@corbat-tech/coco 2.5.2 → 2.5.3

package/dist/cli/index.js

@@ -1050,6 +1050,20 @@ var init_anthropic = __esm({
             if (event.type === "content_block_start") {
               const contentBlock = event.content_block;
               if (contentBlock.type === "tool_use") {
+                if (currentToolCall) {
+                  getLogger().warn(
+                    `[Anthropic] content_block_stop missing for tool '${currentToolCall.name}' \u2014 finalizing early to prevent data bleed.`
+                  );
+                  try {
+                    currentToolCall.input = currentToolInputJson ? JSON.parse(currentToolInputJson) : {};
+                  } catch {
+                    currentToolCall.input = {};
+                  }
+                  yield {
+                    type: "tool_use_end",
+                    toolCall: { ...currentToolCall }
+                  };
+                }
                 currentToolCall = {
                   id: contentBlock.id,
                   name: contentBlock.name
@@ -1650,6 +1664,30 @@ var init_openai = __esm({
             }
           };
           const timeoutInterval = setInterval(checkTimeout, 5e3);
+          const providerName = this.name;
+          const parseArguments = (builder) => {
+            let input = {};
+            try {
+              input = builder.arguments ? JSON.parse(builder.arguments) : {};
+            } catch (error) {
+              console.warn(
+                `[${providerName}] Failed to parse tool call arguments for ${builder.name}: ${builder.arguments?.slice(0, 300)}`
+              );
+              try {
+                if (builder.arguments) {
+                  const repaired = jsonrepair(builder.arguments);
+                  input = JSON.parse(repaired);
+                  console.log(`[${providerName}] \u2713 Successfully repaired JSON for ${builder.name}`);
+                }
+              } catch {
+                console.error(
+                  `[${providerName}] Cannot repair JSON for ${builder.name}, using empty object`
+                );
+                console.error(`[${providerName}] Original error:`, error);
+              }
+            }
+            return input;
+          };
           try {
             for await (const chunk of stream) {
               const delta = chunk.choices[0]?.delta;
@@ -1661,7 +1699,7 @@ var init_openai = __esm({
               }
               if (delta?.tool_calls) {
                 for (const toolCallDelta of delta.tool_calls) {
-                  const index = toolCallDelta.index;
+                  const index = toolCallDelta.index ?? toolCallBuilders.size;
                   if (!toolCallBuilders.has(index)) {
                     toolCallBuilders.set(index, {
                       id: toolCallDelta.id ?? "",
@@ -1696,34 +1734,28 @@ var init_openai = __esm({
                   }
                 }
               }
-            }
-            for (const [, builder] of toolCallBuilders) {
-              let input = {};
-              try {
-                input = builder.arguments ? JSON.parse(builder.arguments) : {};
-              } catch (error) {
-                console.warn(
-                  `[${this.name}] Failed to parse tool call arguments for ${builder.name}: ${builder.arguments?.slice(0, 300)}`
-                );
-                try {
-                  if (builder.arguments) {
-                    const repaired = jsonrepair(builder.arguments);
-                    input = JSON.parse(repaired);
-                    console.log(`[${this.name}] \u2713 Successfully repaired JSON for ${builder.name}`);
-                  }
-                } catch {
-                  console.error(
-                    `[${this.name}] Cannot repair JSON for ${builder.name}, using empty object`
-                  );
-                  console.error(`[${this.name}] Original error:`, error);
+              const finishReason = chunk.choices[0]?.finish_reason;
+              if (finishReason && toolCallBuilders.size > 0) {
+                for (const [, builder] of toolCallBuilders) {
+                  yield {
+                    type: "tool_use_end",
+                    toolCall: {
+                      id: builder.id,
+                      name: builder.name,
+                      input: parseArguments(builder)
+                    }
+                  };
                 }
+                toolCallBuilders.clear();
               }
+            }
+            for (const [, builder] of toolCallBuilders) {
               yield {
                 type: "tool_use_end",
                 toolCall: {
                   id: builder.id,
                   name: builder.name,
-                  input
+                  input: parseArguments(builder)
                 }
               };
             }
@@ -1892,7 +1924,8 @@ var init_openai = __esm({
           if (msg.role === "system") {
             result.push({ role: "system", content: this.contentToString(msg.content) });
           } else if (msg.role === "user") {
-            if (Array.isArray(msg.content) && msg.content[0]?.type === "tool_result") {
+            if (Array.isArray(msg.content) && msg.content.some((b) => b.type === "tool_result")) {
+              const textParts = [];
               for (const block of msg.content) {
                 if (block.type === "tool_result") {
                   const toolResult = block;
@@ -1901,8 +1934,16 @@ var init_openai = __esm({
                     tool_call_id: toolResult.tool_use_id,
                     content: toolResult.content
                   });
+                } else if (block.type === "text") {
+                  textParts.push(block.text);
                 }
               }
+              if (textParts.length > 0) {
+                console.warn(
