fileExists3(path39__default.join(cwd, "yarn.lock"))) return "yarn";
+    if (await fileExists3(path39__default.join(cwd, "bun.lockb"))) return "bun";
     return "npm";
   }
   return null;
 }
 async function detectCI(cwd) {
-  const ghDir = path38__default.join(cwd, ".github", "workflows");
+  const ghDir = path39__default.join(cwd, ".github", "workflows");
   if (await fileExists3(ghDir)) {
     let workflowFiles = [];
     let hasCodeQL = false;
@@ -18566,7 +18822,7 @@ async function detectCI(cwd) {
     }
     return { type: "github-actions", workflowFiles, hasCodeQL, hasLinting };
   }
-  if (await fileExists3(path38__default.join(cwd, ".gitlab-ci.yml"))) {
+  if (await fileExists3(path39__default.join(cwd, ".gitlab-ci.yml"))) {
     return {
       type: "gitlab-ci",
       workflowFiles: [".gitlab-ci.yml"],
@@ -18574,7 +18830,7 @@ async function detectCI(cwd) {
       hasLinting: false
     };
   }
-  if (await fileExists3(path38__default.join(cwd, ".circleci"))) {
+  if (await fileExists3(path39__default.join(cwd, ".circleci"))) {
     return { type: "circle-ci", workflowFiles: [], hasCodeQL: false, hasLinting: false };
   }
   return { type: "none", workflowFiles: [], hasCodeQL: false, hasLinting: false };
@@ -19945,8 +20201,8 @@ function hasNullByte(str) {
 }
 function isBlockedPath(absolute) {
   for (const blocked of BLOCKED_PATHS) {
-    const normalizedBlocked = path38__default.normalize(blocked);
-    if (absolute === normalizedBlocked || absolute.startsWith(normalizedBlocked + path38__default.sep)) {
+    const normalizedBlocked = path39__default.normalize(blocked);
+    if (absolute === normalizedBlocked || absolute.startsWith(normalizedBlocked + path39__default.sep)) {
       return blocked;
     }
   }
@@ -20040,7 +20296,7 @@ Examples:
           throw new ToolError("Invalid file path", { tool: "open_file" });
         }
         const workDir = cwd ?? process.cwd();
-        const absolute = path38__default.isAbsolute(filePath) ? path38__default.normalize(filePath) : path38__default.resolve(workDir, filePath);
+        const absolute = path39__default.isAbsolute(filePath) ? path39__default.normalize(filePath) : path39__default.resolve(workDir, filePath);
         const blockedBy = isBlockedPath(absolute);
         if (blockedBy) {
           throw new ToolError(`Access to system path '${blockedBy}' is not allowed`, {
@@ -20063,14 +20319,14 @@ Examples:
           };
         }
         if (isBlockedExecFile(absolute)) {
-          throw new ToolError(`Execution of sensitive file is blocked: ${path38__default.basename(absolute)}`, {
+          throw new ToolError(`Execution of sensitive file is blocked: ${path39__default.basename(absolute)}`, {
             tool: "open_file"
           });
         }
         if (args.length > 0 && hasDangerousArgs(args)) {
           throw new ToolError("Arguments contain dangerous patterns", { tool: "open_file" });
         }
-        const ext = path38__default.extname(absolute);
+        const ext = path39__default.extname(absolute);
         const interpreter = getInterpreter(ext);
         const executable = await isExecutable(absolute);
         let command;
@@ -20083,7 +20339,7 @@ Examples:
           cmdArgs = [...args];
         } else {
           throw new ToolError(
-            `Cannot execute '${path38__default.basename(absolute)}': no known interpreter for '${ext || "(no extension)"}' and file is not executable`,
+            `Cannot execute '${path39__default.basename(absolute)}': no known interpreter for '${ext || "(no extension)"}' and file is not executable`,
             { tool: "open_file" }
           );
         }
@@ -20255,10 +20511,10 @@ function getAllowedPaths() {
   return [...sessionAllowedPaths];
 }
 function isWithinAllowedPath(absolutePath, operation) {
-  const normalizedTarget = path38__default.normalize(absolutePath);
+  const normalizedTarget = path39__default.normalize(absolutePath);
   for (const entry of sessionAllowedPaths) {
-    const normalizedAllowed = path38__default.normalize(entry.path);
-    if (normalizedTarget === normalizedAllowed || normalizedTarget.startsWith(normalizedAllowed + path38__default.sep)) {
+    const normalizedAllowed = path39__default.normalize(entry.path);
+    if (normalizedTarget === normalizedAllowed || normalizedTarget.startsWith(normalizedAllowed + path39__default.sep)) {
       if (operation === "read") return true;
       if (entry.level === "write") return true;
     }
@@ -20266,8 +20522,8 @@ function isWithinAllowedPath(absolutePath, operation) {
   return false;
 }
 function addAllowedPathToSession(dirPath, level) {
-  const absolute = path38__default.resolve(dirPath);
-  if (sessionAllowedPaths.some((e) => path38__default.normalize(e.path) === path38__default.normalize(absolute))) {
+  const absolute = path39__default.resolve(dirPath);
+  if (sessionAllowedPaths.some((e) => path39__default.normalize(e.path) === path39__default.normalize(absolute))) {
     return;
   }
   sessionAllowedPaths.push({
@@ -20277,14 +20533,14 @@ function addAllowedPathToSession(dirPath, level) {
   });
 }
 function removeAllowedPathFromSession(dirPath) {
-  const absolute = path38__default.resolve(dirPath);
-  const normalized = path38__default.normalize(absolute);
+  const absolute = path39__default.resolve(dirPath);
+  const normalized = path39__default.normalize(absolute);
   const before = sessionAllowedPaths.length;
-  sessionAllowedPaths = sessionAllowedPaths.filter((e) => path38__default.normalize(e.path) !== normalized);
+  sessionAllowedPaths = sessionAllowedPaths.filter((e) => path39__default.normalize(e.path) !== normalized);
   return sessionAllowedPaths.length < before;
 }
 async function loadAllowedPaths(projectPath) {
-  currentProjectPath = path38__default.resolve(projectPath);
+  currentProjectPath = path39__default.resolve(projectPath);
   const store = await loadStore();
   const entries = store.projects[currentProjectPath] ?? [];
   for (const entry of entries) {
@@ -20293,14 +20549,14 @@ async function loadAllowedPaths(projectPath) {
 }
 async function persistAllowedPath(dirPath, level) {
   if (!currentProjectPath) return;
-  const absolute = path38__default.resolve(dirPath);
+  const absolute = path39__default.resolve(dirPath);
   const store = await loadStore();
   if (!store.projects[currentProjectPath]) {
     store.projects[currentProjectPath] = [];
   }
   const entries = store.projects[currentProjectPath];
-  const normalized = path38__default.normalize(absolute);
-  if (entries.some((e) => path38__default.normalize(e.path) === normalized)) {
+  const normalized = path39__default.normalize(absolute);
+  if (entries.some((e) => path39__default.normalize(e.path) === normalized)) {
     return;
   }
   entries.push({
@@ -20312,13 +20568,13 @@ async function persistAllowedPath(dirPath, level) {
 }
 async function removePersistedAllowedPath(dirPath) {
   if (!currentProjectPath) return false;
-  const absolute = path38__default.resolve(dirPath);
-  const normalized = path38__default.normalize(absolute);
+  const absolute = path39__default.resolve(dirPath);
+  const normalized = path39__default.normalize(absolute);
   const store = await loadStore();
   const entries = store.projects[currentProjectPath];
   if (!entries) return false;
   const before = entries.length;
-  store.projects[currentProjectPath] = entries.filter((e) => path38__default.normalize(e.path) !== normalized);
+  store.projects[currentProjectPath] = entries.filter((e) => path39__default.normalize(e.path) !== normalized);
   if (store.projects[currentProjectPath].length < before) {
     await saveStore(store);
     return true;
@@ -20335,7 +20591,7 @@ async function loadStore() {
 }
 async function saveStore(store) {
   try {
-    await fs35__default.mkdir(path38__default.dirname(STORE_FILE), { recursive: true });
+    await fs35__default.mkdir(path39__default.dirname(STORE_FILE), { recursive: true });
     await fs35__default.writeFile(STORE_FILE, JSON.stringify(store, null, 2), "utf-8");
   } catch {
   }
@@ -20344,7 +20600,7 @@ var STORE_FILE, DEFAULT_STORE, sessionAllowedPaths, currentProjectPath;
 var init_allowed_paths = __esm({
   "src/tools/allowed-paths.ts"() {
     init_paths();
-    STORE_FILE = path38__default.join(CONFIG_PATHS.home, "allowed-paths.json");
+    STORE_FILE = path39__default.join(CONFIG_PATHS.home, "allowed-paths.json");
     DEFAULT_STORE = {
       version: 1,
       projects: {}
@@ -20854,7 +21110,7 @@ async function loadStore2() {
   }
 }
 async function saveStore2(store) {
-  await fs35__default.mkdir(path38__default.dirname(TOKEN_STORE_PATH), { recursive: true });
+  await fs35__default.mkdir(path39__default.dirname(TOKEN_STORE_PATH), { recursive: true });
   await fs35__default.writeFile(TOKEN_STORE_PATH, JSON.stringify(store, null, 2), {
     encoding: "utf-8",
     mode: 384
@@ -21110,7 +21366,7 @@ async function authenticateMcpOAuth(params) {
   const resource = canonicalizeResourceUrl(params.resourceUrl);
   const store = await loadStore2();
   const stored = store.tokens[getResourceKey(resource)];
-  if (stored && !isTokenExpired2(stored)) {
+  if (stored && !params.forceRefresh && !isTokenExpired2(stored)) {
     return stored.accessToken;
   }
   if (!process.stdout.isTTY) {
@@ -21135,7 +21391,7 @@ async function authenticateMcpOAuth(params) {
     authorizationMetadata = await discoverAuthorizationServerMetadata(resource);
   }
   authorizationServer = authorizationServer ?? authorizationMetadata.issuer ?? new URL(resource).origin;
-  if (stored && isTokenExpired2(stored) && stored.refreshToken && stored.clientId) {
+  if (stored && stored.refreshToken && stored.clientId && (params.forceRefresh || isTokenExpired2(stored))) {
     try {
       const refreshed = await refreshAccessToken2({
         tokenEndpoint: authorizationMetadata.token_endpoint,
@@ -21201,7 +21457,7 @@ var init_oauth2 = __esm({
     init_paths();
     init_logger();
     execFileAsync2 = promisify(execFile);
-    TOKEN_STORE_PATH = path38__default.join(CONFIG_PATHS.tokens, "mcp-oauth.json");
+    TOKEN_STORE_PATH = path39__default.join(CONFIG_PATHS.tokens, "mcp-oauth.json");
     OAUTH_TIMEOUT_MS = 5 * 60 * 1e3;
     logger = getLogger();
   }
@@ -21280,18 +21536,22 @@ var init_http = __esm({
         }
         return true;
       }
-      async ensureOAuthToken(wwwAuthenticateHeader) {
-        if (this.oauthToken) {
+      async ensureOAuthToken(wwwAuthenticateHeader, options) {
+        if (this.oauthToken && !options?.forceRefresh) {
           return this.oauthToken;
         }
         if (this.oauthInFlight) {
           return this.oauthInFlight;
         }
         const serverName = this.config.name ?? this.config.url;
+        if (options?.forceRefresh) {
+          this.oauthToken = void 0;
+        }
         this.oauthInFlight = authenticateMcpOAuth({
           serverName,
           resourceUrl: this.config.url,
-          wwwAuthenticateHeader
+          wwwAuthenticateHeader,
+          forceRefresh: options?.forceRefresh
         }).then((token) => {
           this.oauthToken = token;
           return token;
@@ -21315,14 +21575,14 @@ var init_http = __esm({
           }
           return response;
         }
-        await this.ensureOAuthToken(response.headers.get("www-authenticate"));
+        await this.ensureOAuthToken(response.headers.get("www-authenticate"), { forceRefresh: true });
         response = await doFetch();
         return response;
       }
       looksLikeAuthErrorMessage(message) {
         if (!message) return false;
         const msg = message.toLowerCase();
-        const hasStrongAuthSignal = msg.includes("unauthorized") || msg.includes("unauthorised") || msg.includes("authentication") || msg.includes("oauth") || msg.includes("access token") || msg.includes("bearer") || msg.includes("not authenticated") || msg.includes("not logged") || msg.includes("login") || msg.includes("generate") && msg.includes("token");
+        const hasStrongAuthSignal = msg.includes("unauthorized") || msg.includes("unauthorised") || msg.includes("authentication") || msg.includes("oauth") || msg.includes("access token") || msg.includes("invalid_token") || msg.includes("invalid token") || msg.includes("token expired") || msg.includes("bearer") || msg.includes("not authenticated") || msg.includes("not logged") || msg.includes("login") || msg.includes("generate") && msg.includes("token");
         const hasVendorHint = msg.includes("gemini cli") || msg.includes("jira") || msg.includes("confluence") || msg.includes("atlassian");
         const hasWeakAuthSignal = msg.includes("authenticate") || msg.includes("token") || msg.includes("authorization");
         return hasStrongAuthSignal || // Vendor-specific hints alone are not enough; require an auth-related token too.
