@kody-ade/kody-engine 0.4.172 → 0.4.174

package/dist/bin/kody.js

@@ -531,7 +531,22 @@ function getIssue(issueNumber, cwd) {
 function stripKodyMentions(body) {
   return body.replace(/(@)(kody)/gi, "$1\u200B$2");
 }
+function detectBotDispatchShape(body) {
+  const trimmed = body.replace(/^\s+/, "");
+  const m = trimmed.match(/^@kody\s+([a-z][a-z0-9-]*)\b/i);
+  return m ? m[1].toLowerCase() : null;
+}
+function isRunningAsBot() {
+  if (process.env.GITHUB_ACTIONS !== "true") return false;
+  const actor = (process.env.GITHUB_ACTOR ?? "").toLowerCase();
+  if (actor.endsWith("[bot]") || actor === "kody-bot" || actor === "kodyade") return true;
+  return !!process.env.KODY_APP_ID;
+}
 function postIssueComment(issueNumber, body, cwd) {
+  if (isRunningAsBot()) {
+    const slug = detectBotDispatchShape(body);
+    if (slug) throw new BotDispatchCommentError(slug);
+  }
   try {
     gh(["issue", "comment", String(issueNumber), "--body-file", "-"], { input: stripKodyMentions(body), cwd });
   } catch (err) {
@@ -629,6 +644,10 @@ function getPrLatestReviewBody(prNumber, cwd) {
   return pr.body;
 }
 function postPrReviewComment(prNumber, body, cwd) {
+  if (isRunningAsBot()) {
+    const slug = detectBotDispatchShape(body);
+    if (slug) throw new BotDispatchCommentError(slug);
+  }
   try {
     gh(["pr", "comment", String(prNumber), "--body-file", "-"], { input: stripKodyMentions(body), cwd });
   } catch (err) {
@@ -638,11 +657,19 @@ function postPrReviewComment(prNumber, body, cwd) {
     );
   }
 }
-var API_TIMEOUT_MS, DEFAULT_COMMENT_LIMIT, DEFAULT_COMMENT_MAX_BYTES, VERDICT_HEADING;
+var API_TIMEOUT_MS, BotDispatchCommentError, DEFAULT_COMMENT_LIMIT, DEFAULT_COMMENT_MAX_BYTES, VERDICT_HEADING;
 var init_issue = __esm({
   "src/issue.ts"() {
     "use strict";
     API_TIMEOUT_MS = 3e4;
+    BotDispatchCommentError = class extends Error {
+      constructor(slug) {
+        super(
+          `bot self-dispatch via @kody comments is banned. Refusing to post "@kody ${slug} \u2026" \u2014 use runExecutableChain (same-run) or dispatchExecutable (cross-run) instead. See docs/duty-dispatch.md for the contract.`
+        );
+        this.name = "BotDispatchCommentError";
+      }
+    };
     DEFAULT_COMMENT_LIMIT = 12;
     DEFAULT_COMMENT_MAX_BYTES = 16e3;
     VERDICT_HEADING = /(^|\n)\s*#{1,6}\s*Verdict\s*:/i;
@@ -1061,7 +1088,7 @@ var init_loadPriorArt = __esm({
 // package.json
 var package_default = {
   name: "@kody-ade/kody-engine",
-  version: "0.4.172",
+  version: "0.4.174",
   description: "kody \u2014 autonomous development engine. Single-session Claude Code agent behind a generic executor + declarative executable profiles.",
   license: "MIT",
   type: "module",
@@ -1675,7 +1702,6 @@ var BASH_WRITE_VERB = /\b(git\s+(commit|push|merge|rebase|tag|reset|cherry-pick)
 function toolMayMutate(name, input) {
   if (!name) return false;
   if (MUTATING_FILE_TOOLS.has(name)) return true;
-  if (name.startsWith("mcp__kody-submit__")) return true;
   if (name === "Bash") return BASH_WRITE_VERB.test(String(input?.command ?? ""));
   return false;
 }
@@ -6430,6 +6456,35 @@ function filterGoalTaskPrs(prs, taskIssueNumbers) {
   });
 }
 
+// src/scripts/deriveQaScopeFromIssue.ts
+init_issue();
+var TITLE_PATTERN = /^QA(?:\s+\w+)?:\s*(.+?)(?:\s*\(#\d+\))?\s*$/i;
+var deriveQaScopeFromIssue = async (ctx) => {
+  if (typeof ctx.args.scope === "string" && ctx.args.scope.trim().length > 0) {
+    return;
+  }
+  const issueNumber = Number(ctx.args.issue ?? 0);
+  if (!Number.isFinite(issueNumber) || issueNumber <= 0) return;
+  let title = "";
+  try {
+    const issue = getIssue(issueNumber, ctx.cwd);
+    title = (issue.title ?? "").trim();
+  } catch (err) {
+    process.stderr.write(
+      `[kody] deriveQaScopeFromIssue: could not read #${issueNumber}: ${err instanceof Error ? err.message : String(err)}
+`
+    );
+    return;
+  }
+  if (!title) return;
+  const m = title.match(TITLE_PATTERN);
+  const scope = (m?.[1] ?? title).trim();
+  if (!scope) return;
+  ctx.args.scope = scope;
+  process.stdout.write(`\u2192 qa-engineer: derived scope from tracking issue #${issueNumber} title: "${scope}"
+`);
+};
+
 // src/scripts/diagMcp.ts
 import { execFileSync as execFileSync10 } from "child_process";
 import * as fs25 from "fs";
@@ -13101,6 +13156,7 @@ var preflightScripts = {
   buildSyntheticPlugin,
   resolveArtifacts,
   discoverQaContext,
+  deriveQaScopeFromIssue,
   resolvePreviewUrl,
   resolveQaUrl,
   promoteQaGoal,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kody-ade/kody-engine",
-  "version": "0.4.172",
+  "version": "0.4.174",
   "description": "kody — autonomous development engine. Single-session Claude Code agent behind a generic executor + declarative executable profiles.",
   "license": "MIT",
   "type": "module",