@kody-ade/kody-engine 0.4.138 → 0.4.140

package/dist/bin/kody.js

@@ -93,7 +93,7 @@ var init_events = __esm({
 // src/verify.ts
 import { spawn } from "child_process";
 function runCommand(command, cwd) {
-  return new Promise((resolve4) => {
+  return new Promise((resolve5) => {
     const start = Date.now();
     const child = spawn(command, {
       cwd,
@@ -122,11 +122,11 @@ function runCommand(command, cwd) {
     child.on("exit", (code) => {
       clearTimeout(timer);
       const tail = Buffer.concat(buffers).toString("utf-8").slice(-TAIL_CHARS);
-      resolve4({ exitCode: code ?? -1, durationMs: Date.now() - start, tail });
+      resolve5({ exitCode: code ?? -1, durationMs: Date.now() - start, tail });
     });
     child.on("error", (err) => {
       clearTimeout(timer);
-      resolve4({ exitCode: -1, durationMs: Date.now() - start, tail: err.message });
+      resolve5({ exitCode: -1, durationMs: Date.now() - start, tail: err.message });
     });
   });
 }
@@ -312,6 +312,52 @@ var init_verifyMcp = __esm({
   }
 });
 
+// src/submitMcp.ts
+var submitMcp_exports = {};
+__export(submitMcp_exports, {
+  buildSubmitMcpServer: () => buildSubmitMcpServer
+});
+import { createSdkMcpServer as createSdkMcpServer2, tool as tool2 } from "@anthropic-ai/claude-agent-sdk";
+import { z as z2 } from "zod";
+function buildSubmitMcpServer() {
+  let submitted;
+  const submitTool = tool2(
+    "submit_state",
+    "Persist this tick's next state. Call this EXACTLY ONCE, at the very end, when you've finished your work \u2014 it is the ONLY way your decision is saved. Pass your next `cursor` (string), your next `data` (object \u2014 carry prior data forward and mutate what you acted on), and `done` (boolean). After calling it you are finished; do not take further actions.",
+    {
+      cursor: z2.string().describe('The next cursor value (e.g. "idle"). Must be a non-empty string.'),
+      data: z2.record(z2.string(), z2.unknown()).describe("The next `data` object. Carry forward prior data and mutate only what you acted on this tick."),
+      done: z2.boolean().describe("true only if this duty is permanently finished; evergreen duties stay false.")
+    },
+    async (args) => {
+      submitted = {
+        cursor: String(args.cursor ?? ""),
+        data: args.data ?? {},
+        done: Boolean(args.done)
+      };
+      return {
+        content: [
+          {
+            type: "text",
+            text: "State recorded. You are done for this tick \u2014 no further action needed."
+          }
+        ]
+      };
+    }
+  );
+  const server = createSdkMcpServer2({
+    name: "kody-submit",
+    version: "0.1.0",
+    tools: [submitTool]
+  });
+  return { server, getSubmitted: () => submitted };
+}
+var init_submitMcp = __esm({
+  "src/submitMcp.ts"() {
+    "use strict";
+  }
+});
+
 // src/issue.ts
 import { execFileSync } from "child_process";
 function ghToken() {
@@ -880,7 +926,7 @@ var init_loadPriorArt = __esm({
 // package.json
 var package_default = {
   name: "@kody-ade/kody-engine",
-  version: "0.4.138",
+  version: "0.4.140",
   description: "kody \u2014 autonomous development engine. Single-session Claude Code agent behind a generic executor + declarative executable profiles.",
   license: "MIT",
   type: "module",
@@ -1514,6 +1560,7 @@ async function runAgent(opts) {
   const turnTimeoutMs = resolveTurnTimeoutMs(opts);
   let ndjsonWriteFailed = false;
   let ndjsonWriteError;
+  let getSubmitted;
   try {
     const queryOptions = {
       model: opts.model.model,
@@ -1541,6 +1588,12 @@ async function runAgent(opts) {
       });
       mcpEntries.push(["kody-verify", verifyServer]);
     }
+    if (opts.enableSubmitTool) {
+      const { buildSubmitMcpServer: buildSubmitMcpServer2 } = await Promise.resolve().then(() => (init_submitMcp(), submitMcp_exports));
+      const submitHandle = buildSubmitMcpServer2();
+      getSubmitted = submitHandle.getSubmitted;
+      mcpEntries.push(["kody-submit", submitHandle.server]);
+    }
     if (mcpEntries.length > 0) {
       queryOptions.mcpServers = Object.fromEntries(mcpEntries);
     }
@@ -1588,10 +1641,10 @@ async function runAgent(opts) {
       let timer;
       let next;
       if (turnTimeoutMs > 0) {
-        const timeoutPromise = new Promise((resolve4) => {
+        const timeoutPromise = new Promise((resolve5) => {
           timer = setTimeout(() => {
             timedOut = true;
-            resolve4({ done: true, value: void 0 });
+            resolve5({ done: true, value: void 0 });
           }, turnTimeoutMs);
         });
         next = await Promise.race([nextPromise, timeoutPromise]);
@@ -1706,10 +1759,12 @@ async function runAgent(opts) {
 `);
   }
   const finalText = resultTexts.join("\n\n---\n\n");
+  const submittedState = getSubmitted?.();
   return {
     outcome,
     outcomeKind,
     finalText,
+    ...submittedState ? { submittedState } : {},
     error: errorMessage,
     ndjsonPath,
     durationMs: Date.now() - startedAt,
@@ -2263,7 +2318,7 @@ async function waitForNextUserMessage(opts) {
   }
 }
 function sleep(ms) {
-  return new Promise((resolve4) => setTimeout(resolve4, ms));
+  return new Promise((resolve5) => setTimeout(resolve5, ms));
 }
 function currentBranch(cwd) {
   try {
@@ -2812,7 +2867,7 @@ function coerceBare(spec, value) {
 init_issue();
 
