@kody-ade/kody-engine 0.4.277 → 0.4.279

package/dist/bin/kody.js

@@ -15,7 +15,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "@kody-ade/kody-engine",
-      version: "0.4.277",
+      version: "0.4.279",
       description: "kody \u2014 autonomous development engine. Single-session Claude Code agent behind a generic executor + declarative executable profiles.",
       license: "MIT",
       type: "module",
@@ -147,23 +147,106 @@ var init_claudeBinary = __esm({
 // src/issue.ts
 import { execFileSync } from "child_process";
 function ghToken(preferRepoToken = false) {
-  const githubToken = process.env.GITHUB_TOKEN?.trim();
+  const githubToken2 = process.env.GITHUB_TOKEN?.trim();
   const kodyToken = process.env.KODY_TOKEN?.trim();
   const ghToken3 = process.env.GH_TOKEN?.trim();
   const ghPat = process.env.GH_PAT?.trim();
-  return preferRepoToken ? githubToken || kodyToken || ghToken3 || ghPat : ghPat || ghToken3 || kodyToken || githubToken;
+  return preferRepoToken ? githubToken2 || kodyToken || ghToken3 || ghPat : ghPat || ghToken3 || kodyToken || githubToken2;
 }
 function gh(args, options) {
   const token = ghToken(options?.preferRepoToken);
   const env = token ? { ...process.env, GH_TOKEN: token } : { ...process.env };
-  return execFileSync("gh", args, {
-    encoding: "utf-8",
-    timeout: API_TIMEOUT_MS,
-    cwd: options?.cwd,
-    env,
-    input: options?.input,
-    stdio: options?.input ? ["pipe", "pipe", "pipe"] : ["inherit", "pipe", "pipe"]
-  }).trim();
+  const maxRetries = envInt("KODY_GH_RATE_LIMIT_MAX_RETRIES", DEFAULT_RATE_LIMIT_RETRIES);
+  const maxWaitMs = envInt("KODY_GH_RATE_LIMIT_MAX_WAIT_MS", DEFAULT_RATE_LIMIT_MAX_WAIT_MS);
+  for (let attempt = 0; ; attempt += 1) {
+    try {
+      return execFileSync("gh", args, {
+        encoding: "utf-8",
+        timeout: API_TIMEOUT_MS,
+        cwd: options?.cwd,
+        env,
+        input: options?.input,
+        stdio: options?.input ? ["pipe", "pipe", "pipe"] : ["inherit", "pipe", "pipe"]
+      }).trim();
+    } catch (err) {
+      if (!isRateLimitError(err) || attempt >= maxRetries) throw err;
+      const waitMs = rateLimitWaitMs(token, options?.cwd, attempt + 1);
+      if (waitMs > maxWaitMs) {
+        process.stderr.write(
+          `[kody gh] rate limit on ${formatGhArgs(args)}; reset wait ${formatDuration(waitMs)} exceeds max ${formatDuration(maxWaitMs)}
+`
+        );
+        throw err;
+      }
+      process.stderr.write(
+        `[kody gh] rate limit on ${formatGhArgs(args)}; retry ${attempt + 1}/${maxRetries} after ${formatDuration(waitMs)}
+`
+      );
+      sleepSync(waitMs);
+    }
+  }
+}
+function envInt(name, fallback) {
+  const raw = process.env[name]?.trim();
+  if (!raw) return fallback;
+  const value = Number(raw);
+  return Number.isFinite(value) && value >= 0 ? Math.floor(value) : fallback;
+}
+function errorMessage(err) {
+  if (err instanceof Error) {
+    const stderr = err.stderr;
+    if (Buffer.isBuffer(stderr)) return `${err.message}
+${stderr.toString("utf-8")}`;