+                  `[${this.name}] User message has mixed tool_result and text blocks \u2014 text emitted as a separate user message.`
+                );
+                result.push({ role: "user", content: textParts.join("") });
+              }
             } else if (Array.isArray(msg.content) && msg.content.some((b) => b.type === "image")) {
               const parts = [];
               for (const block of msg.content) {
@@ -1947,6 +1988,10 @@ var init_openai = __esm({
                       arguments: JSON.stringify(block.input)
                     }
                   });
+                } else {
+                  console.warn(
+                    `[${this.name}] Unexpected block type '${block.type}' in assistant message \u2014 dropping. This may indicate a message history corruption.`
+                  );
                 }
               }
               if (textParts.length > 0) {
@@ -6526,8 +6571,18 @@ CONVERSATION:
             wasCompacted: false
           };
         }
-        const messagesToSummarize = conversationMessages.slice(0, -this.config.preserveLastN);
-        const messagesToPreserve = conversationMessages.slice(-this.config.preserveLastN);
+        let preserveStart = conversationMessages.length - this.config.preserveLastN;
+        if (preserveStart > 0) {
+          while (preserveStart > 0) {
+            const first = conversationMessages[preserveStart];
+            if (!first) break;
+            const isToolResult = Array.isArray(first.content) && first.content.length > 0 && first.content[0]?.type === "tool_result";
+            if (!isToolResult) break;
+            preserveStart--;
+          }
+        }
+        const messagesToSummarize = conversationMessages.slice(0, preserveStart);
+        const messagesToPreserve = conversationMessages.slice(preserveStart);
         if (messagesToSummarize.length === 0) {
           return {
             messages,
@@ -8768,8 +8823,8 @@ async function killOrphanedTestProcesses() {
   }
   let killed = 0;
   try {
-    const { execa: execa13 } = await import('execa');
-    const result = await execa13("pgrep", ["-f", "vitest|jest.*--worker"], {
+    const { execa: execa14 } = await import('execa');
+    const result = await execa14("pgrep", ["-f", "vitest|jest.*--worker"], {
       reject: false
     });
     const pids = result.stdout.split("\n").map((s) => parseInt(s.trim(), 10)).filter((pid) => !isNaN(pid) && pid !== process.pid && pid !== process.ppid);
@@ -14330,6 +14385,15 @@ __export(bash_exports, {
   commandExistsTool: () => commandExistsTool,
   getEnvTool: () => getEnvTool
 });
+function getShellCommandPart(command) {
+  const firstNewline = command.indexOf("\n");
+  if (firstNewline === -1) return command;
+  const firstLine = command.slice(0, firstNewline);
+  if (/<<-?\s*['"]?\w/.test(firstLine)) {
+    return firstLine;
+  }
+  return command;
+}
 function isEnvVarSafe(name) {
   if (SAFE_ENV_VARS.has(name)) {
     return true;
@@ -14350,14 +14414,14 @@ function truncateOutput(output, maxLength = 5e4) {
 
 [Output truncated - ${output.length - maxLength} more characters]`;
 }
-var DEFAULT_TIMEOUT_MS, MAX_OUTPUT_SIZE, DANGEROUS_PATTERNS, SAFE_ENV_VARS, SENSITIVE_ENV_PATTERNS, bashExecTool, bashBackgroundTool, commandExistsTool, getEnvTool, bashTools;
+var DEFAULT_TIMEOUT_MS, MAX_OUTPUT_SIZE, DANGEROUS_PATTERNS_FULL, DANGEROUS_PATTERNS_SHELL_ONLY, SAFE_ENV_VARS, SENSITIVE_ENV_PATTERNS, bashExecTool, bashBackgroundTool, commandExistsTool, getEnvTool, bashTools;
 var init_bash = __esm({
   "src/tools/bash.ts"() {
     init_registry4();
     init_errors();
     DEFAULT_TIMEOUT_MS = 12e4;
     MAX_OUTPUT_SIZE = 1024 * 1024;
-    DANGEROUS_PATTERNS = [
+    DANGEROUS_PATTERNS_FULL = [
       /\brm\s+-rf\s+\/(?!\w)/,
       // rm -rf / (root)
       /\bsudo\s+rm\s+-rf/,
@@ -14370,14 +14434,6 @@ var init_bash = __esm({
       // Format filesystem
       /\bformat\s+/,
       // Windows format
-      /`[^`]+`/,
-      // Backtick command substitution
-      /\$\([^)]+\)/,
-      // $() command substitution
-      /\beval\s+/,
-      // eval command
-      /\bsource\s+/,
-      // source command (can execute arbitrary scripts)
       />\s*\/etc\//,
       // Write to /etc
       />\s*\/root\//,
@@ -14391,6 +14447,16 @@ var init_bash = __esm({
       /\bwget\s+.*\|\s*(ba)?sh/
       // wget | sh pattern
     ];
+    DANGEROUS_PATTERNS_SHELL_ONLY = [
+      /`[^`]+`/,
+      // Backtick command substitution
+      /\$\([^)]+\)/,
+      // $() command substitution
+      /\beval\s+/,
+      // eval command (shell eval, not JS eval())
+      /\bsource\s+/
+      // source command (can execute arbitrary scripts)
+    ];
     SAFE_ENV_VARS = /* @__PURE__ */ new Set([
       // System info (non-sensitive)
       "PATH",
@@ -14457,13 +14523,21 @@ Examples:
         env: z.record(z.string(), z.string()).optional().describe("Environment variables")
       }),
       async execute({ command, cwd, timeout, env: env2 }) {
-        for (const pattern of DANGEROUS_PATTERNS) {
+        const shellPart = getShellCommandPart(command);
+        for (const pattern of DANGEROUS_PATTERNS_FULL) {
           if (pattern.test(command)) {
             throw new ToolError(`Potentially dangerous command blocked: ${command.slice(0, 100)}`, {
               tool: "bash_exec"
             });
           }
         }
+        for (const pattern of DANGEROUS_PATTERNS_SHELL_ONLY) {
+          if (pattern.test(shellPart)) {
+            throw new ToolError(`Potentially dangerous command blocked: ${command.slice(0, 100)}`, {
+              tool: "bash_exec"
+            });
+          }
+        }
         const startTime = performance.now();
         const timeoutMs = timeout ?? DEFAULT_TIMEOUT_MS;
         const { CommandHeartbeat: CommandHeartbeat2 } = await Promise.resolve().then(() => (init_heartbeat(), heartbeat_exports));
