@corbat-tech/coco 2.27.4 → 2.28.0

package/dist/index.d.ts

@@ -963,6 +963,8 @@ interface ToolUseContent {
     id: string;
     name: string;
     input: Record<string, unknown>;
+    /** Gemini-specific: preserve function-call thought signature across tool turns */
+    geminiThoughtSignature?: string;
 }
 /**
  * Tool result content block
@@ -999,6 +1001,8 @@ interface ToolCall {
     id: string;
     name: string;
     input: Record<string, unknown>;
+    /** Gemini-specific: preserve function-call thought signature across tool turns */
+    geminiThoughtSignature?: string;
 }
 /**
  * Chat options

package/dist/index.js

@@ -8,11 +8,11 @@ import fs16__default, { access, readFile, readdir, writeFile, mkdir } from 'fs/p
 import { randomUUID, randomBytes, createHash } from 'crypto';
 import * as http from 'http';
 import { fileURLToPath, URL as URL$1 } from 'url';
+import { exec, execFile, execSync, spawn } from 'child_process';
+import { promisify } from 'util';
 import { z } from 'zod';
 import * as p4 from '@clack/prompts';
 import chalk5 from 'chalk';
-import { exec, execFile, execSync, spawn } from 'child_process';
-import { promisify } from 'util';
 import { homedir } from 'os';
 import JSON5 from 'json5';
 import { execa } from 'execa';
@@ -676,6 +676,15 @@ async function exchangeForCopilotToken(githubToken) {
   }
   return await response.json();
 }
+async function getGitHubCliToken() {
+  try {
+    const { stdout } = await execFileAsync("gh", ["auth", "token"], { timeout: 5e3 });
+    const token = stdout.trim();
+    return token.length > 0 ? token : null;
+  } catch {
+    return null;
+  }
+}
 function getCopilotBaseUrl(accountType) {
   if (accountType && accountType in COPILOT_BASE_URLS) {
     return COPILOT_BASE_URLS[accountType];
@@ -713,10 +722,11 @@ function isCopilotTokenExpired(creds) {
 }
 async function getValidCopilotToken() {
   const creds = await loadCopilotCredentials();
-  if (!creds) return null;
-  const envToken = process.env["GITHUB_TOKEN"] || process.env["GH_TOKEN"];
-  const githubToken = envToken || creds.githubToken;
-  if (!isCopilotTokenExpired(creds) && creds.copilotToken) {
+  const envToken = process.env["COPILOT_GITHUB_TOKEN"] || process.env["GH_TOKEN"] || process.env["GITHUB_TOKEN"];
+  const fallbackGhToken = await getGitHubCliToken();
+  const githubToken = envToken || creds?.githubToken || fallbackGhToken;
+  if (!githubToken) return null;
+  if (creds && !isCopilotTokenExpired(creds) && creds.copilotToken) {
     return {
       token: creds.copilotToken,
       baseUrl: getCopilotBaseUrl(creds.accountType),
@@ -726,11 +736,11 @@ async function getValidCopilotToken() {
   try {
     const copilotToken = await exchangeForCopilotToken(githubToken);
     const updatedCreds = {
-      ...creds,
-      githubToken: creds.githubToken,
+      ...creds ?? { githubToken },
+      githubToken: creds?.githubToken ?? githubToken,
       copilotToken: copilotToken.token,
       copilotTokenExpiresAt: copilotToken.expires_at * 1e3,
-      accountType: copilotToken.annotations?.copilot_plan ?? creds.accountType
+      accountType: copilotToken.annotations?.copilot_plan ?? creds?.accountType
     };
     await saveCopilotCredentials(updatedCreds);
     return {
@@ -746,7 +756,7 @@ async function getValidCopilotToken() {
     throw error;
   }
 }
-var COPILOT_TOKEN_URL, COPILOT_BASE_URLS, DEFAULT_COPILOT_BASE_URL, REFRESH_BUFFER_MS, CopilotAuthError, CopilotCredentialsSchema;
+var COPILOT_TOKEN_URL, COPILOT_BASE_URLS, DEFAULT_COPILOT_BASE_URL, REFRESH_BUFFER_MS, execFileAsync, CopilotAuthError, CopilotCredentialsSchema;
 var init_copilot = __esm({
   "src/auth/copilot.ts"() {
     COPILOT_TOKEN_URL = "https://api.github.com/copilot_internal/v2/token";
