@kody-ade/kody-engine 0.4.149 → 0.4.151

package/dist/bin/kody.js

@@ -1061,7 +1061,7 @@ var init_loadPriorArt = __esm({
 // package.json
 var package_default = {
   name: "@kody-ade/kody-engine",
-  version: "0.4.149",
+  version: "0.4.151",
   description: "kody \u2014 autonomous development engine. Single-session Claude Code agent behind a generic executor + declarative executable profiles.",
   license: "MIT",
   type: "module",
@@ -1662,11 +1662,27 @@ function resolveTurnTimeoutMs(opts) {
   if (Number.isFinite(envSec) && envSec <= 0) return 0;
   return DEFAULT_TURN_TIMEOUT_MS;
 }
+var MAX_CONNECTION_RETRIES = 2;
+var CONNECTION_RETRY_BASE_MS = 2e3;
+function isTransientConnectionError(msg) {
+  if (!msg) return false;
+  return /ConnectionRefused|ECONNREFUSED|ECONNRESET|ETIMEDOUT|EHOSTUNREACH|ENOTFOUND|socket hang up|Unable to connect to API|fetch failed/i.test(
+    msg
+  );
+}
+var MUTATING_FILE_TOOLS = /* @__PURE__ */ new Set(["Edit", "Write", "MultiEdit", "NotebookEdit"]);
+var BASH_WRITE_VERB = /\b(git\s+(commit|push|merge|rebase|tag|reset|cherry-pick)|gh\s+(pr|issue|release)\s+(create|comment|edit|close|merge|review|reopen)|gh\s+api\b[^|&]*-X\s*(POST|PUT|PATCH|DELETE)|npm\s+publish)\b/i;
+function toolMayMutate(name, input) {
+  if (!name) return false;
+  if (MUTATING_FILE_TOOLS.has(name)) return true;
+  if (name.startsWith("mcp__kody-submit__")) return true;
+  if (name === "Bash") return BASH_WRITE_VERB.test(String(input?.command ?? ""));
+  return false;
+}
 async function runAgent(opts) {
   const ndjsonDir = opts.ndjsonDir ?? path7.join(opts.cwd, ".kody");
   fs7.mkdirSync(ndjsonDir, { recursive: true });
   const ndjsonPath = path7.join(ndjsonDir, "last-run.jsonl");
-  const fullLog = fs7.createWriteStream(ndjsonPath, { flags: "w" });
   const env = {
     ...process.env,
     SKIP_HOOKS: "1",
@@ -1685,227 +1701,259 @@ async function runAgent(opts) {
     env.ANTHROPIC_BASE_URL = opts.litellmUrl;
     env.ANTHROPIC_API_KEY = getAnthropicApiKeyOrDummy();
   }
-  const resultTexts = [];
+  const startedAt = Date.now();
+  const turnTimeoutMs = resolveTurnTimeoutMs(opts);
   let outcome = "failed";
   let outcomeKind = "generic_failed";
   let errorMessage;
-  const tokens = { input: 0, output: 0, cacheRead: 0, cacheCreate: 0 };
+  let tokens = { input: 0, output: 0, cacheRead: 0, cacheCreate: 0 };
   let messageCount = 0;
-  const startedAt = Date.now();
-  const turnTimeoutMs = resolveTurnTimeoutMs(opts);
-  let ndjsonWriteFailed = false;
-  let ndjsonWriteError;
+  let finalText = "";
   let getSubmitted;
-  try {
-    const queryOptions = {
-      model: opts.model.model,
-      cwd: opts.cwd,
-      // Fresh array (never mutate the shared DEFAULT_ALLOWED_TOOLS const) so
-      // opt-in tools like fetch_repo can be appended below.
