@kody-ade/kody-engine 0.4.171 → 0.4.173

package/dist/bin/kody.js

@@ -531,7 +531,22 @@ function getIssue(issueNumber, cwd) {
 function stripKodyMentions(body) {
   return body.replace(/(@)(kody)/gi, "$1\u200B$2");
 }
+function detectBotDispatchShape(body) {
+  const trimmed = body.replace(/^\s+/, "");
+  const m = trimmed.match(/^@kody\s+([a-z][a-z0-9-]*)\b/i);
+  return m ? m[1].toLowerCase() : null;
+}
+function isRunningAsBot() {
+  if (process.env.GITHUB_ACTIONS !== "true") return false;
+  const actor = (process.env.GITHUB_ACTOR ?? "").toLowerCase();
+  if (actor.endsWith("[bot]") || actor === "kody-bot" || actor === "kodyade") return true;
+  return !!process.env.KODY_APP_ID;
+}
 function postIssueComment(issueNumber, body, cwd) {
+  if (isRunningAsBot()) {
+    const slug = detectBotDispatchShape(body);
+    if (slug) throw new BotDispatchCommentError(slug);
+  }
   try {
     gh(["issue", "comment", String(issueNumber), "--body-file", "-"], { input: stripKodyMentions(body), cwd });
   } catch (err) {
@@ -629,6 +644,10 @@ function getPrLatestReviewBody(prNumber, cwd) {
   return pr.body;
 }
 function postPrReviewComment(prNumber, body, cwd) {
+  if (isRunningAsBot()) {
+    const slug = detectBotDispatchShape(body);
+    if (slug) throw new BotDispatchCommentError(slug);
+  }
   try {
     gh(["pr", "comment", String(prNumber), "--body-file", "-"], { input: stripKodyMentions(body), cwd });
   } catch (err) {
@@ -638,11 +657,19 @@ function postPrReviewComment(prNumber, body, cwd) {
     );
   }
 }
-var API_TIMEOUT_MS, DEFAULT_COMMENT_LIMIT, DEFAULT_COMMENT_MAX_BYTES, VERDICT_HEADING;
+var API_TIMEOUT_MS, BotDispatchCommentError, DEFAULT_COMMENT_LIMIT, DEFAULT_COMMENT_MAX_BYTES, VERDICT_HEADING;
 var init_issue = __esm({
   "src/issue.ts"() {
     "use strict";
     API_TIMEOUT_MS = 3e4;
+    BotDispatchCommentError = class extends Error {
+      constructor(slug) {
+        super(
+          `bot self-dispatch via @kody comments is banned. Refusing to post "@kody ${slug} \u2026" \u2014 use runExecutableChain (same-run) or dispatchExecutable (cross-run) instead. See docs/duty-dispatch.md for the contract.`
+        );
+        this.name = "BotDispatchCommentError";
+      }
+    };
     DEFAULT_COMMENT_LIMIT = 12;
     DEFAULT_COMMENT_MAX_BYTES = 16e3;
     VERDICT_HEADING = /(^|\n)\s*#{1,6}\s*Verdict\s*:/i;
@@ -1061,7 +1088,7 @@ var init_loadPriorArt = __esm({
 // package.json
 var package_default = {
   name: "@kody-ade/kody-engine",
-  version: "0.4.171",
+  version: "0.4.173",
   description: "kody \u2014 autonomous development engine. Single-session Claude Code agent behind a generic executor + declarative executable profiles.",
   license: "MIT",
   type: "module",
@@ -6430,6 +6457,35 @@ function filterGoalTaskPrs(prs, taskIssueNumbers) {
   });
 }
 
+// src/scripts/deriveQaScopeFromIssue.ts
+init_issue();
+var TITLE_PATTERN = /^QA(?:\s+\w+)?:\s*(.+?)(?:\s*\(#\d+\))?\s*$/i;
+var deriveQaScopeFromIssue = async (ctx) => {
+  if (typeof ctx.args.scope === "string" && ctx.args.scope.trim().length > 0) {
+    return;
+  }
+  const issueNumber = Number(ctx.args.issue ?? 0);
+  if (!Number.isFinite(issueNumber) || issueNumber <= 0) return;
+  let title = "";
+  try {
+    const issue = getIssue(issueNumber, ctx.cwd);
+    title = (issue.title ?? "").trim();
+  } catch (err) {
+    process.stderr.write(
+      `[kody] deriveQaScopeFromIssue: could not read #${issueNumber}: ${err instanceof Error ? err.message : String(err)}
+`
+    );
+    return;
+  }
+  if (!title) return;
+  const m = title.match(TITLE_PATTERN);
+  const scope = (m?.[1] ?? title).trim();
+  if (!scope) return;
+  ctx.args.scope = scope;
+  process.stdout.write(`\u2192 qa-engineer: derived scope from tracking issue #${issueNumber} title: "${scope}"
+`);
+};
+
 // src/scripts/diagMcp.ts
 import { execFileSync as execFileSync10 } from "child_process";
 import * as fs25 from "fs";
@@ -9058,7 +9114,7 @@ var loadJobFromFile = async (ctx, _profile, args) => {
   const loaded = await backend.load(slug);
   ctx.data.jobSlug = slug;
   ctx.data.jobTitle = title;
-  ctx.data.jobIntent = body;
+  ctx.data.jobIntent = body.replace(/\{\{\s*mentions\s*\}\}/g, mentions);
   ctx.data.jobState = loaded;
   ctx.data.jobStateJson = JSON.stringify(loaded.state, null, 2);
   ctx.data.workerSlug = workerSlug;
@@ -13101,6 +13157,7 @@ var preflightScripts = {
   buildSyntheticPlugin,
   resolveArtifacts,
   discoverQaContext,
+  deriveQaScopeFromIssue,
   resolvePreviewUrl,
   resolveQaUrl,
   promoteQaGoal,

package/dist/executables/job-tick/prompt.md

@@ -10,6 +10,8 @@ The job below assigns you, worker **`{{workerSlug}}`**, as its executor. This pe
 
 Slug **`{{jobSlug}}`** — *{{jobTitle}}*, assigned to worker **`{{workerSlug}}`**. The job body below is authoritative for *what* to do, *when* (cadence), allowed commands, and state schema. It is human-edited — re-read it every tick. Execute it **as** the persona above.
 
+**Addressing the operator.** When the job body tells you to @-mention the operator (e.g. the first line of an inbox recommendation), the exact handle(s) to use are: {{mentions}}. Copy that string **verbatim** — never invent, abbreviate, guess, or retype a GitHub username. A wrong handle silently fails to route to the operator's inbox, so the recommendation is lost. If the line above is blank, the duty declared no operator; post without a mention.
+
 ### Job body
 
 {{jobIntent}}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kody-ade/kody-engine",
-  "version": "0.4.171",
+  "version": "0.4.173",
   "description": "kody — autonomous development engine. Single-session Claude Code agent behind a generic executor + declarative executable profiles.",
   "license": "MIT",
   "type": "module",