@@ -757,6 +767,7 @@ var init_copilot = __esm({
     };
     DEFAULT_COPILOT_BASE_URL = "https://api.githubcopilot.com";
     REFRESH_BUFFER_MS = 6e4;
+    execFileAsync = promisify(execFile);
     CopilotAuthError = class extends Error {
       constructor(message, permanent) {
         super(message);
@@ -1482,7 +1493,7 @@ function getDefaultModel(provider) {
     case "anthropic":
       return process.env["ANTHROPIC_MODEL"] ?? "claude-opus-4-6";
     case "openai":
-      return process.env["OPENAI_MODEL"] ?? "gpt-5.4-codex";
+      return process.env["OPENAI_MODEL"] ?? "gpt-5.3-codex";
     case "gemini":
       return process.env["GEMINI_MODEL"] ?? "gemini-3.1-pro-preview";
     case "vertex":
@@ -14107,7 +14118,7 @@ var ResponsesToolCallAssembler = class {
 };
 
 // src/providers/openai.ts
-var DEFAULT_MODEL2 = "gpt-5.4-codex";
+var DEFAULT_MODEL2 = "gpt-5.3-codex";
 var CONTEXT_WINDOWS2 = {
   // OpenAI models
   "gpt-4o": 128e3,
@@ -15313,7 +15324,7 @@ function createKimiProvider(config) {
 init_errors();
 init_auth();
 var CODEX_API_ENDPOINT = "https://chatgpt.com/backend-api/codex/responses";
-var DEFAULT_MODEL3 = "gpt-5.4-codex";
+var DEFAULT_MODEL3 = "gpt-5.3-codex";
 var CONTEXT_WINDOWS3 = {
   "gpt-5.4-codex": 2e5,
   "gpt-5.3-codex": 2e5,
@@ -16089,6 +16100,7 @@ var CopilotProvider = class extends OpenAIProvider {
 // src/providers/gemini.ts
 init_errors();
 var DEFAULT_MODEL5 = "gemini-3.1-pro-preview";
+var SKIP_THOUGHT_SIGNATURE_VALIDATOR = "skip_thought_signature_validator";
 var CONTEXT_WINDOWS5 = {
   "gemini-3.1-pro-preview": 1e6,
   "gemini-3.1-flash-lite-preview": 1e6,
@@ -16181,30 +16193,29 @@ var GeminiProvider = class {
         if (text) {
           yield { type: "text", text };
         }
-        const functionCalls = this.extractFunctionCalls(chunk);
-        for (const functionCall of functionCalls) {
-          const toolCallId = functionCall.id ?? `gemini_call_${++fallbackToolCounter}`;
+        const toolCalls = this.extractToolCalls(chunk, { includeLegacyFunctionCalls: true });
+        for (const toolCall of toolCalls) {
+          const toolCallId = toolCall.id ?? `gemini_call_${++fallbackToolCounter}`;
           if (emittedToolIds.has(toolCallId)) continue;
           emittedToolIds.add(toolCallId);
-          const toolCall = {
-            id: toolCallId,
-            name: functionCall.name ?? "unknown_function",
-            input: functionCall.args ?? {}
+          const normalizedToolCall = {
+            ...toolCall,
+            id: toolCallId
           };
           yield {
             type: "tool_use_start",
             toolCall: {
-              id: toolCall.id,
-              name: toolCall.name
+              id: normalizedToolCall.id,
+              name: normalizedToolCall.name
             }
           };
           yield {
             type: "tool_use_end",
-            toolCall
+            toolCall: normalizedToolCall
           };
         }
         const finishReason = chunk.candidates?.[0]?.finishReason;
-        if (functionCalls.length > 0) {
+        if (toolCalls.length > 0) {
           streamStopReason = "tool_use";
         } else if (finishReason) {
           streamStopReason = this.mapFinishReason(finishReason);
@@ -16328,13 +16339,18 @@ var GeminiProvider = class {
         });
       } else if (block.type === "tool_use") {
         const toolUse = block;
-        parts.push({
-          functionCall: {
-            id: toolUse.id,
-            name: toolUse.name,
-            args: toolUse.input
-          }
-        });
+        const thoughtSignature = toolUse.geminiThoughtSignature ?? SKIP_THOUGHT_SIGNATURE_VALIDATOR;
+        const functionCall = {
+          id: toolUse.id,
+          name: toolUse.name,
+          args: toolUse.input
