@kodax-ai/kodax 0.7.78 → 0.7.79

package/config-templates/config.example.jsonc

@@ -36,13 +36,22 @@
   // "autoMode": {
   //   "engine": "llm",
   //   "classifierModel": "provider:model",
-  //   "timeoutMs": 20000,
+  //   "timeoutMs": 30000,
   //   "speculativeWindowMs": 500
   // },
 
   // UI/manual locale.
   // "locale": "zh",
 
+  // Sensitive environment variables are filtered from model-issued commands by
+  // default. List exact host variable names here to pass them to the command
+  // target (including ASRT); values are never stored in this file. Project
+  // config cannot extend this user-level list. Execution-control variables such
+  // as NODE_OPTIONS and BASH_ENV remain blocked.
+  // "sandbox": {
+  //   "envPass": ["GH_TOKEN", "GITHUB_TOKEN", "OPENAI_API_KEY"]
+  // },
+
   // Custom providers store public connection metadata only. Put the actual
   // credential in the named environment variable, never in this file. Use
   // `kodax setup --custom` for the guided writer.
@@ -58,6 +67,7 @@
   //     "userAgentMode": "compat",
   //     "contextWindow": 128000,
   //     "maxOutputTokens": 8192,
+  //     "maxOutputTokensField": "max_completion_tokens",
   //     "thinkingBudgetCap": 32000,
   //     "promptCacheAffinity": false,
   //     "replayReasoningContent": false,

package/config-templates/integrations/a2a.example.jsonc

@@ -66,13 +66,29 @@
     // Fixed Bearer compatibility example. `enabled` is hot desired state:
     // disabled Agents remain configured but are not candidates for new
     // orchestration, while already admitted remote tasks may finish.
-    // "reporting": {
-    //   "cardUrl": "https://agents.example.com/.well-known/agent-card.json",
-    //   "enabled": true,
-    //   "credentialEnv": "REPORTING_A2A_TOKEN",
-    //   "effect": "read"
-    // },
-
+    // "reporting": {
+    //   "cardUrl": "https://agents.example.com/.well-known/agent-card.json",
+    //   "enabled": true,
+    //   "credentialEnv": "REPORTING_A2A_TOKEN",
+    //   "effect": "read"
+    // },
+
+    // Private addresses and plaintext HTTP are separate, default-deny
+    // permissions. Exact loopback HTTP needs neither. Private HTTP needs both;
+    // private HTTPS needs only allowPrivateAddresses. Prefer TLS whenever it is
+    // available. The equivalent CLI flags are `--allow-private` and
+    // `--allow-insecure-http`. OAuth token endpoints keep their stricter
+    // HTTPS-or-exact-loopback rule even when Agent transport HTTP is allowed.
+    // "intranet": {
+    //   "cardUrl": "http://10.20.30.40/.well-known/agent-card.json",
+    //   "enabled": true,
+    //   "network": {
+    //     "allowPrivateAddresses": true,
+    //     "allowInsecureHttp": true
+    //   },
+    //   "effect": "read"
+    // },
+
     // Standards-based machine-to-machine OAuth2 example. The external
     // Authorization Server issues access tokens; KodaX obtains and caches them
     // only in process memory. `tokenUrl` must exactly match the selected Card

package/dist/builtin/skill-creator/scripts/aggregate-benchmark.js

@@ -198,7 +198,8 @@ async function main() {
   console.log(`Wrote ${benchmarkMdPath}`);
 }
 
-const isDirectRun = process.argv[1]
+const isDirectRun = process.env.KODAX_MODULE_BUNDLE !== 'true'
+  && process.argv[1]
   && fileURLToPath(import.meta.url) === path.resolve(process.argv[1]);
 
 if (isDirectRun) {

package/dist/builtin/skill-creator/scripts/analyze-benchmark.d.ts

@@ -44,3 +44,4 @@ export function analyzeBenchmark(
   analysisJsonPath: string;
   analysisMdPath: string;
 }>;
+export declare function main(argv?: string[]): Promise<void>;

package/dist/builtin/skill-creator/scripts/analyze-benchmark.js

@@ -263,8 +263,8 @@ function parseArgs(argv) {
   return args;
 }
 
-async function main() {
-  const args = parseArgs(process.argv);
+export async function main(argv = process.argv) {
+  const args = parseArgs(argv);
   if (!args.workspaceDir) {
     console.error('Usage: node scripts/analyze-benchmark.js <workspace> [--benchmark benchmark.json] [--output analysis.json] [--markdown analysis.md]');
     process.exit(1);
@@ -278,7 +278,8 @@ async function main() {
   }, null, 2)}\n`);
 }
 
