@kody-ade/kody-engine 0.4.276 → 0.4.278

package/dist/bin/kody.js

@@ -15,7 +15,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "@kody-ade/kody-engine",
-      version: "0.4.276",
+      version: "0.4.278",
       description: "kody \u2014 autonomous development engine. Single-session Claude Code agent behind a generic executor + declarative executable profiles.",
       license: "MIT",
       type: "module",
@@ -156,14 +156,97 @@ function ghToken(preferRepoToken = false) {
 function gh(args, options) {
   const token = ghToken(options?.preferRepoToken);
   const env = token ? { ...process.env, GH_TOKEN: token } : { ...process.env };
-  return execFileSync("gh", args, {
-    encoding: "utf-8",
-    timeout: API_TIMEOUT_MS,
-    cwd: options?.cwd,
-    env,
-    input: options?.input,
-    stdio: options?.input ? ["pipe", "pipe", "pipe"] : ["inherit", "pipe", "pipe"]
-  }).trim();
+  const maxRetries = envInt("KODY_GH_RATE_LIMIT_MAX_RETRIES", DEFAULT_RATE_LIMIT_RETRIES);
+  const maxWaitMs = envInt("KODY_GH_RATE_LIMIT_MAX_WAIT_MS", DEFAULT_RATE_LIMIT_MAX_WAIT_MS);
+  for (let attempt = 0; ; attempt += 1) {
+    try {
+      return execFileSync("gh", args, {
+        encoding: "utf-8",
+        timeout: API_TIMEOUT_MS,
+        cwd: options?.cwd,
+        env,
+        input: options?.input,
+        stdio: options?.input ? ["pipe", "pipe", "pipe"] : ["inherit", "pipe", "pipe"]
+      }).trim();
+    } catch (err) {
+      if (!isRateLimitError(err) || attempt >= maxRetries) throw err;
+      const waitMs = rateLimitWaitMs(token, options?.cwd, attempt + 1);
+      if (waitMs > maxWaitMs) {
+        process.stderr.write(
+          `[kody gh] rate limit on ${formatGhArgs(args)}; reset wait ${formatDuration(waitMs)} exceeds max ${formatDuration(maxWaitMs)}
+`
+        );
+        throw err;
+      }
+      process.stderr.write(
+        `[kody gh] rate limit on ${formatGhArgs(args)}; retry ${attempt + 1}/${maxRetries} after ${formatDuration(waitMs)}
+`
+      );
+      sleepSync(waitMs);
+    }
+  }
+}
+function envInt(name, fallback) {
+  const raw = process.env[name]?.trim();
+  if (!raw) return fallback;
+  const value = Number(raw);
+  return Number.isFinite(value) && value >= 0 ? Math.floor(value) : fallback;
+}
+function errorMessage(err) {
+  if (err instanceof Error) {
+    const stderr = err.stderr;
+    if (Buffer.isBuffer(stderr)) return `${err.message}
+${stderr.toString("utf-8")}`;
+    if (typeof stderr === "string") return `${err.message}
+${stderr}`;
+    return err.message;
+  }
+  return String(err);
+}
+function isRateLimitError(err) {
+  const msg = errorMessage(err);
+  return /rate limit exceeded|secondary rate limit|abuse detection/i.test(msg) && /HTTP 403|rate limit/i.test(msg);
+}
+function rateLimitWaitMs(token, cwd, retryNumber) {
+  const resetMs = readCoreRateLimitResetMs(token, cwd);
+  if (typeof resetMs === "number") {
+    return Math.max(0, resetMs - Date.now() + 1e3);
+  }
+  const base = envInt("KODY_GH_RATE_LIMIT_BASE_DELAY_MS", DEFAULT_RATE_LIMIT_BASE_DELAY_MS);
+  return base * 2 ** Math.max(0, retryNumber - 1);
+}
+function readCoreRateLimitResetMs(token, cwd) {
+  try {
+    const env = token ? { ...process.env, GH_TOKEN: token } : { ...process.env };
+    const raw = execFileSync("gh", ["api", "rate_limit", "--jq", ".resources.core.reset"], {
+      encoding: "utf-8",
+      timeout: API_TIMEOUT_MS,
+      cwd,
+      env,
+      stdio: ["ignore", "pipe", "pipe"]
+    }).trim();
+    const seconds = Number(raw);
+    return Number.isFinite(seconds) && seconds > 0 ? seconds * 1e3 : null;
+  } catch {
+    return null;
+  }
+}
+function sleepSync(ms) {
+  if (ms <= 0) return;
+  const buffer = new SharedArrayBuffer(4);
+  const view = new Int32Array(buffer);
+  Atomics.wait(view, 0, 0, ms);
+}
+function formatGhArgs(args) {
+  return `gh ${args.slice(0, 4).join(" ")}${args.length > 4 ? " ..." : ""}`;
+}
+function formatDuration(ms) {
+  if (ms < 1e3) return `${ms}ms`;
+  const seconds = Math.ceil(ms / 1e3);
+  if (seconds < 60) return `${seconds}s`;
+  const minutes = Math.floor(seconds / 60);
+  const rest = seconds % 60;
+  return rest ? `${minutes}m${rest}s` : `${minutes}m`;
 }
 function getIssue(issueNumber, cwd) {
   const output = gh(["issue", "view", String(issueNumber), "--json", "number,title,body,comments,labels,url"], {
@@ -333,11 +416,14 @@ function postPrReviewComment(prNumber, body, cwd) {
     );
   }
 }
-var API_TIMEOUT_MS, BotDispatchCommentError, DEFAULT_COMMENT_LIMIT, DEFAULT_COMMENT_MAX_BYTES, VERDICT_HEADING;
+var API_TIMEOUT_MS, DEFAULT_RATE_LIMIT_RETRIES, DEFAULT_RATE_LIMIT_BASE_DELAY_MS, DEFAULT_RATE_LIMIT_MAX_WAIT_MS, BotDispatchCommentError, DEFAULT_COMMENT_LIMIT, DEFAULT_COMMENT_MAX_BYTES, VERDICT_HEADING;
 var init_issue = __esm({
   "src/issue.ts"() {
     "use strict";
     API_TIMEOUT_MS = 3e4;
+    DEFAULT_RATE_LIMIT_RETRIES = 2;
+    DEFAULT_RATE_LIMIT_BASE_DELAY_MS = 1e3;
+    DEFAULT_RATE_LIMIT_MAX_WAIT_MS = 65 * 60 * 1e3;
     BotDispatchCommentError = class extends Error {
       constructor(slug2) {
         super(
@@ -352,12 +438,25 @@ var init_issue = __esm({
   }
 });
 
+// src/stateBranch.ts
+var STATE_BRANCH;
+var init_stateBranch = __esm({
+  "src/stateBranch.ts"() {
+    "use strict";
+    STATE_BRANCH = "kody-state";
+  }
+});
+
 // src/stateRepo.ts
 import path2 from "path";
 function is404(err) {
   const msg = err instanceof Error ? err.message : String(err);
   return /HTTP 404/i.test(msg) || /Not Found/i.test(msg);
 }
+function isAlreadyExists(err) {
+  const msg = err instanceof Error ? err.message : String(err);
+  return /HTTP 422/i.test(msg) || /Reference already exists/i.test(msg);
+}
 function parseStateRepoSlug(slug2, field = "stateRepo") {
   const value = slug2.trim();
   let repoPath = value;
@@ -428,11 +527,41 @@ function apiPath(config, targetPath) {
   const parsed = parseStateRepo(config);
   return `/repos/${parsed.owner}/${parsed.repo}/contents/${targetPath}`;
 }
+function branchApiPath(config, targetPath) {
+  return `${apiPath(config, targetPath)}?ref=${encodeURIComponent(STATE_BRANCH)}`;
+}
+function ensureStateBranch(config, cwd) {