 // src/executor.ts
-import { execFileSync as execFileSync30, spawn as spawn8 } from "child_process";
+import { execFileSync as execFileSync30, spawn as spawn9 } from "child_process";
 import * as fs40 from "fs";
 import * as path37 from "path";
 
@@ -3186,6 +3241,7 @@ function parseClaudeCode(p, raw) {
     systemPromptAppend: typeof r.systemPromptAppend === "string" ? r.systemPromptAppend : null,
     cacheable: r.cacheable === true,
     enableVerifyTool: r.enableVerifyTool === true,
+    enableSubmitTool: r.enableSubmitTool === true,
     verifyAttempts: typeof r.verifyAttempts === "number" && r.verifyAttempts > 0 ? r.verifyAttempts : null,
     tools,
     hooks: Array.isArray(r.hooks) ? r.hooks : [],
@@ -4235,6 +4291,7 @@ var advanceFlow = async (ctx, profile) => {
 
 // src/scripts/brainServe.ts
 import { createServer } from "http";
+import { spawn as spawn3, spawnSync } from "child_process";
 import * as fs18 from "fs";
 import * as path17 from "path";
 
@@ -4417,17 +4474,17 @@ function authOk(req, expected) {
   return false;
 }
 function readJsonBody(req) {
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve5, reject) => {
     const chunks = [];
     req.on("data", (c) => chunks.push(c));
     req.on("end", () => {
       const raw = Buffer.concat(chunks).toString("utf-8");
       if (!raw.trim()) {
-        resolve4({});
+        resolve5({});
         return;
       }
       try {
-        resolve4(JSON.parse(raw));
+        resolve5(JSON.parse(raw));
       } catch (err) {
         reject(err instanceof Error ? err : new Error(String(err)));
       }
@@ -4435,6 +4492,13 @@ function readJsonBody(req) {
     req.on("error", reject);
   });
 }
+function strField(body, key) {
+  if (typeof body === "object" && body !== null && key in body) {
+    const v = body[key];
+    if (typeof v === "string" && v.trim()) return v.trim();
+  }
+  return void 0;
+}
 function sendJson(res, status, body) {
   res.writeHead(status, { "content-type": "application/json" });
   res.end(JSON.stringify(body));
@@ -4532,6 +4596,51 @@ function streamToRes(res, dir, chatId, since) {
   );
   res.on("close", unsubscribe);
 }
+var REPO_RE = /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/;
+var repoClones = /* @__PURE__ */ new Map();
+async function ensureRepoCwd(opts) {
+  const repo = opts.repo?.trim();
+  if (!repo || !REPO_RE.test(repo)) return opts.baseCwd;
+  const root = path17.resolve(opts.reposRoot);
+  const dir = path17.resolve(root, repo);
+  if (dir !== root && !dir.startsWith(root + path17.sep)) return opts.baseCwd;
+  if (fs18.existsSync(path17.join(dir, ".git"))) return dir;
+  const inflight = repoClones.get(dir);
+  if (inflight) {
+    await inflight;
+    return dir;
+  }
+  const p = opts.cloneRepo(repo, opts.repoToken, dir).finally(() => {
+    if (repoClones.get(dir) === p) repoClones.delete(dir);
+  });
+  repoClones.set(dir, p);
+  await p;
+  return dir;
+}
+var defaultCloneRepo = (repo, token, dir) => {
+  fs18.mkdirSync(path17.dirname(dir), { recursive: true });
+  const authUrl = token ? `https://x-access-token:${token}@github.com/${repo}.git` : `https://github.com/${repo}.git`;
+  return new Promise((resolve5, reject) => {
+    const child = spawn3("git", ["clone", "--depth=1", authUrl, dir], {
+      stdio: "inherit"
+    });
+    child.on("exit", (code) => {
+      if (code !== 0) {
+        reject(new Error(`git clone ${repo} failed (exit ${code})`));
+        return;
+      }
+      try {
+        const name = process.env.GIT_AUTHOR_NAME ?? "Kody Bot";
+        const email = process.env.GIT_AUTHOR_EMAIL ?? "kody-bot@users.noreply.github.com";
+        spawnSync("git", ["-C", dir, "config", "user.name", name]);
+        spawnSync("git", ["-C", dir, "config", "user.email", email]);
+      } catch {
+      }
+      resolve5();
+    });
+    child.on("error", reject);
+  });
+};
 async function handleChatTurn(req, res, chatId, opts) {
   let body;
   try {
@@ -4545,6 +4654,8 @@ async function handleChatTurn(req, res, chatId, opts) {
     sendJson(res, 400, { error: "message required" });
     return;
   }
+  const repo = strField(body, "repo");
+  const repoToken = strField(body, "repoToken");
   const sessionFile = sessionFilePath(opts.cwd, chatId);
   fs18.mkdirSync(path17.dirname(sessionFile), { recursive: true });
   appendTurn(sessionFile, {
@@ -4555,32 +4666,42 @@ async function handleChatTurn(req, res, chatId, opts) {
   const sinceFloor = getLastSeq(opts.cwd, chatId);
   const emitToLog = beginTurn(opts.cwd, chatId);
   const sink = new BrokerSink(emitToLog, chatId);
-  void enqueue(
-    chatId,
-    () => opts.runTurn({
-      sessionId: chatId,
-      sessionFile,
-      cwd: opts.cwd,
-      model: opts.model,
-      litellmUrl: opts.litellmUrl,
-      sink
-    }).catch((err) => {
+  void enqueue(chatId, async () => {
+    try {
+      const agentCwd = await ensureRepoCwd({
+        baseCwd: opts.cwd,
+        reposRoot: opts.reposRoot,
+        repo,
+        repoToken,
+        cloneRepo: opts.cloneRepo
+      });
+      await opts.runTurn({
+        sessionId: chatId,
+        sessionFile,
+        cwd: agentCwd,
+        model: opts.model,
+        litellmUrl: opts.litellmUrl,