-const isDirectRun = process.argv[1]
+const isDirectRun = process.env.KODAX_MODULE_BUNDLE !== 'true'
+  && process.argv[1]
   && fileURLToPath(import.meta.url) === path.resolve(process.argv[1]);
 
 if (isDirectRun) {

package/dist/builtin/skill-creator/scripts/compare-runs.d.ts

@@ -60,3 +60,4 @@ export function compareWorkspace(
   outputPath: string;
   markdownPath: string;
 }>;
+export declare function main(argv?: string[]): Promise<void>;

package/dist/builtin/skill-creator/scripts/compare-runs.js

@@ -307,8 +307,8 @@ function parseArgs(argv) {
   return args;
 }
 
-async function main() {
-  const args = parseArgs(process.argv);
+export async function main(argv = process.argv) {
+  const args = parseArgs(argv);
   if (!args.workspaceDir) {
     console.error('Usage: node scripts/compare-runs.js <workspace> [--config-a with_skill] [--config-b without_skill] [--output comparison.json]');
     process.exit(1);
@@ -322,7 +322,8 @@ async function main() {
   }, null, 2)}\n`);
 }
 
-const isDirectRun = process.argv[1]
+const isDirectRun = process.env.KODAX_MODULE_BUNDLE !== 'true'
+  && process.argv[1]
   && fileURLToPath(import.meta.url) === path.resolve(process.argv[1]);
 
 if (isDirectRun) {

package/dist/builtin/skill-creator/scripts/generate-review.js

@@ -404,7 +404,8 @@ async function main() {
   });
 }
 
-const isDirectRun = process.argv[1]
+const isDirectRun = process.env.KODAX_MODULE_BUNDLE !== 'true'
+  && process.argv[1]
   && fileURLToPath(import.meta.url) === path.resolve(process.argv[1]);
 
 if (isDirectRun) {

package/dist/builtin/skill-creator/scripts/grade-evals.d.ts

@@ -71,3 +71,4 @@ export function gradeWorkspace(
   processed_runs: Array<Record<string, unknown>>;
   skipped_runs: string[];
 }>;
+export declare function main(argv?: string[]): Promise<void>;

package/dist/builtin/skill-creator/scripts/grade-evals.js

@@ -383,8 +383,8 @@ function parseArgs(argv) {
   return args;
 }
 
-async function main() {
-  const args = parseArgs(process.argv);
+export async function main(argv = process.argv) {
+  const args = parseArgs(argv);
   if (!args.workspaceDir) {
     console.error('Usage: node scripts/grade-evals.js <workspace> [--provider anthropic] [--configs with_skill,without_skill] [--overwrite]');
     process.exit(1);
@@ -394,7 +394,8 @@ async function main() {
   process.stdout.write(`${JSON.stringify(summary, null, 2)}\n`);
 }
 
-const isDirectRun = process.argv[1]
+const isDirectRun = process.env.KODAX_MODULE_BUNDLE !== 'true'
+  && process.argv[1]
   && fileURLToPath(import.meta.url) === path.resolve(process.argv[1]);
 
 if (isDirectRun) {

package/dist/builtin/skill-creator/scripts/improve-description.js

@@ -150,7 +150,8 @@ async function main() {
   }
 }
 
-const isDirectRun = process.argv[1]
+const isDirectRun = process.env.KODAX_MODULE_BUNDLE !== 'true'
+  && process.argv[1]
   && fileURLToPath(import.meta.url) === path.resolve(process.argv[1]);
 
 if (isDirectRun) {

package/dist/builtin/skill-creator/scripts/init-skill.d.ts

@@ -12,3 +12,4 @@ export function initSkill(options: InitSkillOptions): Promise<{
   skillDir: string;
   created: string[];
 }>;
+export declare function main(argv?: string[]): Promise<void>;