@@ -14545,13 +14619,21 @@ Examples:
         env: z.record(z.string(), z.string()).optional().describe("Environment variables")
       }),
       async execute({ command, cwd, env: env2 }) {
-        for (const pattern of DANGEROUS_PATTERNS) {
+        const shellPart = getShellCommandPart(command);
+        for (const pattern of DANGEROUS_PATTERNS_FULL) {
           if (pattern.test(command)) {
             throw new ToolError(`Potentially dangerous command blocked: ${command.slice(0, 100)}`, {
               tool: "bash_background"
             });
           }
         }
+        for (const pattern of DANGEROUS_PATTERNS_SHELL_ONLY) {
+          if (pattern.test(shellPart)) {
+            throw new ToolError(`Potentially dangerous command blocked: ${command.slice(0, 100)}`, {
+              tool: "bash_background"
+            });
+          }
+        }
         try {
           const filteredEnv = {};
           for (const [key, value] of Object.entries(process.env)) {
@@ -18787,6 +18869,680 @@ var init_tools = __esm({
   }
 });
 
+// src/cli/repl/hooks/types.ts
+function isHookEvent(value) {
+  return typeof value === "string" && HOOK_EVENTS.includes(value);
+}
+function isHookType(value) {
+  return value === "command" || value === "prompt";
+}
+function isHookAction(value) {
+  return value === "allow" || value === "deny" || value === "modify";
+}
+var HOOK_EVENTS;
+var init_types8 = __esm({
+  "src/cli/repl/hooks/types.ts"() {
+    HOOK_EVENTS = [
+      "PreToolUse",
+      "PostToolUse",
+      "Stop",
+      "SubagentStop",
+      "PreCompact",
+      "SessionStart",
+      "SessionEnd"
+    ];
+  }
+});
+function createHookRegistry() {
+  return new HookRegistry();
+}
+var HookRegistry;
+var init_registry5 = __esm({
+  "src/cli/repl/hooks/registry.ts"() {
+    init_types8();
+    HookRegistry = class {
+      /** Hooks indexed by event type for O(1) lookup */
+      hooksByEvent;
+      /** Hooks indexed by ID for quick access */
+      hooksById;
+      constructor() {
+        this.hooksByEvent = /* @__PURE__ */ new Map();
+        this.hooksById = /* @__PURE__ */ new Map();
+      }
+      /**
+       * Register a hook
+       *
+       * @param hook - Hook definition to register
+       * @throws Error if hook with same ID already exists
+       */
+      register(hook) {
+        if (this.hooksById.has(hook.id)) {
+          throw new Error(`Hook with ID '${hook.id}' already exists`);
+        }
+        this.hooksById.set(hook.id, hook);
+        const eventHooks = this.hooksByEvent.get(hook.event) ?? [];
+        eventHooks.push(hook);
+        this.hooksByEvent.set(hook.event, eventHooks);
+      }
+      /**
+       * Unregister a hook by ID
+       *
+       * @param hookId - ID of hook to remove
+       * @returns true if hook was removed, false if not found
+       */
+      unregister(hookId) {
+        const hook = this.hooksById.get(hookId);
+        if (!hook) {
+          return false;
+        }
+        this.hooksById.delete(hookId);
+        const eventHooks = this.hooksByEvent.get(hook.event);
+        if (eventHooks) {
+          const index = eventHooks.findIndex((h) => h.id === hookId);
+          if (index !== -1) {
+            eventHooks.splice(index, 1);
+          }
+          if (eventHooks.length === 0) {
+            this.hooksByEvent.delete(hook.event);
+          }
+        }
+        return true;
+      }
+      /**
+       * Get all hooks for an event type
+       *
+       * @param event - Event type to query
+       * @returns Array of hooks for the event (empty if none)
+       */
+      getHooksForEvent(event) {
+        return this.hooksByEvent.get(event) ?? [];
+      }
+      /**
+       * Get hooks that match a specific event and optionally a tool
+       *
+       * Filters hooks by:
+       * 1. Event type match
+       * 2. Hook enabled status
+       * 3. Tool name pattern match (if toolName provided)
+       *
+       * @param event - Event type to match
+       * @param toolName - Optional tool name to match against matcher patterns
+       * @returns Array of matching enabled hooks
+       */
+      getMatchingHooks(event, toolName) {
+        const eventHooks = this.getHooksForEvent(event);
+        return eventHooks.filter((hook) => {
+          if (hook.enabled === false) {
+            return false;
+          }
+          if (!hook.matcher) {
+            return true;
+          }
+          if (!toolName) {
+            return !hook.matcher;
+          }
+          return this.matchesPattern(toolName, hook.matcher);
+        });
+      }
+      /**
+       * Load hooks from a config file
+       *
+       * Expects a JSON file with structure:
+       * ```json
+       * {
+       *   "version": 1,
+       *   "hooks": [...]
+       * }
+       * ```
+       *
+       * @param filePath - Path to hooks config file (JSON)
+       * @throws Error if file cannot be read or parsed
+       */
+      async loadFromFile(filePath) {
+        try {
+          await access(filePath);
+          const content = await readFile(filePath, "utf-8");
+          const config = JSON.parse(content);
+          if (typeof config.version !== "number") {
+            throw new Error("Invalid hooks config: missing version");
+          }
+          if (!Array.isArray(config.hooks)) {
+            throw new Error("Invalid hooks config: hooks must be an array");
+          }
+          this.clear();
+          for (const hook of config.hooks) {
+            this.validateHookDefinition(hook);
+            this.register(hook);
+          }
+        } catch (error) {
+          if (error.code === "ENOENT") {
+            return;
+          }
+          throw error;
+        }
+      }
+      /**
+       * Save hooks to a config file
+       *
+       * Creates the directory if it doesn't exist.