+        sink
+      });
+    } catch (err) {
       const errMsg3 = err instanceof Error ? err.message : String(err);
       process.stderr.write(`[brain-serve] chat turn failed: ${errMsg3}
 `);
       endTurnIfUnterminated(opts.cwd, chatId, errMsg3);
-    }).finally(() => {
+    } finally {
       endTurnIfUnterminated(
         opts.cwd,
         chatId,
         "Brain turn ended without a reply (the machine may have restarted mid-turn) \u2014 please resend your message"
       );
-    })
-  );
+    }
+  });
   streamToRes(res, opts.cwd, chatId, sinceFloor);
 }
 function buildServer(opts) {
   const runTurn = opts.runTurn ?? runChatTurn;
+  const cloneRepo = opts.cloneRepo ?? defaultCloneRepo;
+  const reposRoot = opts.reposRoot ?? path17.join(path17.dirname(path17.resolve(opts.cwd)), "repos");
   return createServer(async (req, res) => {
     if (!req.method || !req.url) {
       sendJson(res, 400, { error: "bad request" });
@@ -4604,6 +4725,8 @@ function buildServer(opts) {
       }
       await handleChatTurn(req, res, chatId, {
         cwd: opts.cwd,
+        reposRoot,
+        cloneRepo,
         model: opts.model,
         litellmUrl: opts.litellmUrl,
         runTurn
@@ -4654,16 +4777,18 @@ var brainServe = async (ctx) => {
   const server = buildServer({
     apiKey,
     cwd: ctx.cwd,
+    // Per-repo clones live here; defaults to a `repos` sibling of cwd.
+    reposRoot: process.env.BRAIN_REPOS_ROOT?.trim() || void 0,
     model,
     litellmUrl
   });
-  await new Promise((resolve4) => {
+  await new Promise((resolve5) => {
     server.listen(port, "0.0.0.0", () => {
       process.stdout.write(
         `[brain-serve] listening on 0.0.0.0:${port} (cwd=${ctx.cwd})
 `
       );
-      resolve4();
+      resolve5();
     });
   });
   const shutdown = (signal) => {
@@ -5458,36 +5583,46 @@ var createQaGoal = async (ctx, _profile, agentResult) => {
     ctx.data.action = failedAction2("empty report body");
     return;
   }
+  const { markdown } = splitReport(finalText);
+  const verdict = detectVerdict(markdown);
+  const existingIssue = ctx.args.issue;
+  if (typeof existingIssue === "number" && existingIssue > 0) {
+    try {
+      postIssueComment(existingIssue, finalText, ctx.cwd);
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      ctx.output.exitCode = 4;
+      ctx.output.reason = `failed to comment on issue #${existingIssue}: ${msg}`;
+      ctx.data.action = failedAction2(ctx.output.reason);
+      return;
+    }
+    process.stdout.write(
+      `
+QA_REPORT_POSTED=https://github.com/${ctx.config.github.owner}/${ctx.config.github.repo}/issues/${existingIssue} (verdict: ${verdict})
+`
+    );
+    ctx.data.action = qaAction(verdict, { issueNumber: existingIssue, mode: "comment" });
+    ctx.output.exitCode = verdict === "FAIL" ? 1 : 0;
+    return;
+  }
+  await promoteReportToGoal(
+    ctx,
+    finalText,
+    ctx.args.scope,
+    ctx.args.goal
+  );
+};
+async function promoteReportToGoal(ctx, finalText, scopeArg, explicitGoalArg) {
   const { markdown, data, jsonError } = splitReport(finalText);
   const verdict = detectVerdict(markdown);
   const findings = data?.findings ?? [];
-  const existingIssue = ctx.args.issue;
   if (findings.length === 0 || jsonError) {
     if (jsonError) {
-      process.stderr.write(`[createQaGoal] JSON parse: ${jsonError} \u2014 falling back to single-issue mode
+      process.stderr.write(`[promoteReportToGoal] JSON parse: ${jsonError} \u2014 falling back to single-issue mode
 `);
     }
-    if (typeof existingIssue === "number" && existingIssue > 0) {
-      try {
-        postIssueComment(existingIssue, finalText, ctx.cwd);
-      } catch (err) {
-        const msg = err instanceof Error ? err.message : String(err);
-        ctx.output.exitCode = 4;
-        ctx.output.reason = `failed to comment on issue #${existingIssue}: ${msg}`;
-        ctx.data.action = failedAction2(ctx.output.reason);
-        return;
-      }
-      process.stdout.write(
-        `
-QA_REPORT_POSTED=https://github.com/${ctx.config.github.owner}/${ctx.config.github.repo}/issues/${existingIssue} (verdict: ${verdict})
-`
-      );
-      ctx.data.action = qaAction(verdict, { issueNumber: existingIssue, mode: "comment" });
-      ctx.output.exitCode = verdict === "FAIL" ? 1 : 0;
-      return;
-    }
     ensureLabel(FINDING_LABEL, "ededed", "kody: QA finding", ctx.cwd);
-    const scope2 = ctx.args.scope;
+    const scope2 = scopeArg;
     const title = `QA [${verdict}]: ${scope2?.trim() || "smoke"} \u2014 ${todayIso()}`.slice(0, 240);
     let url = "";
     try {
@@ -5515,8 +5650,8 @@ QA_REPORT_POSTED=${url} (verdict: ${verdict})
     ctx.output.exitCode = verdict === "FAIL" ? 1 : 0;
     return;
   }
-  const explicitGoal = ctx.args.goal?.trim();
-  const scope = ctx.args.scope;
+  const explicitGoal = explicitGoalArg?.trim();
+  const scope = scopeArg;
   let goalId;
   let manifestIssueNumber = null;
   let manifestCreated = false;
@@ -5614,7 +5749,7 @@ QA_GOAL_TARGETED=(no manifest issue) (id: ${goalId}, verdict: ${verdict})
     mode: explicitGoal ? "goal-attach" : manifestCreated ? "goal-create" : "goal-append"
   });
   ctx.output.exitCode = verdict === "FAIL" ? 1 : 0;
-};
+}
 