@@ -21396,7 +21656,9 @@ var init_http = __esm({
             }
             const data = await response.json();
             if (this.shouldAttemptOAuth() && this.isJsonRpcAuthError(data)) {
-              await this.ensureOAuthToken(response.headers.get("www-authenticate"));
+              await this.ensureOAuthToken(response.headers.get("www-authenticate"), {
+                forceRefresh: true
+              });
               const retryResponse = await this.sendRequestWithOAuthRetry(
                 "POST",
                 JSON.stringify(message),
@@ -22069,7 +22331,7 @@ __export(allow_path_prompt_exports, {
   promptAllowPath: () => promptAllowPath
 });
 async function promptAllowPath(dirPath) {
-  const absolute = path38__default.resolve(dirPath);
+  const absolute = path39__default.resolve(dirPath);
   console.log();
   console.log(chalk.yellow("  \u26A0 Access denied \u2014 path is outside the project directory"));
   console.log(chalk.dim(`  \u{1F4C1} ${absolute}`));
@@ -22311,13 +22573,13 @@ __export(stack_detector_exports, {
   detectProjectStack: () => detectProjectStack
 });
 async function detectStack2(cwd) {
-  if (await fileExists3(path38__default.join(cwd, "package.json"))) return "node";
-  if (await fileExists3(path38__default.join(cwd, "Cargo.toml"))) return "rust";
-  if (await fileExists3(path38__default.join(cwd, "pyproject.toml"))) return "python";
-  if (await fileExists3(path38__default.join(cwd, "go.mod"))) return "go";
-  if (await fileExists3(path38__default.join(cwd, "pom.xml"))) return "java";
-  if (await fileExists3(path38__default.join(cwd, "build.gradle"))) return "java";
-  if (await fileExists3(path38__default.join(cwd, "build.gradle.kts"))) return "java";
+  if (await fileExists3(path39__default.join(cwd, "package.json"))) return "node";
+  if (await fileExists3(path39__default.join(cwd, "Cargo.toml"))) return "rust";
+  if (await fileExists3(path39__default.join(cwd, "pyproject.toml"))) return "python";
+  if (await fileExists3(path39__default.join(cwd, "go.mod"))) return "go";
+  if (await fileExists3(path39__default.join(cwd, "pom.xml"))) return "java";
+  if (await fileExists3(path39__default.join(cwd, "build.gradle"))) return "java";
+  if (await fileExists3(path39__default.join(cwd, "build.gradle.kts"))) return "java";
   return "unknown";
 }
 async function detectPackageManager3(cwd, stack) {
@@ -22325,23 +22587,23 @@ async function detectPackageManager3(cwd, stack) {
   if (stack === "python") return "pip";
   if (stack === "go") return "go";
   if (stack === "java") {
-    if (await fileExists3(path38__default.join(cwd, "build.gradle")) || await fileExists3(path38__default.join(cwd, "build.gradle.kts"))) {
+    if (await fileExists3(path39__default.join(cwd, "build.gradle")) || await fileExists3(path39__default.join(cwd, "build.gradle.kts"))) {
       return "gradle";
     }
-    if (await fileExists3(path38__default.join(cwd, "pom.xml"))) {
+    if (await fileExists3(path39__default.join(cwd, "pom.xml"))) {
       return "maven";
     }
   }
   if (stack === "node") {
-    if (await fileExists3(path38__default.join(cwd, "pnpm-lock.yaml"))) return "pnpm";
-    if (await fileExists3(path38__default.join(cwd, "yarn.lock"))) return "yarn";
-    if (await fileExists3(path38__default.join(cwd, "bun.lockb"))) return "bun";
+    if (await fileExists3(path39__default.join(cwd, "pnpm-lock.yaml"))) return "pnpm";
+    if (await fileExists3(path39__default.join(cwd, "yarn.lock"))) return "yarn";
+    if (await fileExists3(path39__default.join(cwd, "bun.lockb"))) return "bun";
     return "npm";
   }
   return null;
 }
 async function parsePackageJson(cwd) {
-  const packageJsonPath = path38__default.join(cwd, "package.json");
+  const packageJsonPath = path39__default.join(cwd, "package.json");
   try {
     const content = await fs35__default.readFile(packageJsonPath, "utf-8");
     const pkg = JSON.parse(content);
@@ -22373,7 +22635,7 @@ async function parsePackageJson(cwd) {
     if (allDeps["@playwright/test"]) testingFrameworks.push("playwright");
     if (allDeps.cypress) testingFrameworks.push("cypress");
     const languages = ["JavaScript"];
-    if (allDeps.typescript || await fileExists3(path38__default.join(cwd, "tsconfig.json"))) {
+    if (allDeps.typescript || await fileExists3(path39__default.join(cwd, "tsconfig.json"))) {
       languages.push("TypeScript");
     }
     return {
@@ -22394,7 +22656,7 @@ async function parsePackageJson(cwd) {
   }
 }
 async function parsePomXml(cwd) {
-  const pomPath = path38__default.join(cwd, "pom.xml");
+  const pomPath = path39__default.join(cwd, "pom.xml");
   try {
     const content = await fs35__default.readFile(pomPath, "utf-8");
     const dependencies = {};
@@ -22431,7 +22693,7 @@ async function parsePomXml(cwd) {
   }
 }
 async function parsePyprojectToml(cwd) {
-  const pyprojectPath = path38__default.join(cwd, "pyproject.toml");
+  const pyprojectPath = path39__default.join(cwd, "pyproject.toml");
   try {
     const content = await fs35__default.readFile(pyprojectPath, "utf-8");
     const dependencies = {};
@@ -22474,7 +22736,7 @@ async function detectProjectStack(cwd) {
     testingFrameworks = parsed.testingFrameworks;
     languages = parsed.languages;
   } else if (stack === "java") {
-    const isGradle = await fileExists3(path38__default.join(cwd, "build.gradle")) || await fileExists3(path38__default.join(cwd, "build.gradle.kts"));
+    const isGradle = await fileExists3(path39__default.join(cwd, "build.gradle")) || await fileExists3(path39__default.join(cwd, "build.gradle.kts"));
     const parsed = isGradle ? { dependencies: {}, frameworks: [], buildTools: ["gradle"], testingFrameworks: ["JUnit"] } : await parsePomXml(cwd);
     dependencies = parsed.dependencies;
     frameworks = parsed.frameworks;
@@ -22522,6 +22784,14 @@ __export(tools_exports, {
   wrapMCPTool: () => wrapMCPTool,
   wrapMCPTools: () => wrapMCPTools
 });
+function buildMcpToolDescription(serverName, tool) {
+  const base = tool.description || `Tool '${tool.name}' exposed by MCP server '${serverName}'`;
+  const lowerServer = serverName.toLowerCase();
+  if (lowerServer.includes("atlassian") || lowerServer.includes("jira") || lowerServer.includes("confluence")) {
+    return `${base}. Use this MCP tool for Atlassian/Jira/Confluence data. Prefer it over direct web_fetch or http_fetch for Atlassian content.`;
+  }
+  return `${base}. Exposed by MCP server '${serverName}'. Prefer this MCP tool over generic web/http fetch when accessing data from that connected service.`;
+}
 function jsonSchemaToZod(schema) {
   if (schema.enum && Array.isArray(schema.enum)) {
     const values = schema.enum;
@@ -22674,7 +22944,7 @@ function wrapMCPTool(tool, serverName, client, options = {}) {
   const parametersSchema = createToolParametersSchema(tool);
   const cocoTool = {
     name: wrappedName,
-    description: tool.description || `MCP tool: ${tool.name}`,
+    description: buildMcpToolDescription(serverName, tool),
     category: opts.category,
     parameters: parametersSchema,
     execute: async (params) => {
@@ -22760,251 +23030,6 @@ var init_tools = __esm({
   }
 });
 
-// src/mcp/config-loader.ts
-var config_loader_exports = {};
-__export(config_loader_exports, {
-  loadMCPConfigFile: () => loadMCPConfigFile,
-  loadMCPServersFromCOCOConfig: () => loadMCPServersFromCOCOConfig,
-  loadProjectMCPFile: () => loadProjectMCPFile,
-  mergeMCPConfigs: () => mergeMCPConfigs
-});
-function expandEnvVar(value) {
-  return value.replace(/\$\{([^}]+)\}/g, (match, name) => process.env[name] ?? match);
-}
-function expandEnvObject(env2) {
-  const result = {};
-  for (const [k, v] of Object.entries(env2)) {
-    result[k] = expandEnvVar(v);
-  }
-  return result;
-}
-function expandHeaders(headers) {
-  const result = {};
-  for (const [k, v] of Object.entries(headers)) {
-    result[k] = expandEnvVar(v);
-  }
-  return result;
-}
-function convertStandardEntry(name, entry) {
-  if (entry.command) {
-    return {
-      name,
-      transport: "stdio",
-      enabled: entry.enabled ?? true,
-      stdio: {
-        command: entry.command,
-        args: entry.args,
-        env: entry.env ? expandEnvObject(entry.env) : void 0
-      }
-    };
-  }
-  if (entry.url) {
-    const headers = entry.headers ? expandHeaders(entry.headers) : void 0;
-    const authHeader = headers?.["Authorization"] ?? headers?.["authorization"];
-    let auth;
-    if (authHeader) {
-      if (authHeader.startsWith("Bearer ")) {
-        auth = { type: "bearer", token: authHeader.slice(7) };
-      } else {
-        auth = { type: "apikey", token: authHeader };
-      }
-    }
-    return {
-      name,
-      transport: "http",
-      enabled: entry.enabled ?? true,
-      http: {
-        url: entry.url,
-        ...headers && Object.keys(headers).length > 0 ? { headers } : {},
-        ...auth ? { auth } : {}
-      }
-    };
-  }
-  throw new Error(`Server "${name}" must have either "command" (stdio) or "url" (http) defined`);
-}
-async function loadMCPConfigFile(configPath) {
-  try {
-    await access(configPath);
-  } catch {
-    throw new MCPError(-32003 /* CONNECTION_ERROR */, `Config file not found: ${configPath}`);
-  }
-  let content;
-  try {
-    content = await readFile(configPath, "utf-8");
-  } catch (error) {
-    throw new MCPError(
-      -32003 /* CONNECTION_ERROR */,
-      `Failed to read config file: ${error instanceof Error ? error.message : "Unknown error"}`
-    );
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(content);
-  } catch {
-    throw new MCPError(-32700 /* PARSE_ERROR */, "Invalid JSON in config file");
-  }
-  const obj = parsed;
-  if (obj.mcpServers && typeof obj.mcpServers === "object" && !Array.isArray(obj.mcpServers)) {
-    return loadStandardFormat(obj, configPath);
-  }
-  if (obj.servers && Array.isArray(obj.servers)) {
-    return loadCocoFormat(obj, configPath);
-  }
-  throw new MCPError(
-    -32602 /* INVALID_PARAMS */,
-    'Config file must have either a "mcpServers" object (standard) or a "servers" array (Coco format)'
-  );
-}
-function loadStandardFormat(config, configPath) {
-  const validServers = [];
-  const errors = [];
-  for (const [name, entry] of Object.entries(config.mcpServers)) {
-    if (name.startsWith("_")) continue;
-    try {
-      const converted = convertStandardEntry(name, entry);
-      validateServerConfig(converted);
-      validServers.push(converted);
-    } catch (error) {
-      const message = error instanceof Error ? error.message : "Unknown error";
-      errors.push(`Server '${name}': ${message}`);
-    }
-  }
-  if (errors.length > 0) {
-    getLogger().warn(`[MCP] Some servers in ${configPath} failed to load: ${errors.join("; ")}`);
-  }
-  return validServers;
-}
-async function loadProjectMCPFile(projectPath) {
-  const mcpJsonPath = path38__default.join(projectPath, ".mcp.json");
-  try {
-    await access(mcpJsonPath);
-  } catch {
-    return [];
-  }
-  try {
-    return await loadMCPConfigFile(mcpJsonPath);
-  } catch (error) {
-    getLogger().warn(
-      `[MCP] Failed to load .mcp.json: ${error instanceof Error ? error.message : String(error)}`
-    );
-    return [];
-  }
-}
-function loadCocoFormat(config, configPath) {
-  const validServers = [];
-  const errors = [];
-  for (const server of config.servers) {
-    try {
-      const converted = convertCocoServerEntry(server);
-      validateServerConfig(converted);
-      validServers.push(converted);
-    } catch (error) {
-      const message = error instanceof Error ? error.message : "Unknown error";
-      errors.push(`Server '${server.name || "unknown"}': ${message}`);
-    }
-  }
-  if (errors.length > 0) {
-    getLogger().warn(`[MCP] Some servers in ${configPath} failed to load: ${errors.join("; ")}`);
-  }
-  return validServers;
-}
-function convertCocoServerEntry(server) {
-  const base = {
-    name: server.name,
-    description: server.description,
-    transport: server.transport,