-      allowedTools: [...opts.allowedToolsOverride ?? DEFAULT_ALLOWED_TOOLS],
-      permissionMode: opts.permissionModeOverride ?? "acceptEdits",
-      env
-    };
-    const mcpEntries = [];
-    if (opts.mcpServers && opts.mcpServers.length > 0) {
-      for (const s of opts.mcpServers) {
-        const cfg = { command: s.command };
-        if (s.args) cfg.args = s.args;
-        if (s.env) cfg.env = s.env;
-        mcpEntries.push([s.name, cfg]);
-      }
-    }
-    if (opts.enableVerifyTool && opts.verifyConfig) {
-      const { buildVerifyMcpServer: buildVerifyMcpServer2 } = await Promise.resolve().then(() => (init_verifyMcp(), verifyMcp_exports));
-      const verifyServer = buildVerifyMcpServer2({
-        config: opts.verifyConfig,
+  for (let attempt = 0; ; attempt++) {
+    const fullLog = fs7.createWriteStream(ndjsonPath, { flags: "w" });
+    const resultTexts = [];
+    outcome = "failed";
+    outcomeKind = "generic_failed";
+    errorMessage = void 0;
+    tokens = { input: 0, output: 0, cacheRead: 0, cacheCreate: 0 };
+    messageCount = 0;
+    let ndjsonWriteFailed = false;
+    let ndjsonWriteError;
+    let sawMutatingTool = false;
+    try {
+      const queryOptions = {
+        model: opts.model.model,
         cwd: opts.cwd,
-        executable: opts.executableName ?? "agent",
-        maxAttempts: typeof opts.verifyToolMaxAttempts === "number" && opts.verifyToolMaxAttempts > 0 ? opts.verifyToolMaxAttempts : void 0
-      });
-      mcpEntries.push(["kody-verify", verifyServer]);
-    }
-    if (opts.enableSubmitTool) {
-      const { buildSubmitMcpServer: buildSubmitMcpServer2 } = await Promise.resolve().then(() => (init_submitMcp(), submitMcp_exports));
-      const submitHandle = buildSubmitMcpServer2();
-      getSubmitted = submitHandle.getSubmitted;
-      mcpEntries.push(["kody-submit", submitHandle.server]);
-    }
-    if (opts.enableFetchRepoTool && opts.reposRoot) {
-      const { buildFetchRepoMcpServer: buildFetchRepoMcpServer2 } = await Promise.resolve().then(() => (init_fetchRepoMcp(), fetchRepoMcp_exports));
-      const fetchServer = buildFetchRepoMcpServer2({
-        reposRoot: opts.reposRoot,
-        repoToken: opts.repoToken
-      });
-      mcpEntries.push(["kody-fetch-repo", fetchServer]);
-      queryOptions.allowedTools.push("mcp__kody-fetch-repo__fetch_repo");
-      queryOptions.additionalDirectories = [opts.reposRoot];
-    }
-    if (mcpEntries.length > 0) {
-      queryOptions.mcpServers = Object.fromEntries(mcpEntries);
-    }
-    if (opts.pluginPaths && opts.pluginPaths.length > 0) {
-      queryOptions.plugins = opts.pluginPaths.map((p) => ({ type: "local", path: p }));
-    }
-    if (opts.agents && Object.keys(opts.agents).length > 0) {
-      queryOptions.agents = opts.agents;
-    }
-    if (typeof opts.maxTurns === "number" && opts.maxTurns > 0) {
-      queryOptions.maxTurns = opts.maxTurns;
-    }
-    if (typeof opts.maxThinkingTokens === "number" && opts.maxThinkingTokens > 0) {
-      queryOptions.maxThinkingTokens = opts.maxThinkingTokens;
-    }
-    if (typeof opts.systemPromptAppend === "string" && opts.systemPromptAppend.length > 0) {
-      const systemPrompt = {
-        type: "preset",
-        preset: "claude_code",
-        append: opts.systemPromptAppend
+        // Fresh array (never mutate the shared DEFAULT_ALLOWED_TOOLS const) so
+        // opt-in tools like fetch_repo can be appended below.