+       *
+       * @param filePath - Path to save hooks config
+       */
+      async saveToFile(filePath) {
+        await mkdir(dirname(filePath), { recursive: true });
+        const config = {
+          version: 1,
+          hooks: this.getAllHooks()
+        };
+        await writeFile(filePath, JSON.stringify(config, null, 2), "utf-8");
+      }
+      /**
+       * Clear all registered hooks
+       */
+      clear() {
+        this.hooksByEvent.clear();
+        this.hooksById.clear();
+      }
+      /**
+       * Get all registered hooks
+       *
+       * @returns Array of all hook definitions
+       */
+      getAllHooks() {
+        return Array.from(this.hooksById.values());
+      }
+      /**
+       * Get a hook by ID
+       *
+       * @param hookId - Hook ID to find
+       * @returns Hook definition or undefined if not found
+       */
+      getHookById(hookId) {
+        return this.hooksById.get(hookId);
+      }
+      /**
+       * Check if registry has any hooks for an event
+       *
+       * @param event - Event to check
+       * @returns true if any hooks are registered for the event
+       */
+      hasHooksForEvent(event) {
+        const hooks = this.hooksByEvent.get(event);
+        return hooks !== void 0 && hooks.length > 0;
+      }
+      /**
+       * Update an existing hook
+       *
+       * @param hookId - ID of hook to update
+       * @param updates - Partial hook definition with updates
+       * @returns true if hook was updated, false if not found
+       */
+      updateHook(hookId, updates) {
+        const existing = this.hooksById.get(hookId);
+        if (!existing) {
+          return false;
+        }
+        const eventChanging = updates.event && updates.event !== existing.event;
+        const oldEvent = existing.event;
+        Object.assign(existing, updates);
+        if (eventChanging && updates.event) {
+          const oldEventHooks = this.hooksByEvent.get(oldEvent);
+          if (oldEventHooks) {
+            const index = oldEventHooks.findIndex((h) => h.id === hookId);
+            if (index !== -1) {
+              oldEventHooks.splice(index, 1);
+            }
+            if (oldEventHooks.length === 0) {
+              this.hooksByEvent.delete(oldEvent);
+            }
+          }
+          const newEventHooks = this.hooksByEvent.get(updates.event) ?? [];
+          newEventHooks.push(existing);
+          this.hooksByEvent.set(updates.event, newEventHooks);
+        }
+        return true;
+      }
+      /**
+       * Enable or disable a hook
+       *
+       * @param hookId - ID of hook to toggle
+       * @param enabled - New enabled state
+       * @returns true if hook was updated, false if not found
+       */
+      setEnabled(hookId, enabled) {
+        return this.updateHook(hookId, { enabled });
+      }
+      /**
+       * Get count of registered hooks
+       */
+      get size() {
+        return this.hooksById.size;
+      }
+      /**
+       * Check if a tool name matches a glob-like pattern
+       *
+       * Supported patterns:
+       * - `*` matches any tool
+       * - `Edit*` matches Edit, EditFile, etc. (prefix match)
+       * - `*File` matches ReadFile, WriteFile, etc. (suffix match)
+       * - `*Code*` matches anything containing "Code"
+       * - `Bash` exact match
+       *
+       * @param toolName - Tool name to check
+       * @param pattern - Glob-like pattern
+       * @returns true if tool name matches pattern
+       */
+      matchesPattern(toolName, pattern) {
+        if (pattern === "*") {
+          return true;
+        }
+        if (!pattern.includes("*")) {
+          return toolName === pattern;
+        }
+        const escaped = pattern.replace(/[.+?^${}()|[\]\\]/g, "\\$&");
+        const regexPattern = escaped.replace(/\*/g, ".*");
+        const regex = new RegExp(`^${regexPattern}$`);
+        return regex.test(toolName);
+      }
+      /**
+       * Validate a hook definition has required fields
+       *
+       * @param hook - Hook to validate
+       * @throws Error if hook is invalid
+       */
+      validateHookDefinition(hook) {
+        if (!hook || typeof hook !== "object") {
+          throw new Error("Hook definition must be an object");
+        }
+        const h = hook;
+        if (typeof h.id !== "string" || h.id.length === 0) {
+          throw new Error("Hook definition must have a non-empty id");
+        }
+        if (typeof h.event !== "string") {
+          throw new Error("Hook definition must have an event type");
+        }
+        if (!isHookEvent(h.event)) {
+          throw new Error(
+            `Invalid hook event type: ${h.event}. Valid events: ${HOOK_EVENTS.join(", ")}`
+          );
+        }
+        if (typeof h.type !== "string") {
+          throw new Error("Hook definition must have a type (command or prompt)");
+        }
+        if (!isHookType(h.type)) {
+          throw new Error(`Invalid hook type: ${h.type}. Valid types: command, prompt`);
+        }
+        if (h.type === "command" && typeof h.command !== "string") {
+          throw new Error("Command hooks must have a command string");
+        }
+        if (h.type === "prompt" && typeof h.prompt !== "string") {
+          throw new Error("Prompt hooks must have a prompt string");
+        }
+      }
+    };
+  }
+});
+function createHookExecutor(options) {
+  return new HookExecutor(options);
+}
+var DEFAULT_TIMEOUT_MS5, MAX_OUTPUT_SIZE3, HookExecutor;
+var init_executor = __esm({
+  "src/cli/repl/hooks/executor.ts"() {
+    DEFAULT_TIMEOUT_MS5 = 3e4;
+    MAX_OUTPUT_SIZE3 = 64 * 1024;
+    HookExecutor = class {
+      defaultTimeout;
+      shell;
+      cwd;
+      /**
+       * Create a new HookExecutor
+       *
+       * @param options - Configuration options for the executor
+       */
+      constructor(options) {
+        this.defaultTimeout = options?.defaultTimeout ?? DEFAULT_TIMEOUT_MS5;
+        this.shell = options?.shell ?? (process.platform === "win32" ? "cmd.exe" : "/bin/bash");
+        this.cwd = options?.cwd ?? process.cwd();
+      }
+      /**
+       * Execute all hooks for an event from the registry
+       *
+       * @description Retrieves hooks from the registry that match the event and context,
+       * executes them in order, and aggregates the results. Execution stops early if
+       * a hook denies the operation (for PreToolUse events).