-    enabled: server.enabled ?? true,
-    metadata: server.metadata
-  };
-  if (server.transport === "stdio" && server.stdio) {
-    return {
-      ...base,
-      stdio: {
-        command: server.stdio.command,
-        args: server.stdio.args,
-        env: server.stdio.env ? expandEnvObject(server.stdio.env) : void 0,
-        cwd: server.stdio.cwd
-      }
-    };
-  }
-  if (server.transport === "http" && server.http) {
-    return {
-      ...base,
-      http: {
-        url: server.http.url,
-        ...server.http.headers ? { headers: expandHeaders(server.http.headers) } : {},
-        ...server.http.auth ? { auth: server.http.auth } : {},
-        ...server.http.timeout !== void 0 ? { timeout: server.http.timeout } : {}
-      }
-    };
-  }
-  throw new Error(`Missing configuration for transport: ${server.transport}`);
-}
-function mergeMCPConfigs(base, ...overrides) {
-  const merged = /* @__PURE__ */ new Map();
-  for (const server of base) {
-    merged.set(server.name, server);
-  }
-  for (const override of overrides) {
-    for (const server of override) {
-      const existing = merged.get(server.name);
-      if (existing) {
-        merged.set(server.name, { ...existing, ...server });
-      } else {
-        merged.set(server.name, server);
-      }
-    }
-  }
-  return Array.from(merged.values());
-}
-async function loadMCPServersFromCOCOConfig(configPath) {
-  const { loadConfig: loadConfig3 } = await Promise.resolve().then(() => (init_loader(), loader_exports));
-  const { MCPServerConfigEntrySchema: MCPServerConfigEntrySchema2 } = await Promise.resolve().then(() => (init_schema(), schema_exports));
-  const config = await loadConfig3(configPath);
-  if (!config.mcp?.servers || config.mcp.servers.length === 0) {
-    return [];
-  }
-  const servers = [];
-  for (const entry of config.mcp.servers) {
-    try {
-      const parsed = MCPServerConfigEntrySchema2.parse(entry);
-      const serverConfig = {
-        name: parsed.name,
-        description: parsed.description,
-        transport: parsed.transport,
-        enabled: parsed.enabled,
-        ...parsed.transport === "stdio" && parsed.command && {
-          stdio: {
-            command: parsed.command,
-            args: parsed.args,
-            env: parsed.env ? expandEnvObject(parsed.env) : void 0
-          }
-        },
-        ...parsed.transport === "http" && parsed.url && {
-          http: {
-            url: parsed.url,
-            auth: parsed.auth
-          }
-        }
-      };
-      validateServerConfig(serverConfig);
-      servers.push(serverConfig);
-    } catch (error) {
-      const message = error instanceof Error ? error.message : "Unknown error";
-      getLogger().warn(`[MCP] Failed to load server '${entry.name}': ${message}`);
-    }
-  }
-  return servers;
-}
-var init_config_loader = __esm({
-  "src/mcp/config-loader.ts"() {
-    init_config();
-    init_types();
-    init_errors2();
-    init_logger();
-  }
-});
-
 // src/cli/repl/hooks/types.ts
 function isHookEvent(value) {
   return typeof value === "string" && HOOK_EVENTS.includes(value);
@@ -24187,23 +24212,23 @@ init_version();
 // src/orchestrator/project.ts
 init_env();
 async function createProjectStructure(projectPath, info) {
-  const cocoPath = path38__default.join(projectPath, ".coco");
+  const cocoPath = path39__default.join(projectPath, ".coco");
   const directories = [
     cocoPath,
-    path38__default.join(cocoPath, "state"),
-    path38__default.join(cocoPath, "checkpoints"),
-    path38__default.join(cocoPath, "logs"),
-    path38__default.join(cocoPath, "discovery"),
-    path38__default.join(cocoPath, "spec"),
-    path38__default.join(cocoPath, "architecture"),
-    path38__default.join(cocoPath, "architecture", "adrs"),
-    path38__default.join(cocoPath, "architecture", "diagrams"),
-    path38__default.join(cocoPath, "planning"),
-    path38__default.join(cocoPath, "planning", "epics"),
-    path38__default.join(cocoPath, "execution"),
-    path38__default.join(cocoPath, "versions"),
-    path38__default.join(cocoPath, "reviews"),
-    path38__default.join(cocoPath, "delivery")
+    path39__default.join(cocoPath, "state"),
+    path39__default.join(cocoPath, "checkpoints"),
+    path39__default.join(cocoPath, "logs"),
+    path39__default.join(cocoPath, "discovery"),
+    path39__default.join(cocoPath, "spec"),
+    path39__default.join(cocoPath, "architecture"),
+    path39__default.join(cocoPath, "architecture", "adrs"),
+    path39__default.join(cocoPath, "architecture", "diagrams"),
+    path39__default.join(cocoPath, "planning"),
+    path39__default.join(cocoPath, "planning", "epics"),
+    path39__default.join(cocoPath, "execution"),
+    path39__default.join(cocoPath, "versions"),
+    path39__default.join(cocoPath, "reviews"),
+    path39__default.join(cocoPath, "delivery")
   ];
   for (const dir of directories) {
     await fs35__default.mkdir(dir, { recursive: true });
@@ -24241,7 +24266,7 @@ async function createInitialConfig(cocoPath, info) {
       maxCheckpoints: 50
     }
   };
-  await fs35__default.writeFile(path38__default.join(cocoPath, "config.json"), JSON.stringify(config, null, 2), "utf-8");
+  await fs35__default.writeFile(path39__default.join(cocoPath, "config.json"), JSON.stringify(config, null, 2), "utf-8");
 }
 async function createProjectState(cocoPath, info) {
   const state = {
@@ -24259,7 +24284,7 @@ async function createProjectState(cocoPath, info) {
     lastCheckpoint: null
   };
   await fs35__default.writeFile(
-    path38__default.join(cocoPath, "state", "project.json"),
+    path39__default.join(cocoPath, "state", "project.json"),
     JSON.stringify(state, null, 2),
     "utf-8"
   );
@@ -24280,7 +24305,7 @@ checkpoints/
 state/session.json
 state/lock.json
 `;
-  await fs35__default.writeFile(path38__default.join(cocoPath, ".gitignore"), content, "utf-8");
+  await fs35__default.writeFile(path39__default.join(cocoPath, ".gitignore"), content, "utf-8");
 }
 async function createReadme(cocoPath, info) {
   const content = `# Corbat-Coco Project: ${info.name}
@@ -24327,7 +24352,7 @@ Edit \`config.json\` to customize:
 ---
 Generated by Corbat-Coco v0.1.0
 `;
-  await fs35__default.writeFile(path38__default.join(cocoPath, "README.md"), content, "utf-8");
+  await fs35__default.writeFile(path39__default.join(cocoPath, "README.md"), content, "utf-8");
 }
 
 // src/cli/commands/init.ts
@@ -25631,13 +25656,13 @@ function createSpecificationGenerator(llm, config) {
 // src/phases/converge/persistence.ts
 init_errors();
 function getPersistencePaths(projectPath) {
-  const baseDir = path38__default.join(projectPath, ".coco", "spec");
+  const baseDir = path39__default.join(projectPath, ".coco", "spec");
   return {
     baseDir,
-    sessionFile: path38__default.join(baseDir, "discovery-session.json"),
-    specFile: path38__default.join(baseDir, "spec.md"),
-    conversationLog: path38__default.join(baseDir, "conversation.jsonl"),
-    checkpointFile: path38__default.join(baseDir, "checkpoint.json")
+    sessionFile: path39__default.join(baseDir, "discovery-session.json"),
+    specFile: path39__default.join(baseDir, "spec.md"),
+    conversationLog: path39__default.join(baseDir, "conversation.jsonl"),
+    checkpointFile: path39__default.join(baseDir, "checkpoint.json")
   };
 }
 var SessionPersistence = class {
@@ -27741,7 +27766,7 @@ var OrchestrateExecutor = class {
   }
   async loadSpecification(projectPath) {
     try {
-      const jsonPath = path38__default.join(projectPath, ".coco", "spec", "spec.json");
+      const jsonPath = path39__default.join(projectPath, ".coco", "spec", "spec.json");
       const jsonContent = await fs35__default.readFile(jsonPath, "utf-8");
       return JSON.parse(jsonContent);
     } catch {
@@ -27753,7 +27778,7 @@ var OrchestrateExecutor = class {
       version: "1.0.0",
       generatedAt: /* @__PURE__ */ new Date(),
       overview: {
-        name: path38__default.basename(projectPath),
+        name: path39__default.basename(projectPath),
         description: "Project specification",
         goals: [],
         targetUsers: ["developers"],
@@ -27780,52 +27805,52 @@ var OrchestrateExecutor = class {
     };
   }
   async saveArchitecture(projectPath, architecture) {
-    const dir = path38__default.join(projectPath, ".coco", "architecture");
+    const dir = path39__default.join(projectPath, ".coco", "architecture");
     await fs35__default.mkdir(dir, { recursive: true });
-    const mdPath = path38__default.join(dir, "ARCHITECTURE.md");
+    const mdPath = path39__default.join(dir, "ARCHITECTURE.md");
     await fs35__default.writeFile(mdPath, generateArchitectureMarkdown(architecture), "utf-8");
-    const jsonPath = path38__default.join(dir, "architecture.json");
+    const jsonPath = path39__default.join(dir, "architecture.json");
     await fs35__default.writeFile(jsonPath, JSON.stringify(architecture, null, 2), "utf-8");
     return mdPath;
   }
   async saveADRs(projectPath, adrs) {
-    const dir = path38__default.join(projectPath, ".coco", "architecture", "adrs");
+    const dir = path39__default.join(projectPath, ".coco", "architecture", "adrs");
     await fs35__default.mkdir(dir, { recursive: true });
     const paths = [];
-    const indexPath = path38__default.join(dir, "README.md");
+    const indexPath = path39__default.join(dir, "README.md");
     await fs35__default.writeFile(indexPath, generateADRIndexMarkdown(adrs), "utf-8");
     paths.push(indexPath);
     for (const adr of adrs) {
       const filename = getADRFilename(adr);
-      const adrPath = path38__default.join(dir, filename);
+      const adrPath = path39__default.join(dir, filename);
       await fs35__default.writeFile(adrPath, generateADRMarkdown(adr), "utf-8");
       paths.push(adrPath);
     }
     return paths;
   }
   async saveBacklog(projectPath, backlogResult) {
-    const dir = path38__default.join(projectPath, ".coco", "planning");
+    const dir = path39__default.join(projectPath, ".coco", "planning");
     await fs35__default.mkdir(dir, { recursive: true });
-    const mdPath = path38__default.join(dir, "BACKLOG.md");
+    const mdPath = path39__default.join(dir, "BACKLOG.md");
     await fs35__default.writeFile(mdPath, generateBacklogMarkdown(backlogResult.backlog), "utf-8");
-    const jsonPath = path38__default.join(dir, "backlog.json");
+    const jsonPath = path39__default.join(dir, "backlog.json");
     await fs35__default.writeFile(jsonPath, JSON.stringify(backlogResult, null, 2), "utf-8");
     return mdPath;
   }
   async saveSprint(projectPath, sprint, backlogResult) {
-    const dir = path38__default.join(projectPath, ".coco", "planning", "sprints");
+    const dir = path39__default.join(projectPath, ".coco", "planning", "sprints");
     await fs35__default.mkdir(dir, { recursive: true });
     const filename = `${sprint.id}.md`;
-    const sprintPath = path38__default.join(dir, filename);
+    const sprintPath = path39__default.join(dir, filename);
     await fs35__default.writeFile(sprintPath, generateSprintMarkdown(sprint, backlogResult.backlog), "utf-8");
-    const jsonPath = path38__default.join(dir, `${sprint.id}.json`);
+    const jsonPath = path39__default.join(dir, `${sprint.id}.json`);
     await fs35__default.writeFile(jsonPath, JSON.stringify(sprint, null, 2), "utf-8");
     return sprintPath;
   }
   async saveDiagram(projectPath, id, mermaid) {
-    const dir = path38__default.join(projectPath, ".coco", "architecture", "diagrams");
+    const dir = path39__default.join(projectPath, ".coco", "architecture", "diagrams");
     await fs35__default.mkdir(dir, { recursive: true });
-    const diagramPath = path38__default.join(dir, `${id}.mmd`);
+    const diagramPath = path39__default.join(dir, `${id}.mmd`);
     await fs35__default.writeFile(diagramPath, mermaid, "utf-8");
     return diagramPath;
   }
@@ -30076,10 +30101,10 @@ async function runAdd(source, options) {