+        allowedTools: [...opts.allowedToolsOverride ?? DEFAULT_ALLOWED_TOOLS],
+        permissionMode: opts.permissionModeOverride ?? "acceptEdits",
+        env
       };
-      if (opts.cacheable) systemPrompt.excludeDynamicSections = true;
-      queryOptions.systemPrompt = systemPrompt;
-    } else if (opts.cacheable) {
-      queryOptions.systemPrompt = {
-        type: "preset",
-        preset: "claude_code",
-        excludeDynamicSections: true
-      };
-    }
-    queryOptions.settingSources = opts.settingSources ?? ["project", "local"];
-    const stableBinary = ensureStableClaudeBinary();
-    if (stableBinary) {
-      queryOptions.pathToClaudeCodeExecutable = stableBinary;
-    }
-    const result = query({
-      prompt: opts.prompt,
-      // biome-ignore lint/suspicious/noExplicitAny: SDK options type is narrow; mcpServers is runtime-passthrough.
-      options: queryOptions
-    });
-    const iterator = typeof result[Symbol.asyncIterator] === "function" ? result[Symbol.asyncIterator]() : result;
-    while (true) {
-      const nextPromise = iterator.next();
-      let timedOut = false;
-      let timer;
-      let next;
-      if (turnTimeoutMs > 0) {
-        const timeoutPromise = new Promise((resolve6) => {
-          timer = setTimeout(() => {
-            timedOut = true;
-            resolve6({ done: true, value: void 0 });
-          }, turnTimeoutMs);
+      const mcpEntries = [];
+      if (opts.mcpServers && opts.mcpServers.length > 0) {
+        for (const s of opts.mcpServers) {
+          const cfg = { command: s.command };
+          if (s.args) cfg.args = s.args;
+          if (s.env) cfg.env = s.env;
+          mcpEntries.push([s.name, cfg]);
+        }
+      }
+      if (opts.enableVerifyTool && opts.verifyConfig) {
+        const { buildVerifyMcpServer: buildVerifyMcpServer2 } = await Promise.resolve().then(() => (init_verifyMcp(), verifyMcp_exports));
+        const verifyServer = buildVerifyMcpServer2({
+          config: opts.verifyConfig,
+          cwd: opts.cwd,
+          executable: opts.executableName ?? "agent",
+          maxAttempts: typeof opts.verifyToolMaxAttempts === "number" && opts.verifyToolMaxAttempts > 0 ? opts.verifyToolMaxAttempts : void 0
         });
-        next = await Promise.race([nextPromise, timeoutPromise]);
-        if (timer) clearTimeout(timer);
-      } else {
-        next = await nextPromise;
+        mcpEntries.push(["kody-verify", verifyServer]);
       }
-      if (timedOut) {
-        outcome = "failed";
-        outcomeKind = "stalled";
-        errorMessage = `agent stalled: no SDK message in ${Math.round(turnTimeoutMs / 1e3)}s`;
-        if (typeof iterator.return === "function") {
-          try {
-            await iterator.return(void 0);
-          } catch {
+      if (opts.enableSubmitTool) {
+        const { buildSubmitMcpServer: buildSubmitMcpServer2 } = await Promise.resolve().then(() => (init_submitMcp(), submitMcp_exports));
+        const submitHandle = buildSubmitMcpServer2();
+        getSubmitted = submitHandle.getSubmitted;
+        mcpEntries.push(["kody-submit", submitHandle.server]);
+      }
+      if (opts.enableFetchRepoTool && opts.reposRoot) {
+        const { buildFetchRepoMcpServer: buildFetchRepoMcpServer2 } = await Promise.resolve().then(() => (init_fetchRepoMcp(), fetchRepoMcp_exports));
+        const fetchServer = buildFetchRepoMcpServer2({
+          reposRoot: opts.reposRoot,
+          repoToken: opts.repoToken
+        });
+        mcpEntries.push(["kody-fetch-repo", fetchServer]);
+        queryOptions.allowedTools.push("mcp__kody-fetch-repo__fetch_repo");
+        queryOptions.additionalDirectories = [opts.reposRoot];
+      }
+      if (mcpEntries.length > 0) {