+       *
+       * @param registry - The hook registry to query for hooks
+       * @param context - The execution context with event details
+       * @returns Aggregated results from all hook executions
+       *
+       * @example
+       * ```typescript
+       * const result = await executor.executeHooks(registry, context);
+       * console.log(`Executed ${result.results.length} hooks in ${result.duration}ms`);
+       * ```
+       */
+      async executeHooks(registry, context) {
+        const startTime = performance.now();
+        const hooks = registry.getHooksForEvent(context.event);
+        const matchingHooks = hooks.filter((hook) => this.matchesContext(hook, context));
+        const enabledHooks = matchingHooks.filter((hook) => hook.enabled !== false);
+        if (enabledHooks.length === 0) {
+          return {
+            event: context.event,
+            results: [],
+            allSucceeded: true,
+            shouldContinue: true,
+            duration: performance.now() - startTime
+          };
+        }
+        const results = [];
+        let shouldContinue = true;
+        let modifiedInput;
+        let allSucceeded = true;
+        for (const hook of enabledHooks) {
+          if (!shouldContinue) {
+            break;
+          }
+          let result;
+          try {
+            if (hook.type === "command") {
+              result = await this.executeCommandHook(hook, context);
+            } else {
+              result = await this.executePromptHook(hook, context);
+            }
+          } catch (error) {
+            result = {
+              hookId: hook.id,
+              success: false,
+              error: error instanceof Error ? error.message : String(error),
+              duration: 0
+            };
+          }
+          results.push(result);
+          if (!result.success) {
+            allSucceeded = false;
+            if (!hook.continueOnError) {
+              shouldContinue = false;
+            }
+          }
+          if (result.action === "deny") {
+            shouldContinue = false;
+          } else if (result.action === "modify" && result.modifiedInput) {
+            modifiedInput = result.modifiedInput;
+          }
+          if (hook.type === "command" && result.exitCode === 1 && context.event === "PreToolUse") {
+            shouldContinue = false;
+          }
+        }
+        return {
+          event: context.event,
+          results,
+          allSucceeded,
+          shouldContinue,
+          modifiedInput,
+          duration: performance.now() - startTime
+        };
+      }
+      /**
+       * Execute a single command hook via shell
+       *
+       * @description Runs the hook's command in a shell subprocess with environment
+       * variables set based on the hook context. Handles timeouts and captures
+       * stdout/stderr.
+       *
+       * @param hook - The hook definition containing the command to execute
+       * @param context - The execution context
+       * @returns Result of the command execution
+       */
+      async executeCommandHook(hook, context) {
+        const startTime = performance.now();
+        if (!hook.command) {
+          return {
+            hookId: hook.id,
+            success: false,
+            error: "Command hook has no command defined",
+            duration: performance.now() - startTime
+          };
+        }
+        const timeoutMs = hook.timeout ?? this.defaultTimeout;
+        const env2 = this.buildEnvironment(context);
+        try {
+          const options = {
+            cwd: this.cwd,
+            timeout: timeoutMs,
+            env: { ...process.env, ...env2 },
+            shell: this.shell,
+            reject: false,
+            maxBuffer: MAX_OUTPUT_SIZE3
+          };
+          const result = await execa(hook.command, options);
+          const stdout = typeof result.stdout === "string" ? result.stdout : String(result.stdout ?? "");
+          const stderr = typeof result.stderr === "string" ? result.stderr : String(result.stderr ?? "");
+          const exitCode = result.exitCode ?? 0;
+          const success = exitCode === 0;
+          const output = [stdout, stderr].filter(Boolean).join("\n").trim();
+          return {
+            hookId: hook.id,
+            success,
+            output: output || void 0,
+            error: !success && stderr ? stderr : void 0,
+            duration: performance.now() - startTime,
+            exitCode
+          };
+        } catch (error) {
+          if (error.timedOut) {
+            return {
+              hookId: hook.id,
+              success: false,
+              error: `Hook timed out after ${timeoutMs}ms`,
+              duration: performance.now() - startTime
+            };
+          }
+          return {
+            hookId: hook.id,
+            success: false,
+            error: error instanceof Error ? error.message : String(error),
+            duration: performance.now() - startTime
+          };
+        }
+      }
+      /**
+       * Execute a single prompt hook via LLM
+       *
+       * @description Evaluates the hook's prompt using an LLM to determine the action
+       * to take. Currently simplified - returns "allow" by default. Full implementation
+       * would require LLM provider integration.
+       *
+       * @param hook - The hook definition containing the prompt to evaluate
+       * @param context - The execution context
+       * @returns Result of the prompt evaluation with action
+       *
+       * @remarks
+       * This is a simplified implementation. A full implementation would:
+       * 1. Format the prompt with context variables
+       * 2. Send the prompt to an LLM provider
+       * 3. Parse the response for action (allow/deny/modify)
+       * 4. Extract any modified input if action is "modify"
+       */
+      async executePromptHook(hook, context) {
+        const startTime = performance.now();
+        if (!hook.prompt) {
+          return {
+            hookId: hook.id,
+            success: false,
+            error: "Prompt hook has no prompt defined",
+            duration: performance.now() - startTime
+          };
+        }
+        const formattedPrompt = this.formatPrompt(hook.prompt, context);
+        const action = "allow";
+        return {
+          hookId: hook.id,
+          success: true,
+          output: `Prompt evaluated: ${formattedPrompt.slice(0, 100)}...`,
+          duration: performance.now() - startTime,
+          action
+        };
+      }
+      /**
+       * Build environment variables for hook execution
+       *
+       * @description Creates a set of environment variables that provide context
+       * to command hooks. Variables include event type, tool information, session ID,
+       * and project path.
+       *
+       * @param context - The hook execution context
+       * @returns Record of environment variable names to values
+       */
+      buildEnvironment(context) {
+        const env2 = {
+          COCO_HOOK_EVENT: context.event,
+          COCO_SESSION_ID: context.sessionId,
+          COCO_PROJECT_PATH: context.projectPath,
+          COCO_HOOK_TIMESTAMP: context.timestamp.toISOString()
+        };
+        if (context.toolName) {
+          env2.COCO_TOOL_NAME = context.toolName;
+        }
+        if (context.toolInput) {
+          try {
+            env2.COCO_TOOL_INPUT = JSON.stringify(context.toolInput);
+          } catch {
+            env2.COCO_TOOL_INPUT = String(context.toolInput);
+          }
+        }
+        if (context.toolResult) {
+          try {
+            env2.COCO_TOOL_RESULT = JSON.stringify(context.toolResult);
+          } catch {
+            env2.COCO_TOOL_RESULT = String(context.toolResult);
+          }
+        }
+        if (context.metadata) {
+          for (const [key, value] of Object.entries(context.metadata)) {
+            const envKey = `COCO_META_${key.toUpperCase().replace(/[^A-Z0-9_]/g, "_")}`;
+            try {
+              env2[envKey] = typeof value === "string" ? value : JSON.stringify(value);
+            } catch {
+              env2[envKey] = String(value);
+            }
+          }
+        }
+        return env2;
+      }
+      /**
+       * Check if a hook matches the given context
+       *
+       * @description Evaluates whether a hook should be executed based on its
+       * matcher pattern and the context's tool name. Supports glob-like patterns.