   const isGithubShorthand = source.includes("/") && !isGitUrl;
   const isLocalPath = source.startsWith(".") || source.startsWith("/");
   if (isLocalPath) {
-    const targetDir = options.global ? CONFIG_PATHS.skills : path38__default.join(process.cwd(), ".agents", "skills");
-    const sourcePath = path38__default.resolve(source);
-    const skillName = path38__default.basename(sourcePath);
-    const destPath = path38__default.join(targetDir, skillName);
+    const targetDir = options.global ? CONFIG_PATHS.skills : path39__default.join(process.cwd(), ".agents", "skills");
+    const sourcePath = path39__default.resolve(source);
+    const skillName = path39__default.basename(sourcePath);
+    const destPath = path39__default.join(targetDir, skillName);
     try {
       await fs35__default.mkdir(targetDir, { recursive: true });
       await fs35__default.cp(sourcePath, destPath, { recursive: true });
@@ -30113,10 +30138,10 @@ async function runAdd(source, options) {
       p26.log.info("Try installing manually: git clone the repo into .agents/skills/");
     }
   } else if (isGitUrl) {
-    const targetDir = options.global ? CONFIG_PATHS.skills : path38__default.join(process.cwd(), ".agents", "skills");
+    const targetDir = options.global ? CONFIG_PATHS.skills : path39__default.join(process.cwd(), ".agents", "skills");
     await fs35__default.mkdir(targetDir, { recursive: true });
     const skillName = source.split("/").pop()?.replace(".git", "") ?? "skill";
-    const skillDir = path38__default.join(targetDir, skillName);
+    const skillDir = path39__default.join(targetDir, skillName);
     const spinner18 = p26.spinner();
     spinner18.start(`Cloning ${source}...`);
     try {
@@ -30142,9 +30167,9 @@ async function runAdd(source, options) {
 }
 async function runRemove(name, options) {
   p26.intro(chalk.magenta("Remove Skill"));
-  const targetDir = options.global ? CONFIG_PATHS.skills : path38__default.join(process.cwd(), ".agents", "skills");
-  const skillPath = path38__default.resolve(targetDir, name);
-  if (!skillPath.startsWith(path38__default.resolve(targetDir) + path38__default.sep)) {
+  const targetDir = options.global ? CONFIG_PATHS.skills : path39__default.join(process.cwd(), ".agents", "skills");
+  const skillPath = path39__default.resolve(targetDir, name);
+  if (!skillPath.startsWith(path39__default.resolve(targetDir) + path39__default.sep)) {
     p26.log.error(`Invalid skill name: "${name}"`);
     p26.outro("");
     return;
@@ -30228,8 +30253,8 @@ async function runInfo(name) {
 }
 async function runCreate(name, options) {
   p26.intro(chalk.magenta("Create Skill"));
-  const targetDir = options.global ? CONFIG_PATHS.skills : path38__default.join(process.cwd(), ".agents", "skills");
-  const skillDir = path38__default.join(targetDir, name);
+  const targetDir = options.global ? CONFIG_PATHS.skills : path39__default.join(process.cwd(), ".agents", "skills");
+  const skillDir = path39__default.join(targetDir, name);
   try {
     await fs35__default.access(skillDir);
     p26.log.error(`Skill "${name}" already exists at ${skillDir}`);
@@ -30282,10 +30307,10 @@ when this skill is activated (automatically via matching or manually via /${name
 2. Include examples when helpful
 3. Keep instructions under 500 lines
 `;
-  await fs35__default.writeFile(path38__default.join(skillDir, "SKILL.md"), skillMd, "utf-8");
-  await fs35__default.mkdir(path38__default.join(skillDir, "references"), { recursive: true });
+  await fs35__default.writeFile(path39__default.join(skillDir, "SKILL.md"), skillMd, "utf-8");
+  await fs35__default.mkdir(path39__default.join(skillDir, "references"), { recursive: true });
   p26.log.success(`Created skill at ${skillDir}`);
-  p26.log.info(`Edit ${path38__default.join(skillDir, "SKILL.md")} to add instructions.`);
+  p26.log.info(`Edit ${path39__default.join(skillDir, "SKILL.md")} to add instructions.`);
   p26.outro("");
 }
 function registerWinner(winners, candidate, candidateScanOrder, scanOrderById) {
@@ -33982,7 +34007,7 @@ async function saveConfiguration(result) {
 }
 async function saveEnvVars(filePath, vars, createDir = false) {
   if (createDir) {
-    const dir = path38.dirname(filePath);
+    const dir = path39.dirname(filePath);
     try {
       await fs35.mkdir(dir, { recursive: true, mode: 448 });
     } catch {
@@ -35553,7 +35578,7 @@ var buildCommand = {
 };
 async function loadBacklog(projectPath) {
   try {
-    const backlogPath = path38.join(projectPath, ".coco", "planning", "backlog.json");
+    const backlogPath = path39.join(projectPath, ".coco", "planning", "backlog.json");
     const content = await fs35.readFile(backlogPath, "utf-8");
     const data = JSON.parse(content);
     return data.backlog;
@@ -35563,13 +35588,13 @@ async function loadBacklog(projectPath) {
 }
 async function loadSprint(projectPath, sprintId) {
   try {
-    const sprintsDir = path38.join(projectPath, ".coco", "planning", "sprints");
+    const sprintsDir = path39.join(projectPath, ".coco", "planning", "sprints");
     const files = await fs35.readdir(sprintsDir);
     const jsonFiles = files.filter((f) => f.endsWith(".json"));
     if (jsonFiles.length === 0) return null;
     const targetFile = sprintId ? jsonFiles.find((f) => f.includes(sprintId)) : jsonFiles[0];
     if (!targetFile) return null;
-    const sprintPath = path38.join(sprintsDir, targetFile);
+    const sprintPath = path39.join(sprintsDir, targetFile);
     const content = await fs35.readFile(sprintPath, "utf-8");
     return JSON.parse(content);
   } catch {
@@ -35577,7 +35602,7 @@ async function loadSprint(projectPath, sprintId) {
   }
 }
 async function saveBacklog(projectPath, backlog) {
-  const backlogPath = path38.join(projectPath, ".coco", "planning", "backlog.json");
+  const backlogPath = path39.join(projectPath, ".coco", "planning", "backlog.json");
   const content = await fs35.readFile(backlogPath, "utf-8");
   const data = JSON.parse(content);
   data.backlog = backlog;
@@ -36287,7 +36312,7 @@ function getLevelName(level) {
 function displayMemoryFile(file) {
   const { emoji, color } = getLevelStyle(file.level);
   const levelName = getLevelName(file.level);
-  const fileName = path38__default.basename(file.path);
+  const fileName = path39__default.basename(file.path);
   console.log();
   console.log(
     `${emoji} ${color.bold(levelName)} ${chalk.dim(`(${fileName})`)} ${chalk.dim(file.path)}`
@@ -36382,7 +36407,7 @@ var memoryCommand = {
           )
         );
         for (const f of reloaded) {
-          const fileName = path38__default.basename(f.path);
+          const fileName = path39__default.basename(f.path);
           console.log(chalk.dim(`  ${fileName} (${formatSize(f.content?.length ?? 0)})`));
         }
       } else {
@@ -37253,8 +37278,8 @@ var NPM_REGISTRY_URL = "https://registry.npmjs.org/@corbat-tech/coco/latest";
 var CHECK_INTERVAL_MS = 24 * 60 * 60 * 1e3;
 var FETCH_TIMEOUT_MS = 5e3;
 var STARTUP_TIMEOUT_MS = 5500;
-var CACHE_DIR = path38__default.join(os4__default.homedir(), ".coco");
-var CACHE_FILE = path38__default.join(CACHE_DIR, "version-check-cache.json");
+var CACHE_DIR = path39__default.join(os4__default.homedir(), ".coco");
+var CACHE_FILE = path39__default.join(CACHE_DIR, "version-check-cache.json");
 function compareVersions(a, b) {
   const partsA = a.replace(/^v/, "").split(".").map((p45) => Number(p45.replace(/-.*$/, "")));
   const partsB = b.replace(/^v/, "").split(".").map((p45) => Number(p45.replace(/-.*$/, "")));
@@ -37596,7 +37621,7 @@ async function readClipboardImage() {
   return null;
 }
 async function readClipboardImageMacOS() {
-  const tmpFile = path38.join(os4.tmpdir(), `coco-clipboard-${Date.now()}.png`);
+  const tmpFile = path39.join(os4.tmpdir(), `coco-clipboard-${Date.now()}.png`);
   try {
     const script = `
 set theFile to POSIX file "${tmpFile}"
@@ -37658,7 +37683,7 @@ async function readClipboardImageLinux() {
   }
 }
 async function readClipboardImageWindows() {
-  const tmpFile = path38.join(os4.tmpdir(), `coco-clipboard-${Date.now()}.png`);
+  const tmpFile = path39.join(os4.tmpdir(), `coco-clipboard-${Date.now()}.png`);
   try {
     const escapedPath = tmpFile.replace(/'/g, "''");
     const script = `
@@ -37783,7 +37808,7 @@ var allowPathCommand = {
   }
 };
 async function addPath(dirPath, session) {
-  const absolute = path38__default.resolve(dirPath);
+  const absolute = path39__default.resolve(dirPath);
   try {
     const stat2 = await fs35__default.stat(absolute);
     if (!stat2.isDirectory()) {
@@ -37795,19 +37820,19 @@ async function addPath(dirPath, session) {
     return;
   }
   for (const blocked of BLOCKED_SYSTEM_PATHS) {
-    const normalizedBlocked = path38__default.normalize(blocked);
-    if (absolute === normalizedBlocked || absolute.startsWith(normalizedBlocked + path38__default.sep)) {
+    const normalizedBlocked = path39__default.normalize(blocked);
+    if (absolute === normalizedBlocked || absolute.startsWith(normalizedBlocked + path39__default.sep)) {
       p26.log.error(`System path '${blocked}' cannot be allowed`);
       return;
     }
   }
-  const normalizedCwd = path38__default.normalize(session.projectPath);
-  if (absolute === normalizedCwd || absolute.startsWith(normalizedCwd + path38__default.sep)) {
+  const normalizedCwd = path39__default.normalize(session.projectPath);
+  if (absolute === normalizedCwd || absolute.startsWith(normalizedCwd + path39__default.sep)) {
     p26.log.info("That path is already within the project directory");
     return;
   }
   const existing = getAllowedPaths();
-  if (existing.some((e) => path38__default.normalize(e.path) === path38__default.normalize(absolute))) {
+  if (existing.some((e) => path39__default.normalize(e.path) === path39__default.normalize(absolute))) {
     p26.log.info(`Already allowed: ${absolute}`);
     return;
   }
@@ -37878,7 +37903,7 @@ async function revokePath(dirPath, _session) {
     }
     dirPath = selected;
   }
-  const absolute = path38__default.resolve(dirPath);
+  const absolute = path39__default.resolve(dirPath);
   const removed = removeAllowedPathFromSession(absolute);
   await removePersistedAllowedPath(absolute);
   if (removed) {
@@ -38251,7 +38276,7 @@ async function savePermissionPreference(key, value) {
     } catch {
     }
     config[key] = value;
-    await fs35__default.mkdir(path38__default.dirname(CONFIG_PATHS.config), { recursive: true });
+    await fs35__default.mkdir(path39__default.dirname(CONFIG_PATHS.config), { recursive: true });
     await fs35__default.writeFile(CONFIG_PATHS.config, JSON.stringify(config, null, 2), "utf-8");
   } catch {
   }
@@ -38968,15 +38993,20 @@ var tutorialCommand = {
 // src/cli/repl/commands/mcp.ts
 init_lifecycle();
 init_registry();
+init_config_loader();
 function formatLatency(ms) {
   if (ms < 1) return "<1ms";
   if (ms < 1e3) return `${Math.round(ms)}ms`;
   return `${(ms / 1e3).toFixed(1)}s`;
 }
-async function listServers() {
+async function listServers(session) {
   const registry = new MCPRegistryImpl();
   await registry.load();
-  const servers = registry.listServers();
+  const servers = mergeMCPConfigs(
+    registry.listServers(),
+    await loadMCPServersFromCOCOConfig(),
+    await loadProjectMCPFile(session.projectPath)
+  );
   const manager = getMCPServerManager();
   p26.intro("MCP Servers");
   if (servers.length === 0) {
@@ -39078,12 +39108,12 @@ var mcpCommand = {
   aliases: [],
   description: "Manage MCP servers (list, status, health, restart)",
   usage: "/mcp [list|status|health [name]|restart <name>]",
-  execute: async (args, _session) => {
+  execute: async (args, session) => {
     const subcommand = args[0]?.toLowerCase() ?? "list";
     try {
       switch (subcommand) {
         case "list":
-          await listServers();
+          await listServers(session);
           break;
         case "status":
           showStatus2();
@@ -39442,9 +39472,9 @@ Response format (JSON only, no prose):