+        queryOptions.mcpServers = Object.fromEntries(mcpEntries);
+      }
+      if (opts.pluginPaths && opts.pluginPaths.length > 0) {
+        queryOptions.plugins = opts.pluginPaths.map((p) => ({ type: "local", path: p }));
+      }
+      if (opts.agents && Object.keys(opts.agents).length > 0) {
+        queryOptions.agents = opts.agents;
+      }
+      if (typeof opts.maxTurns === "number" && opts.maxTurns > 0) {
+        queryOptions.maxTurns = opts.maxTurns;
+      }
+      if (typeof opts.maxThinkingTokens === "number" && opts.maxThinkingTokens > 0) {
+        queryOptions.maxThinkingTokens = opts.maxThinkingTokens;
+      }
+      if (typeof opts.systemPromptAppend === "string" && opts.systemPromptAppend.length > 0) {
+        const systemPrompt = {
+          type: "preset",
+          preset: "claude_code",
+          append: opts.systemPromptAppend
+        };
+        if (opts.cacheable) systemPrompt.excludeDynamicSections = true;
+        queryOptions.systemPrompt = systemPrompt;
+      } else if (opts.cacheable) {
+        queryOptions.systemPrompt = {
+          type: "preset",
+          preset: "claude_code",
+          excludeDynamicSections: true
+        };
+      }
+      queryOptions.settingSources = opts.settingSources ?? ["project", "local"];
+      const stableBinary = ensureStableClaudeBinary();
+      if (stableBinary) {
+        queryOptions.pathToClaudeCodeExecutable = stableBinary;
+      }
+      const result = query({
+        prompt: opts.prompt,
+        // biome-ignore lint/suspicious/noExplicitAny: SDK options type is narrow; mcpServers is runtime-passthrough.
+        options: queryOptions
+      });
+      const iterator = typeof result[Symbol.asyncIterator] === "function" ? result[Symbol.asyncIterator]() : result;
+      while (true) {
+        const nextPromise = iterator.next();
+        let timedOut = false;
+        let timer;
+        let next;
+        if (turnTimeoutMs > 0) {
+          const timeoutPromise = new Promise((resolve6) => {
+            timer = setTimeout(() => {
+              timedOut = true;
+              resolve6({ done: true, value: void 0 });
+            }, turnTimeoutMs);
+          });
+          next = await Promise.race([nextPromise, timeoutPromise]);
+          if (timer) clearTimeout(timer);
+        } else {
+          next = await nextPromise;
+        }
+        if (timedOut) {
+          outcome = "failed";
+          outcomeKind = "stalled";
+          errorMessage = `agent stalled: no SDK message in ${Math.round(turnTimeoutMs / 1e3)}s`;
+          if (typeof iterator.return === "function") {
+            try {
+              await iterator.return(void 0);
+            } catch {
+            }
           }
+          break;
         }
-        break;
-      }
-      if (next.done) break;
-      const msg = next.value;
-      messageCount++;
-      try {
-        fullLog.write(`${JSON.stringify(msg)}
+        if (next.done) break;
+        const msg = next.value;
+        messageCount++;
+        try {
+          fullLog.write(`${JSON.stringify(msg)}
 `);
-      } catch (e) {
-        ndjsonWriteFailed = true;
-        ndjsonWriteError = e instanceof Error ? e.message : String(e);
-      }
-      const line = renderEvent(msg, { verbose: opts.verbose, quiet: opts.quiet });
-      if (line) process.stdout.write(`${line}
+        } catch (e) {
+          ndjsonWriteFailed = true;
+          ndjsonWriteError = e instanceof Error ? e.message : String(e);
+        }
+        const line = renderEvent(msg, { verbose: opts.verbose, quiet: opts.quiet });
+        if (line) process.stdout.write(`${line}
 `);
-      const m = msg;
-      if (opts.onProgress) {
-        const blocks = m.message?.content ?? [];
-        for (const block of blocks) {
-          try {