package/dist/builtin/skill-creator/scripts/init-skill.js

@@ -131,8 +131,8 @@ function parseArgs(argv) {
   return args;
 }
 
-async function main() {
-  const args = parseArgs(process.argv);
+export async function main(argv = process.argv) {
+  const args = parseArgs(argv);
   if (!args.name) {
     console.error('Usage: node scripts/init-skill.js <skill-name> [--path <skills-dir>] [--description <text>] [--force] [--no-evals]');
     process.exit(1);
@@ -142,7 +142,8 @@ async function main() {
   console.log(`Initialized ${result.skillDir}`);
 }
 
-const isDirectRun = process.argv[1]
+const isDirectRun = process.env.KODAX_MODULE_BUNDLE !== 'true'
+  && process.argv[1]
   && fileURLToPath(import.meta.url) === path.resolve(process.argv[1]);
 
 if (isDirectRun) {

package/dist/builtin/skill-creator/scripts/install-skill.d.ts

@@ -27,3 +27,4 @@ export function installSkill(
   inputPath: string,
   options?: { skillsDir?: string; force?: boolean }
 ): Promise<InstalledSkillResult>;
+export declare function main(argv?: string[]): Promise<void>;

package/dist/builtin/skill-creator/scripts/install-skill.js

@@ -154,8 +154,8 @@ function parseArgs(argv) {
   return args;
 }
 
-async function main() {
-  const args = parseArgs(process.argv);
+export async function main(argv = process.argv) {
+  const args = parseArgs(argv);
   if (!args.input) {
     console.error('Usage: node scripts/install-skill.js <skill-dir-or-archive> [--dest <skills-dir>] [--force]');
     process.exit(1);
@@ -165,7 +165,8 @@ async function main() {
   console.log(`Installed ${result.skillName} to ${result.installedTo}`);
 }
 
-const isDirectRun = process.argv[1]
+const isDirectRun = process.env.KODAX_MODULE_BUNDLE !== 'true'
+  && process.argv[1]
   && fileURLToPath(import.meta.url) === path.resolve(process.argv[1]);
 
 if (isDirectRun) {

package/dist/builtin/skill-creator/scripts/package-skill.d.ts

@@ -36,3 +36,4 @@ export function writeSkillPackage(
   outputPath: string,
   options?: { createdAt?: string }
 ): Promise<{ manifest: SkillPackageManifest; bytes: Uint8Array; outputPath: string }>;
+export declare function main(argv?: string[]): Promise<void>;

package/dist/builtin/skill-creator/scripts/package-skill.js

@@ -100,8 +100,8 @@ function parseArgs(argv) {
   return args;
 }
 
-async function main() {
-  const args = parseArgs(process.argv);
+export async function main(argv = process.argv) {
+  const args = parseArgs(argv);
   if (!args.skillDir) {
     console.error('Usage: node scripts/package-skill.js <skill-dir> [--output <file.skill>]');
     process.exit(1);
@@ -113,7 +113,8 @@ async function main() {
   console.log(`Wrote ${result.outputPath}`);
 }
 
-const isDirectRun = process.argv[1]
+const isDirectRun = process.env.KODAX_MODULE_BUNDLE !== 'true'
+  && process.argv[1]
   && fileURLToPath(import.meta.url) === path.resolve(process.argv[1]);
 
 if (isDirectRun) {

package/dist/builtin/skill-creator/scripts/quick-validate.d.ts

@@ -6,3 +6,4 @@ export interface SkillValidationResult {
 }
 
 export function validateSkillDirectory(skillDir: string): Promise<SkillValidationResult>;
+export declare function main(argv?: string[]): Promise<void>;

package/dist/builtin/skill-creator/scripts/quick-validate.js

@@ -127,8 +127,8 @@ export async function validateSkillDirectory(skillDir) {
   return result;
 }
 
