@kody-ade/kody-engine 0.4.127 → 0.4.129

package/dist/bin/kody.js

@@ -880,7 +880,7 @@ var init_loadPriorArt = __esm({
 // package.json
 var package_default = {
   name: "@kody-ade/kody-engine",
-  version: "0.4.127",
+  version: "0.4.129",
   description: "kody \u2014 autonomous development engine. Single-session Claude Code agent behind a generic executor + declarative executable profiles.",
   license: "MIT",
   type: "module",
@@ -8573,6 +8573,24 @@ function readKodyVariables(cwd) {
 
 // src/scripts/loadQaContext.ts
 var PROFILE_DIR_REL_PATH = ".kody/profile";
+var FRONTMATTER_RE2 = /^---\r?\n([\s\S]*?)\r?\n---\r?\n?/;
+function readProfileAudience(raw) {
+  const m = FRONTMATTER_RE2.exec(raw);
+  if (!m) return { audience: ["chat"], body: raw };
+  const body = raw.slice(m[0].length);
+  for (const line of (m[1] ?? "").split(/\r?\n/)) {
+    const t = line.trim();
+    const c = t.indexOf(":");
+    if (c < 0) continue;
+    if (t.slice(0, c).trim() === "audience") {
+      const v = t.slice(c + 1).trim();
+      const inner = v.startsWith("[") && v.endsWith("]") ? v.slice(1, -1) : v;
+      const audience = inner.split(",").map((s) => s.trim().replace(/^["']|["']$/g, "").toLowerCase()).filter(Boolean);
+      return { audience: audience.length > 0 ? audience : ["chat"], body };
+    }
+  }
+  return { audience: ["chat"], body };
+}
 function readProfile(cwd) {
   const dir = path33.join(cwd, PROFILE_DIR_REL_PATH);
   if (!fs34.existsSync(dir)) return "";
@@ -8585,10 +8603,12 @@ function readProfile(cwd) {
   const blocks = [];
   for (const file of entries) {
     try {
-      const content = fs34.readFileSync(path33.join(dir, file), "utf-8");
+      const raw = fs34.readFileSync(path33.join(dir, file), "utf-8");
+      const { audience, body } = readProfileAudience(raw);
+      if (!audience.includes("qa")) continue;
       blocks.push(`## ${file}
 
-${content}`);
+${body.trim()}`);
     } catch {
     }
   }

package/dist/executables/qa-engineer/prompt.md

@@ -128,6 +128,7 @@ If you don't include this block, the postflight falls back to opening a single r
 
 # Rules
 
+- **Never write credentials anywhere.** The QA login is provided only so you can sign in — you MUST NOT put the password (or any token/secret) into the report, findings, steps, evidence captions, or any text posted to GitHub. Issues are often public. When describing an authenticated step, write "log in as the QA account" — never quote the username or the password.
 - No commits. No `git` / `gh`. No edits outside `.kody/qa-reports/`.
 - Verdict **PASS** only when every UI surface you exercised behaved as the user would expect.
 - Be specific in every finding: route + concrete steps + screenshot path (or DOM snapshot reference). No "consider improving X" advice.

package/dist/executables/ui-review/prompt.md

@@ -111,6 +111,7 @@ _UI review by kody — browsed {{previewUrl}}_
 
 # Rules
 
+- **Never write credentials anywhere.** The QA login is provided only so you can sign in — you MUST NOT put the password (or any token/secret) into the review, findings, steps, or any text posted to GitHub. PRs and issues are often public. When describing an authenticated step, write "log in as the QA account" — never quote the username or the password.
 - No commits. No `git` / `gh` invocations. No edits to files outside `.kody/ui-review/`.
 - Verdict **FAIL** only for clear visual regressions, broken flows, or correctness/accessibility issues that block merge.
 - Verdict **CONCERNS** for clarity/polish/edge-case gaps that shouldn't block.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kody-ade/kody-engine",
-  "version": "0.4.127",
+  "version": "0.4.129",
   "description": "kody — autonomous development engine. Single-session Claude Code agent behind a generic executor + declarative executable profiles.",
   "license": "MIT",
   "type": "module",