+  const parsed = parseStateRepo(config);
+  const cacheKey2 = `${parsed.owner}/${parsed.repo}:${STATE_BRANCH}`;
+  if (ensuredStateBranches.has(cacheKey2)) return;
+  try {
+    gh(["api", `/repos/${parsed.owner}/${parsed.repo}/git/ref/heads/${STATE_BRANCH}`], { cwd });
+    ensuredStateBranches.add(cacheKey2);
+    return;
+  } catch (err) {
+    if (!is404(err)) throw err;
+  }
+  const repoRaw = gh(["api", `/repos/${parsed.owner}/${parsed.repo}`], { cwd });
+  const defaultBranch = String(JSON.parse(repoRaw).default_branch ?? "").trim();
+  if (!defaultBranch) throw new Error(`stateRepo: ${parsed.owner}/${parsed.repo} default branch missing`);
+  const refRaw = gh(["api", `/repos/${parsed.owner}/${parsed.repo}/git/ref/heads/${defaultBranch}`], { cwd });
+  const sha = String(JSON.parse(refRaw).object?.sha ?? "").trim();
+  if (!sha) throw new Error(`stateRepo: ${parsed.owner}/${parsed.repo} ${defaultBranch} ref sha missing`);
+  try {
+    gh(["api", "--method", "POST", `/repos/${parsed.owner}/${parsed.repo}/git/refs`, "--input", "-"], {
+      cwd,
+      input: JSON.stringify({ ref: `refs/heads/${STATE_BRANCH}`, sha })
+    });
+  } catch (err) {
+    if (!isAlreadyExists(err)) throw err;
+  }
+  ensuredStateBranches.add(cacheKey2);
+}
 function readStateText(config, cwd, filePath) {
   const targetPath = stateRepoPath(config, filePath);
   let raw = "";
   try {
-    raw = gh(["api", apiPath(config, targetPath)], { cwd });
+    raw = gh(["api", branchApiPath(config, targetPath)], { cwd });
   } catch (err) {
     if (is404(err)) return null;
     throw err;
@@ -457,9 +586,11 @@ function readStateText(config, cwd, filePath) {
 }
 function writeStateText(config, cwd, filePath, content, message, sha) {
   const targetPath = stateRepoPath(config, filePath);
+  ensureStateBranch(config, cwd);
   const payload = {
     message,
-    content: Buffer.from(content, "utf-8").toString("base64")
+    content: Buffer.from(content, "utf-8").toString("base64"),
+    branch: STATE_BRANCH
   };
   if (sha) payload.sha = sha;
   gh(["api", "--method", "PUT", apiPath(config, targetPath), "--input", "-"], {
@@ -490,7 +621,7 @@ function listStateDirectory(config, cwd, dirPath) {
   const targetPath = stateRepoPath(config, dirPath);
   let raw = "";
   try {
-    raw = gh(["api", apiPath(config, targetPath)], { cwd });
+    raw = gh(["api", branchApiPath(config, targetPath)], { cwd });
   } catch (err) {
     if (is404(err)) return [];
     throw err;
@@ -498,10 +629,13 @@ function listStateDirectory(config, cwd, dirPath) {
   const parsed = JSON.parse(raw);
   return Array.isArray(parsed) ? parsed : [];
 }
+var ensuredStateBranches;
 var init_stateRepo = __esm({
   "src/stateRepo.ts"() {
     "use strict";
     init_issue();
+    init_stateBranch();
+    ensuredStateBranches = /* @__PURE__ */ new Set();
   }
 });
 
@@ -1356,18 +1490,312 @@ function buildSubmitMcpServer() {
   });
   return { server, getSubmitted: handle.getSubmitted };
 }
-var DESCRIPTION2, INPUT_SCHEMA2;
-var init_submitMcp = __esm({
-  "src/submitMcp.ts"() {
+var DESCRIPTION2, INPUT_SCHEMA2;
+var init_submitMcp = __esm({
+  "src/submitMcp.ts"() {
+    "use strict";
+    DESCRIPTION2 = "Persist this tick's next state. Call this EXACTLY ONCE, at the very end, when you've finished your work \u2014 it is the ONLY way your decision is saved. Pass your next `cursor` (string), your next `data` (object \u2014 carry prior data forward and mutate what you acted on), and `done` (boolean). After calling it you are finished; do not take further actions.";
+    INPUT_SCHEMA2 = {
+      cursor: z.string().describe('The next cursor value (e.g. "idle"). Must be a non-empty string.'),
+      data: z.record(z.string(), z.unknown()).describe("The next `data` object. Carry forward prior data and mutate only what you acted on this tick."),
+      done: z.boolean().describe(
+        "true only if this capability is permanently finished; evergreen capabilities stay false."
+      )
+    };
+  }
+});
+
+// src/dashboardCmsMcp.ts
+var dashboardCmsMcp_exports = {};
+__export(dashboardCmsMcp_exports, {
+  DASHBOARD_CMS_MCP_TOOL_NAMES: () => DASHBOARD_CMS_MCP_TOOL_NAMES,
+  buildDashboardCmsMcpServer: () => buildDashboardCmsMcpServer,
+  dashboardCmsToolDefinitions: () => dashboardCmsToolDefinitions
+});
+import { createSdkMcpServer as createSdkMcpServer3, tool as tool3 } from "@anthropic-ai/claude-agent-sdk";
+import { z as z2 } from "zod";
+function dashboardBaseUrl(opts) {
+  const raw = opts.dashboardUrl?.trim() || process.env.KODY_CMS_DASHBOARD_URL?.trim() || process.env.KODY_DASHBOARD_URL?.trim() || process.env.DASHBOARD_URL?.trim() || "";
+  if (!raw) return null;
+  try {
+    return new URL(raw).origin;
+  } catch {
+    return null;
+  }
+}
+function dashboardCmsToken(opts) {
+  return opts.token?.trim() || process.env.KODY_CMS_TOKEN?.trim() || process.env.KODY_DASHBOARD_TOKEN?.trim() || process.env.KODY_TOKEN?.trim() || process.env.GH_TOKEN?.trim() || process.env.GITHUB_TOKEN?.trim() || process.env.GH_PAT?.trim() || null;
+}
+function cmsHeaders(opts) {
+  const token = dashboardCmsToken(opts);
+  const [owner, repo] = opts.repoSlug.split("/");
+  if (!token) {
+    return {
+      ok: false,
+      error: "missing_cms_token",
+      message: "Set KODY_CMS_TOKEN, KODY_DASHBOARD_TOKEN, KODY_TOKEN, GH_TOKEN, GITHUB_TOKEN, or GH_PAT."
+    };
+  }
+  if (!owner || !repo) {
+    return { ok: false, error: "invalid_repo", message: `Invalid repo slug: ${opts.repoSlug}` };
+  }
+  return {
+    ok: true,
+    headers: {
+      "Content-Type": "application/json",
+      "x-kody-token": token,
+      "x-kody-owner": owner,
+      "x-kody-repo": repo,
+      ...opts.storeRepoUrl?.trim() ? { "x-kody-store-repo-url": opts.storeRepoUrl.trim() } : {},
+      ...opts.storeRef?.trim() ? { "x-kody-store-ref": opts.storeRef.trim() } : {}
+    }
+  };
+}
+async function callDashboardCms(opts, path50, init = {}) {
+  const baseUrl = dashboardBaseUrl(opts);
+  if (!baseUrl) {
+    return {
+      ok: false,
+      error: "missing_dashboard_url",
+      message: "Set KODY_CMS_DASHBOARD_URL or KODY_DASHBOARD_URL to the Dashboard origin."