+    if (typeof stderr === "string") return `${err.message}
+${stderr}`;
+    return err.message;
+  }
+  return String(err);
+}
+function isRateLimitError(err) {
+  const msg = errorMessage(err);
+  return /rate limit exceeded|secondary rate limit|abuse detection/i.test(msg) && /HTTP 403|rate limit/i.test(msg);
+}
+function rateLimitWaitMs(token, cwd, retryNumber) {
+  const resetMs = readCoreRateLimitResetMs(token, cwd);
+  if (typeof resetMs === "number") {
+    return Math.max(0, resetMs - Date.now() + 1e3);
+  }
+  const base = envInt("KODY_GH_RATE_LIMIT_BASE_DELAY_MS", DEFAULT_RATE_LIMIT_BASE_DELAY_MS);
+  return base * 2 ** Math.max(0, retryNumber - 1);
+}
+function readCoreRateLimitResetMs(token, cwd) {
+  try {
+    const env = token ? { ...process.env, GH_TOKEN: token } : { ...process.env };
+    const raw = execFileSync("gh", ["api", "rate_limit", "--jq", ".resources.core.reset"], {
+      encoding: "utf-8",
+      timeout: API_TIMEOUT_MS,
+      cwd,
+      env,
+      stdio: ["ignore", "pipe", "pipe"]
+    }).trim();
+    const seconds = Number(raw);
+    return Number.isFinite(seconds) && seconds > 0 ? seconds * 1e3 : null;
+  } catch {
+    return null;
+  }
+}
+function sleepSync(ms) {
+  if (ms <= 0) return;
+  const buffer = new SharedArrayBuffer(4);
+  const view = new Int32Array(buffer);
+  Atomics.wait(view, 0, 0, ms);
+}
+function formatGhArgs(args) {
+  return `gh ${args.slice(0, 4).join(" ")}${args.length > 4 ? " ..." : ""}`;
+}
+function formatDuration(ms) {
+  if (ms < 1e3) return `${ms}ms`;
+  const seconds = Math.ceil(ms / 1e3);
+  if (seconds < 60) return `${seconds}s`;
+  const minutes = Math.floor(seconds / 60);
+  const rest = seconds % 60;
+  return rest ? `${minutes}m${rest}s` : `${minutes}m`;
 }
 function getIssue(issueNumber, cwd) {
   const output = gh(["issue", "view", String(issueNumber), "--json", "number,title,body,comments,labels,url"], {
@@ -333,11 +416,14 @@ function postPrReviewComment(prNumber, body, cwd) {
     );
   }
 }
-var API_TIMEOUT_MS, BotDispatchCommentError, DEFAULT_COMMENT_LIMIT, DEFAULT_COMMENT_MAX_BYTES, VERDICT_HEADING;
+var API_TIMEOUT_MS, DEFAULT_RATE_LIMIT_RETRIES, DEFAULT_RATE_LIMIT_BASE_DELAY_MS, DEFAULT_RATE_LIMIT_MAX_WAIT_MS, BotDispatchCommentError, DEFAULT_COMMENT_LIMIT, DEFAULT_COMMENT_MAX_BYTES, VERDICT_HEADING;
 var init_issue = __esm({
   "src/issue.ts"() {
     "use strict";
     API_TIMEOUT_MS = 3e4;
+    DEFAULT_RATE_LIMIT_RETRIES = 2;
+    DEFAULT_RATE_LIMIT_BASE_DELAY_MS = 1e3;
+    DEFAULT_RATE_LIMIT_MAX_WAIT_MS = 65 * 60 * 1e3;
     BotDispatchCommentError = class extends Error {
       constructor(slug2) {
         super(
@@ -446,8 +532,11 @@ function branchApiPath(config, targetPath) {
 }
 function ensureStateBranch(config, cwd) {
   const parsed = parseStateRepo(config);
+  const cacheKey3 = `${parsed.owner}/${parsed.repo}:${STATE_BRANCH}`;
+  if (ensuredStateBranches.has(cacheKey3)) return;
   try {
     gh(["api", `/repos/${parsed.owner}/${parsed.repo}/git/ref/heads/${STATE_BRANCH}`], { cwd });
+    ensuredStateBranches.add(cacheKey3);