 // src/goal/operations.ts
 init_issue();
@@ -9313,8 +9448,30 @@ var parseJobStateFromAgentResult = async (ctx, _profile, agentResult, args) => {
   }
   const loaded = ctx.data.jobState;
   const prevRev = loaded?.state.rev ?? 0;
+  const submitted = agentResult.submittedState;
+  if (submitted && typeof submitted.cursor === "string" && submitted.cursor.length > 0) {
+    ctx.data.nextJobState = {
+      version: 1,
+      rev: prevRev + 1,
+      cursor: submitted.cursor,
+      data: submitted.data ?? {},
+      done: Boolean(submitted.done)
+    };
+    return;
+  }
   const result = extractNextStateFromText(agentResult.finalText, fenceLabel, prevRev);
   if (result.error) {
+    const cleanFinishNoBlock = result.error.startsWith("missing `") && agentResult.outcome === "completed" && loaded != null;
+    if (cleanFinishNoBlock) {
+      ctx.data.nextJobState = {
+        version: 1,
+        rev: prevRev + 1,
+        cursor: loaded.state.cursor,
+        data: loaded.state.data,
+        done: loaded.state.done
+      };
+      return;
+    }
     ctx.data.nextStateParseError = result.error.startsWith("missing `") ? `agent did not emit a \`${fenceLabel}\` fenced block` : result.error;
     return;
   }
@@ -9435,7 +9592,7 @@ var persistFlowState = async (ctx) => {
 };
 
 // src/scripts/poolServe.ts
-import { spawn as spawn3 } from "child_process";
+import { spawn as spawn4 } from "child_process";
 import { createServer as createServer2 } from "http";
 
 // src/pool/fly.ts
@@ -10005,14 +10162,14 @@ function sendJson2(res, status, body) {
   res.end(JSON.stringify(body));
 }
 function readJsonBody2(req) {
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve5, reject) => {
     const chunks = [];
     req.on("data", (c) => chunks.push(c));
     req.on("end", () => {
       const raw = Buffer.concat(chunks).toString("utf-8");
-      if (!raw.trim()) return resolve4({});
+      if (!raw.trim()) return resolve5({});
       try {
-        resolve4(JSON.parse(raw));
+        resolve5(JSON.parse(raw));
       } catch (err) {
         reject(err instanceof Error ? err : new Error(String(err)));
       }
@@ -10054,7 +10211,7 @@ function superviseLitellm() {
   let restarts = 0;
   const start = () => {
     log(`starting litellm child (port ${port}, host ${host})`);
-    const child = spawn3("litellm", ["--config", config, "--port", port, "--host", host], {
+    const child = spawn4("litellm", ["--config", config, "--port", port, "--host", host], {
       stdio: "inherit"
     });
     child.on("exit", (code) => {
@@ -10159,10 +10316,10 @@ var poolServe = async (ctx) => {
     }
   });
   const apiHost = process.env.POOL_API_HOST ?? "::";
-  await new Promise((resolve4) => {
+  await new Promise((resolve5) => {
     server.listen(apiPort, apiHost, () => {
       log(`listening on ${apiHost}:${apiPort} (min=${min}, app=${app}, region=${region})`);
-      resolve4();
+      resolve5();
     });
   });
   const shutdown = (signal) => {
@@ -10675,6 +10832,46 @@ function pushEmptyCommit(branch, cwd) {
   }
 }
 