+        };
+        const part = {
+          functionCall,
+          thoughtSignature,
+          thought_signature: thoughtSignature
+        };
+        parts.push(part);
       }
     }
     return parts.length > 0 ? parts : [{ text: "" }];
@@ -16358,13 +16374,31 @@ var GeminiProvider = class {
       allowedFunctionNames: [choice.name]
     };
   }
-  extractFunctionCalls(response) {
-    if (response.functionCalls && response.functionCalls.length > 0) {
-      return response.functionCalls;
+  extractThoughtSignatureFromPart(part) {
+    const withSignature = part;
+    return withSignature.thoughtSignature ?? withSignature.thought_signature ?? withSignature.functionCall?.thoughtSignature ?? withSignature.functionCall?.thought_signature;
+  }
+  extractToolCalls(response, options) {
+    const toolCallsFromParts = (response.candidates?.[0]?.content?.parts ?? []).filter((part) => !!part.functionCall).map((part, index) => ({
+      id: part.functionCall.id ?? `gemini_call_${index + 1}`,
+      name: part.functionCall.name ?? "unknown_function",
+      input: part.functionCall.args ?? {},
+      geminiThoughtSignature: this.extractThoughtSignatureFromPart(part)
+    }));
+    if (toolCallsFromParts.length > 0) {
+      return toolCallsFromParts;
     }
-    const candidate = response.candidates?.[0];
-    const parts = candidate?.content?.parts ?? [];
-    return parts.filter((part) => !!part.functionCall).map((part) => part.functionCall).filter(Boolean);
+    if (!options?.includeLegacyFunctionCalls || !response.functionCalls?.length) {
+      return [];
+    }
+    return response.functionCalls.map((functionCall, index) => ({
+      id: functionCall.id ?? `gemini_call_${index + 1}`,
+      name: functionCall.name ?? "unknown_function",
+      input: functionCall.args ?? {},
+      geminiThoughtSignature: this.extractThoughtSignatureFromPart({
+        functionCall
+      })
+    }));
   }
   parseResponse(response, model) {
     const usage = response.usageMetadata;
@@ -16381,11 +16415,7 @@ var GeminiProvider = class {
   }
   parseResponseWithTools(response, model) {
     const usage = response.usageMetadata;
-    const toolCalls = this.extractFunctionCalls(response).map((functionCall, index) => ({
-      id: functionCall.id ?? `gemini_call_${index + 1}`,
-      name: functionCall.name ?? "unknown_function",
-      input: functionCall.args ?? {}
-    }));
+    const toolCalls = this.extractToolCalls(response, { includeLegacyFunctionCalls: true });
     return {
       id: `gemini-${Date.now()}`,
       content: response.text ?? "",
@@ -16437,12 +16467,33 @@ var DEFAULT_MODEL6 = "gemini-2.5-pro";
 var DEFAULT_BASE_URL = "https://aiplatform.googleapis.com/v1";
 var DEFAULT_LOCATION = "global";
 var CONTEXT_WINDOWS6 = {
+  "gemini-3-pro-preview": 1048576,
+  "gemini-3-flash-preview": 1048576,
   "gemini-2.5-pro": 1048576,
   "gemini-2.5-flash": 1048576,
   "gemini-2.5-flash-lite": 1048576,
   "gemini-2.0-flash-001": 1048576,
   "gemini-2.0-flash-lite-001": 1048576
 };
+var SKIP_THOUGHT_SIGNATURE_VALIDATOR2 = "skip_thought_signature_validator";
+function extractSseEventData(rawEvent) {
+  const dataLines = rawEvent.split(/\r?\n/).filter((line) => line.startsWith("data:")).map((line) => line.slice(5).trim()).filter(Boolean);
+  if (dataLines.length === 0) {
+    return null;
+  }
+  return dataLines.join("\n");
+}
+function getToolCallFingerprint(part) {
+  const name = part.functionCall?.name ?? "unknown_function";
+  let argsSerialized = "{}";
+  try {
+    argsSerialized = JSON.stringify(part.functionCall?.args ?? {});
+  } catch {
+    argsSerialized = "{}";
+  }
+  const thoughtSignature = part.thoughtSignature ?? part.thought_signature ?? part.functionCall?.thoughtSignature ?? part.functionCall?.thought_signature ?? "";