       cancel5("Build cancelled.");
     }
   }
-  const cocoDir = path38__default.join(outputPath, ".coco");
+  const cocoDir = path39__default.join(outputPath, ".coco");
   await fs35__default.mkdir(cocoDir, { recursive: true });
-  await fs35__default.writeFile(path38__default.join(cocoDir, "backlog.json"), JSON.stringify(spec, null, 2), "utf-8");
+  await fs35__default.writeFile(path39__default.join(cocoDir, "backlog.json"), JSON.stringify(spec, null, 2), "utf-8");
   p26.outro("  Spec saved \u2014 starting sprints");
   return spec;
 }
@@ -39994,19 +40024,19 @@ init_errors();
 init_subprocess_registry();
 async function detectTestFramework2(cwd) {
   try {
-    await fs35__default.access(path38__default.join(cwd, "pom.xml"));
+    await fs35__default.access(path39__default.join(cwd, "pom.xml"));
     return "maven";
   } catch {
   }
   for (const gradleFile of ["build.gradle", "build.gradle.kts"]) {
     try {
-      await fs35__default.access(path38__default.join(cwd, gradleFile));
+      await fs35__default.access(path39__default.join(cwd, gradleFile));
       return "gradle";
     } catch {
     }
   }
   try {
-    const pkgPath = path38__default.join(cwd, "package.json");
+    const pkgPath = path39__default.join(cwd, "package.json");
     const pkgContent = await fs35__default.readFile(pkgPath, "utf-8");
     const pkg = JSON.parse(pkgContent);
     const deps = {
@@ -40023,16 +40053,16 @@ async function detectTestFramework2(cwd) {
   }
 }
 function toMavenTestFilter(pattern) {
-  const base = path38__default.basename(pattern).replace(/\.java$/, "");
+  const base = path39__default.basename(pattern).replace(/\.java$/, "");
   return base;
 }
 function toGradleTestFilter(pattern) {
-  const base = path38__default.basename(pattern).replace(/\.java$/, "");
+  const base = path39__default.basename(pattern).replace(/\.java$/, "");
   return `*${base}`;
 }
 async function mavenExecutable(cwd) {
   try {
-    await fs35__default.access(path38__default.join(cwd, "mvnw"));
+    await fs35__default.access(path39__default.join(cwd, "mvnw"));
     return "./mvnw";
   } catch {
     return "mvn";
@@ -40040,7 +40070,7 @@ async function mavenExecutable(cwd) {
 }
 async function gradleExecutable(cwd) {
   try {
-    await fs35__default.access(path38__default.join(cwd, "gradlew"));
+    await fs35__default.access(path39__default.join(cwd, "gradlew"));
     return "./gradlew";
   } catch {
     return "gradle";
@@ -40281,14 +40311,14 @@ Examples:
     const projectDir = cwd ?? process.cwd();
     try {
       const coverageLocations = [
-        path38__default.join(projectDir, "coverage", "coverage-summary.json"),
-        path38__default.join(projectDir, "coverage", "coverage-final.json"),
-        path38__default.join(projectDir, ".nyc_output", "coverage-summary.json"),
+        path39__default.join(projectDir, "coverage", "coverage-summary.json"),
+        path39__default.join(projectDir, "coverage", "coverage-final.json"),
+        path39__default.join(projectDir, ".nyc_output", "coverage-summary.json"),
         // Maven JaCoCo
-        path38__default.join(projectDir, "target", "site", "jacoco", "jacoco.csv"),
-        path38__default.join(projectDir, "target", "site", "jacoco-ut", "jacoco.csv"),
+        path39__default.join(projectDir, "target", "site", "jacoco", "jacoco.csv"),
+        path39__default.join(projectDir, "target", "site", "jacoco-ut", "jacoco.csv"),
         // Gradle JaCoCo
-        path38__default.join(projectDir, "build", "reports", "jacoco", "test", "jacocoTestReport.csv")
+        path39__default.join(projectDir, "build", "reports", "jacoco", "test", "jacocoTestReport.csv")
       ];
       for (const location of coverageLocations) {
         try {
@@ -40401,7 +40431,7 @@ async function findFileRecursive(rootDir, target, options = {}) {
   const results = [];
   const startTime = Date.now();
   const isTimedOut = () => Date.now() - startTime > opts.timeoutMs;
-  const queue = [[path38__default.resolve(rootDir), 0]];
+  const queue = [[path39__default.resolve(rootDir), 0]];
   const visited = /* @__PURE__ */ new Set();
   while (queue.length > 0 && results.length < opts.maxResults) {
     if (isTimedOut()) break;
@@ -40414,7 +40444,7 @@ async function findFileRecursive(rootDir, target, options = {}) {
       for (const entry of entries) {
         if (isTimedOut()) break;
         const entryName = entry.name;
-        const entryPath = path38__default.join(currentDir, entryName);
+        const entryPath = path39__default.join(currentDir, entryName);
         if (!opts.includeHidden && entryName.startsWith(".")) continue;
         if (entry.isDirectory() && opts.excludeDirs.has(entryName)) continue;
         const isMatch = opts.type === "file" && entry.isFile() || opts.type === "directory" && entry.isDirectory() || opts.type === "both";
@@ -40448,19 +40478,19 @@ async function suggestSimilarFilesDeep(missingPath, rootDir = process.cwd(), opt
   if (fastResults.length > 0) {
     return fastResults;
   }
-  const absPath = path38__default.resolve(missingPath);
-  const target = path38__default.basename(absPath);
+  const absPath = path39__default.resolve(missingPath);
+  const target = path39__default.basename(absPath);
   return findFileRecursive(rootDir, target, options);
 }
 async function suggestSimilarDirsDeep(missingPath, rootDir = process.cwd(), options) {
-  const absPath = path38__default.resolve(missingPath);
-  const target = path38__default.basename(absPath);
-  const parentDir = path38__default.dirname(absPath);
+  const absPath = path39__default.resolve(missingPath);
+  const target = path39__default.basename(absPath);
+  const parentDir = path39__default.dirname(absPath);
   try {
     const entries = await fs35__default.readdir(parentDir, { withFileTypes: true });
     const dirs = entries.filter((e) => e.isDirectory());
     const scored = dirs.map((d) => ({
-      path: path38__default.join(parentDir, d.name),
+      path: path39__default.join(parentDir, d.name),
       distance: levenshtein(target.toLowerCase(), d.name.toLowerCase())
     })).filter((s) => s.distance <= Math.max(target.length * 0.6, 3)).sort((a, b) => a.distance - b.distance).slice(0, options?.maxResults ?? MAX_SUGGESTIONS);
     if (scored.length > 0) {
@@ -40471,15 +40501,15 @@ async function suggestSimilarDirsDeep(missingPath, rootDir = process.cwd(), opti
   return findFileRecursive(rootDir, target, { ...options, type: "directory" });
 }
 async function suggestSimilarFiles(missingPath, options) {
-  const absPath = path38__default.resolve(missingPath);
-  const dir = path38__default.dirname(absPath);
-  const target = path38__default.basename(absPath);
+  const absPath = path39__default.resolve(missingPath);
+  const dir = path39__default.dirname(absPath);
+  const target = path39__default.basename(absPath);
   const maxResults = options?.maxResults;
   try {
     const entries = await fs35__default.readdir(dir);
     const limited = entries.slice(0, MAX_DIR_ENTRIES);
     const scored = limited.map((name) => ({
-      path: path38__default.join(dir, name),
+      path: path39__default.join(dir, name),
       distance: levenshtein(target.toLowerCase(), name.toLowerCase())
     })).filter((s) => s.distance <= Math.max(target.length * 0.6, 3)).sort((a, b) => a.distance - b.distance);
     return scored.slice(0, maxResults);
@@ -40491,7 +40521,7 @@ function formatSuggestions(suggestions, baseDir) {
   if (suggestions.length === 0) return "";
   const base = baseDir ?? process.cwd();
   const lines = suggestions.map((s) => {
-    const rel = path38__default.relative(base, s.path);
+    const rel = path39__default.relative(base, s.path);
     return `  - ${rel}`;
   });
   return `
@@ -40520,44 +40550,85 @@ var SENSITIVE_PATTERNS = [
   // PyPI auth
 ];
 var BLOCKED_PATHS2 = ["/etc", "/var", "/usr", "/root", "/sys", "/proc", "/boot"];
+var SAFE_COCO_HOME_READ_FILES = /* @__PURE__ */ new Set([
+  "mcp.json",
+  "config.json",
+  "COCO.md",
+  "AGENTS.md",
+  "CLAUDE.md",
+  "projects.json",
+  "trusted-tools.json",
+  "allowed-paths.json"
+]);
+var SAFE_COCO_HOME_READ_DIR_PREFIXES = ["skills", "memories", "logs", "checkpoints", "sessions"];
 function hasNullByte2(str) {
   return str.includes("\0");
 }
 function normalizePath2(filePath) {
   let normalized = filePath.replace(/\0/g, "");
-  normalized = path38__default.normalize(normalized);
+  normalized = path39__default.normalize(normalized);
   return normalized;
 }
+function isWithinDirectory(targetPath, baseDir) {
+  const normalizedTarget = path39__default.normalize(targetPath);
+  const normalizedBase = path39__default.normalize(baseDir);
+  return normalizedTarget === normalizedBase || normalizedTarget.startsWith(normalizedBase + path39__default.sep);
+}
+function isSafeCocoHomeReadPath(absolutePath, homeDir) {
+  const cocoHome = path39__default.join(homeDir, ".coco");
+  if (!isWithinDirectory(absolutePath, cocoHome)) {
+    return false;
+  }
+  const relativePath = path39__default.relative(cocoHome, absolutePath);
+  if (!relativePath || relativePath.startsWith("..")) {
+    return false;
+  }
+  const segments = relativePath.split(path39__default.sep).filter(Boolean);
+  const firstSegment = segments[0];
+  if (!firstSegment) {
+    return false;
+  }
+  if (firstSegment === "tokens" || firstSegment === ".env") {
+    return false;
+  }
+  if (segments.length === 1 && SAFE_COCO_HOME_READ_FILES.has(firstSegment)) {
+    return true;
+  }
+  return SAFE_COCO_HOME_READ_DIR_PREFIXES.includes(firstSegment);
+}
 function isPathAllowed(filePath, operation) {
   if (hasNullByte2(filePath)) {
     return { allowed: false, reason: "Path contains invalid characters" };
   }
   const normalized = normalizePath2(filePath);
-  const absolute = path38__default.resolve(normalized);
+  const absolute = path39__default.resolve(normalized);
   const cwd = process.cwd();
   for (const blocked of BLOCKED_PATHS2) {
-    const normalizedBlocked = path38__default.normalize(blocked);
-    if (absolute === normalizedBlocked || absolute.startsWith(normalizedBlocked + path38__default.sep)) {
+    const normalizedBlocked = path39__default.normalize(blocked);
+    if (absolute === normalizedBlocked || absolute.startsWith(normalizedBlocked + path39__default.sep)) {
       return { allowed: false, reason: `Access to system path '${blocked}' is not allowed` };
     }
   }
   const home = process.env.HOME;
   if (home) {
-    const normalizedHome = path38__default.normalize(home);
-    const normalizedCwd = path38__default.normalize(cwd);
+    const normalizedHome = path39__default.normalize(home);
+    const normalizedCwd = path39__default.normalize(cwd);
     if (absolute.startsWith(normalizedHome) && !absolute.startsWith(normalizedCwd)) {
       if (isWithinAllowedPath(absolute, operation)) ; else if (operation === "read") {
+        if (isSafeCocoHomeReadPath(absolute, normalizedHome)) {
+          return { allowed: true };
+        }
         const allowedHomeReads = [".gitconfig", ".zshrc", ".bashrc"];
-        const basename4 = path38__default.basename(absolute);
+        const basename4 = path39__default.basename(absolute);
         if (!allowedHomeReads.includes(basename4)) {
-          const targetDir = path38__default.dirname(absolute);
+          const targetDir = path39__default.dirname(absolute);
           return {
             allowed: false,
             reason: `Reading files outside project directory is not allowed. Use /allow-path ${targetDir} to grant access.`
           };
         }
       } else {
-        const targetDir = path38__default.dirname(absolute);
+        const targetDir = path39__default.dirname(absolute);
         return {
           allowed: false,
           reason: `${operation} operations outside project directory are not allowed. Use /allow-path ${targetDir} to grant access.`
@@ -40566,7 +40637,7 @@ function isPathAllowed(filePath, operation) {
     }
   }
   if (operation === "write" || operation === "delete") {