+       *
+       * @param hook - The hook definition to check
+       * @param context - The execution context
+       * @returns true if the hook should be executed
+       */
+      matchesContext(hook, context) {
+        if (!hook.matcher) {
+          return true;
+        }
+        if (!context.toolName) {
+          return true;
+        }
+        return this.matchPattern(hook.matcher, context.toolName);
+      }
+      /**
+       * Match a glob-like pattern against a string
+       *
+       * @description Supports simple glob patterns:
+       * - "*" matches any sequence of characters
+       * - "?" matches any single character
+       * - Exact match otherwise
+       *
+       * @param pattern - The pattern to match
+       * @param value - The value to match against
+       * @returns true if the value matches the pattern
+       */
+      matchPattern(pattern, value) {
+        if (!pattern.includes("*") && !pattern.includes("?")) {
+          return pattern === value;
+        }
+        const regexPattern = pattern.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*").replace(/\?/g, ".");
+        const regex = new RegExp(`^${regexPattern}$`);
+        return regex.test(value);
+      }
+      /**
+       * Format a prompt template with context values
+       *
+       * @description Replaces template variables in the prompt with values from
+       * the context. Variables are in the format {{variableName}}.
+       *
+       * Supported variables:
+       * - {{event}} - The hook event type
+       * - {{toolName}} - Name of the tool (if applicable)
+       * - {{toolInput}} - JSON string of tool input
+       * - {{toolResult}} - JSON string of tool result
+       * - {{sessionId}} - Session ID
+       * - {{projectPath}} - Project path
+       *
+       * @param prompt - The prompt template
+       * @param context - The execution context
+       * @returns Formatted prompt with variables replaced
+       */
+      formatPrompt(prompt, context) {
+        let formatted = prompt;
+        formatted = formatted.replace(/\{\{event\}\}/g, context.event);
+        formatted = formatted.replace(/\{\{toolName\}\}/g, context.toolName ?? "N/A");
+        formatted = formatted.replace(/\{\{sessionId\}\}/g, context.sessionId);
+        formatted = formatted.replace(/\{\{projectPath\}\}/g, context.projectPath);
+        if (context.toolInput) {
+          try {
+            formatted = formatted.replace(
+              /\{\{toolInput\}\}/g,
+              JSON.stringify(context.toolInput, null, 2)
+            );
+          } catch {
+            formatted = formatted.replace(/\{\{toolInput\}\}/g, String(context.toolInput));
+          }
+        } else {
+          formatted = formatted.replace(/\{\{toolInput\}\}/g, "N/A");
+        }
+        if (context.toolResult) {
+          try {
+            formatted = formatted.replace(
+              /\{\{toolResult\}\}/g,
+              JSON.stringify(context.toolResult, null, 2)
+            );
+          } catch {
+            formatted = formatted.replace(/\{\{toolResult\}\}/g, String(context.toolResult));
+          }
+        } else {
+          formatted = formatted.replace(/\{\{toolResult\}\}/g, "N/A");
+        }
+        return formatted;
+      }
+    };
+  }
+});
+
+// src/cli/repl/hooks/index.ts
+var hooks_exports = {};
+__export(hooks_exports, {
+  HOOK_EVENTS: () => HOOK_EVENTS,
+  HookExecutor: () => HookExecutor,
+  HookRegistry: () => HookRegistry,
+  createHookExecutor: () => createHookExecutor,
+  createHookRegistry: () => createHookRegistry,
+  isHookAction: () => isHookAction,
+  isHookEvent: () => isHookEvent,
+  isHookType: () => isHookType
+});
+var init_hooks = __esm({
+  "src/cli/repl/hooks/index.ts"() {
+    init_types8();
+    init_registry5();
+    init_executor();
+  }
+});
+
 // src/cli/repl/input/message-queue.ts
 function createMessageQueue(maxSize = 50) {
   let messages = [];
@@ -23100,9 +23856,9 @@ async function createCliPhaseContext(projectPath, _onUserInput) {
       },
       bash: {
         async exec(command, options = {}) {
-          const { execa: execa13 } = await import('execa');
+          const { execa: execa14 } = await import('execa');
           try {
-            const result = await execa13(command, {
+            const result = await execa14(command, {
               shell: true,
               cwd: options.cwd || projectPath,
               timeout: options.timeout,
@@ -31847,10 +32603,10 @@ var resumeCommand = {
 
 // src/cli/repl/version-check.ts
 init_version();
-var NPM_REGISTRY_URL = "https://registry.npmjs.org/@corbat-tech/coco";
+var NPM_REGISTRY_URL = "https://registry.npmjs.org/@corbat-tech/coco/latest";
 var CHECK_INTERVAL_MS = 24 * 60 * 60 * 1e3;
-var FETCH_TIMEOUT_MS = 2e3;
-var STARTUP_TIMEOUT_MS = 2500;
+var FETCH_TIMEOUT_MS = 5e3;
+var STARTUP_TIMEOUT_MS = 5500;
 var CACHE_DIR = path34__default.join(os4__default.homedir(), ".coco");
 var CACHE_FILE = path34__default.join(CACHE_DIR, "version-check-cache.json");
 function compareVersions(a, b) {
@@ -31898,7 +32654,7 @@ async function fetchLatestVersion() {
         return null;
       }
       const data = await response.json();
-      return data["dist-tags"]?.latest ?? null;
+      return data.version ?? null;
     } finally {
       clearTimeout(timeout);
     }
@@ -31970,10 +32726,14 @@ function printUpdateBanner(updateInfo) {
   console.log();
 }
 async function checkForUpdatesInteractive() {
+  let startupTimerId;
   const updateInfo = await Promise.race([
     checkForUpdates(),
-    new Promise((resolve4) => setTimeout(() => resolve4(null), STARTUP_TIMEOUT_MS))
+    new Promise((resolve4) => {