+    };
+  }
+  const headerResult = cmsHeaders(opts);
+  if (!headerResult.ok) return headerResult;
+  try {
+    const res = await fetch(`${baseUrl}${path50}`, {
+      ...init,
+      headers: {
+        ...headerResult.headers,
+        ...init.headers
+      }
+    });
+    const contentType = res.headers.get("content-type") ?? "";
+    const data = contentType.includes("application/json") ? await res.json().catch(() => null) : await res.text().catch(() => "");
+    if (!res.ok) {
+      return {
+        ok: false,
+        status: res.status,
+        error: stringFieldFromRecord(data, "error") ?? "cms_request_failed",
+        message: stringFieldFromRecord(data, "message") ?? `Dashboard CMS request failed with ${res.status}.`,
+        data
+      };
+    }
+    return { ok: true, status: res.status, data };
+  } catch (err) {
+    return {
+      ok: false,
+      error: "cms_request_error",
+      message: err instanceof Error ? err.message : String(err)
+    };
+  }
+}
+function cmsToolResponse(result) {
+  return {
+    content: [{ type: "text", text: JSON.stringify(result, null, 2) }],
+    ...result.ok ? {} : { isError: true }
+  };
+}
+function cmsQuery(args) {
+  const params = new URLSearchParams();
+  const q = stringArg(args.q);
+  if (q) params.set("q", q);
+  const limit = numberArg(args.limit);
+  if (limit !== void 0) params.set("limit", String(limit));
+  const offset = numberArg(args.offset);
+  if (offset !== void 0) params.set("offset", String(offset));
+  if (args.filters && typeof args.filters === "object" && !Array.isArray(args.filters)) {
+    params.set("filters", JSON.stringify(args.filters));
+  }
+  if (Array.isArray(args.sort)) {
+    const sort = args.sort.flatMap((entry) => {
+      if (!entry || typeof entry !== "object") return [];
+      const field = stringArg(entry.field);
+      if (!field) return [];
+      const direction = entry.direction === "asc" ? "asc" : "desc";
+      return [`${field}:${direction}`];
+    }).join(",");
+    if (sort) params.set("sort", sort);
+  }
+  const value = params.toString();
+  return value ? `?${value}` : "";
+}
+function stringArg(value) {
+  return typeof value === "string" ? value.trim() : "";
+}
+function numberArg(value) {
+  if (value === void 0 || value === null || value === "") return void 0;
+  const n = Number(value);
+  return Number.isFinite(n) ? n : void 0;
+}
+function documentArg(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return {};
+  return value;
+}
+function normalizeCmsDocumentIdInput(input) {
+  const trimmed = stripWrappingQuotes(input.trim());
+  const withoutQuery = trimmed.split(/[?#]/, 1)[0] ?? trimmed;
+  const path50 = parseDocumentPath(withoutQuery);
+  return path50 ?? parseDocumentIdSegment(withoutQuery) ?? withoutQuery;
+}
+function stripWrappingQuotes(value) {
+  let current = value;
+  for (; ; ) {
+    const next = current.replace(/^[`'"]+|[`'"]+$/g, "").trim();
+    if (next === current) return current;
+    current = next;
+  }
+}
+function parseDocumentPath(value) {
+  const path50 = value.startsWith("http://") || value.startsWith("https://") ? urlPathname(value) : value;
+  if (!path50?.includes("/content/entries/")) return null;
+  const parts = path50.split("/").filter(Boolean).map(decodePathPart);
+  const entriesIndex = parts.findIndex((part, index) => part === "content" && parts[index + 1] === "entries");
+  const idPart = parts[entriesIndex + 3];
+  if (!idPart || idPart === "new") return null;
+  return idPart === "edit" ? parts[entriesIndex + 2] ?? null : idPart;
+}
+function parseDocumentIdSegment(value) {
+  const parts = value.split("/").filter(Boolean).map(decodePathPart);
+  if (parts.length < 2) return null;
+  const lastPart = parts[parts.length - 1];
+  if (!lastPart || lastPart === "new") return null;
+  return lastPart === "edit" ? parts[parts.length - 2] ?? null : lastPart;
+}
+function urlPathname(value) {
+  try {
+    return new URL(value).pathname;
+  } catch {
+    return null;
+  }
+}
+function decodePathPart(value) {
+  try {
+    return decodeURIComponent(value);
+  } catch {
+    return value;
+  }
+}
+function stringFieldFromRecord(value, field) {
+  return value && typeof value === "object" && !Array.isArray(value) && typeof value[field] === "string" ? String(value[field]) : void 0;
+}
+function dashboardCmsToolDefinitions(opts) {
+  const cmsListCollectionsTool = {
+    name: "cms_list_collections",
+    description: "List configured Dashboard CMS collections and their supported operations. Read-only.",
+    inputSchema: {},
+    handler: async () => cmsToolResponse(await callDashboardCms(opts, "/api/kody/cms"))
+  };
+  const cmsListDocumentsTool = {
+    name: "cms_list_documents",
+    description: "List or search Dashboard CMS documents from one configured collection. Read-only.",
+    inputSchema: {
+      collection: z2.string().min(1).describe("CMS collection name."),
+      q: z2.string().optional().describe("Optional search query."),
+      filters: z2.record(z2.string(), z2.unknown()).optional().describe("Optional filter object keyed by field."),
+      sort: z2.array(
+        z2.object({
+          field: z2.string().min(1),
+          direction: z2.enum(["asc", "desc"]).default("desc")
+        })
+      ).optional(),
+      limit: z2.number().int().min(1).max(100).optional(),
+      offset: z2.number().int().min(0).optional()
+    },
+    handler: async (args) => {
+      const collection = encodeURIComponent(stringArg(args.collection));
+      return cmsToolResponse(await callDashboardCms(opts, `/api/kody/cms/${collection}${cmsQuery(args)}`));
+    }
+  };
+  const cmsGetDocumentTool = {
+    name: "cms_get_document",
+    description: "Get one Dashboard CMS document by collection and id. Use a raw id or the content entry URL copied from the Dashboard.",
+    inputSchema: {
+      collection: z2.string().min(1).describe("CMS collection name."),
+      id: z2.string().min(1).describe("Document id. Use cmsDocumentId from cms_list_documents when available.")
+    },
+    handler: async (args) => {
+      const collection = encodeURIComponent(stringArg(args.collection));
+      const id = encodeURIComponent(normalizeCmsDocumentIdInput(stringArg(args.id)));
+      return cmsToolResponse(await callDashboardCms(opts, `/api/kody/cms/${collection}/${id}`));
+    }
+  };
+  const cmsCreateDocumentTool = {
+    name: "cms_create_document",
+    description: "Create one Dashboard CMS document when the caller allows writes and the CMS collection allows create.",
+    inputSchema: {
+      collection: z2.string().min(1).describe("CMS collection name."),
+      data: z2.record(z2.string(), z2.unknown()).describe("Document fields to create.")
+    },
+    handler: async (args) => {
+      const refusal = opts.assertWriteAllowed?.();
+      if (refusal) return { content: [{ type: "text", text: refusal }] };
+      const collection = encodeURIComponent(stringArg(args.collection));
+      return cmsToolResponse(
+        await callDashboardCms(opts, `/api/kody/cms/${collection}`, {
+          method: "POST",
+          body: JSON.stringify(documentArg(args.data))
+        })
+      );
+    }
+  };
+  const cmsUpdateDocumentTool = {
+    name: "cms_update_document",
+    description: "Update one Dashboard CMS document when the caller allows writes and the CMS collection allows update.",
+    inputSchema: {
+      collection: z2.string().min(1).describe("CMS collection name."),
+      id: z2.string().min(1).describe("Document id."),
+      data: z2.record(z2.string(), z2.unknown()).describe("Partial document fields to update.")
+    },
+    handler: async (args) => {
+      const refusal = opts.assertWriteAllowed?.();
+      if (refusal) return { content: [{ type: "text", text: refusal }] };
+      const collection = encodeURIComponent(stringArg(args.collection));
+      const id = encodeURIComponent(normalizeCmsDocumentIdInput(stringArg(args.id)));
+      return cmsToolResponse(
+        await callDashboardCms(opts, `/api/kody/cms/${collection}/${id}`, {
+          method: "PATCH",
+          body: JSON.stringify(documentArg(args.data))
+        })
+      );
+    }
+  };
+  return [
+    cmsListCollectionsTool,
+    cmsListDocumentsTool,
+    cmsGetDocumentTool,
+    cmsCreateDocumentTool,
+    cmsUpdateDocumentTool
+  ];
+}
+function buildDashboardCmsMcpServer(opts) {
+  const tools = dashboardCmsToolDefinitions(opts).map(
+    (def) => tool3(
+      def.name,
+      def.description,
+      def.inputSchema,
+      async (args) => def.handler(args)
+    )
+  );
+  return {
+    server: createSdkMcpServer3({
+      name: "kody-cms",
+      version: "0.1.0",
+      tools
+    })
+  };
+}
+var DASHBOARD_CMS_MCP_TOOL_NAMES;
+var init_dashboardCmsMcp = __esm({
+  "src/dashboardCmsMcp.ts"() {
     "use strict";
-    DESCRIPTION2 = "Persist this tick's next state. Call this EXACTLY ONCE, at the very end, when you've finished your work \u2014 it is the ONLY way your decision is saved. Pass your next `cursor` (string), your next `data` (object \u2014 carry prior data forward and mutate what you acted on), and `done` (boolean). After calling it you are finished; do not take further actions.";
-    INPUT_SCHEMA2 = {
-      cursor: z.string().describe('The next cursor value (e.g. "idle"). Must be a non-empty string.'),
-      data: z.record(z.string(), z.unknown()).describe("The next `data` object. Carry forward prior data and mutate only what you acted on this tick."),
-      done: z.boolean().describe(
-        "true only if this capability is permanently finished; evergreen capabilities stay false."