-    const basename4 = path38__default.basename(absolute);
+    const basename4 = path39__default.basename(absolute);
     for (const pattern of SENSITIVE_PATTERNS) {
       if (pattern.test(basename4)) {
         return {
@@ -40589,17 +40660,17 @@ function isENOENT(error) {
   return error.code === "ENOENT";
 }
 async function enrichENOENT(filePath, operation) {
-  const absPath = path38__default.resolve(filePath);
+  const absPath = path39__default.resolve(filePath);
   const suggestions = await suggestSimilarFilesDeep(absPath, process.cwd());
-  const hint = formatSuggestions(suggestions, path38__default.dirname(absPath));
+  const hint = formatSuggestions(suggestions, path39__default.dirname(absPath));
   const action = operation === "read" ? "Use glob or list_dir to find the correct path." : "Check that the parent directory exists.";
   return `File not found: ${filePath}${hint}
 ${action}`;
 }
 async function enrichDirENOENT(dirPath) {
-  const absPath = path38__default.resolve(dirPath);
+  const absPath = path39__default.resolve(dirPath);
   const suggestions = await suggestSimilarDirsDeep(absPath, process.cwd());
-  const hint = formatSuggestions(suggestions, path38__default.dirname(absPath));
+  const hint = formatSuggestions(suggestions, path39__default.dirname(absPath));
   return `Directory not found: ${dirPath}${hint}
 Use list_dir or glob to find the correct path.`;
 }
@@ -40620,7 +40691,7 @@ Examples:
   async execute({ path: filePath, encoding, maxSize }) {
     validatePath(filePath, "read");
     try {
-      const absolutePath = path38__default.resolve(filePath);
+      const absolutePath = path39__default.resolve(filePath);
       const stats = await fs35__default.stat(absolutePath);
       const maxBytes = maxSize ?? DEFAULT_MAX_FILE_SIZE;
       let truncated = false;
@@ -40679,7 +40750,7 @@ Examples:
   async execute({ path: filePath, content, createDirs, dryRun }) {
     validatePath(filePath, "write");
     try {
-      const absolutePath = path38__default.resolve(filePath);
+      const absolutePath = path39__default.resolve(filePath);
       let wouldCreate = false;
       try {
         await fs35__default.access(absolutePath);
@@ -40695,7 +40766,7 @@ Examples:
         };
       }
       if (createDirs) {
-        await fs35__default.mkdir(path38__default.dirname(absolutePath), { recursive: true });
+        await fs35__default.mkdir(path39__default.dirname(absolutePath), { recursive: true });
       }
       await fs35__default.writeFile(absolutePath, content, "utf-8");
       const stats = await fs35__default.stat(absolutePath);
@@ -40741,7 +40812,7 @@ Examples:
   async execute({ path: filePath, oldText, newText, all, dryRun }) {
     validatePath(filePath, "write");
     try {
-      const absolutePath = path38__default.resolve(filePath);
+      const absolutePath = path39__default.resolve(filePath);
       let content = await fs35__default.readFile(absolutePath, "utf-8");
       let replacements = 0;
       if (all) {
@@ -40862,7 +40933,7 @@ Examples:
   }),
   async execute({ path: filePath }) {
     try {
-      const absolutePath = path38__default.resolve(filePath);
+      const absolutePath = path39__default.resolve(filePath);
       const stats = await fs35__default.stat(absolutePath);
       return {
         exists: true,
@@ -40893,12 +40964,12 @@ Examples:
   }),
   async execute({ path: dirPath, recursive }) {
     try {
-      const absolutePath = path38__default.resolve(dirPath);
+      const absolutePath = path39__default.resolve(dirPath);
       const entries = [];
       async function listDir(dir, prefix = "") {
         const items = await fs35__default.readdir(dir, { withFileTypes: true });
         for (const item of items) {
-          const fullPath = path38__default.join(dir, item.name);
+          const fullPath = path39__default.join(dir, item.name);
           const relativePath = prefix ? `${prefix}/${item.name}` : item.name;
           if (item.isDirectory()) {
             entries.push({ name: relativePath, type: "directory" });
@@ -40953,7 +41024,7 @@ Examples:
     }
     validatePath(filePath, "delete");
     try {
-      const absolutePath = path38__default.resolve(filePath);
+      const absolutePath = path39__default.resolve(filePath);
       const stats = await fs35__default.stat(absolutePath);
       if (stats.isDirectory()) {
         if (!recursive) {
@@ -40969,7 +41040,7 @@ Examples:
     } catch (error) {
       if (error instanceof ToolError) throw error;
       if (error.code === "ENOENT") {
-        return { deleted: false, path: path38__default.resolve(filePath) };
+        return { deleted: false, path: path39__default.resolve(filePath) };
       }
       throw new FileSystemError(`Failed to delete: ${filePath}`, {
         path: filePath,
@@ -40997,8 +41068,8 @@ Examples:
     validatePath(source, "read");
     validatePath(destination, "write");
     try {
-      const srcPath = path38__default.resolve(source);
-      const destPath = path38__default.resolve(destination);
+      const srcPath = path39__default.resolve(source);
+      const destPath = path39__default.resolve(destination);
       if (!overwrite) {
         try {
           await fs35__default.access(destPath);
@@ -41014,7 +41085,7 @@ Examples:
           }
         }
       }
-      await fs35__default.mkdir(path38__default.dirname(destPath), { recursive: true });
+      await fs35__default.mkdir(path39__default.dirname(destPath), { recursive: true });
       await fs35__default.copyFile(srcPath, destPath);
       const stats = await fs35__default.stat(destPath);
       return {
@@ -41058,8 +41129,8 @@ Examples:
     validatePath(source, "delete");
     validatePath(destination, "write");
     try {
-      const srcPath = path38__default.resolve(source);
-      const destPath = path38__default.resolve(destination);
+      const srcPath = path39__default.resolve(source);
+      const destPath = path39__default.resolve(destination);
       if (!overwrite) {
         try {
           await fs35__default.access(destPath);
@@ -41075,7 +41146,7 @@ Examples:
           }
         }
       }
-      await fs35__default.mkdir(path38__default.dirname(destPath), { recursive: true });
+      await fs35__default.mkdir(path39__default.dirname(destPath), { recursive: true });
       await fs35__default.rename(srcPath, destPath);
       return {
         source: srcPath,
@@ -41145,10 +41216,10 @@ Examples:
   }),
   async execute({ path: dirPath, depth, showHidden, dirsOnly }) {
     try {
-      const absolutePath = path38__default.resolve(dirPath ?? ".");
+      const absolutePath = path39__default.resolve(dirPath ?? ".");
       let totalFiles = 0;
       let totalDirs = 0;
-      const lines = [path38__default.basename(absolutePath) + "/"];
+      const lines = [path39__default.basename(absolutePath) + "/"];
       let truncated = false;
       async function buildTree(dir, prefix, currentDepth) {
         if (currentDepth > (depth ?? 4)) return;
@@ -41178,7 +41249,7 @@ Examples:
           if (item.isDirectory()) {
             totalDirs++;
             lines.push(`${prefix}${connector}${item.name}/`);
-            await buildTree(path38__default.join(dir, item.name), prefix + childPrefix, currentDepth + 1);
+            await buildTree(path39__default.join(dir, item.name), prefix + childPrefix, currentDepth + 1);
           } else {
             totalFiles++;
             lines.push(`${prefix}${connector}${item.name}`);
@@ -42446,7 +42517,7 @@ Examples:
     caseSensitive,
     wholeWord
   }) {
-    const targetPath = searchPath ? path38__default.resolve(searchPath) : process.cwd();
+    const targetPath = searchPath ? path39__default.resolve(searchPath) : process.cwd();
     const matches = [];
     let filesSearched = 0;
     const filesWithMatches = /* @__PURE__ */ new Set();
@@ -42513,7 +42584,7 @@ Examples:
                 contextAfter.push(lines[j] ?? "");
               }
               matches.push({
-                file: path38__default.relative(process.cwd(), file),
+                file: path39__default.relative(process.cwd(), file),
                 line: i + 1,
                 column: match.index + 1,
                 content: line,
@@ -42564,7 +42635,7 @@ Examples:
   }),
   async execute({ file, pattern, caseSensitive }) {
     try {
-      const absolutePath = path38__default.resolve(file);
+      const absolutePath = path39__default.resolve(file);
       const content = await fs35__default.readFile(absolutePath, "utf-8");
       const lines = content.split("\n");
       const matches = [];
@@ -42583,7 +42654,7 @@ Examples:
     } catch (error) {
       if (error.code === "ENOENT") {
         const suggestions = await suggestSimilarFilesDeep(file, process.cwd());
-        const hint = formatSuggestions(suggestions, path38__default.dirname(file));
+        const hint = formatSuggestions(suggestions, path39__default.dirname(file));
         throw new ToolError(`File not found: ${file}${hint}
 Use glob to find the correct path.`, {
           tool: "find_in_file"
@@ -42774,7 +42845,7 @@ async function detectPackageManager2(cwd) {
   ];
   for (const { file, pm } of lockfiles) {
     try {
-      await fs35__default.access(path38__default.join(cwd, file));
+      await fs35__default.access(path39__default.join(cwd, file));
       return pm;
     } catch {
     }
@@ -43047,7 +43118,7 @@ ${message}
     });
     try {
       try {
-        await fs35__default.access(path38__default.join(projectDir, "Makefile"));
+        await fs35__default.access(path39__default.join(projectDir, "Makefile"));
       } catch {
         throw new ToolError("No Makefile found in directory", { tool: "make" });
       }
@@ -43217,7 +43288,7 @@ ${message}
 });
 async function resolveMaven(cwd) {
   try {
-    await fs35__default.access(path38__default.join(cwd, "mvnw"));
+    await fs35__default.access(path39__default.join(cwd, "mvnw"));
     return "./mvnw";
   } catch {
     return "mvn";
@@ -43225,7 +43296,7 @@ async function resolveMaven(cwd) {
 }
 async function resolveGradle(cwd) {
   try {
-    await fs35__default.access(path38__default.join(cwd, "gradlew"));
+    await fs35__default.access(path39__default.join(cwd, "gradlew"));
     return "./gradlew";
   } catch {
     return "gradle";
@@ -44093,7 +44164,7 @@ init_review();
 init_registry4();
 init_errors();
 var fs38 = await import('fs/promises');
-var path41 = await import('path');
+var path42 = await import('path');
 var { glob: glob14 } = await import('glob');
 var DEFAULT_MAX_FILES = 200;
 var LANGUAGE_EXTENSIONS = {
@@ -44119,7 +44190,7 @@ var DEFAULT_EXCLUDES = [
   "**/*.d.ts"
 ];
 function detectLanguage3(filePath) {
-  const ext = path41.extname(filePath).toLowerCase();
+  const ext = path42.extname(filePath).toLowerCase();
   for (const [lang, extensions] of Object.entries(LANGUAGE_EXTENSIONS)) {
     if (extensions.includes(ext)) return lang;
   }
@@ -44528,7 +44599,7 @@ Examples:
   }),
   async execute({ path: rootPath, include, exclude, languages, maxFiles, depth }) {
     const startTime = performance.now();
-    const absPath = path41.resolve(rootPath);
+    const absPath = path42.resolve(rootPath);
     try {
       const stat2 = await fs38.stat(absPath);
       if (!stat2.isDirectory()) {
@@ -44567,7 +44638,7 @@ Examples:
     let totalDefinitions = 0;
     let exportedSymbols = 0;
     for (const file of limitedFiles) {
-      const fullPath = path41.join(absPath, file);
+      const fullPath = path42.join(absPath, file);
       const language = detectLanguage3(file);
       if (!language) continue;
       if (languages && !languages.includes(language)) {
@@ -44612,9 +44683,9 @@ init_registry4();
 init_errors();
 init_paths();
 var fs39 = await import('fs/promises');
-var path42 = await import('path');
+var path43 = await import('path');
 var crypto2 = await import('crypto');
-var GLOBAL_MEMORIES_DIR = path42.join(COCO_HOME, "memories");