+      startupTimerId = setTimeout(() => resolve4(null), STARTUP_TIMEOUT_MS);
+    })
   ]);
+  clearTimeout(startupTimerId);
   if (!updateInfo) return;
   const p45 = await import('@clack/prompts');
   printUpdateBanner(updateInfo);
@@ -31986,10 +32746,10 @@ async function checkForUpdatesInteractive() {
     console.log(chalk25.dim(`  Running: ${updateInfo.updateCommand}`));
     console.log();
     try {
-      const { execa: execa13 } = await import('execa');
+      const { execa: execa14 } = await import('execa');
       const [cmd, ...args] = updateInfo.updateCommand.split(" ");
       if (!cmd) return;
-      await execa13(cmd, args, { stdio: "inherit", timeout: 12e4 });
+      await execa14(cmd, args, { stdio: "inherit", timeout: 12e4 });
       console.log();
       console.log(chalk25.green("  \u2713 Updated! Run coco again to start the new version."));
       console.log();
@@ -39289,7 +40049,7 @@ var imageTools = [readImageTool];
 init_registry4();
 init_errors();
 var path43 = await import('path');
-var DANGEROUS_PATTERNS2 = [
+var DANGEROUS_PATTERNS = [
   /\bDROP\s+(?:TABLE|DATABASE|INDEX|VIEW)\b/i,
   /\bTRUNCATE\b/i,
   /\bALTER\s+TABLE\b/i,
@@ -39299,7 +40059,7 @@ var DANGEROUS_PATTERNS2 = [
   /\bCREATE\s+(?:TABLE|DATABASE|INDEX)\b/i
 ];
 function isDangerousSql(sql2) {
-  return DANGEROUS_PATTERNS2.some((pattern) => pattern.test(sql2));
+  return DANGEROUS_PATTERNS.some((pattern) => pattern.test(sql2));
 }
 var sqlQueryTool = defineTool({
   name: "sql_query",
@@ -42742,7 +43502,20 @@ var ParallelToolExecutor = class {
         }
         nextTaskIndex++;
         activeCount++;
-        const taskPromise = this.executeSingleTool(
+        const execPromise = options.hookRegistry && options.hookExecutor ? this.executeSingleToolWithHooks(
+          task.toolCall,
+          task.index,
+          total,
+          registry,
+          options
+        ).then(({ executed: executed2, skipped: wasSkipped, reason }) => {
+          if (wasSkipped) {
+            const skipReason = reason ?? "Blocked by hook";
+            skipped.push({ toolCall: task.toolCall, reason: skipReason });
+            onToolSkipped?.(task.toolCall, skipReason);
+          }
+          return executed2 ?? null;
+        }) : this.executeSingleTool(
           task.toolCall,
           task.index,
           total,
@@ -42751,14 +43524,23 @@ var ParallelToolExecutor = class {
           onToolEnd,
           signal,
           onPathAccessDenied
-        ).then((result) => {
-          task.result = result;
-          task.completed = true;
-          results[task.index - 1] = result;
-          activeCount--;
-          startNextTask();
-          return result;
-        });
+        );
+        const taskPromise = execPromise.then(
+          (result) => {
+            task.result = result;
+            task.completed = true;
+            results[task.index - 1] = result;
+            activeCount--;
+            startNextTask();
+            return result;
+          },
+          (err) => {
+            task.completed = true;
+            activeCount--;
+            startNextTask();
+            throw err;
+          }
+        );
         task.promise = taskPromise;
         processingPromises.push(taskPromise);
       }
@@ -42789,7 +43571,11 @@ var ParallelToolExecutor = class {
     if (!result.success && result.error && onPathAccessDenied) {
       const dirPath = extractDeniedPath(result.error);
       if (dirPath) {
-        const authorized = await onPathAccessDenied(dirPath);
+        let authorized = false;
+        try {
+          authorized = await onPathAccessDenied(dirPath);
+        } catch {
+        }
         if (authorized) {
           result = await registry.execute(toolCall.name, toolCall.input, { signal });
         }
@@ -43077,7 +43863,13 @@ async function executeAgentTurn(session, userMessage, provider, toolRegistry, op
           const result = await promptAllowPath(dirPath);
           options.onAfterConfirmation?.();
           return result;
-        }
+        },
+        // Pass hooks through so PreToolUse/PostToolUse hooks fire during execution
+        hookRegistry: options.hookRegistry,
+        hookExecutor: options.hookExecutor,
+        sessionId: session.id,
+        projectPath: session.projectPath,
+        onHookExecuted: options.onHookExecuted
       });
       for (const executed of parallelResult.executed) {
         executedTools.push(executed);
@@ -43149,6 +43941,16 @@ async function executeAgentTurn(session, userMessage, provider, toolRegistry, op
           content: executedCall.result.output,
           is_error: !executedCall.result.success
         });
+      } else {
+        console.warn(
+          `[AgentLoop] No result found for tool call ${toolCall.name}:${toolCall.id} \u2014 injecting error placeholder to keep history valid`
+        );
+        toolResults.push({
+          type: "tool_result",
+          tool_use_id: toolCall.id,
+          content: "Tool execution result unavailable (internal error)",
+          is_error: true
+        });
       }
     }
     let stuckInErrorLoop = false;
@@ -43871,6 +44673,24 @@ async function startRepl(options = {}) {
       `[MCP] Initialization failed: ${mcpError instanceof Error ? mcpError.message : String(mcpError)}`
     );
   }
+  let hookRegistry;
+  let hookExecutor;
+  try {
+    const hooksConfigPath = `${projectPath}/.coco/hooks.json`;
+    const { createHookRegistry: createHookRegistry2, createHookExecutor: createHookExecutor2 } = await Promise.resolve().then(() => (init_hooks(), hooks_exports));
+    const registry = createHookRegistry2();
+    await registry.loadFromFile(hooksConfigPath);
+    if (registry.size > 0) {