+// src/scripts/promoteQaGoal.ts
+init_issue();
+var REPORT_JSON_OPEN2 = "<!-- KODY_QA_REPORT_JSON";
+var promoteQaGoal = async (ctx) => {
+  ctx.skipAgent = true;
+  const issueNum = ctx.args.issue;
+  if (typeof issueNum !== "number" || issueNum <= 0) {
+    ctx.output.exitCode = 2;
+    ctx.output.reason = "qa-goal requires --issue <n>";
+    process.stderr.write("[qa-goal] missing --issue\n");
+    return;
+  }
+  let report;
+  try {
+    const issue = getIssue(issueNum, ctx.cwd);
+    const reportComment = [...issue.comments].reverse().find((c) => c.body.includes(REPORT_JSON_OPEN2));
+    if (!reportComment) {
+      ctx.output.exitCode = 3;
+      ctx.output.reason = `no QA report (${REPORT_JSON_OPEN2} \u2026) found on issue #${issueNum}`;
+      process.stderr.write(`[qa-goal] ${ctx.output.reason}
+`);
+      return;
+    }
+    report = reportComment.body;
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    ctx.output.exitCode = 3;
+    ctx.output.reason = `failed to read issue #${issueNum}: ${msg}`;
+    process.stderr.write(`[qa-goal] ${ctx.output.reason}
+`);
+    return;
+  }
+  await promoteReportToGoal(
+    ctx,
+    report,
+    ctx.args.scope,
+    ctx.args.goal
+  );
+};
+
 // src/deployments.ts
 init_issue();
 function findPreviewDeploymentUrl(prNumber, cwd) {
@@ -11016,7 +11213,7 @@ function resolveBaseOverride(value) {
 }
 
 // src/scripts/runnerServe.ts
-import { spawn as spawn4 } from "child_process";
+import { spawn as spawn5 } from "child_process";
 import { createServer as createServer3 } from "http";
 import * as fs37 from "fs";
 var DEFAULT_PORT2 = 8080;
@@ -11040,17 +11237,17 @@ function authOk2(req, expected) {
   return false;
 }
 function readJsonBody3(req) {
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve5, reject) => {
     const chunks = [];
     req.on("data", (c) => chunks.push(c));
     req.on("end", () => {
       const raw = Buffer.concat(chunks).toString("utf-8");
       if (!raw.trim()) {
-        resolve4({});
+        resolve5({});
         return;
       }
       try {
-        resolve4(JSON.parse(raw));
+        resolve5(JSON.parse(raw));
       } catch (err) {
         reject(err instanceof Error ? err : new Error(String(err)));
       }
@@ -11125,13 +11322,13 @@ async function defaultRunJob(job) {
     ...interactive && job.idleExitMs ? { KODY_IDLE_EXIT_MS: String(job.idleExitMs) } : {},
     ...interactive && job.hardCapMs ? { KODY_HARD_CAP_MS: String(job.hardCapMs) } : {}
   };
-  const run = (cmd, args, cwd) => new Promise((resolve4) => {
-    const child = spawn4(cmd, args, { stdio: "inherit", env: childEnv, cwd });
-    child.on("exit", (code) => resolve4(code ?? 0));
+  const run = (cmd, args, cwd) => new Promise((resolve5) => {
+    const child = spawn5(cmd, args, { stdio: "inherit", env: childEnv, cwd });
+    child.on("exit", (code) => resolve5(code ?? 0));
     child.on("error", (err) => {
       process.stderr.write(`[runner-serve] ${cmd} failed: ${err.message}
 `);
-      resolve4(1);
+      resolve5(1);
     });
   });
   process.stdout.write(`[runner-serve] job ${job.jobId}: cloning ${job.repo}@${branch}
@@ -11218,11 +11415,11 @@ var runnerServe = async (ctx) => {
   const port = Number(process.env.PORT ?? DEFAULT_PORT2);
   const server = buildServer2({ apiKey });
   const host = process.env.RUNNER_HOST ?? "::";
-  await new Promise((resolve4) => {
+  await new Promise((resolve5) => {
     server.listen(port, host, () => {
       process.stdout.write(`[runner-serve] listening on ${host}:${port} (idle, awaiting job)
 `);
-      resolve4();
+      resolve5();
     });
   });
   const shutdown = (signal) => {
@@ -11237,7 +11434,7 @@ var runnerServe = async (ctx) => {
 };
 