-      )
-    };
+    DASHBOARD_CMS_MCP_TOOL_NAMES = [
+      "cms_list_collections",
+      "cms_list_documents",
+      "cms_get_document",
+      "cms_create_document",
+      "cms_update_document"
+    ];
   }
 });
 
@@ -1941,8 +2369,8 @@ __export(capabilityMcp_exports, {
   readCheckRuns: () => readCheckRuns,
   readThread: () => readThread
 });
-import { createSdkMcpServer as createSdkMcpServer3, tool as tool3 } from "@anthropic-ai/claude-agent-sdk";
-import { z as z2 } from "zod";
+import { createSdkMcpServer as createSdkMcpServer4, tool as tool4 } from "@anthropic-ai/claude-agent-sdk";
+import { z as z3 } from "zod";
 function summarizeCiStatus(rollup) {
   if (!Array.isArray(rollup) || rollup.length === 0) return "UNKNOWN";
   let hasRunning = false;
@@ -2181,132 +2609,12 @@ function isDispatchGated(capability, mode) {
 function trustRefusal(capabilitySlug) {
   return `Not dispatched: capability \`${capabilitySlug ?? "?"}\` is in ASK mode (not trusted for autonomy). Do NOT retry the dispatch. Instead notify the operator (use recommend_to_operator, or rely on the tracking issue that already @-mentions them), then submit_state. To let this capability act on its own, grant it Auto on the dashboard Trust page.`;
 }
-function dashboardBaseUrl() {
-  const raw = process.env.KODY_CMS_DASHBOARD_URL?.trim() || process.env.KODY_DASHBOARD_URL?.trim() || process.env.DASHBOARD_URL?.trim() || "";
-  if (!raw) return null;
-  try {
-    const parsed = new URL(raw);
-    return parsed.origin;
-  } catch {
-    return null;
-  }
-}
-function dashboardCmsToken() {
-  return process.env.KODY_CMS_TOKEN?.trim() || process.env.KODY_DASHBOARD_TOKEN?.trim() || process.env.KODY_TOKEN?.trim() || process.env.GH_TOKEN?.trim() || process.env.GITHUB_TOKEN?.trim() || process.env.GH_PAT?.trim() || null;
-}
-function cmsHeaders(opts) {
-  const token = dashboardCmsToken();
-  const [owner, repo] = opts.repoSlug.split("/");
-  if (!token) {
-    return {
-      ok: false,
-      error: "missing_cms_token",
-      message: "Set KODY_CMS_TOKEN, KODY_DASHBOARD_TOKEN, KODY_TOKEN, GH_TOKEN, GITHUB_TOKEN, or GH_PAT."
-    };
-  }
-  if (!owner || !repo) {
-    return { ok: false, error: "invalid_repo", message: `Invalid repo slug: ${opts.repoSlug}` };
-  }
-  return {
-    ok: true,
-    headers: {
-      "Content-Type": "application/json",
-      "x-kody-token": token,
-      "x-kody-owner": owner,
-      "x-kody-repo": repo
-    }
-  };
-}
-async function callDashboardCms(opts, path50, init = {}) {
-  const baseUrl = dashboardBaseUrl();
-  if (!baseUrl) {
-    return {
-      ok: false,
-      error: "missing_dashboard_url",
-      message: "Set KODY_CMS_DASHBOARD_URL or KODY_DASHBOARD_URL to the Dashboard origin."
-    };
-  }
-  const headerResult = cmsHeaders(opts);
-  if (!headerResult.ok) return headerResult;
-  try {
-    const res = await fetch(`${baseUrl}${path50}`, {
-      ...init,
-      headers: {
-        ...headerResult.headers,
-        ...init.headers
-      }
-    });
-    const contentType = res.headers.get("content-type") ?? "";
-    const data = contentType.includes("application/json") ? await res.json().catch(() => null) : await res.text().catch(() => "");
-    if (!res.ok) {
-      return {
-        ok: false,
-        status: res.status,
-        error: stringFieldFromRecord(data, "error") ?? "cms_request_failed",
-        message: stringFieldFromRecord(data, "message") ?? `Dashboard CMS request failed with ${res.status}.`,
-        data
-      };
-    }
-    return { ok: true, status: res.status, data };
-  } catch (err) {
-    return {
-      ok: false,
-      error: "cms_request_error",
-      message: err instanceof Error ? err.message : String(err)
-    };
-  }
-}
-function cmsToolResponse(result) {
-  return {
-    content: [{ type: "text", text: JSON.stringify(result, null, 2) }],
-    ...result.ok ? {} : { isError: true }
-  };
-}
 function assertCmsWriteAllowed(opts) {
   if (isDispatchGated(opts.capabilitySlug, readCapabilityTrustMode(opts.state, opts.repoSlug, opts.capabilitySlug))) {
     return trustRefusal(opts.capabilitySlug);
   }
   return null;
 }
-function cmsQuery(args) {
-  const params = new URLSearchParams();
-  const q = stringArg(args.q);
-  if (q) params.set("q", q);
-  const limit = numberArg(args.limit);
-  if (limit !== void 0) params.set("limit", String(limit));
-  const offset = numberArg(args.offset);
-  if (offset !== void 0) params.set("offset", String(offset));
-  if (args.filters && typeof args.filters === "object" && !Array.isArray(args.filters)) {
-    params.set("filters", JSON.stringify(args.filters));
-  }
-  if (Array.isArray(args.sort)) {
-    const sort = args.sort.flatMap((entry) => {
-      if (!entry || typeof entry !== "object") return [];
-      const field = stringArg(entry.field);
-      if (!field) return [];
-      const direction = entry.direction === "asc" ? "asc" : "desc";
-      return [`${field}:${direction}`];
-    }).join(",");
-    if (sort) params.set("sort", sort);
-  }
-  const value = params.toString();
-  return value ? `?${value}` : "";
-}
-function stringArg(value) {
-  return typeof value === "string" ? value.trim() : "";
-}
-function numberArg(value) {
-  if (value === void 0 || value === null || value === "") return void 0;
-  const n = Number(value);
-  return Number.isFinite(n) ? n : void 0;
-}
-function documentArg(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) return {};
-  return value;
-}
-function stringFieldFromRecord(value, field) {
-  return value && typeof value === "object" && !Array.isArray(value) && typeof value[field] === "string" ? String(value[field]) : void 0;
-}
 function capabilityToolDefinitions(opts) {
   const workflowFile = opts.workflowFile ?? "kody.yml";
   const listTool = {
@@ -2329,7 +2637,7 @@ function capabilityToolDefinitions(opts) {
     name: `${verb.replace("-", "_")}_pr`,
     description: describe,
     inputSchema: {
-      pr: z2.number().int().positive().describe("PR number to repair.")
+      pr: z3.number().int().positive().describe("PR number to repair.")
     },
     handler: async (args) => {
       const pr = Number(args.pr);
@@ -2357,8 +2665,8 @@ function capabilityToolDefinitions(opts) {
     name: "recommend_to_operator",
     description: "Post ONE comment on a PR with the operator @-mention prepended. Use this when a capability is in ASK mode and you want the operator to confirm via the dashboard inbox. The mention handle is substituted from kody.config.json `github.operators` \u2014 do not type it yourself.",
     inputSchema: {
-      pr: z2.number().int().positive().describe("PR number to comment on."),
-      body: z2.string().min(1).describe("Comment body (markdown). Do not include the operator mention \u2014 the engine prepends it.")
+      pr: z3.number().int().positive().describe("PR number to comment on."),
+      body: z3.string().min(1).describe("Comment body (markdown). Do not include the operator mention \u2014 the engine prepends it.")
     },
     handler: async (args) => {
       const pr = Number(args.pr);
@@ -2372,7 +2680,7 @@ function capabilityToolDefinitions(opts) {
     name: "read_ledger",
     description: "Read any sentinel-fenced JSON manifest stored on a labeled issue. Returns `{found, issueNumber, payload}` where payload is the parsed JSON between `<!-- <label>:start -->` and `<!-- <label>:end -->` sentinels.",
     inputSchema: {
-      label: z2.string().min(1).describe("GitHub issue label that identifies the manifest issue.")
+      label: z3.string().min(1).describe("GitHub issue label that identifies the manifest issue.")
     },
     handler: async (args) => {
       const label = String(args.label ?? "");
@@ -2384,8 +2692,8 @@ function capabilityToolDefinitions(opts) {
     name: "read_check_runs",
     description: "Read CI for a branch or commit ref (e.g. 'dev'). Returns {sha, state, failing:[{name,conclusion,detailsUrl}], pending:[{name,status}]}. state is RED (\u22651 check has a terminal-failure conclusion: failure/timed_out/startup_failure/action_required), PENDING (none failed but some still running), or GREEN (all completed, none failed). Kody's own job check-runs (run/kody/capability-tick/\u2026) are excluded by default. This reads the commit's authoritative check-runs \u2014 use it instead of guessing CI health from a run list.",
     inputSchema: {
-      ref: z2.string().min(1).describe("Branch name or commit SHA to read CI for (e.g. 'dev')."),
-      ignoreNames: z2.array(z2.string()).optional().describe("Check names to exclude (default: Kody's own job names).")