+var GLOBAL_MEMORIES_DIR = path43.join(COCO_HOME, "memories");
 var PROJECT_MEMORIES_DIR = ".coco/memories";
 var DEFAULT_MAX_MEMORIES = 1e3;
 async function ensureDir2(dirPath) {
@@ -44625,7 +44696,7 @@ function getMemoriesDir(scope) {
 }
 async function loadIndex(scope) {
   const dir = getMemoriesDir(scope);
-  const indexPath = path42.join(dir, "index.json");
+  const indexPath = path43.join(dir, "index.json");
   try {
     const content = await fs39.readFile(indexPath, "utf-8");
     return JSON.parse(content);
@@ -44636,12 +44707,12 @@ async function loadIndex(scope) {
 async function saveIndex(scope, index) {
   const dir = getMemoriesDir(scope);
   await ensureDir2(dir);
-  const indexPath = path42.join(dir, "index.json");
+  const indexPath = path43.join(dir, "index.json");
   await fs39.writeFile(indexPath, JSON.stringify(index, null, 2), "utf-8");
 }
 async function loadMemory(scope, id) {
   const dir = getMemoriesDir(scope);
-  const memPath = path42.join(dir, `${id}.json`);
+  const memPath = path43.join(dir, `${id}.json`);
   try {
     const content = await fs39.readFile(memPath, "utf-8");
     return JSON.parse(content);
@@ -44652,7 +44723,7 @@ async function loadMemory(scope, id) {
 async function saveMemory(scope, memory) {
   const dir = getMemoriesDir(scope);
   await ensureDir2(dir);
-  const memPath = path42.join(dir, `${memory.id}.json`);
+  const memPath = path43.join(dir, `${memory.id}.json`);
   await fs39.writeFile(memPath, JSON.stringify(memory, null, 2), "utf-8");
 }
 var createMemoryTool = defineTool({
@@ -44993,7 +45064,7 @@ var checkpointTools = [createCheckpointTool, restoreCheckpointTool, listCheckpoi
 // src/tools/semantic-search.ts
 init_registry4();
 var fs41 = await import('fs/promises');
-var path43 = await import('path');
+var path44 = await import('path');
 var { glob: glob15 } = await import('glob');
 var INDEX_DIR = ".coco/search-index";
 var DEFAULT_CHUNK_SIZE = 20;
@@ -45121,7 +45192,7 @@ async function getEmbedding(text13) {
 }
 async function loadIndex2(indexDir) {
   try {
-    const indexPath = path43.join(indexDir, "index.json");
+    const indexPath = path44.join(indexDir, "index.json");
     const content = await fs41.readFile(indexPath, "utf-8");
     return JSON.parse(content);
   } catch {
@@ -45130,11 +45201,11 @@ async function loadIndex2(indexDir) {
 }
 async function saveIndex2(indexDir, index) {
   await fs41.mkdir(indexDir, { recursive: true });
-  const indexPath = path43.join(indexDir, "index.json");
+  const indexPath = path44.join(indexDir, "index.json");
   await fs41.writeFile(indexPath, JSON.stringify(index), "utf-8");
 }
 function isBinary(filePath) {
-  return BINARY_EXTENSIONS.has(path43.extname(filePath).toLowerCase());
+  return BINARY_EXTENSIONS.has(path44.extname(filePath).toLowerCase());
 }
 var semanticSearchTool = defineTool({
   name: "semantic_search",
@@ -45159,8 +45230,8 @@ Examples:
     const effectivePath = rootPath ?? ".";
     const effectiveMaxResults = maxResults ?? 10;
     const effectiveThreshold = threshold ?? 0.3;
-    const absPath = path43.resolve(effectivePath);
-    const indexDir = path43.join(absPath, INDEX_DIR);
+    const absPath = path44.resolve(effectivePath);
+    const indexDir = path44.join(absPath, INDEX_DIR);
     let index = reindex ? null : await loadIndex2(indexDir);
     let warnings = [];
     if (!index) {
@@ -45176,7 +45247,7 @@ Examples:
       let indexSaveWarning = "";
       for (const file of files) {
         if (isBinary(file)) continue;
-        const fullPath = path43.join(absPath, file);
+        const fullPath = path44.join(absPath, file);
         try {
           const stat2 = await fs41.stat(fullPath);
           const content = await fs41.readFile(fullPath, "utf-8");
@@ -45260,7 +45331,7 @@ var semanticSearchTools = [semanticSearchTool];
 init_registry4();
 init_errors();
 var fs42 = await import('fs/promises');
-var path44 = await import('path');
+var path45 = await import('path');
 var { glob: glob16 } = await import('glob');
 async function parseClassRelationships(rootPath, include) {
   const pattern = include ?? "**/*.{ts,tsx,js,jsx}";
@@ -45273,7 +45344,7 @@ async function parseClassRelationships(rootPath, include) {
   const interfaces = [];
   for (const file of files.slice(0, 100)) {
     try {
-      const content = await fs42.readFile(path44.join(rootPath, file), "utf-8");
+      const content = await fs42.readFile(path45.join(rootPath, file), "utf-8");
       const lines = content.split("\n");
       for (let i = 0; i < lines.length; i++) {
         const line = lines[i];
@@ -45399,7 +45470,7 @@ async function generateArchitectureDiagram(rootPath) {
   const lines = ["graph TD"];
   let nodeCount = 0;
   let edgeCount = 0;
-  const rootName = path44.basename(rootPath);
+  const rootName = path45.basename(rootPath);
   lines.push(`  ROOT["${rootName}"]`);
   nodeCount++;
   for (const dir of dirs) {
@@ -45409,7 +45480,7 @@ async function generateArchitectureDiagram(rootPath) {
     nodeCount++;
     edgeCount++;
     try {
-      const subEntries = await fs42.readdir(path44.join(rootPath, dir.name), {
+      const subEntries = await fs42.readdir(path45.join(rootPath, dir.name), {
         withFileTypes: true
       });
       const subDirs = subEntries.filter(
@@ -45532,7 +45603,7 @@ Examples:
         tool: "generate_diagram"
       });
     }
-    const absPath = rootPath ? path44.resolve(rootPath) : process.cwd();
+    const absPath = rootPath ? path45.resolve(rootPath) : process.cwd();
     switch (type) {
       case "class":
         return generateClassDiagram(absPath, include);
@@ -45598,7 +45669,7 @@ var diagramTools = [generateDiagramTool];
 init_registry4();
 init_errors();
 var fs43 = await import('fs/promises');
-var path45 = await import('path');
+var path46 = await import('path');
 var DEFAULT_MAX_PAGES = 20;
 var MAX_FILE_SIZE = 50 * 1024 * 1024;
 function parsePageRange(rangeStr, totalPages) {
@@ -45633,7 +45704,7 @@ Examples:
   }),
   async execute({ path: filePath, pages, maxPages }) {
     const startTime = performance.now();
-    const absPath = path45.resolve(filePath);
+    const absPath = path46.resolve(filePath);
     try {
       const stat2 = await fs43.stat(absPath);
       if (!stat2.isFile()) {
@@ -45718,7 +45789,7 @@ var pdfTools = [readPdfTool];
 init_registry4();
 init_errors();
 var fs44 = await import('fs/promises');
-var path46 = await import('path');
+var path47 = await import('path');
 var SUPPORTED_FORMATS = /* @__PURE__ */ new Set([".png", ".jpg", ".jpeg", ".gif", ".webp", ".bmp"]);
 var MAX_IMAGE_SIZE = 20 * 1024 * 1024;
 var MIME_TYPES = {
@@ -45746,15 +45817,15 @@ Examples:
   async execute({ path: filePath, prompt, provider }) {
     const startTime = performance.now();
     const effectivePrompt = prompt ?? "Describe this image in detail. If it's code or a UI, identify the key elements.";
-    const absPath = path46.resolve(filePath);
+    const absPath = path47.resolve(filePath);
     const cwd = process.cwd();
-    if (!absPath.startsWith(cwd + path46.sep) && absPath !== cwd) {
+    if (!absPath.startsWith(cwd + path47.sep) && absPath !== cwd) {
       throw new ToolError(
         `Path traversal denied: '${filePath}' resolves outside the project directory`,
         { tool: "read_image" }
       );
     }
-    const ext = path46.extname(absPath).toLowerCase();
+    const ext = path47.extname(absPath).toLowerCase();
     if (!SUPPORTED_FORMATS.has(ext)) {
       throw new ToolError(
         `Unsupported image format '${ext}'. Supported: ${Array.from(SUPPORTED_FORMATS).join(", ")}`,
@@ -45905,7 +45976,7 @@ var imageTools = [readImageTool];
 // src/tools/database.ts
 init_registry4();
 init_errors();
-var path47 = await import('path');
+var path48 = await import('path');
 var DANGEROUS_PATTERNS = [
   /\bDROP\s+(?:TABLE|DATABASE|INDEX|VIEW)\b/i,
   /\bTRUNCATE\b/i,
@@ -45936,7 +46007,7 @@ Examples:
   async execute({ database, query, params, readonly: isReadonlyParam }) {
     const isReadonly = isReadonlyParam ?? true;
     const startTime = performance.now();
-    const absPath = path47.resolve(database);
+    const absPath = path48.resolve(database);
     if (isReadonly && isDangerousSql(query)) {
       throw new ToolError(
         "Write operations (INSERT, UPDATE, DELETE, DROP, ALTER, TRUNCATE, CREATE) are blocked in readonly mode. Set readonly: false to allow writes.",
@@ -46019,7 +46090,7 @@ Examples:
   }),
   async execute({ database, table }) {
     const startTime = performance.now();
-    const absPath = path47.resolve(database);
+    const absPath = path48.resolve(database);
     try {
       const { default: Database } = await import('better-sqlite3');
       const db = new Database(absPath, { readonly: true, fileMustExist: true });
@@ -46203,7 +46274,7 @@ var astValidatorTools = [validateCodeTool, findMissingImportsTool];
 // src/tools/code-analyzer.ts
 init_registry4();
 var fs45 = await import('fs/promises');
-var path48 = await import('path');
+var path49 = await import('path');
 var AnalyzeFileSchema = z.object({
   filePath: z.string().describe("Path to file to analyze"),
   includeAst: z.boolean().default(false).describe("Include AST in result")
@@ -46313,10 +46384,10 @@ async function analyzeDirectory(dirPath) {
     try {
       const analysis = await analyzeFile(file, false);
       totalLines += analysis.lines;
-      const ext = path48.extname(file);
+      const ext = path49.extname(file);
       filesByType[ext] = (filesByType[ext] || 0) + 1;
       fileStats.push({
-        file: path48.relative(dirPath, file),
+        file: path49.relative(dirPath, file),
         lines: analysis.lines,
         complexity: analysis.complexity.cyclomatic
       });
@@ -46880,7 +46951,7 @@ var smartSuggestionsTools = [suggestImprovementsTool, calculateCodeScoreTool];
 // src/tools/context-enhancer.ts
 init_registry4();
 var fs47 = await import('fs/promises');
-var path49 = await import('path');
+var path50 = await import('path');
 var ContextMemoryStore = class {
   items = /* @__PURE__ */ new Map();
   learnings = /* @__PURE__ */ new Map();
@@ -46900,7 +46971,7 @@ var ContextMemoryStore = class {
     }
   }
   async save() {
-    const dir = path49.dirname(this.storePath);
+    const dir = path50.dirname(this.storePath);
     await fs47.mkdir(dir, { recursive: true });
     const data = {
       sessionId: this.sessionId,
@@ -47077,7 +47148,7 @@ var contextEnhancerTools = [
 // src/tools/skill-enhancer.ts
 init_registry4();
 var fs48 = await import('fs/promises');
-var path50 = await import('path');
+var path51 = await import('path');
 async function discoverSkills(skillsDir) {
   try {
     const files = await fs48.readdir(skillsDir);
@@ -47093,7 +47164,7 @@ async function loadSkillMetadata(skillPath) {
     const descMatch = content.match(/@description\s+(.+)/);
     const versionMatch = content.match(/@version\s+(\S+)/);
     return {
-      name: nameMatch?.[1] || path50.basename(skillPath, path50.extname(skillPath)),
+      name: nameMatch?.[1] || path51.basename(skillPath, path51.extname(skillPath)),
       description: descMatch?.[1] || "No description",
       version: versionMatch?.[1] || "1.0.0",
       dependencies: []
@@ -47137,7 +47208,7 @@ var discoverSkillsTool = defineTool({
     const { skillsDir } = input;
     const skills = await discoverSkills(skillsDir);
     const metadata = await Promise.all(
-      skills.map((s) => loadSkillMetadata(path50.join(skillsDir, s)))
+      skills.map((s) => loadSkillMetadata(path51.join(skillsDir, s)))
     );
     return {
       skillsDir,
@@ -47265,6 +47336,66 @@ var skillEnhancerTools = [discoverSkillsTool, validateSkillTool, createCustomToo
 init_git_enhanced();
 init_github();
 init_open();
+
+// src/tools/mcp.ts
+init_registry4();
+init_registry();
+init_config_loader();
+init_lifecycle();
+var mcpListServersTool = defineTool({
+  name: "mcp_list_servers",
+  description: `Inspect Coco's MCP configuration and current runtime connections.