     return;
   } catch (err) {
     if (!is404(err)) throw err;
@@ -466,6 +555,7 @@ function ensureStateBranch(config, cwd) {
   } catch (err) {
     if (!isAlreadyExists(err)) throw err;
   }
+  ensuredStateBranches.add(cacheKey3);
 }
 function readStateText(config, cwd, filePath) {
   const targetPath = stateRepoPath(config, filePath);
@@ -539,11 +629,13 @@ function listStateDirectory(config, cwd, dirPath) {
   const parsed = JSON.parse(raw);
   return Array.isArray(parsed) ? parsed : [];
 }
+var ensuredStateBranches;
 var init_stateRepo = __esm({
   "src/stateRepo.ts"() {
     "use strict";
     init_issue();
     init_stateBranch();
+    ensuredStateBranches = /* @__PURE__ */ new Set();
   }
 });
 
@@ -1116,7 +1208,7 @@ var init_events = __esm({
 // src/verify.ts
 import { spawn } from "child_process";
 function runCommand(command, cwd) {
-  return new Promise((resolve8) => {
+  return new Promise((resolve9) => {
     const start = Date.now();
     const child = spawn(command, {
       cwd,
@@ -1145,11 +1237,11 @@ function runCommand(command, cwd) {
     child.on("exit", (code) => {
       clearTimeout(timer);
       const tail = Buffer.concat(buffers).toString("utf-8").slice(-TAIL_CHARS);
-      resolve8({ exitCode: code ?? -1, durationMs: Date.now() - start, tail });
+      resolve9({ exitCode: code ?? -1, durationMs: Date.now() - start, tail });
     });
     child.on("error", (err) => {
       clearTimeout(timer);
-      resolve8({ exitCode: -1, durationMs: Date.now() - start, tail: err.message });
+      resolve9({ exitCode: -1, durationMs: Date.now() - start, tail: err.message });
     });
   });
 }
@@ -1413,6 +1505,300 @@ var init_submitMcp = __esm({
   }
 });
 
+// src/dashboardCmsMcp.ts
+var dashboardCmsMcp_exports = {};
+__export(dashboardCmsMcp_exports, {
+  DASHBOARD_CMS_MCP_TOOL_NAMES: () => DASHBOARD_CMS_MCP_TOOL_NAMES,
+  buildDashboardCmsMcpServer: () => buildDashboardCmsMcpServer,
+  dashboardCmsToolDefinitions: () => dashboardCmsToolDefinitions
+});
+import { createSdkMcpServer as createSdkMcpServer3, tool as tool3 } from "@anthropic-ai/claude-agent-sdk";
+import { z as z2 } from "zod";
+function dashboardBaseUrl(opts) {
+  const raw = opts.dashboardUrl?.trim() || process.env.KODY_CMS_DASHBOARD_URL?.trim() || process.env.KODY_DASHBOARD_URL?.trim() || process.env.DASHBOARD_URL?.trim() || "";
+  if (!raw) return null;
+  try {
+    return new URL(raw).origin;
+  } catch {
+    return null;
+  }
+}
+function dashboardCmsToken(opts) {
+  return opts.token?.trim() || process.env.KODY_CMS_TOKEN?.trim() || process.env.KODY_DASHBOARD_TOKEN?.trim() || process.env.KODY_TOKEN?.trim() || process.env.GH_TOKEN?.trim() || process.env.GITHUB_TOKEN?.trim() || process.env.GH_PAT?.trim() || null;
+}
+function cmsHeaders(opts) {
+  const token = dashboardCmsToken(opts);
+  const [owner, repo] = opts.repoSlug.split("/");
+  if (!token) {
+    return {
+      ok: false,
+      error: "missing_cms_token",
+      message: "Set KODY_CMS_TOKEN, KODY_DASHBOARD_TOKEN, KODY_TOKEN, GH_TOKEN, GITHUB_TOKEN, or GH_PAT."