+      ref: z3.string().min(1).describe("Branch name or commit SHA to read CI for (e.g. 'dev')."),
+      ignoreNames: z3.array(z3.string()).optional().describe("Check names to exclude (default: Kody's own job names).")
     },
     handler: async (args) => {
       const ref = String(args.ref ?? "");
@@ -2398,8 +2706,8 @@ function capabilityToolDefinitions(opts) {
     name: "read_thread",
     description: "Read an issue or PR's recent comments + labels + title/state. Returns {number, title, state, labels:[...], comments:[{author, createdAt, body}]} (newest last, body truncated). Use this to read a verdict a dispatched check posted back \u2014 e.g. qa-engineer's report or ui-review's PASS/CONCERNS/FAIL \u2014 on a later tick. Read-only; works for both issues AND PRs.",
     inputSchema: {
-      number: z2.number().int().positive().describe("Issue or PR number to read."),
-      limit: z2.number().int().positive().optional().describe("Max recent comments to return (default 10).")
+      number: z3.number().int().positive().describe("Issue or PR number to read."),
+      limit: z3.number().int().positive().optional().describe("Max recent comments to return (default 10).")
     },
     handler: async (args) => {
       const number = Number(args.number);
@@ -2412,11 +2720,11 @@ function capabilityToolDefinitions(opts) {
     name: "ensure_issue",
     description: "Idempotently ensure ONE open tracking issue exists for `key`. Searches OPEN issues (issues API, not the laggy search index) for `key`'s hidden marker; if found, returns {created:false, number} and creates NOTHING; otherwise creates the issue (title + body, marker appended) and returns {created:true, number}. This is the anti-duplication primitive: use one stable `key` per recurring finding so re-ticks reuse the same issue. Only take follow-up actions (dispatch/comment) when created===true.",
     inputSchema: {
-      key: z2.string().min(1).describe(
+      key: z3.string().min(1).describe(
         "Stable dedup identity for this finding (e.g. 'dev-ci-red', 'docs-drift:<feature>'). Same key across ticks = same issue."
       ),
-      title: z2.string().min(1).describe("Issue title (used only on first creation)."),
-      body: z2.string().min(1).describe(
+      title: z3.string().min(1).describe("Issue title (used only on first creation)."),
+      body: z3.string().min(1).describe(
         "Issue body markdown (used only on first creation). Include the operator mention verbatim if the capability body has one."
       )
     },
@@ -2432,9 +2740,9 @@ function capabilityToolDefinitions(opts) {
     name: "ensure_comment",
     description: "Idempotently post ONE comment on an issue for `key`. If a comment carrying `key`'s marker already exists on the issue, returns {posted:false}; otherwise posts the comment (marker appended) and returns {posted:true}. Use for a notify/audit comment that must appear exactly once.",
     inputSchema: {
-      issue: z2.number().int().positive().describe("Issue number to comment on."),
-      key: z2.string().min(1).describe("Stable dedup identity for this comment (e.g. 'dev-ci-red:dispatched')."),
-      body: z2.string().min(1).describe("Comment body markdown.")
+      issue: z3.number().int().positive().describe("Issue number to comment on."),
+      key: z3.string().min(1).describe("Stable dedup identity for this comment (e.g. 'dev-ci-red:dispatched')."),
+      body: z3.string().min(1).describe("Comment body markdown.")
     },
     handler: async (args) => {
       const issue = Number(args.issue);
@@ -2448,9 +2756,9 @@ function capabilityToolDefinitions(opts) {
     name: "dispatch_workflow",
     description: "Dispatch a kody.yml workflow_dispatch run for a capability action against an issue (the cross-run bot\u2192engine path; a bot `@kody` comment would be dropped). E.g. dispatch_workflow({capability:'run', issueNumber:<n>}) opens a fix PR from a tracking issue. Returns {ok} or {ok:false,error}.",
     inputSchema: {
-      capability: z2.string().min(1).optional().describe("Capability action to run (e.g. 'run')."),
-      executable: z2.string().min(1).optional().describe("Deprecated alias for capability."),
-      issueNumber: z2.number().int().positive().describe("Issue (or PR) number forwarded as issue_number.")
+      capability: z3.string().min(1).optional().describe("Capability action to run (e.g. 'run')."),
+      executable: z3.string().min(1).optional().describe("Deprecated alias for capability."),
+      issueNumber: z3.number().int().positive().describe("Issue (or PR) number forwarded as issue_number.")
     },
     handler: async (args) => {
       const capability = String(args.capability ?? args.executable ?? "");
@@ -2463,86 +2771,10 @@ function capabilityToolDefinitions(opts) {
       return { content: [{ type: "text", text }] };
     }
   };
-  const cmsListCollectionsTool = {
-    name: "cms_list_collections",
-    description: "List configured Dashboard CMS collections and their supported operations. Read-only.",
-    inputSchema: {},
-    handler: async () => cmsToolResponse(await callDashboardCms(opts, "/api/kody/cms"))
-  };
-  const cmsListDocumentsTool = {
-    name: "cms_list_documents",
-    description: "List or search Dashboard CMS documents from one configured collection. Read-only.",
-    inputSchema: {
-      collection: z2.string().min(1).describe("CMS collection name."),
-      q: z2.string().optional().describe("Optional search query."),
-      filters: z2.record(z2.string(), z2.unknown()).optional().describe("Optional filter object keyed by field."),
-      sort: z2.array(
-        z2.object({
-          field: z2.string().min(1),
-          direction: z2.enum(["asc", "desc"]).default("desc")
-        })
-      ).optional(),
-      limit: z2.number().int().min(1).max(100).optional(),
-      offset: z2.number().int().min(0).optional()
-    },
-    handler: async (args) => {
-      const collection = encodeURIComponent(stringArg(args.collection));
-      return cmsToolResponse(await callDashboardCms(opts, `/api/kody/cms/${collection}${cmsQuery(args)}`));
-    }
-  };
-  const cmsGetDocumentTool = {
-    name: "cms_get_document",
-    description: "Get one Dashboard CMS document by collection and id. Read-only.",
-    inputSchema: {
-      collection: z2.string().min(1).describe("CMS collection name."),
-      id: z2.string().min(1).describe("Document id.")
-    },
-    handler: async (args) => {
-      const collection = encodeURIComponent(stringArg(args.collection));
-      const id = encodeURIComponent(stringArg(args.id));
-      return cmsToolResponse(await callDashboardCms(opts, `/api/kody/cms/${collection}/${id}`));
-    }
-  };
-  const cmsCreateDocumentTool = {
-    name: "cms_create_document",
-    description: "Create one Dashboard CMS document when the capability is trusted and the CMS collection allows create.",
-    inputSchema: {
-      collection: z2.string().min(1).describe("CMS collection name."),
-      data: z2.record(z2.string(), z2.unknown()).describe("Document fields to create.")
-    },
-    handler: async (args) => {
-      const refusal = assertCmsWriteAllowed(opts);
-      if (refusal) return { content: [{ type: "text", text: refusal }] };
-      const collection = encodeURIComponent(stringArg(args.collection));
-      return cmsToolResponse(
-        await callDashboardCms(opts, `/api/kody/cms/${collection}`, {
-          method: "POST",
-          body: JSON.stringify(documentArg(args.data))
-        })
-      );
-    }
-  };
-  const cmsUpdateDocumentTool = {
-    name: "cms_update_document",
-    description: "Update one Dashboard CMS document when the capability is trusted and the CMS collection allows update.",
-    inputSchema: {
-      collection: z2.string().min(1).describe("CMS collection name."),
-      id: z2.string().min(1).describe("Document id."),
-      data: z2.record(z2.string(), z2.unknown()).describe("Partial document fields to update.")