 // src/scripts/runTickScript.ts
-import { spawnSync } from "child_process";
+import { spawnSync as spawnSync2 } from "child_process";
 import * as fs38 from "fs";
 import * as path36 from "path";
 var runTickScript = async (ctx, _profile, args) => {
@@ -11283,7 +11480,7 @@ var runTickScript = async (ctx, _profile, args) => {
   ctx.data.jobSlug = slug;
   ctx.data.jobState = loaded;
   const childEnv = buildChildEnv(process.env, Boolean(ctx.args.force));
-  const result = spawnSync("bash", [scriptPath], {
+  const result = spawnSync2("bash", [scriptPath], {
     cwd: ctx.cwd,
     env: childEnv,
     stdio: ["ignore", "pipe", "pipe"],
@@ -11416,7 +11613,7 @@ function synthesizeAction(ctx) {
 }
 
 // src/scripts/serveFlow.ts
-import { spawn as spawn5 } from "child_process";
+import { spawn as spawn6 } from "child_process";
 function parseTarget(positional) {
   if (!Array.isArray(positional) || positional.length === 0) return "none";
   const first = String(positional[0]).toLowerCase();
@@ -11465,15 +11662,15 @@ var serveFlow = async (ctx) => {
     if (usesProxy) process.stdout.write(`  ANTHROPIC_BASE_URL=${url}
 `);
     const args = ["--dangerously-skip-permissions", "--model", model.model];
-    const child = spawn5("claude", args, { stdio: "inherit", env: editorEnv, cwd: ctx.cwd });
-    const exitCode = await new Promise((resolve4) => {
-      child.on("exit", (code) => resolve4(code ?? 0));
+    const child = spawn6("claude", args, { stdio: "inherit", env: editorEnv, cwd: ctx.cwd });
+    const exitCode = await new Promise((resolve5) => {
+      child.on("exit", (code) => resolve5(code ?? 0));
       child.on("error", (err) => {
         process.stderr.write(`[kody serve] failed to launch Claude Code: ${err.message}
 `);
         process.stderr.write(`  Install: https://docs.anthropic.com/claude/docs/claude-code
 `);
-        resolve4(1);
+        resolve5(1);
       });
     });
     killProxy();
@@ -11486,7 +11683,7 @@ var serveFlow = async (ctx) => {
     if (usesProxy) process.stdout.write(`  ANTHROPIC_BASE_URL=${url}
 `);
     try {
-      const code = spawn5("code", [ctx.cwd], { stdio: "inherit", env: editorEnv, detached: true });
+      const code = spawn6("code", [ctx.cwd], { stdio: "inherit", env: editorEnv, detached: true });
       code.on("error", (err) => {
         process.stderr.write(`[kody serve] failed to launch VS Code: ${err.message}
 `);
@@ -11741,7 +11938,7 @@ var verify = async (ctx) => {
 };
 
 // src/scripts/verifyReproFails.ts
-import { spawn as spawn6 } from "child_process";
+import { spawn as spawn7 } from "child_process";
 var TEST_TIMEOUT_MS = 10 * 60 * 1e3;
 var TAIL_CHARS2 = 8e3;
 var ANSI_RE2 = /\x1B\[[0-?]*[ -/]*[@-~]/g;
@@ -11809,8 +12006,8 @@ function stripAnsi2(s) {
   return s.replace(ANSI_RE2, "");
 }
 function runCommand2(command, cwd) {
-  return new Promise((resolve4) => {
-    const child = spawn6(command, {
+  return new Promise((resolve5) => {
+    const child = spawn7(command, {
       cwd,
       shell: true,
       env: { ...process.env, HUSKY: "0", SKIP_HOOKS: "1", CI: process.env.CI ?? "1" },
@@ -11836,11 +12033,11 @@ function runCommand2(command, cwd) {
     }, TEST_TIMEOUT_MS);
     child.on("exit", (code) => {
       clearTimeout(timer);
-      resolve4({ exitCode: code ?? -1, output: Buffer.concat(buffers).toString("utf-8") });
+      resolve5({ exitCode: code ?? -1, output: Buffer.concat(buffers).toString("utf-8") });
     });
     child.on("error", (err) => {
       clearTimeout(timer);
-      resolve4({ exitCode: -1, output: err.message });
+      resolve5({ exitCode: -1, output: err.message });
     });
   });
 }
@@ -12139,7 +12336,7 @@ var appendCompanyActivity = async (ctx, _profile, agentResult) => {
 };
 
