@kody-ade/kody-engine 0.4.118 → 0.4.120

package/dist/bin/kody.js

@@ -880,7 +880,7 @@ var init_loadPriorArt = __esm({
 // package.json
 var package_default = {
   name: "@kody-ade/kody-engine",
-  version: "0.4.118",
+  version: "0.4.120",
   description: "kody \u2014 autonomous development engine. Single-session Claude Code agent behind a generic executor + declarative executable profiles.",
   license: "MIT",
   type: "module",
@@ -1241,10 +1241,18 @@ var GITHUB_AUTHOR_ASSOCIATIONS = [
   "MANNEQUIN",
   "NONE"
 ];
+var DEFAULT_ALLOWED_ASSOCIATIONS = ["OWNER", "MEMBER", "COLLABORATOR"];
 function parseAccessConfig(raw) {
-  if (!raw || typeof raw !== "object") return void 0;
+  if (raw === void 0 || raw === null) {
+    return { allowedAssociations: [...DEFAULT_ALLOWED_ASSOCIATIONS] };
+  }
+  if (typeof raw !== "object") {
+    throw new Error(`kody.config.json: access must be an object`);
+  }
   const r = raw;
-  if (r.allowedAssociations === void 0) return void 0;
+  if (r.allowedAssociations === void 0) {
+    return { allowedAssociations: [...DEFAULT_ALLOWED_ASSOCIATIONS] };
+  }
   if (!Array.isArray(r.allowedAssociations)) {
     throw new Error(`kody.config.json: access.allowedAssociations must be an array of strings`);
   }
@@ -1262,7 +1270,7 @@ function parseAccessConfig(raw) {
     }
     out.push(up);
   }
-  return out.length > 0 ? { allowedAssociations: out } : void 0;
+  return { allowedAssociations: out };
 }
 function parseQaConfig(raw) {
   if (!raw || typeof raw !== "object") return void 0;

package/kody.config.schema.json

@@ -404,6 +404,22 @@
       },
       "additionalProperties": false
     },
+    "access": {
+      "type": "object",
+      "description": "Who may trigger kody via an @kody comment. Gates on the GitHub comment.author_association already present on the issue_comment event (no API call, no read:org token).",
+      "properties": {
+        "allowedAssociations": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "enum": ["OWNER", "MEMBER", "COLLABORATOR", "CONTRIBUTOR", "FIRST_TIME_CONTRIBUTOR", "FIRST_TIMER", "MANNEQUIN", "NONE"]
+          },
+          "description": "Allowlist of author_association values permitted to trigger kody. OMIT this key for the secure default — only the team (OWNER, MEMBER, COLLABORATOR) may trigger; public drive-by comments are silently ignored. A non-empty list overrides which associations are allowed. An explicit empty list ([]) DISABLES the gate (anyone may trigger). MEMBER applies only to org-owned repos; on a user-owned repo the owner is OWNER and invited people are COLLABORATOR.",
+          "default": ["OWNER", "MEMBER", "COLLABORATOR"]
+        }
+      },
+      "additionalProperties": false
+    },
     "qa": {
       "type": "object",
       "description": "qa-engineer defaults. Used by the resolveQaUrl preflight when no explicit --url is passed and no $PREVIEW_URL env var is set.",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kody-ade/kody-engine",
-  "version": "0.4.118",
+  "version": "0.4.120",
   "description": "kody — autonomous development engine. Single-session Claude Code agent behind a generic executor + declarative executable profiles.",
   "license": "MIT",
   "type": "module",
@@ -12,23 +12,6 @@
     "templates",
     "kody.config.schema.json"
   ],
-  "scripts": {
-    "kody:run": "tsx bin/kody.ts",
-    "serve": "tsx bin/kody.ts serve",
-    "serve:vscode": "tsx bin/kody.ts serve vscode",
-    "serve:claude": "tsx bin/kody.ts serve claude",
-    "build": "tsup && node scripts/copy-assets.cjs",
-    "check:modularity": "tsx scripts/check-script-modularity.ts",
-    "pretest": "pnpm check:modularity",
-    "test": "vitest run tests/unit tests/int --no-coverage",
-    "test:e2e": "vitest run tests/e2e --no-coverage",
-    "test:all": "vitest run tests --no-coverage",
-    "typecheck": "tsc --noEmit",
-    "lint": "biome check",
-    "lint:fix": "biome check --write",
-    "format": "biome format --write",
-    "prepublishOnly": "pnpm build"
-  },
   "dependencies": {
     "@actions/cache": "^6.0.0",
     "@anthropic-ai/claude-agent-sdk": "0.2.119",
@@ -50,5 +33,21 @@
     "url": "git+https://github.com/aharonyaircohen/kody-engine.git"
   },
   "homepage": "https://github.com/aharonyaircohen/kody-engine",
-  "bugs": "https://github.com/aharonyaircohen/kody-engine/issues"
-}
+  "bugs": "https://github.com/aharonyaircohen/kody-engine/issues",
+  "scripts": {
+    "kody:run": "tsx bin/kody.ts",
+    "serve": "tsx bin/kody.ts serve",
+    "serve:vscode": "tsx bin/kody.ts serve vscode",
+    "serve:claude": "tsx bin/kody.ts serve claude",
+    "build": "tsup && node scripts/copy-assets.cjs",
+    "check:modularity": "tsx scripts/check-script-modularity.ts",
+    "pretest": "pnpm check:modularity",
+    "test": "vitest run tests/unit tests/int --no-coverage",
+    "test:e2e": "vitest run tests/e2e --no-coverage",
+    "test:all": "vitest run tests --no-coverage",
+    "typecheck": "tsc --noEmit",
+    "lint": "biome check",
+    "lint:fix": "biome check --write",
+    "format": "biome format --write"
+  }
+}

package/templates/kody.yml

@@ -90,4 +90,4 @@ jobs:
           INIT_MESSAGE:  ${{ inputs.message }}
           MODEL:         ${{ inputs.model }}
           DASHBOARD_URL: ${{ inputs.dashboardUrl }}
-        run: npx -y -p @kody-ade/kody-engine@0.4.109 kody-engine
+        run: npx -y -p @kody-ade/kody-engine@0.4.120 kody-engine