-    },
-    handler: async (args) => {
-      const refusal = assertCmsWriteAllowed(opts);
-      if (refusal) return { content: [{ type: "text", text: refusal }] };
-      const collection = encodeURIComponent(stringArg(args.collection));
-      const id = encodeURIComponent(stringArg(args.id));
-      return cmsToolResponse(
-        await callDashboardCms(opts, `/api/kody/cms/${collection}/${id}`, {
-          method: "PATCH",
-          body: JSON.stringify(documentArg(args.data))
-        })
-      );
-    }
-  };
+  const cmsTools = dashboardCmsToolDefinitions({
+    repoSlug: opts.repoSlug,
+    assertWriteAllowed: () => assertCmsWriteAllowed(opts)
+  });
   return [
     listTool,
     syncTool,
@@ -2555,24 +2787,20 @@ function capabilityToolDefinitions(opts) {
     ensureIssueTool,
     ensureCommentTool,
     dispatchTool,
-    cmsListCollectionsTool,
-    cmsListDocumentsTool,
-    cmsGetDocumentTool,
-    cmsCreateDocumentTool,
-    cmsUpdateDocumentTool
+    ...cmsTools
   ];
 }
 function buildCapabilityMcpServer(opts) {
   const definitions = capabilityToolDefinitions(opts);
   const tools = definitions.map(
-    (def) => tool3(
+    (def) => tool4(
       def.name,
       def.description,
       def.inputSchema,
       async (args) => def.handler(args)
     )
   );
-  const server = createSdkMcpServer3({
+  const server = createSdkMcpServer4({
     name: "kody-capability",
     version: "0.1.0",
     tools
@@ -2583,6 +2811,7 @@ var FAIL_CONCLUSIONS, RUNNING_STATUSES, TRUST_FILE_PATH, THREAD_BODY_MAX, CHECK_
 var init_capabilityMcp = __esm({
   "src/capabilityMcp.ts"() {
     "use strict";
+    init_dashboardCmsMcp();
     init_issue();
     init_registry();
     init_stateRepo();
@@ -2607,11 +2836,7 @@ var init_capabilityMcp = __esm({
       "ensure_issue",
       "ensure_comment",
       "dispatch_workflow",
-      "cms_list_collections",
-      "cms_list_documents",
-      "cms_get_document",
-      "cms_create_document",
-      "cms_update_document"
+      ...DASHBOARD_CMS_MCP_TOOL_NAMES
     ];
   }
 });
@@ -2689,8 +2914,8 @@ __export(fetchRepoMcp_exports, {
   buildFetchRepoMcpServer: () => buildFetchRepoMcpServer,
   fetchRepoToolDefinition: () => fetchRepoToolDefinition
 });
-import { createSdkMcpServer as createSdkMcpServer4, tool as tool4 } from "@anthropic-ai/claude-agent-sdk";
-import { z as z3 } from "zod";
+import { createSdkMcpServer as createSdkMcpServer5, tool as tool5 } from "@anthropic-ai/claude-agent-sdk";
+import { z as z4 } from "zod";
 function fetchRepoToolDefinition(opts) {
   return {
     name: "fetch_repo",
@@ -2725,10 +2950,10 @@ Use Read/Grep/Glob/Bash at that absolute path to explore it. It now lives in you
 }
 function buildFetchRepoMcpServer(opts) {
   const def = fetchRepoToolDefinition(opts);
-  const fetchTool = tool4(def.name, def.description, def.inputSchema, async (args) => {
+  const fetchTool = tool5(def.name, def.description, def.inputSchema, async (args) => {
     return def.handler({ repo: String(args.repo ?? "") });
   });
-  return createSdkMcpServer4({
+  return createSdkMcpServer5({
     name: "kody-fetch-repo",
     version: "0.1.0",
     tools: [fetchTool]
@@ -2741,7 +2966,7 @@ var init_fetchRepoMcp = __esm({
     init_repoWorkspace();
     DESCRIPTION3 = 'Clone another GitHub repository into your workspace so you can read and work on it. Pass `repo` as "owner/name" (e.g. "A-Guy-educ/A-Guy"). Returns the absolute path of the clone \u2014 then use your Read/Grep/Glob/Bash tools at that path to inspect it. Already-fetched repos are reused instantly. Use this whenever the user asks about a repository other than your current one \u2014 you are NOT limited to a single repo.';
     INPUT_SCHEMA3 = {
-      repo: z3.string().describe('GitHub repository as "owner/name", e.g. "A-Guy-educ/A-Guy".')
+      repo: z4.string().describe('GitHub repository as "owner/name", e.g. "A-Guy-educ/A-Guy".')
     };
   }
 });
@@ -2825,7 +3050,7 @@ async function runAgent(opts) {
   const turnTimeoutMs = resolveTurnTimeoutMs(opts);
   let outcome = "failed";
   let outcomeKind = "generic_failed";
-  let errorMessage;
+  let errorMessage2;
   let tokens = { input: 0, output: 0, cacheRead: 0, cacheCreate: 0 };
   let messageCount = 0;
   let finalText = "";
@@ -2841,7 +3066,7 @@ async function runAgent(opts) {
     const resultTexts = [];
     outcome = "failed";
     outcomeKind = "generic_failed";
-    errorMessage = void 0;
+    errorMessage2 = void 0;
     tokens = { input: 0, output: 0, cacheRead: 0, cacheCreate: 0 };
     messageCount = 0;
     let sawMutatingTool = false;
@@ -2899,6 +3124,24 @@ async function runAgent(opts) {
         });
         mcpEntries.push(["kody-capability", dutyHandle.server]);
       }
+      if (opts.enableDashboardCmsTool) {
+        const { buildDashboardCmsMcpServer: buildDashboardCmsMcpServer2, DASHBOARD_CMS_MCP_TOOL_NAMES: DASHBOARD_CMS_MCP_TOOL_NAMES2 } = await Promise.resolve().then(() => (init_dashboardCmsMcp(), dashboardCmsMcp_exports));
+        if (!opts.cmsRepoSlug) {
+          throw new Error("enableDashboardCmsTool requires cmsRepoSlug (owner/name)");
+        }
+        const cmsHandle = buildDashboardCmsMcpServer2({
+          repoSlug: opts.cmsRepoSlug,
+          dashboardUrl: opts.cmsDashboardUrl,
+          token: opts.cmsToken,
+          storeRepoUrl: opts.cmsStoreRepoUrl,
+          storeRef: opts.cmsStoreRef
+        });
+        mcpEntries.push(["kody-cms", cmsHandle.server]);
+        for (const toolName of DASHBOARD_CMS_MCP_TOOL_NAMES2) {
+          ;
+          queryOptions.allowedTools.push(`mcp__kody-cms__${toolName}`);
+        }
+      }
       if (opts.enableFetchRepoTool && opts.reposRoot) {
         const { buildFetchRepoMcpServer: buildFetchRepoMcpServer2 } = await Promise.resolve().then(() => (init_fetchRepoMcp(), fetchRepoMcp_exports));
         const fetchServer = buildFetchRepoMcpServer2({
@@ -2979,7 +3222,7 @@ async function runAgent(opts) {
         if (timedOut) {
           outcome = "failed";
           outcomeKind = "stalled";
-          errorMessage = `agent stalled: no SDK message in ${Math.round(turnTimeoutMs / 1e3)}s`;
+          errorMessage2 = `agent stalled: no SDK message in ${Math.round(turnTimeoutMs / 1e3)}s`;
           if (typeof iterator.return === "function") {
             try {
               await iterator.return(void 0);
@@ -3083,17 +3326,17 @@ async function runAgent(opts) {
           } else {
             outcome = "failed";
             outcomeKind = classifySubtype(m.subtype);
-            errorMessage = `result subtype: ${m.subtype ?? "unknown"}`;
+            errorMessage2 = `result subtype: ${m.subtype ?? "unknown"}`;
           }
         }
       }
     } catch (e) {
       if (sawTerminalSuccess) {
-        errorMessage = e instanceof Error ? e.message : String(e);
+        errorMessage2 = e instanceof Error ? e.message : String(e);
       } else {
         outcome = "failed";
         outcomeKind = "model_error";
-        errorMessage = e instanceof Error ? e.message : String(e);
+        errorMessage2 = e instanceof Error ? e.message : String(e);
       }
     } finally {
       try {
@@ -3111,7 +3354,7 @@ async function runAgent(opts) {
     if (outcome === "completed" && sawLoginRequired) {
       outcome = "failed";
       outcomeKind = "model_error";
-      errorMessage = "Claude Code reported it is not logged in; refusing to mark agent run successful";
+      errorMessage2 = "Claude Code reported it is not logged in; refusing to mark agent run successful";
     }
     if (outcome === "completed" && !sawMutatingTool) {
       const backendDead = opts.isBackendHealthy ? !await opts.isBackendHealthy() : false;
@@ -3120,14 +3363,14 @@ async function runAgent(opts) {
         outcome = "failed";
         outcomeKind = "model_error";
         noWorkSuccess = true;
-        errorMessage = errorMessage ?? (backendDead ? "model backend unreachable after a reported success \u2014 proxy crashed mid-request (hollow success)" : "session reported success but produced no model output (0 output tokens) \u2014 backend likely unreachable");