+  return `${name}:${argsSerialized}:${thoughtSignature}`;
+}
 var VertexProvider = class {
   id = "vertex";
   name = "Google Vertex AI Gemini";
@@ -16518,6 +16569,7 @@ var VertexProvider = class {
     );
     let stopReason = "end_turn";
     let streamToolCallCounter = 0;
+    const emittedToolFingerprints = /* @__PURE__ */ new Set();
     for await (const chunk of stream) {
       const candidate = chunk.candidates?.[0];
       const parts = candidate?.content?.parts ?? [];
@@ -16526,13 +16578,20 @@ var VertexProvider = class {
           yield { type: "text", text: part.text };
         }
         if (part.functionCall) {
+          const fingerprint = getToolCallFingerprint(part);
+          if (emittedToolFingerprints.has(fingerprint)) {
+            continue;
+          }
+          emittedToolFingerprints.add(fingerprint);
           streamToolCallCounter++;
+          const geminiThoughtSignature = part.thoughtSignature ?? part.thought_signature ?? part.functionCall.thoughtSignature ?? part.functionCall.thought_signature;
           yield {
             type: "tool_use_start",
             toolCall: {
               id: `vertex_call_${streamToolCallCounter}`,
               name: part.functionCall.name,
-              input: part.functionCall.args ?? {}
+              input: part.functionCall.args ?? {},
+              geminiThoughtSignature
             }
           };
           yield {
@@ -16540,7 +16599,8 @@ var VertexProvider = class {
             toolCall: {
               id: `vertex_call_${streamToolCallCounter}`,
               name: part.functionCall.name,
-              input: part.functionCall.args ?? {}
+              input: part.functionCall.args ?? {},
+              geminiThoughtSignature
             }
           };
         }
@@ -16673,11 +16733,14 @@ var VertexProvider = class {
         });
       } else if (block.type === "tool_use") {
         const toolUse = block;
+        const thoughtSignature = toolUse.geminiThoughtSignature ?? SKIP_THOUGHT_SIGNATURE_VALIDATOR2;
         parts.push({
           functionCall: {
             name: toolUse.name,
             args: toolUse.input
-          }
+          },
+          thoughtSignature,
+          thought_signature: thoughtSignature
         });
       }
     }
@@ -16769,22 +16832,27 @@ var VertexProvider = class {
       if (done) break;
       buffer += decoder.decode(value, { stream: true });
       while (true) {
-        const eventBoundary = buffer.indexOf("\n\n");
-        if (eventBoundary === -1) break;
-        const rawEvent = buffer.slice(0, eventBoundary);
-        buffer = buffer.slice(eventBoundary + 2);
-        const dataLines = rawEvent.split("\n").filter((line) => line.startsWith("data:")).map((line) => line.slice(5).trim()).filter(Boolean);
-        for (const line of dataLines) {
-          if (line === "[DONE]") return;
-          yield JSON.parse(line);
+        const boundaryMatch = /\r?\n\r?\n/.exec(buffer);
+        if (!boundaryMatch || boundaryMatch.index === void 0) break;
+        const rawEvent = buffer.slice(0, boundaryMatch.index);
+        buffer = buffer.slice(boundaryMatch.index + boundaryMatch[0].length);
+        const data = extractSseEventData(rawEvent);
+        if (!data || data === "[DONE]") {
+          if (data === "[DONE]") return;
+          continue;
+        }
+        try {
+          yield JSON.parse(data);
+        } catch {
+          continue;
         }
       }
     }
-    const trailing = buffer.trim();
-    if (trailing.startsWith("data:")) {
-      const line = trailing.slice(5).trim();
-      if (line && line !== "[DONE]") {
-        yield JSON.parse(line);
+    const trailingData = extractSseEventData(buffer.trim());