-            if (block.type === "thinking") {
-              const t = block.thinking;
-              if (typeof t === "string" && t.length > 0) {
-                await opts.onProgress({ kind: "thinking", thinking: t });
-              }
-            } else if (block.type === "tool_use") {
-              const b = block;
-              await opts.onProgress({
-                kind: "tool_use",
-                name: b.name ?? "tool",
-                input: b.input,
-                id: b.id
-              });
-            } else if (block.type === "tool_result") {
-              const b = block;
-              const content = typeof b.content === "string" ? b.content : (() => {
-                try {
-                  return JSON.stringify(b.content);
-                } catch {
-                  return "";
+        const m = msg;
+        if (opts.onProgress) {
+          const blocks = m.message?.content ?? [];
+          for (const block of blocks) {
+            try {
+              if (block.type === "thinking") {
+                const t = block.thinking;
+                if (typeof t === "string" && t.length > 0) {
+                  await opts.onProgress({ kind: "thinking", thinking: t });
                 }
-              })();
-              await opts.onProgress({
-                kind: "tool_result",
-                toolUseId: b.tool_use_id,
-                content,
-                isError: b.is_error
-              });
-            } else if (block.type === "text") {
+              } else if (block.type === "tool_use") {
+                const b = block;
+                await opts.onProgress({
+                  kind: "tool_use",
+                  name: b.name ?? "tool",
+                  input: b.input,
+                  id: b.id
+                });
+              } else if (block.type === "tool_result") {
+                const b = block;
+                const content = typeof b.content === "string" ? b.content : (() => {
+                  try {
+                    return JSON.stringify(b.content);
+                  } catch {
+                    return "";
+                  }
+                })();
+                await opts.onProgress({
+                  kind: "tool_result",
+                  toolUseId: b.tool_use_id,
+                  content,
+                  isError: b.is_error
+                });
+              } else if (block.type === "text") {
+                const b = block;
+                if (typeof b.text === "string" && b.text.length > 0) {
+                  await opts.onProgress({ kind: "text", text: b.text });
+                }
+              }
+            } catch {
+            }
+          }
+        }
+        const usage = m.usage;
+        if (usage && typeof usage === "object") {
+          const i = Number(usage.input_tokens ?? 0);
+          const o = Number(usage.output_tokens ?? 0);
+          const cr = Number(usage.cache_read_input_tokens ?? 0);
+          const cc = Number(usage.cache_creation_input_tokens ?? 0);
+          if (Number.isFinite(i)) tokens.input += i;
+          if (Number.isFinite(o)) tokens.output += o;
+          if (Number.isFinite(cr)) tokens.cacheRead += cr;
+          if (Number.isFinite(cc)) tokens.cacheCreate += cc;
+        }
+        if (!sawMutatingTool) {
+          const blocks = m.message?.content ?? [];
+          for (const block of blocks) {
+            if (block.type === "tool_use") {
               const b = block;
-              if (typeof b.text === "string" && b.text.length > 0) {
-                await opts.onProgress({ kind: "text", text: b.text });
+              if (toolMayMutate(b.name, b.input)) {
+                sawMutatingTool = true;
+                break;
               }
             }