+
+Use this instead of bash_exec with "coco mcp ..." and instead of manually reading ~/.coco/mcp.json
+when you need to know which MCP servers are configured, connected, healthy, or which tools they expose.`,
+  category: "config",
+  parameters: z.object({
+    includeDisabled: z.boolean().optional().default(false).describe("Include disabled MCP servers in the result"),
+    includeTools: z.boolean().optional().default(false).describe("Include the list of exposed tool names for connected servers"),
+    projectPath: z.string().optional().describe("Project path whose .mcp.json should be merged. Defaults to process.cwd()")
+  }),
+  async execute({ includeDisabled, includeTools, projectPath }) {
+    const registry = new MCPRegistryImpl();
+    await registry.load();
+    const resolvedProjectPath = projectPath || process.cwd();
+    const configuredServers = mergeMCPConfigs(
+      registry.listServers(),
+      await loadMCPServersFromCOCOConfig(),
+      await loadProjectMCPFile(resolvedProjectPath)
+    ).filter((server) => includeDisabled || server.enabled !== false);
+    const manager = getMCPServerManager();
+    const servers = [];
+    for (const server of configuredServers) {
+      const connection = manager.getConnection(server.name);
+      let tools;
+      if (includeTools && connection) {
+        try {
+          const listed = await connection.client.listTools();
+          tools = listed.tools.map((tool) => tool.name);
+        } catch {
+          tools = [];
+        }
+      }
+      servers.push({
+        name: server.name,
+        transport: server.transport,
+        enabled: server.enabled !== false,
+        connected: connection !== void 0,
+        healthy: connection?.healthy ?? false,
+        toolCount: connection?.toolCount ?? 0,
+        ...includeTools ? { tools: tools ?? [] } : {}
+      });
+    }
+    return {
+      configuredCount: servers.length,
+      connectedCount: servers.filter((server) => server.connected).length,
+      servers
+    };
+  }
+});
+var mcpTools = [mcpListServersTool];
+
+// src/tools/index.ts
 init_registry4();
 init_bash();
 init_git();
@@ -47308,7 +47439,7 @@ Examples:
     reason: z.string().optional().describe("Why access is needed (shown to user for context)")
   }),
   async execute({ path: dirPath, reason }) {
-    const absolute = path38__default.resolve(dirPath);
+    const absolute = path39__default.resolve(dirPath);
     if (isWithinAllowedPath(absolute, "read")) {
       return {
         authorized: true,
@@ -47317,8 +47448,8 @@ Examples:
       };
     }
     for (const blocked of BLOCKED_SYSTEM_PATHS2) {
-      const normalizedBlocked = path38__default.normalize(blocked);
-      if (absolute === normalizedBlocked || absolute.startsWith(normalizedBlocked + path38__default.sep)) {
+      const normalizedBlocked = path39__default.normalize(blocked);
+      if (absolute === normalizedBlocked || absolute.startsWith(normalizedBlocked + path39__default.sep)) {
         return {
           authorized: false,
           path: absolute,
@@ -47327,7 +47458,7 @@ Examples:
       }
     }
     const cwd = process.cwd();
-    if (absolute === path38__default.normalize(cwd) || absolute.startsWith(path38__default.normalize(cwd) + path38__default.sep)) {
+    if (absolute === path39__default.normalize(cwd) || absolute.startsWith(path39__default.normalize(cwd) + path39__default.sep)) {
       return {
         authorized: true,
         path: absolute,
@@ -47351,7 +47482,7 @@ Examples:
       };
     }
     const existing = getAllowedPaths();
-    if (existing.some((e) => path38__default.normalize(e.path) === path38__default.normalize(absolute))) {
+    if (existing.some((e) => path39__default.normalize(e.path) === path39__default.normalize(absolute))) {
       return {
         authorized: true,
         path: absolute,
@@ -47410,6 +47541,7 @@ function registerAllTools(registry) {
     ...gitEnhancedTools,
     ...githubTools,
     ...openTools,
+    ...mcpTools,
     ...authorizePathTools
   ];
   for (const tool of allTools) {
@@ -47437,7 +47569,7 @@ async function runSprints(options) {
   );
   const coordinator = createAgentCoordinator(executor, agentDefsMap);
   await fs35__default.mkdir(spec.outputPath, { recursive: true });
-  const sprintsDir = path38__default.join(spec.outputPath, ".coco", "sprints");
+  const sprintsDir = path39__default.join(spec.outputPath, ".coco", "sprints");
   await fs35__default.mkdir(sprintsDir, { recursive: true });
   for (const sprint of spec.sprints) {
     onProgress(`Starting ${sprint.id}: ${sprint.name}`);
@@ -47691,7 +47823,7 @@ Assess: overall architecture, consistency, error handling, and production readin
   };
 }
 async function saveSprintResult(sprintsDir, result) {
-  const filePath = path38__default.join(sprintsDir, `${result.sprintId}.json`);
+  const filePath = path39__default.join(sprintsDir, `${result.sprintId}.json`);
   await fs35__default.writeFile(filePath, JSON.stringify(result, null, 2), "utf-8");
 }
 
@@ -47717,9 +47849,9 @@ function parseArgs6(args) {
   return { description, specFile, outputDir, skipConfirmation };
 }
 function isWithinRoot(resolvedPath, rootDir) {
-  const normalRoot = path38__default.normalize(rootDir) + path38__default.sep;
-  const normalPath = path38__default.normalize(resolvedPath);
-  return normalPath === path38__default.normalize(rootDir) || normalPath.startsWith(normalRoot);
+  const normalRoot = path39__default.normalize(rootDir) + path39__default.sep;
+  const normalPath = path39__default.normalize(resolvedPath);
+  return normalPath === path39__default.normalize(rootDir) || normalPath.startsWith(normalRoot);
 }
 var buildAppCommand = {
   name: "build-app",
@@ -47742,7 +47874,7 @@ var buildAppCommand = {
     }
     let initialDescription = parsed.description;
     if (parsed.specFile) {
-      const specPath = path38__default.resolve(session.projectPath, parsed.specFile);
+      const specPath = path39__default.resolve(session.projectPath, parsed.specFile);
       if (!isWithinRoot(specPath, session.projectPath)) {
         p26.log.error(`--spec path must be within the project directory: ${specPath}`);
         return false;
@@ -47755,7 +47887,7 @@ var buildAppCommand = {
         return false;
       }
     }
-    const outputPath = parsed.outputDir ? path38__default.resolve(session.projectPath, parsed.outputDir) : path38__default.join(session.projectPath, "build-app-output");
+    const outputPath = parsed.outputDir ? path39__default.resolve(session.projectPath, parsed.outputDir) : path39__default.join(session.projectPath, "build-app-output");
     if (parsed.outputDir && !isWithinRoot(outputPath, session.projectPath)) {
       p26.log.error(`--output path must be within the project directory: ${outputPath}`);
       return false;
@@ -47939,7 +48071,7 @@ var WorktreeManager = class {
     const id = randomUUID();
     const branchPrefix = options.branchPrefix ?? "coco-agent";
     const branchName = `${branchPrefix}/${name}-${id.slice(0, 8)}`;
-    const worktreePath = path38__default.join(this.projectRoot, WORKTREES_DIR, `${name}-${id.slice(0, 8)}`);
+    const worktreePath = path39__default.join(this.projectRoot, WORKTREES_DIR, `${name}-${id.slice(0, 8)}`);
     const worktree = {
       id,
       name,
@@ -47950,7 +48082,7 @@ var WorktreeManager = class {
     };
     this.worktrees.set(id, worktree);
     try {
-      await fs35__default.mkdir(path38__default.join(this.projectRoot, WORKTREES_DIR), { recursive: true });
+      await fs35__default.mkdir(path39__default.join(this.projectRoot, WORKTREES_DIR), { recursive: true });
       const baseBranch = options.baseBranch ?? "HEAD";
       await this.git(["worktree", "add", "-b", branchName, worktreePath, baseBranch]);
       worktree.status = "active";
@@ -49549,7 +49681,7 @@ function getAllCommands() {
 }
 
 // src/cli/repl/input/handler.ts
-var HISTORY_FILE = path38.join(os4.homedir(), ".coco", "history");
+var HISTORY_FILE = path39.join(os4.homedir(), ".coco", "history");
 async function handleOptionC(copyFn = copyToClipboard, getLastBlockFn = getLastBlock) {
   const block = getLastBlockFn();
   if (!block) return null;
@@ -49570,7 +49702,7 @@ function loadHistory() {
 }
 function saveHistory(history) {
   try {
-    const dir = path38.dirname(HISTORY_FILE);
+    const dir = path39.dirname(HISTORY_FILE);
     if (!fs5.existsSync(dir)) {
       fs5.mkdirSync(dir, { recursive: true });
     }
@@ -51590,6 +51722,28 @@ async function executeAgentTurn(session, userMessage, provider, toolRegistry, op
   };
   const allTools = toolRegistry.getToolDefinitionsForLLM();
   const tools = session.planMode ? filterReadOnlyTools(allTools) : allTools;
+  const availableMcpToolNames = allTools.map((t) => t.name).filter((name) => name.startsWith("mcp_"));
+  function extractPlainText(content) {
+    if (typeof content === "string") return content;
+    return content.filter((block) => block.type === "text").map((block) => block.text).join(" ");
+  }
+  const normalizedUserRequest = extractPlainText(userMessage).toLowerCase();
+  const userExplicitlyRequestedMcp = /\bmcp\b/.test(normalizedUserRequest) || /\b(use|using|usa|usar|utiliza|utilizar)\b.{0,24}\bmcp\b/.test(normalizedUserRequest);
+  const userExplicitlyRequestedCocoMcpCli = /\bcoco\s+mcp\b/.test(normalizedUserRequest) || /\b(run|ejecuta|ejecutar|lanza|lanzar)\b.{0,24}\bcoco\s+mcp\b/.test(normalizedUserRequest);
+  const genericNetworkToolNames = /* @__PURE__ */ new Set(["http_fetch", "http_json", "web_fetch", "web_search"]);
+  function shouldForceMcpForTool(toolCall) {
+    if (!userExplicitlyRequestedMcp) return false;
+    if (availableMcpToolNames.length === 0) return false;
+    if (!genericNetworkToolNames.has(toolCall.name)) return false;
+    return true;
+  }
+  function shouldBlockShellMcpInspection(toolCall) {
+    if (toolCall.name !== "bash_exec") return false;
+    if (!userExplicitlyRequestedMcp) return false;
+    if (userExplicitlyRequestedCocoMcpCli) return false;
+    const command = String(toolCall.input.command ?? "").trim().toLowerCase();
+    return /^coco\s+mcp(?:\s|$)/.test(command);
+  }
   let iteration = 0;
   let maxIterations = session.config.agent.maxToolIterations;
   const HARD_MAX_ITERATIONS = 100;
@@ -51829,6 +51983,22 @@ ${tail}`;
       if (options.signal?.aborted || turnAborted) {
         break;
       }
+      if (shouldForceMcpForTool(toolCall)) {
+        declinedTools.set(
+          toolCall.id,
+          `User explicitly requested MCP, but the model selected '${toolCall.name}' instead. Use an MCP tool (${availableMcpToolNames.join(", ")}) for this service access.`
+        );
+        options.onToolSkipped?.(toolCall, "Use MCP tool instead of generic fetch");
+        continue;
+      }
+      if (shouldBlockShellMcpInspection(toolCall)) {
+        declinedTools.set(
+          toolCall.id,
+          "Use the native mcp_list_servers tool to inspect configured and connected MCP services in this session. Do not shell out to `coco mcp ...` for runtime MCP diagnosis unless the user explicitly asked for the CLI command."
+        );
+        options.onToolSkipped?.(toolCall, "Use mcp_list_servers instead of coco mcp CLI");
+        continue;
+      }
       const trustPattern = getTrustPattern(toolCall.name, toolCall.input);
       const needsConfirmation = !options.skipConfirmation && !session.trustedTools.has(trustPattern) && requiresConfirmation(toolCall.name, toolCall.input);
       if (needsConfirmation) {
@@ -52721,7 +52891,7 @@ function formatContextUsage(percent) {
 }
 function formatStatusBar(projectPath, config, gitCtx, contextUsagePercent) {
   const parts = [];
-  const projectName = path38__default.basename(projectPath);
+  const projectName = path39__default.basename(projectPath);
   parts.push(chalk.dim("\u{1F4C1} ") + chalk.magenta(projectName));
   const providerName = config.provider.type;
   const modelName = config.provider.model || "default";