-async function main() {
-  const skillDir = process.argv[2];
+export async function main(argv = process.argv) {
+  const skillDir = argv[2];
   if (!skillDir) {
     console.error('Usage: node scripts/quick-validate.js <skill-directory>');
     process.exit(1);
@@ -155,7 +155,8 @@ async function main() {
   process.exit(result.valid ? 0 : 1);
 }
 
-const isDirectRun = process.argv[1]
+const isDirectRun = process.env.KODAX_MODULE_BUNDLE !== 'true'
+  && process.argv[1]
   && fileURLToPath(import.meta.url) === path.resolve(process.argv[1]);
 
 if (isDirectRun) {

package/dist/builtin/skill-creator/scripts/run-eval.d.ts

@@ -64,3 +64,4 @@ export function runEvalWorkspace(
   runs_per_config: number;
   reports: Array<Record<string, unknown>>;
 }>;
+export declare function main(argv?: string[]): Promise<void>;

package/dist/builtin/skill-creator/scripts/run-eval.js

@@ -327,8 +327,8 @@ function parseArgs(argv) {
   return args;
 }
 
-async function main() {
-  const args = parseArgs(process.argv);
+export async function main(argv = process.argv) {
+  const args = parseArgs(argv);
   if (!args.skillPath || !args.evalsPath || !args.workspaceDir) {
     console.error('Usage: node scripts/run-eval.js --skill-path <dir> --evals <evals.json> --workspace <dir> [--provider anthropic] [--runs 1]');
     process.exit(1);
@@ -345,7 +345,8 @@ async function main() {
   }
 }
 
-const isDirectRun = process.argv[1]
+const isDirectRun = process.env.KODAX_MODULE_BUNDLE !== 'true'
+  && process.argv[1]
   && fileURLToPath(import.meta.url) === path.resolve(process.argv[1]);
 
 if (isDirectRun) {

package/dist/builtin/skill-creator/scripts/run-loop.js

@@ -232,7 +232,8 @@ async function main() {
   }
 }
 
-const isDirectRun = process.argv[1]
+const isDirectRun = process.env.KODAX_MODULE_BUNDLE !== 'true'
+  && process.argv[1]
   && fileURLToPath(import.meta.url) === path.resolve(process.argv[1]);
 
 if (isDirectRun) {

package/dist/builtin/skill-creator/scripts/run-trigger-eval.js

@@ -214,7 +214,8 @@ async function main() {
   }
 }
 
-const isDirectRun = process.argv[1]
+const isDirectRun = process.env.KODAX_MODULE_BUNDLE !== 'true'
+  && process.argv[1]
   && fileURLToPath(import.meta.url) === path.resolve(process.argv[1]);
 
 if (isDirectRun) {

package/dist/builtin/skill-creator/scripts/utils.d.ts

@@ -0,0 +1,3 @@
+export declare function setKodaXSDKForSkillCreator(
+  sdk: Readonly<Record<string, unknown>>,
+): void;

package/dist/builtin/skill-creator/scripts/utils.js

@@ -31,7 +31,11 @@ import YAML from 'yaml';
 // See docs/ADR.md ADR-022 / ADR-024 + docs/HLD.md §12 for the SDK distribution
 // contract.
 
-let _cachedSdk = null;
+let _cachedSdk = null;
+
+export function setKodaXSDKForSkillCreator(sdk) {
+  _cachedSdk = sdk;
+}
 
 export async function loadKodaXSDK() {
   if (_cachedSdk) return _cachedSdk;