-          } catch {
           }
         }
-      }
-      const usage = m.usage;
-      if (usage && typeof usage === "object") {
-        const i = Number(usage.input_tokens ?? 0);
-        const o = Number(usage.output_tokens ?? 0);
-        const cr = Number(usage.cache_read_input_tokens ?? 0);
-        const cc = Number(usage.cache_creation_input_tokens ?? 0);
-        if (Number.isFinite(i)) tokens.input += i;
-        if (Number.isFinite(o)) tokens.output += o;
-        if (Number.isFinite(cr)) tokens.cacheRead += cr;
-        if (Number.isFinite(cc)) tokens.cacheCreate += cc;
-      }
-      if (m.type === "result") {
-        if (m.subtype === "success") {
-          outcome = "completed";
-          outcomeKind = "ok";
-          const text = (typeof m.result === "string" ? m.result : "").trim();
-          if (text) resultTexts.push(text);
-        } else {
-          outcome = "failed";
-          outcomeKind = classifySubtype(m.subtype);
-          errorMessage = `result subtype: ${m.subtype ?? "unknown"}`;
+        if (m.type === "result") {
+          if (m.subtype === "success") {
+            outcome = "completed";
+            outcomeKind = "ok";
+            const text = (typeof m.result === "string" ? m.result : "").trim();
+            if (text) resultTexts.push(text);
+          } else {
+            outcome = "failed";
+            outcomeKind = classifySubtype(m.subtype);
+            errorMessage = `result subtype: ${m.subtype ?? "unknown"}`;
+          }
         }
       }
+    } catch (e) {
+      outcome = "failed";
+      outcomeKind = "model_error";
+      errorMessage = e instanceof Error ? e.message : String(e);
+    } finally {
+      try {
+        fullLog.end();
+      } catch {
+      }
     }
-  } catch (e) {
-    outcome = "failed";
-    outcomeKind = "model_error";
-    errorMessage = e instanceof Error ? e.message : String(e);
-  } finally {
-    try {
-      fullLog.end();
-    } catch {
+    if (ndjsonWriteFailed) {
+      process.stderr.write(
+        `[kody agent] NDJSON write failed (post-mortem may be incomplete): ${ndjsonWriteError ?? "unknown error"}
+`
+      );
     }
+    finalText = resultTexts.join("\n\n---\n\n");
+    const shouldRetry = outcome === "failed" && attempt < MAX_CONNECTION_RETRIES && !sawMutatingTool && isTransientConnectionError(errorMessage);
+    if (!shouldRetry) break;
+    const delayMs = CONNECTION_RETRY_BASE_MS * 2 ** attempt;
+    process.stderr.write(
+      `[kody agent] transient connection error (attempt ${attempt + 1}/${MAX_CONNECTION_RETRIES + 1}); retrying in ${Math.round(delayMs / 1e3)}s: ${errorMessage}
+`
+    );
+    await new Promise((r) => setTimeout(r, delayMs));
   }
-  if (ndjsonWriteFailed) {
-    process.stderr.write(`[kody agent] NDJSON write failed (post-mortem may be incomplete): ${ndjsonWriteError ?? "unknown error"}
-`);
-  }
-  const finalText = resultTexts.join("\n\n---\n\n");
   const submittedState = getSubmitted?.();
   return {
     outcome,
@@ -2703,6 +2751,76 @@ import { execFileSync as execFileSync29 } from "child_process";
 import * as fs41 from "fs";
 import * as path37 from "path";
 
+// src/app-auth.ts
+import { createSign } from "crypto";
+var GH_API = process.env.GITHUB_API_URL || "https://api.github.com";
+function b64url(input) {
+  return Buffer.from(input).toString("base64url");
+}
+function normalizePem(key) {
+  const trimmed = key.trim();
+  if (trimmed.includes("BEGIN")) return trimmed;
+  try {
+    const decoded = Buffer.from(trimmed, "base64").toString("utf8");
+    if (decoded.includes("BEGIN")) return decoded;
+  } catch {
+  }
+  return trimmed;
+}
+function buildAppJwt(appId, privateKeyPem) {
+  const now = Math.floor(Date.now() / 1e3);
+  const header = { alg: "RS256", typ: "JWT" };