 // src/scripts/warmupMcp.ts
-import { spawn as spawn7 } from "child_process";
+import { spawn as spawn8 } from "child_process";
 var PER_SERVER_TIMEOUT_MS = 6e4;
 var PER_REQUEST_TIMEOUT_MS = 2e4;
 var warmupMcp = async (_ctx, profile) => {
@@ -12161,7 +12358,7 @@ var warmupMcp = async (_ctx, profile) => {
   }
 };
 async function warmupOne(command, args, env) {
-  const child = spawn7(command, args, {
+  const child = spawn8(command, args, {
     stdio: ["pipe", "pipe", "pipe"],
     env: env ? { ...process.env, ...env } : process.env
   });
@@ -12262,20 +12459,20 @@ function lineStream(stream) {
     tryDeliver();
   });
   return {
-    next: (timeoutMs) => new Promise((resolve4) => {
+    next: (timeoutMs) => new Promise((resolve5) => {
       if (queue.length > 0) {
-        resolve4(queue.shift());
+        resolve5(queue.shift());
         return;
       }
       if (ended) {
-        resolve4(null);
+        resolve5(null);
         return;
       }
-      waiter = resolve4;
+      waiter = resolve5;
       const t = setTimeout(() => {
-        if (waiter === resolve4) {
+        if (waiter === resolve5) {
           waiter = null;
-          resolve4(null);
+          resolve5(null);
         }
       }, Math.max(0, timeoutMs));
       t.unref?.();
@@ -12428,6 +12625,7 @@ var preflightScripts = {
   discoverQaContext,
   resolvePreviewUrl,
   resolveQaUrl,
+  promoteQaGoal,
   composePrompt,
   setCommentTarget,
   setLifecycleLabel,
@@ -12512,21 +12710,21 @@ function firstRequiredFailure(results, tools) {
   }
   return null;
 }
-function verifyOne(tool2, cwd) {
-  const result = { name: tool2.name, present: false, verified: false };
-  let present = runShell(tool2.install.checkCommand, cwd);
-  if (!present && tool2.install.installCommand) {
-    runShell(tool2.install.installCommand, cwd, 12e4);
-    present = runShell(tool2.install.checkCommand, cwd);
+function verifyOne(tool3, cwd) {
+  const result = { name: tool3.name, present: false, verified: false };
+  let present = runShell(tool3.install.checkCommand, cwd);
+  if (!present && tool3.install.installCommand) {
+    runShell(tool3.install.installCommand, cwd, 12e4);
+    present = runShell(tool3.install.checkCommand, cwd);
   }
   result.present = present;
   if (!present) {
-    result.error = `tool "${tool2.name}" not on PATH (check: ${tool2.install.checkCommand})`;
+    result.error = `tool "${tool3.name}" not on PATH (check: ${tool3.install.checkCommand})`;
     return result;
   }
-  const verified = runShell(tool2.verify, cwd);
+  const verified = runShell(tool3.verify, cwd);
   result.verified = verified;
-  if (!verified) result.error = `tool "${tool2.name}" failed verify: ${tool2.verify}`;
+  if (!verified) result.error = `tool "${tool3.name}" failed verify: ${tool3.verify}`;
   return result;
 }
 function runShell(cmd, cwd, timeoutMs = 3e4) {
@@ -12666,6 +12864,7 @@ async function runExecutable(profileName, input) {
       systemPromptAppend: [DISCIPLINE, profile.claudeCode.systemPromptAppend, taskArtifacts?.promptAddendum].filter((s) => typeof s === "string" && s.length > 0).join("\n\n") || void 0,
       cacheable: profile.claudeCode.cacheable,
       enableVerifyTool: profile.claudeCode.enableVerifyTool,
+      enableSubmitTool: profile.claudeCode.enableSubmitTool,
       verifyToolMaxAttempts: profile.claudeCode.verifyAttempts ?? null,
       verifyConfig: profile.claudeCode.enableVerifyTool ? config : void 0,
       executableName: profileName,
@@ -12988,7 +13187,7 @@ async function runShellEntry(entry, ctx, profile) {
     env[`KODY_CFG_${k}`] = v;
   }
   const timeoutMs = resolveShellTimeoutMs(entry);
-  const child = spawn8("bash", [shellPath, ...positional], {
+  const child = spawn9("bash", [shellPath, ...positional], {
     cwd: ctx.cwd,
     env,
     stdio: ["pipe", "pipe", "pipe"],
@@ -13010,14 +13209,14 @@ async function runShellEntry(entry, ctx, profile) {
   let killTimer;
   let escalateTimer;
   const result = await new Promise(
-    (resolve4) => {
+    (resolve5) => {
       let settled = false;
       const settle = (code, signal, spawnErr) => {
         if (settled) return;
         settled = true;
         if (killTimer) clearTimeout(killTimer);
         if (escalateTimer) clearTimeout(escalateTimer);
-        resolve4({ code, signal, spawnErr });
+        resolve5({ code, signal, spawnErr });
       };
       child.on("error", (err) => settle(null, null, err));
       child.on("close", (code, signal) => settle(code, signal));

package/dist/executables/job-tick/profile.json

@@ -21,10 +21,11 @@
   "claudeCode": {
     "model": "inherit",
     "permissionMode": "default",
-    "maxTurns": 20,
+    "maxTurns": 100,
     "maxThinkingTokens": null,
     "systemPromptAppend": null,
-    "tools": ["Bash", "Read"],
+    "enableSubmitTool": true,
+    "tools": ["Bash", "Read", "mcp__kody-submit"],
     "hooks": [],
     "skills": [],
     "commands": [],

package/dist/executables/job-tick/prompt.md

@@ -32,23 +32,25 @@ This is the state you wrote at the end of the previous tick (or `null` if this i
 2. **Re-read the job body.** It may have changed since the last tick.
 3. **Execute exactly the work the body's `## Job` section describes**, subject to its `## Allowed Commands` and `## Restrictions`. Use the `## State` section to interpret and update `data`.
 4. **Optionally post a short narration** wherever the job tells you to (typically a PR comment alongside the action). Keep it terse.
-5. **Emit the new state** at the very end of your response using the fenced block below. Do not include `version` or `rev` — the postflight script manages those.
+5. **Submit the new state** by calling the `submit_state` tool (see contract below). Do not include `version` or `rev` — the postflight script manages those.
 