+      hookRegistry = registry;
+      hookExecutor = createHookExecutor2();
+      logger.info(`[Hooks] Loaded ${registry.size} hook(s) from ${hooksConfigPath}`);
+    }
+  } catch (hookError) {
+    const msg = hookError instanceof Error ? hookError.message : String(hookError);
+    if (!msg.includes("ENOENT")) {
+      logger.warn(`[Hooks] Failed to load hooks: ${msg}`);
+    }
+  }
   const inputHandler = createInputHandler();
   const { createConcurrentCapture: createConcurrentCapture2 } = await Promise.resolve().then(() => (init_concurrent_capture_v2(), concurrent_capture_v2_exports));
   const { createFeedbackSystem: createFeedbackSystem2 } = await Promise.resolve().then(() => (init_feedback_system(), feedback_system_exports));
@@ -43929,6 +44749,10 @@ async function startRepl(options = {}) {
       break;
     }
     if (!input && !hasPendingImage()) continue;
+    if (input && ["exit", "quit", "q"].includes(input.trim().toLowerCase())) {
+      console.log(chalk25.dim("\nGoodbye!"));
+      break;
+    }
     let agentMessage = null;
     if (input && isSlashCommand(input)) {
       const prevProviderType = session.config.provider.type;
@@ -44154,6 +44978,8 @@ async function startRepl(options = {}) {
       );
       process.once("SIGINT", sigintHandler);
       let streamStarted = false;
+      let llmCallCount = 0;
+      let lastToolGroup = null;
       const result = await executeAgentTurn(session, effectiveMessage, provider, toolRegistry, {
         onStream: (chunk) => {
           if (!streamStarted) {
@@ -44181,10 +45007,13 @@ async function startRepl(options = {}) {
           }
           renderToolStart(result2.name, result2.input);
           renderToolEnd(result2);
+          lastToolGroup = getToolGroup(result2.name);
           if (!result2.result.success && result2.result.error && looksLikeTechnicalJargon(result2.result.error)) {
             pendingExplanations.push(humanizeWithLLM(result2.result.error, result2.name, provider));
           }
-          if (isQualityLoop()) {
+          if (isQualityLoop() && llmCallCount > 0) {
+            setSpinner(`Processing results (iter. ${llmCallCount})...`);
+          } else if (isQualityLoop()) {
             setSpinner("Processing results & checking quality...");
           } else {
             setSpinner("Processing...");
@@ -44195,18 +45024,22 @@ async function startRepl(options = {}) {
           console.log(chalk25.yellow(`\u2298 Skipped ${tc.name}: ${reason}`));
         },
         onThinkingStart: () => {
-          setSpinner("Thinking...");
+          llmCallCount++;
+          const iterPrefix = isQualityLoop() && llmCallCount > 1 ? `Iter. ${llmCallCount} \xB7 ` : "";
+          const afterText = lastToolGroup ? `after ${lastToolGroup} \xB7 ` : "";
+          setSpinner(`${iterPrefix}${afterText}Thinking...`);
           thinkingStartTime = Date.now();
           thinkingInterval = setInterval(() => {
             if (!thinkingStartTime) return;
             const elapsed = Math.floor((Date.now() - thinkingStartTime) / 1e3);
             if (elapsed < 4) return;
+            const prefix = isQualityLoop() && llmCallCount > 1 ? `Iter. ${llmCallCount} \xB7 ` : "";
             if (isQualityLoop()) {
-              if (elapsed < 8) setSpinner("Analyzing request...");
-              else if (elapsed < 15) setSpinner("Running quality checks...");
-              else if (elapsed < 25) setSpinner("Iterating for quality...");
-              else if (elapsed < 40) setSpinner("Verifying implementation...");
-              else setSpinner(`Quality iteration in progress... (${elapsed}s)`);
+              if (elapsed < 8) setSpinner(`${prefix}Analyzing results...`);
+              else if (elapsed < 15) setSpinner(`${prefix}Running quality checks...`);
+              else if (elapsed < 25) setSpinner(`${prefix}Iterating for quality...`);
+              else if (elapsed < 40) setSpinner(`${prefix}Verifying implementation...`);
+              else setSpinner(`${prefix}Still working... (${elapsed}s)`);
             } else {
               if (elapsed < 8) setSpinner("Analyzing request...");
               else if (elapsed < 12) setSpinner("Planning approach...");
@@ -44231,7 +45064,10 @@ async function startRepl(options = {}) {
           concurrentCapture.resumeCapture();
           inputEcho.resume();
         },
-        signal: abortController.signal
+        signal: abortController.signal,
+        // Wire lifecycle hooks (PreToolUse/PostToolUse) if configured in .coco/hooks.json
+        hookRegistry,
+        hookExecutor
       });
       clearThinkingInterval();
       clearSpinner();
@@ -44498,6 +45334,37 @@ async function checkProjectTrust(projectPath) {
   console.log(chalk25.green("  \u2713 Access granted") + chalk25.dim(" \u2022 /trust to manage"));
   return true;
 }
+function getToolGroup(toolName) {
+  switch (toolName) {
+    case "run_tests":
+      return "running tests";
+    case "bash_exec":
+      return "running command";
+    case "web_search":
+    case "web_fetch":
+      return "web search";
+    case "read_file":
+    case "list_directory":
+    case "glob_files":
+    case "tree":
+      return "reading files";
+    case "grep_search":
+    case "semantic_search":
+    case "codebase_map":
+      return "searching code";
+    case "write_file":
+      return "writing file";
+    case "edit_file":
+      return "editing file";
+    case "git_status":
+    case "git_diff":
+    case "git_commit":
+    case "git_log":
+      return "git";
+    default:
+      return toolName.replace(/_/g, " ");
+  }
+}
 function getToolPreparingDescription(toolName) {
   switch (toolName) {
     case "write_file":