+        errorMessage2 = errorMessage2 ?? (backendDead ? "model backend unreachable after a reported success \u2014 proxy crashed mid-request (hollow success)" : "session reported success but produced no model output (0 output tokens) \u2014 backend likely unreachable");
       }
     }
-    const shouldRetry = outcome === "failed" && attempt < MAX_CONNECTION_RETRIES && !sawMutatingTool && (isTransientConnectionError(errorMessage) || noWorkSuccess);
+    const shouldRetry = outcome === "failed" && attempt < MAX_CONNECTION_RETRIES && !sawMutatingTool && (isTransientConnectionError(errorMessage2) || noWorkSuccess);
     if (!shouldRetry) break;
     const delayMs = CONNECTION_RETRY_BASE_MS * 2 ** attempt;
     process.stderr.write(
-      `[kody agent] transient connection error (attempt ${attempt + 1}/${MAX_CONNECTION_RETRIES + 1}); retrying in ${Math.round(delayMs / 1e3)}s: ${errorMessage}
+      `[kody agent] transient connection error (attempt ${attempt + 1}/${MAX_CONNECTION_RETRIES + 1}); retrying in ${Math.round(delayMs / 1e3)}s: ${errorMessage2}
 `
     );
     if (opts.ensureBackend) {
@@ -3146,7 +3389,7 @@ async function runAgent(opts) {
     outcomeKind,
     finalText,
     ...submittedState ? { submittedState } : {},
-    error: errorMessage,
+    error: errorMessage2,
     ndjsonPath,
     durationMs: Date.now() - startedAt,
     tokens,
@@ -5771,7 +6014,7 @@ var init_litellm = __esm({
 
 // src/pushWithRetry.ts
 import { execFileSync as execFileSync6 } from "child_process";
-function sleepSync(ms) {
+function sleepSync2(ms) {
   if (ms <= 0) return;
   Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
 }
@@ -5832,7 +6075,7 @@ function pushWithRetry(opts = {}) {
       };
     }
     const delay = Math.min(baseBackoff * 2 ** (attempt - 1), MAX_BACKOFF_MS);
-    sleepSync(delay);
+    sleepSync2(delay);
   }
   return {
     ok: false,
@@ -6077,6 +6320,13 @@ function jobMetaFromData(data) {
     why: typeof data.jobWhy === "string" ? data.jobWhy : void 0
   };
 }
+function applyStandaloneTerminalState(state, ctx, profile) {
+  if (profile.lifecycleConfig?.finalize !== true || state.flow?.issueNumber) return;
+  const delivered = ctx.output.exitCode === 0 && !!state.core.prUrl;
+  state.core.phase = delivered ? "shipped" : "failed";
+  state.core.status = delivered ? "succeeded" : "failed";
+  state.core.currentExecutable = null;
+}
 function synthesizeAction(ctx) {
   const ok = ctx.output.exitCode === 0;
   return {
@@ -6107,6 +6357,7 @@ var init_saveTaskState = __esm({
       });
       if (ctx.output.prUrl) next.core.prUrl = ctx.output.prUrl;
       if (typeof ctx.data.runUrl === "string") next.core.runUrl = ctx.data.runUrl;
+      applyStandaloneTerminalState(next, ctx, profile);
       writeTaskState(target, number, next, ctx.cwd, ctx.config);
       ctx.data.taskState = next;
       ctx.data.taskStateRendered = renderStateComment(next);
@@ -11436,12 +11687,9 @@ var init_finalizeTerminal = __esm({
       const issueNumber = ctx.args.issue;
       const targetNumber = ctx.data.commentTargetNumber ?? issueNumber;
       if (!targetNumber) return;
-      let prUrl;
-      try {
-        prUrl = readTaskState(target, targetNumber, ctx.cwd, ctx.config).core.prUrl;
-      } catch {
-        prUrl = void 0;
-      }
+      const cachedState = ctx.data.taskState;
+      let state = cachedState;
+      const prUrl = cachedState?.core.prUrl ?? ctx.output.prUrl ?? ctx.data.prResult?.url;
       const delivered = ctx.output.exitCode === 0 && !!prUrl;
       const spec = delivered ? DONE : FAILED;
       const phase = delivered ? "shipped" : "failed";
@@ -11449,12 +11697,28 @@ var init_finalizeTerminal = __esm({
       if (issueNumber) setKodyLabel(issueNumber, spec, ctx.cwd);
       const prNumber = prUrl ? parsePrNumber(prUrl) : null;
       if (prNumber && prNumber !== issueNumber) setKodyLabel(prNumber, spec, ctx.cwd);
+      if (!state) {
+        try {
+          state = readTaskState(target, targetNumber, ctx.cwd, ctx.config);
+        } catch {
+          state = void 0;
+        }
+      }
+      if (!state) return;
+      const alreadyTerminal = state.core.phase === phase && state.core.status === status && state.core.currentExecutable === null;
+      if (alreadyTerminal) return;
+      const next = {
+        ...state,
+        core: {
+          ...state.core,
+          phase,
+          status,
+          currentExecutable: null
+        }
+      };
+      ctx.data.taskState = next;
       try {
-        const state = readTaskState(target, targetNumber, ctx.cwd, ctx.config);
-        state.core.phase = phase;
-        state.core.status = status;
-        state.core.currentExecutable = null;
-        writeTaskState(target, targetNumber, state, ctx.cwd, ctx.config);
+        writeTaskState(target, targetNumber, next, ctx.cwd, ctx.config);
       } catch (err) {
         process.stderr.write(
           `[kody finalizeTerminal] failed to write terminal state on ${target} #${targetNumber}: ${err instanceof Error ? err.message : String(err)}
@@ -13119,17 +13383,22 @@ var init_mirrorStateToPr = __esm({
       const issueNumber = ctx.data.commentTargetNumber;
       const issueTarget = ctx.data.commentTargetType;
       if (!issueNumber || issueTarget !== "issue") return;
-      const prUrl = ctx.output.prUrl ?? ctx.data.prResult?.url;
+      let state = ctx.data.taskState;
+      const prUrl = ctx.output.prUrl ?? ctx.data.prResult?.url ?? state?.core.prUrl;
       if (!prUrl) return;
       const prNumber = parsePrNumber4(prUrl);
       if (!prNumber) return;
-      let state;
-      try {
-        state = readTaskState("issue", issueNumber, ctx.cwd, ctx.config);
-      } catch {
-        return;
+      if (!state) {
+        try {
+          state = readTaskState("issue", issueNumber, ctx.cwd, ctx.config);
+        } catch {
+          return;
+        }
+      }
+      if (prUrl && !state.core.prUrl) {
+        state = { ...state, core: { ...state.core, prUrl } };
+        ctx.data.taskState = state;
       }
-      if (prUrl && !state.core.prUrl) state.core.prUrl = prUrl;
       try {
         writeTaskState("pr", prNumber, state, ctx.cwd, ctx.config);
       } catch (err) {
@@ -17093,24 +17362,24 @@ function firstRequiredFailure(results, tools) {
   }
   return null;
 }
-function verifyOne(tool5, cwd) {
-  const result = { name: tool5.name, present: false, verified: false };
-  const checkRes = runShell(tool5.install.checkCommand, cwd);
+function verifyOne(tool6, cwd) {
+  const result = { name: tool6.name, present: false, verified: false };
+  const checkRes = runShell(tool6.install.checkCommand, cwd);
   let present = checkRes.ok;
-  if (!present && tool5.install.installCommand) {
-    runShell(tool5.install.installCommand, cwd, 12e4);
-    present = runShell(tool5.install.checkCommand, cwd).ok;
+  if (!present && tool6.install.installCommand) {
+    runShell(tool6.install.installCommand, cwd, 12e4);
+    present = runShell(tool6.install.checkCommand, cwd).ok;
   }
   result.present = present;
   if (!present) {
-    result.error = `tool "${tool5.name}" not on PATH (check: ${tool5.install.checkCommand})`;
+    result.error = `tool "${tool6.name}" not on PATH (check: ${tool6.install.checkCommand})`;
     return result;
   }
-  const verifyRes = runShell(tool5.verify, cwd);
+  const verifyRes = runShell(tool6.verify, cwd);
   result.verified = verifyRes.ok;
   if (!verifyRes.ok) {
     const tail = formatStderrTail(verifyRes.stderr, verifyRes.stdout);
-    result.error = `tool "${tool5.name}" failed verify: ${tool5.verify}${tail ? ` \u2014 ${tail}` : ""}`;
+    result.error = `tool "${tool6.name}" failed verify: ${tool6.verify}${tail ? ` \u2014 ${tail}` : ""}`;
   }
   return result;
 }
@@ -18822,6 +19091,12 @@ var CROSS_REPO_PROMPT = [
   "instantly. When the user asks about a different repo \u2014 or to compare repos \u2014",
   "fetch it instead of saying you are scoped to a single repo."