+    if (trailingData && trailingData !== "[DONE]") {
+      try {
+        yield JSON.parse(trailingData);
+      } catch {
       }
     }
   }
@@ -16817,7 +16885,8 @@ var VertexProvider = class {
         toolCalls.push({
           id: `vertex_call_${toolIndex}`,
           name: part.functionCall.name,
-          input: part.functionCall.args ?? {}
+          input: part.functionCall.args ?? {},
+          geminiThoughtSignature: part.thoughtSignature ?? part.thought_signature ?? part.functionCall.thoughtSignature ?? part.functionCall.thought_signature
         });
       }
     }
@@ -21448,9 +21517,6 @@ var buildTools = [
   runGradleTool
 ];
 
-// src/cli/repl/recommended-permissions.ts
-init_paths();
-
 // src/cli/repl/session.ts
 init_env();
 init_paths();
@@ -21485,6 +21551,7 @@ z.object({
 // src/cli/repl/session.ts
 path17__default.dirname(CONFIG_PATHS.trustedTools);
 CONFIG_PATHS.trustedTools;
+path17__default.join(".coco", "trusted-tools.json");
 
 // src/cli/repl/recommended-permissions.ts
 var RECOMMENDED_GLOBAL = [
@@ -27503,7 +27570,7 @@ init_errors2();
 init_callback_server();
 init_paths();
 init_logger();
-var execFileAsync2 = promisify(execFile);
+var execFileAsync3 = promisify(execFile);
 var TOKEN_STORE_PATH = path17__default.join(CONFIG_PATHS.tokens, "mcp-oauth.json");
 var OAUTH_TIMEOUT_MS = 5 * 60 * 1e3;
 var logger = getLogger();
@@ -27600,7 +27667,7 @@ async function openBrowser(url) {
   }
   for (const { cmd, args } of commands) {
     try {
-      await execFileAsync2(cmd, args);
+      await execFileAsync3(cmd, args);
       return true;
     } catch {
       continue;
@@ -28476,6 +28543,25 @@ var MCPServerManager = class _MCPServerManager {
   connections = /* @__PURE__ */ new Map();
   logger = getLogger();
   static STOP_TIMEOUT_MS = 5e3;
+  /**
+   * Run an async operation with a timeout, always clearing timer resources.
+   */
+  async runWithTimeout(operation, timeoutMs, timeoutMessage) {
+    let timeoutId;
+    const timeoutPromise = new Promise((_, reject) => {
+      timeoutId = setTimeout(() => reject(new Error(timeoutMessage)), timeoutMs);
+      if (typeof timeoutId.unref === "function") {
+        timeoutId.unref();
+      }
+    });
+    try {
+      return await Promise.race([operation, timeoutPromise]);
+    } finally {
+      if (timeoutId) {
+        clearTimeout(timeoutId);
+      }
+    }
+  }
   /**
    * Create transport for a server config
    */
@@ -28562,15 +28648,11 @@ var MCPServerManager = class _MCPServerManager {
     }
     this.logger.info(`Stopping MCP server: ${name}`);
     try {
-      await Promise.race([
+      await this.runWithTimeout(
         connection.transport.disconnect(),
-        new Promise(
-          (_, reject) => setTimeout(
-            () => reject(new Error("MCP disconnect timeout")),
-            _MCPServerManager.STOP_TIMEOUT_MS
-          )
-        )
-      ]);
+        _MCPServerManager.STOP_TIMEOUT_MS,
+        "MCP disconnect timeout"
+      );
     } catch (error) {
       this.logger.error(
         `Error disconnecting server '${name}': ${error instanceof Error ? error.message : String(error)}`
@@ -28607,12 +28689,11 @@ var MCPServerManager = class _MCPServerManager {
     }
     const startTime = performance.now();
     try {
-      const { tools } = await Promise.race([
+      const { tools } = await this.runWithTimeout(
         connection.client.listTools(),
-        new Promise(
-          (_, reject) => setTimeout(() => reject(new Error("Health check timeout")), 5e3)
-        )
-      ]);
+        5e3,
+        "Health check timeout"
+      );
       const latencyMs = performance.now() - startTime;
       connection.healthy = true;
       connection.toolCount = tools.length;