Skip to content

CoCo v1.2.0 — two new skills and a security pass

Latest
Latest

Choose a tag to compare

View all tags
@coco-research coco-research released this 31 Jul 21:58
· 44 commits to main since this release
v1.2.0
f1c4b19
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

The first release since v1.1.0 on 2026-07-18. Two new skills, and a security pass across the installer, the CI workflows, and the funding configuration.

Added

coco-loop turns a plain-language goal into a readable charter that you confirm, then arms and runs a bounded autonomous loop in propose-only mode. It never commits on its own. It needs the coco-loops framework, which the skill now links with install steps.

scroll-world builds an immersive scroll-scrubbed landing page: a pre-rendered camera flies from outside each scene into its interior, then on to the next with no cuts, as one continuous flight. Contributed upstream by cyw under MIT, with the original licence retained at skills/scroll-world/LICENSE.

Security

Most of this work is by @imachiever (Rajat Bhatia), and it is worth reading if you install CoCo via the one-line bootstrap.

  • The bootstrap installer now asks before it runs. bin/coco-bootstrap.sh clones first, prints the commit hash, date and message, and waits for explicit confirmation before executing install.sh. The default is fail-closed. Only COCO_BOOTSTRAP_YES=1 or --yes skips it.
  • GitHub Actions are pinned to commit SHAs with workflows scoped to permissions: contents: read. Pins target actions/setup-node v7 and actions/setup-python v5, each verified to exist upstream and to match the commit its tag points to.
  • A DOM cross-site-scripting vector was fixed in the brainstorming helper, which built its selection indicator by concatenating a label into innerHTML.
  • The Cursor adapter installer was hardened. link_dir() could silently overwrite a real file, and a A && B || C pattern could execute a real command when a dry-run echo failed.
  • The funding configuration was corrected. .github/FUNDING.yml still referenced rkz91, the account name used before the 2026-07-18 rename to coco-research. An unrelated third party had since registered the vacated username. No funds could have been misdirected, because that account has no Sponsors listing, but the window is now closed. The same stale references were removed from the installer, where one was the documented curl-pipe-to-bash command.
  • A Content-Security-Policy was added to the generated diagram artifacts, CVE floor versions were raised in the openai-apps-mcp template, and find-skills now requires a resolved package name to be surfaced and confirmed before an agent installs anything on your behalf.

Counts

Asset counts now match the tree exactly: 149 skills (66 core plus 83 across bundles), 867 addressable assets, 126 in a core install. Spec Version is 1.2.0.

Install

bash <(curl -fsSL https://raw.githubusercontent.com/coco-research/coco/main/bin/coco-bootstrap.sh)

You will be shown the commit you are about to install and asked to confirm.

Upgrading from v1.1.0? Nothing breaks. There are no schema or contract changes, so an existing install can update in place.

Assets 2
Loading