+    };
+  }
+  if (!owner || !repo) {
+    return { ok: false, error: "invalid_repo", message: `Invalid repo slug: ${opts.repoSlug}` };
+  }
+  return {
+    ok: true,
+    headers: {
+      "Content-Type": "application/json",
+      "x-kody-token": token,
+      "x-kody-owner": owner,
+      "x-kody-repo": repo,
+      ...opts.storeRepoUrl?.trim() ? { "x-kody-store-repo-url": opts.storeRepoUrl.trim() } : {},
+      ...opts.storeRef?.trim() ? { "x-kody-store-ref": opts.storeRef.trim() } : {}
+    }
+  };
+}
+async function callDashboardCms(opts, path50, init = {}) {
+  const baseUrl = dashboardBaseUrl(opts);
+  if (!baseUrl) {
+    return {
+      ok: false,
+      error: "missing_dashboard_url",
+      message: "Set KODY_CMS_DASHBOARD_URL or KODY_DASHBOARD_URL to the Dashboard origin."
+    };
+  }
+  const headerResult = cmsHeaders(opts);
+  if (!headerResult.ok) return headerResult;
+  try {
+    const res = await fetch(`${baseUrl}${path50}`, {
+      ...init,
+      headers: {
+        ...headerResult.headers,
+        ...init.headers
+      }
+    });
+    const contentType = res.headers.get("content-type") ?? "";
+    const data = contentType.includes("application/json") ? await res.json().catch(() => null) : await res.text().catch(() => "");
+    if (!res.ok) {
+      return {
+        ok: false,
+        status: res.status,
+        error: stringFieldFromRecord(data, "error") ?? "cms_request_failed",
+        message: stringFieldFromRecord(data, "message") ?? `Dashboard CMS request failed with ${res.status}.`,
+        data
+      };
+    }
+    return { ok: true, status: res.status, data };
+  } catch (err) {
+    return {
+      ok: false,
+      error: "cms_request_error",
+      message: err instanceof Error ? err.message : String(err)
+    };
+  }
+}
+function cmsToolResponse(result) {
+  return {
+    content: [{ type: "text", text: JSON.stringify(result, null, 2) }],
+    ...result.ok ? {} : { isError: true }
+  };
+}
+function cmsQuery(args) {
+  const params = new URLSearchParams();
+  const q = stringArg(args.q);
+  if (q) params.set("q", q);
+  const limit = numberArg(args.limit);
+  if (limit !== void 0) params.set("limit", String(limit));
+  const offset = numberArg(args.offset);
+  if (offset !== void 0) params.set("offset", String(offset));
+  if (args.filters && typeof args.filters === "object" && !Array.isArray(args.filters)) {
+    params.set("filters", JSON.stringify(args.filters));
+  }
+  if (Array.isArray(args.sort)) {
+    const sort = args.sort.flatMap((entry) => {
+      if (!entry || typeof entry !== "object") return [];
+      const field = stringArg(entry.field);
+      if (!field) return [];
+      const direction = entry.direction === "asc" ? "asc" : "desc";
+      return [`${field}:${direction}`];
+    }).join(",");
+    if (sort) params.set("sort", sort);
+  }
+  const value = params.toString();
+  return value ? `?${value}` : "";
+}
+function stringArg(value) {
+  return typeof value === "string" ? value.trim() : "";
+}
+function numberArg(value) {
+  if (value === void 0 || value === null || value === "") return void 0;
+  const n = Number(value);
+  return Number.isFinite(n) ? n : void 0;
+}
+function documentArg(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return {};
+  return value;
+}
+function normalizeCmsDocumentIdInput(input) {
+  const trimmed = stripWrappingQuotes(input.trim());
+  const withoutQuery = trimmed.split(/[?#]/, 1)[0] ?? trimmed;
+  const path50 = parseDocumentPath(withoutQuery);
+  return path50 ?? parseDocumentIdSegment(withoutQuery) ?? withoutQuery;
+}
+function stripWrappingQuotes(value) {
+  let current = value;
+  for (; ; ) {