 ## Output contract (MANDATORY, exactly once, at the end)
 
-End your response with a single fenced block using the `kody-job-next-state` language tag:
+Call the **`submit_state`** tool exactly once, as the final step, with your next state:
 
-````
-```kody-job-next-state
-{
-  "cursor": "<your-next-cursor>",
-  "data": { ... },
-  "done": <true|false>
-}
-```
-````
+- `cursor` — your next cursor (string, e.g. `"idle"`).
+- `data` — your next `data` object. Carry forward prior `data` and mutate only what you acted on this tick.
+- `done` — `true` only if the duty is permanently finished; evergreen duties stay `false`.
+
+This is the ONLY way your decision is saved. If you don't call it, the tick fails and the state is NOT updated — on the next wake you'll see the same prior state and can retry.
 
-If you fail to emit this block, or the JSON is invalid, the tick fails and the gist state is NOT updated. On the next wake you'll see the same prior state and can retry.
+> Backstop (legacy): if the `submit_state` tool is unavailable, end your reply with the same JSON in a single fenced block tagged `kody-job-next-state` instead:
+>
+> ````
+> ```kody-job-next-state
+> { "cursor": "<next>", "data": { ... }, "done": <true|false> }
+> ```
+> ````
 
 ## Rules
 

package/dist/executables/qa-goal/profile.json

@@ -0,0 +1,65 @@
+{
+  "name": "qa-goal",
+  "role": "primitive",
+  "kind": "oneshot",
+  "describe": "Operator-gated half of QA: promotes a QA report (already posted on an issue by qa-engineer) into a goal — manifest entry + one fix-ticket per finding + a committed .kody/goals/<id>/state.json. Deterministic, no agent. The qa / qa-sweep duties surface a `@kody qa-goal --issue <n>` inbox rec; this runs when the operator approves it, so QA never auto-creates goals on its own.",
+  "inputs": [
+    {
+      "name": "issue",
+      "flag": "--issue",
+      "type": "int",
+      "required": true,
+      "describe": "Issue number carrying qa-engineer's QA report (the comment with the <!-- KODY_QA_REPORT_JSON --> block)."
+    },
+    {
+      "name": "scope",
+      "flag": "--scope",
+      "type": "string",
+      "required": false,
+      "describe": "Optional scope label for the goal name (e.g. the changelog entry title). Defaults to 'smoke'."
+    },
+    {
+      "name": "goal",
+      "flag": "--goal",
+      "type": "string",
+      "required": false,
+      "describe": "Optional existing goal id to attach findings to instead of creating a new one."
+    }
+  ],
+  "claudeCode": {
+    "model": "inherit",
+    "permissionMode": "default",
+    "maxTurns": null,
+    "maxThinkingTokens": null,
+    "systemPromptAppend": null,
+    "tools": [],
+    "hooks": [],
+    "skills": [],
+    "commands": [],
+    "subagents": [],
+    "plugins": [],
+    "mcpServers": []
+  },
+  "cliTools": [
+    {
+      "name": "gh",
+      "install": {
+        "required": true,
+        "checkCommand": "command -v gh"
+      },
+      "verify": "gh auth status",
+      "usage": "Reads the QA report (`gh issue view --json comments`), appends to the goals manifest, and opens fix-ticket issues.",
+      "allowedUses": ["issue", "api"]
+    }
+  ],
+  "inputArtifacts": [],
+  "outputArtifacts": [],
+  "scripts": {
+    "preflight": [
+      {
+        "script": "promoteQaGoal"
+      }
+    ],
+    "postflight": []
+  }
+}

package/dist/executables/types.ts

@@ -228,6 +228,13 @@ export interface ClaudeCodeSpec {
    * Default false.
    */
   enableVerifyTool?: boolean
+  /**
+   * Opt-in: expose an in-process `submit_state` tool the agent calls to
+   * persist its next state, instead of relying on a trailing fenced
+   * `kody-job-next-state` block it must remember to emit. Used by job-tick.
+   * The fenced block stays supported as a fallback. Default false.
+   */
+  enableSubmitTool?: boolean
   /**
    * Hard cap on verify-tool invocations per agent session when
    * `enableVerifyTool` is true. Default 4 (≈3 fix iterations after the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kody-ade/kody-engine",
-  "version": "0.4.138",
+  "version": "0.4.140",
   "description": "kody — autonomous development engine. Single-session Claude Code agent behind a generic executor + declarative executable profiles.",
   "license": "MIT",
   "type": "module",