 ].join("\n");
+var DASHBOARD_CMS_PROMPT = [
+  "# Dashboard CMS",
+  "Use Dashboard CMS tools for CMS content. The Dashboard is the source of truth.",
+  "Do not query Mongo directly for CMS content and do not infer CMS data from repository files.",
+  "Use cms_list_documents first when you need to find content, then pass the raw id or cmsDocumentId to cms_get_document."
+].join("\n");
 function buildExecutableCatalog() {
   let discovered;
   try {
@@ -18880,6 +19155,8 @@ async function runChatTurn(opts) {
   const memoryBlock = readMemoryIndexBlock(opts.cwd);
   const instructionsBlock = readInstructionsBlock(opts.cwd);
   const crossRepoBlock = opts.reposRoot ? CROSS_REPO_PROMPT : null;
+  const dashboardCmsEnabled = Boolean(opts.cmsDashboardUrl && opts.cmsRepoSlug && opts.cmsToken);
+  const dashboardCmsBlock = dashboardCmsEnabled ? DASHBOARD_CMS_PROMPT : null;
   const imageBlock = imagePaths.length > 0 ? [
     "# Attached images",
     "The user attached one or more images on this turn. They are saved as",
@@ -18894,6 +19171,7 @@ async function runChatTurn(opts) {
     memoryBlock,
     instructionsBlock,
     crossRepoBlock,
+    dashboardCmsBlock,
     imageBlock,
     catalog,
     artifactAddendum
@@ -18921,6 +19199,14 @@ async function runChatTurn(opts) {
       reposRoot: opts.reposRoot,
       repoToken: opts.repoToken
     } : {},
+    ...dashboardCmsEnabled ? {
+      enableDashboardCmsTool: true,
+      cmsDashboardUrl: opts.cmsDashboardUrl,
+      cmsRepoSlug: opts.cmsRepoSlug,
+      cmsToken: opts.cmsToken,
+      cmsStoreRepoUrl: opts.cmsStoreRepoUrl,
+      cmsStoreRef: opts.cmsStoreRef
+    } : {},
     onProgress: async (ev) => {
       progressSeq += 1;
       if (ev.kind === "thinking") {
@@ -19019,7 +19305,9 @@ function readMemoryIndexBlock(cwd) {
   }
   const trimmed = raw.trim();
   if (!trimmed) return "";
-  const body = trimmed.length > MAX_INDEX_BYTES ? trimmed.slice(0, MAX_INDEX_BYTES) + "\n\n_\u2026 (memory index truncated; use recall_search to read more)_" : trimmed;
+  const body = trimmed.length > MAX_INDEX_BYTES ? `${trimmed.slice(0, MAX_INDEX_BYTES)}
+
+_\u2026 (memory index truncated; use recall_search to read more)_` : trimmed;
   return [
     "# Project memory index (state repo `memory/INDEX.md`)",
     "",
@@ -20647,6 +20935,9 @@ async function handleChatTurn(req, res, chatId, opts) {
   }
   const repo = strField(body, "repo");
   const repoToken = strField(body, "repoToken");
+  const dashboardUrl = strField(body, "dashboardUrl");
+  const storeRepoUrl = strField(body, "storeRepoUrl");
+  const storeRef = strField(body, "storeRef");
   let agentCwd;
   try {
     agentCwd = await ensureRepoCwd({
@@ -20723,7 +21014,14 @@ async function handleChatTurn(req, res, chatId, opts) {
         sink,
         // Let the agent clone + work on OTHER repos via the fetch_repo tool.
         reposRoot: opts.reposRoot,
-        repoToken
+        repoToken,
+        ...dashboardUrl && repo && stateToken ? {
+          cmsDashboardUrl: dashboardUrl,
+          cmsRepoSlug: repo,
+          cmsToken: stateToken,
+          cmsStoreRepoUrl: storeRepoUrl,
+          cmsStoreRef: storeRef
+        } : {}
       });
     } catch (err) {
       const errMsg3 = err instanceof Error ? err.message : String(err);
@@ -20980,7 +21278,10 @@ async function proxyToBrainServe(args) {
     body: JSON.stringify({
       message: args.body.message,
       ...args.body.repo ? { repo: args.body.repo } : {},
-      ...args.body.repoToken ? { repoToken: args.body.repoToken } : {}
+      ...args.body.repoToken ? { repoToken: args.body.repoToken } : {},
+      ...args.body.dashboardUrl ? { dashboardUrl: args.body.dashboardUrl } : {},
+      ...args.body.storeRepoUrl ? { storeRepoUrl: args.body.storeRepoUrl } : {},
+      ...args.body.storeRef ? { storeRef: args.body.storeRef } : {}
     })
   });
   if (!upstream.ok || !upstream.body) {
@@ -21195,15 +21496,15 @@ function buildMcpHttpServer(opts) {
     transports.set(route.path, transport);
     routes.set(route.path, route.name);
     const mcpServer = new McpServer({ name: route.name, version: route.version });
-    for (const tool5 of route.tools) {
+    for (const tool6 of route.tools) {
       mcpServer.registerTool(
-        tool5.name,
+        tool6.name,
         {
-          description: tool5.description,
-          inputSchema: tool5.inputSchema
+          description: tool6.description,
+          inputSchema: tool6.inputSchema
         },
         async (args) => {
-          const result = await tool5.handler(args);
+          const result = await tool6.handler(args);
           return {
             content: result.content,
             ...result.isError ? { isError: true } : {}
@@ -22509,7 +22810,7 @@ var PERF_GUEST = {
   medium: { cpu_kind: "performance", cpus: 1, memory_mb: 2048 },
   high: { cpu_kind: "performance", cpus: 2, memory_mb: 4096 }
 };
-function envInt(name, dflt) {
+function envInt2(name, dflt) {
   const v = Number(process.env[name]);
   return Number.isFinite(v) && v > 0 ? v : dflt;
 }
@@ -22629,10 +22930,10 @@ async function poolServe() {
   const region = process.env.POOL_REGION ?? "fra";
   const perf = process.env.POOL_PERF ?? "medium";
   const guest = PERF_GUEST[perf] ?? PERF_GUEST.medium;
-  const min = envInt("POOL_MIN", 2);
-  const runnerPort = envInt("RUNNER_PORT", 8080);
-  const apiPort = envInt("POOL_API_PORT", 4100);
-  const healthTimeoutMs = envInt("POOL_HEALTH_TIMEOUT_MS", 12e4);
+  const min = envInt2("POOL_MIN", 2);
+  const runnerPort = envInt2("RUNNER_PORT", 8080);
+  const apiPort = envInt2("POOL_API_PORT", 4100);
+  const healthTimeoutMs = envInt2("POOL_HEALTH_TIMEOUT_MS", 12e4);
   const registry = new PoolRegistry({
     githubToken,
     masterKey: master,
@@ -22648,12 +22949,12 @@ async function poolServe() {
     },
     log
   });
-  const refillMs = envInt("POOL_REFILL_INTERVAL_MS", 6e4);
+  const refillMs = envInt2("POOL_REFILL_INTERVAL_MS", 6e4);
   const tick = setInterval(() => {
     registry.resyncAll().catch((err) => log(`resync tick failed: ${err instanceof Error ? err.message : String(err)}`));
   }, refillMs);
   const dutyTickEnabled = (process.env.POOL_CAPABILITY_TICK ?? "1") !== "0";
-  const dutyTickMs = envInt("POOL_CAPABILITY_TICK_MS", 15 * 6e4);
+  const dutyTickMs = envInt2("POOL_CAPABILITY_TICK_MS", 15 * 6e4);
   const dutyTick = dutyTickEnabled ? setInterval(() => {
     runCapabilityFallbackTick({
       isDegraded: () => gitHubActionsDegraded(),