+  const payload = { iat: now - 60, exp: now + 9 * 60, iss: appId };
+  const signingInput = `${b64url(JSON.stringify(header))}.${b64url(JSON.stringify(payload))}`;
+  const signer = createSign("RSA-SHA256");
+  signer.update(signingInput);
+  signer.end();
+  const signature = signer.sign(normalizePem(privateKeyPem)).toString("base64url");
+  return `${signingInput}.${signature}`;
+}
+async function ghApp(jwt, apiPath, method = "GET") {
+  const res = await fetch(`${GH_API}${apiPath}`, {
+    method,
+    headers: {
+      Authorization: `Bearer ${jwt}`,
+      Accept: "application/vnd.github+json",
+      "X-GitHub-Api-Version": "2022-11-28",
+      "User-Agent": "kody-engine"
+    }
+  });
+  if (!res.ok) {
+    const body = await res.text().catch(() => "");
+    throw new Error(
+      `GitHub App API ${method} ${apiPath} \u2192 ${res.status} ${res.statusText}${body ? `: ${body.slice(0, 200)}` : ""}`
+    );
+  }
+  return await res.json();
+}
+function readAppCreds(env = process.env) {
+  const appId = env.KODY_APP_ID?.trim();
+  const privateKey = env.KODY_APP_PRIVATE_KEY;
+  if (!appId || !privateKey) return null;
+  return {
+    appId,
+    privateKey,
+    installationId: env.KODY_APP_INSTALLATION_ID?.trim() || void 0,
+    repo: env.GITHUB_REPOSITORY?.trim() || void 0
+  };
+}
+async function mintAppInstallationToken(creds) {
+  const jwt = buildAppJwt(creds.appId, creds.privateKey);
+  let installationId = creds.installationId;
+  if (!installationId) {
+    if (!creds.repo) {
+      throw new Error("cannot resolve App installation: no KODY_APP_INSTALLATION_ID and no GITHUB_REPOSITORY");
+    }
+    const inst = await ghApp(jwt, `/repos/${creds.repo}/installation`);
+    installationId = String(inst.id);
+  }
+  const tok = await ghApp(jwt, `/app/installations/${installationId}/access_tokens`, "POST");
+  return tok.token;
+}
+
 // src/dispatch.ts
 import * as fs12 from "fs";
 
@@ -3029,9 +3147,6 @@ function coerceBare(spec, value) {
   return value;
 }
 
-// src/kody-cli.ts
-init_issue();
-
 // src/executor.ts
 import { execFileSync as execFileSync28, spawn as spawn9 } from "child_process";
 import * as fs40 from "fs";
@@ -7783,6 +7898,8 @@ var FAILED = {
   description: "kody: flow failed"
 };
 var finalizeTerminal = async (ctx) => {
+  const flow = ctx.data.taskState?.flow;
+  if (flow?.issueNumber) return;
   const target = ctx.data.commentTargetType ?? "issue";
   const issueNumber = ctx.args.issue;
   const targetNumber = ctx.data.commentTargetNumber ?? issueNumber;
@@ -13821,7 +13938,7 @@ function unpackAllSecrets(env = process.env) {
   }
   return count;
 }
-function resolveAuthToken(env = process.env) {
+async function resolveAuthToken(env = process.env) {
   const sources = [
     ["KODY_TOKEN", env.KODY_TOKEN],
     ["GH_TOKEN", env.GH_TOKEN],
@@ -13834,10 +13951,24 @@ function resolveAuthToken(env = process.env) {
   if (token) {
     process.stdout.write(`\u2192 kody: GH_TOKEN sourced from env.${picked[0]}
 `);
-  } else {
-    process.stdout.write("\u2192 kody: WARNING no auth token found (KODY_TOKEN/GH_TOKEN/GITHUB_TOKEN/GH_PAT all empty)\n");
+    return token;
+  }
+  const creds = readAppCreds(env);
+  if (creds) {
+    try {
+      const minted = await mintAppInstallationToken(creds);
+      env.GH_TOKEN = minted;
+      process.stdout.write("\u2192 kody: GH_TOKEN minted from GitHub App (KODY_APP_ID/KODY_APP_PRIVATE_KEY)\n");
+      return minted;
+    } catch (err) {
+      process.stdout.write(`\u2192 kody: WARNING GitHub App token mint failed: ${err.message}
+`);
+    }
   }
-  return token;
+  process.stdout.write(
+    "\u2192 kody: WARNING no auth token found (KODY_TOKEN/GH_TOKEN/GITHUB_TOKEN/GH_PAT/GitHub App all empty)\n"
+  );
+  return void 0;
 }