package/dist/chunks/{agent-ASP4MS3X.js → agent-V4AC5JZD.js}

@@ -1,2 +1,2 @@
 // @kodax-ai/kodax — bundled distribution. See docs/ADR.md ADR-022 + ADR-024.
-import{Ja as g,La as h,Ya as i,a as c,cb as j,ra as d,sa as e,ta as f}from"./chunk-TQDBTTIM.js";import"./chunk-Z3KFRTSB.js";import"./chunk-KQLQYHWU.js";import"./chunk-YAZQTC2L.js";import"./chunk-5NDCSFOP.js";import{qb as a,rb as b}from"./chunk-VAT2QYXM.js";import"./chunk-6XM4B6K2.js";import"./chunk-2CFHBKRE.js";import"./chunk-NXO6GWSY.js";import"./chunk-ONUPGMER.js";export{e as bucketProviderPayloadSize,g as buildAutoRepoIntelligenceContext,f as checkPromiseSignal,b as cleanupIncompleteToolCalls,h as describeTransientProviderRetry,c as emitResilienceDebug,d as estimateProviderPayloadBytes,j as runKodaX,i as saveSessionSnapshot,a as validateAndFixToolHistory};
+import{Ja as g,La as h,Ya as i,a as c,cb as j,ra as d,sa as e,ta as f}from"./chunk-B6UY3VHV.js";import"./chunk-67THZRM6.js";import"./chunk-TSTVAU5E.js";import"./chunk-OWQT3FTE.js";import"./chunk-SG6P4SZS.js";import{ub as a,vb as b}from"./chunk-RQPMGRTR.js";import"./chunk-GEECPO2H.js";import"./chunk-M4N2JZTZ.js";import"./chunk-H5LLM7DB.js";import"./chunk-ONUPGMER.js";export{e as bucketProviderPayloadSize,g as buildAutoRepoIntelligenceContext,f as checkPromiseSignal,b as cleanupIncompleteToolCalls,h as describeTransientProviderRetry,c as emitResilienceDebug,d as estimateProviderPayloadBytes,j as runKodaX,i as saveSessionSnapshot,a as validateAndFixToolHistory};

package/dist/chunks/argument-completer-ZPC2MLES.js

@@ -0,0 +1,2 @@
+// @kodax-ai/kodax — bundled distribution. See docs/ADR.md ADR-022 + ADR-024.
+import{$a as a,ab as b}from"./chunk-ZCZZUE5E.js";import"./chunk-EDZ4QILG.js";import"./chunk-BBOVVDQJ.js";import"./chunk-KLWP7POA.js";import"./chunk-B6UY3VHV.js";import"./chunk-CXHEZY5G.js";import"./chunk-67THZRM6.js";import"./chunk-QCZLCLFL.js";import"./chunk-TSTVAU5E.js";import"./chunk-OWQT3FTE.js";import"./chunk-SG6P4SZS.js";import"./chunk-RQPMGRTR.js";import"./chunk-GEECPO2H.js";import"./chunk-M4N2JZTZ.js";import"./chunk-H5LLM7DB.js";import"./chunk-ONUPGMER.js";export{a as ArgumentCompleter,b as createArgumentCompleter};

package/dist/chunks/{chunk-Z3KFRTSB.js → chunk-67THZRM6.js}

@@ -1,2 +1,2 @@
 // @kodax-ai/kodax — bundled distribution. See docs/ADR.md ADR-022 + ADR-024.
-import{o}from"./chunk-5NDCSFOP.js";import{a as i}from"./chunk-ONUPGMER.js";function r(u){let e=o(u?.llm);if(!e)return;let t={};return e.requestTimeoutMs!==void 0&&(t.requestTimeoutMs=e.requestTimeoutMs),e.streamIdleTimeoutMs!==void 0&&(t.streamIdleTimeoutMs=e.streamIdleTimeoutMs),e.chunkTimeoutMs!==void 0&&(t.chunkTimeoutMs=e.chunkTimeoutMs),e.maxRetryDelayMs!==void 0&&(t.maxRetryDelayMs=e.maxRetryDelayMs),Object.keys(t).length>0?t:void 0}i(r,"providerResilienceConfigFromTimeouts");export{r as a};
+import{o}from"./chunk-SG6P4SZS.js";import{a as i}from"./chunk-ONUPGMER.js";function r(u){let e=o(u?.llm);if(!e)return;let t={};return e.requestTimeoutMs!==void 0&&(t.requestTimeoutMs=e.requestTimeoutMs),e.streamIdleTimeoutMs!==void 0&&(t.streamIdleTimeoutMs=e.streamIdleTimeoutMs),e.chunkTimeoutMs!==void 0&&(t.chunkTimeoutMs=e.chunkTimeoutMs),e.maxRetryDelayMs!==void 0&&(t.maxRetryDelayMs=e.maxRetryDelayMs),Object.keys(t).length>0?t:void 0}i(r,"providerResilienceConfigFromTimeouts");export{r as a};