 function detectPackageManager2(cwd) {
   if (fs41.existsSync(path37.join(cwd, "pnpm-lock.yaml"))) return "pnpm";
@@ -13986,7 +14117,7 @@ async function runCi(argv) {
     if (outcome.kind === "unrecognized") {
       try {
         unpackAllSecrets();
-        resolveAuthToken();
+        await resolveAuthToken();
       } catch {
       }
       const tokenLabel = outcome.token ? `\`${outcome.token}\`` : "an empty subcommand";
@@ -14003,8 +14134,10 @@ async function runCi(argv) {
         if (outcome.isPr) postPrReviewComment(outcome.target, body, cwd);
         else postIssueComment(outcome.target, body, cwd);
       } catch (err) {
-        process.stderr.write(`[kody] dispatch: failed to post unrecognized-token feedback: ${err instanceof Error ? err.message : String(err)}
-`);
+        process.stderr.write(
+          `[kody] dispatch: failed to post unrecognized-token feedback: ${err instanceof Error ? err.message : String(err)}
+`
+        );
       }
       process.stdout.write(
         `\u2192 kody: unrecognized subcommand "${outcome.token}" on #${outcome.target} \u2014 feedback comment attempt finished, exiting cleanly
@@ -14039,7 +14172,7 @@ ${CI_HELP}`);
     const n = unpackAllSecrets();
     if (n > 0) process.stdout.write(`\u2192 kody: unpacked ${n} secret(s) from ALL_SECRETS
 `);
-    resolveAuthToken();
+    await resolveAuthToken();
     reactToTriggerComment(cwd);
     const pm = args.packageManager ?? detectPackageManager2(cwd);
     process.stdout.write(`\u2192 kody: package manager = ${pm}
@@ -14112,7 +14245,7 @@ async function runScheduledFanOut(cwd, args, opts) {
     const n = unpackAllSecrets();
     if (n > 0) process.stdout.write(`\u2192 kody: unpacked ${n} secret(s) from ALL_SECRETS
 `);
-    resolveAuthToken();
+    await resolveAuthToken();
     const pm = args.packageManager ?? detectPackageManager2(cwd);
     process.stdout.write(`\u2192 kody: package manager = ${pm}
 `);
@@ -14285,7 +14418,7 @@ ${CHAT_HELP}`);
     process.stdout.write(`\u2192 kody: unpacked ${unpackedSecrets} secret(s) from ALL_SECRETS
 `);
   }
-  resolveAuthToken();
+  await resolveAuthToken();
   configureGitIdentity(cwd);
   const config = tryLoadConfig(cwd);
   const modelSpec = args.model ?? config?.agent.model ?? DEFAULT_MODEL;

package/dist/executables/fix/profile.json

@@ -70,7 +70,8 @@
       "color": "e99695",
       "description": "kody: applying review feedback"
     },
-    "context": "task"
+    "context": "task",
+    "finalize": true
   },
   "scripts": {
     "preflight": [

package/dist/executables/fix-ci/profile.json

@@ -52,7 +52,8 @@
       "description": "kody: fixing CI failures"
     },
     "context": "ci-fix",
-    "advance": false
+    "advance": false,
+    "finalize": true
   },
   "scripts": {
     "preflight": [

package/dist/executables/run/profile.json

@@ -54,7 +54,8 @@
     "context": "task",
     "contextExtras": ["resolveArtifacts"],
     "sync": false,
-    "mirrorState": true
+    "mirrorState": true,
+    "finalize": true
   },
   "scripts": {
     "preflight": [

package/dist/executables/sync/profile.json

@@ -27,14 +27,6 @@
   "cliTools": [],
   "scripts": {
     "preflight": [
-      {
-        "script": "setLifecycleLabel",
-        "with": {
-          "label": "kody:syncing",
-          "color": "c5def5",
-          "description": "kody: syncing PR with base"
-        }
-      },
       {
         "script": "syncFlow",
         "with": { "announceOnSuccess": true }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kody-ade/kody-engine",
-  "version": "0.4.149",
+  "version": "0.4.151",
   "description": "kody — autonomous development engine. Single-session Claude Code agent behind a generic executor + declarative executable profiles.",
   "license": "MIT",
   "type": "module",