+    const next = current.replace(/^[`'"]+|[`'"]+$/g, "").trim();
+    if (next === current) return current;
+    current = next;
+  }
+}
+function parseDocumentPath(value) {
+  const path50 = value.startsWith("http://") || value.startsWith("https://") ? urlPathname(value) : value;
+  if (!path50?.includes("/content/entries/")) return null;
+  const parts = path50.split("/").filter(Boolean).map(decodePathPart);
+  const entriesIndex = parts.findIndex((part, index) => part === "content" && parts[index + 1] === "entries");
+  const idPart = parts[entriesIndex + 3];
+  if (!idPart || idPart === "new") return null;
+  return idPart === "edit" ? parts[entriesIndex + 2] ?? null : idPart;
+}
+function parseDocumentIdSegment(value) {
+  const parts = value.split("/").filter(Boolean).map(decodePathPart);
+  if (parts.length < 2) return null;
+  const lastPart = parts[parts.length - 1];
+  if (!lastPart || lastPart === "new") return null;
+  return lastPart === "edit" ? parts[parts.length - 2] ?? null : lastPart;
+}
+function urlPathname(value) {
+  try {
+    return new URL(value).pathname;
+  } catch {
+    return null;
+  }
+}
+function decodePathPart(value) {
+  try {
+    return decodeURIComponent(value);
+  } catch {
+    return value;
+  }
+}
+function stringFieldFromRecord(value, field) {
+  return value && typeof value === "object" && !Array.isArray(value) && typeof value[field] === "string" ? String(value[field]) : void 0;
+}
+function dashboardCmsToolDefinitions(opts) {
+  const cmsListCollectionsTool = {
+    name: "cms_list_collections",
+    description: "List configured Dashboard CMS collections and their supported operations. Read-only.",
+    inputSchema: {},
+    handler: async () => cmsToolResponse(await callDashboardCms(opts, "/api/kody/cms"))
+  };
+  const cmsListDocumentsTool = {
+    name: "cms_list_documents",
+    description: "List or search Dashboard CMS documents from one configured collection. Read-only.",
+    inputSchema: {
+      collection: z2.string().min(1).describe("CMS collection name."),
+      q: z2.string().optional().describe("Optional search query."),
+      filters: z2.record(z2.string(), z2.unknown()).optional().describe("Optional filter object keyed by field."),
+      sort: z2.array(
+        z2.object({
+          field: z2.string().min(1),
+          direction: z2.enum(["asc", "desc"]).default("desc")
+        })
+      ).optional(),
+      limit: z2.number().int().min(1).max(100).optional(),
+      offset: z2.number().int().min(0).optional()
+    },
+    handler: async (args) => {
+      const collection = encodeURIComponent(stringArg(args.collection));
+      return cmsToolResponse(await callDashboardCms(opts, `/api/kody/cms/${collection}${cmsQuery(args)}`));
+    }
+  };
+  const cmsGetDocumentTool = {
+    name: "cms_get_document",
+    description: "Get one Dashboard CMS document by collection and id. Use a raw id or the content entry URL copied from the Dashboard.",
+    inputSchema: {
+      collection: z2.string().min(1).describe("CMS collection name."),
+      id: z2.string().min(1).describe("Document id. Use cmsDocumentId from cms_list_documents when available.")
+    },
+    handler: async (args) => {
+      const collection = encodeURIComponent(stringArg(args.collection));
+      const id = encodeURIComponent(normalizeCmsDocumentIdInput(stringArg(args.id)));
+      return cmsToolResponse(await callDashboardCms(opts, `/api/kody/cms/${collection}/${id}`));
+    }
+  };
+  const cmsCreateDocumentTool = {
+    name: "cms_create_document",
+    description: "Create one Dashboard CMS document when the caller allows writes and the CMS collection allows create.",
+    inputSchema: {
+      collection: z2.string().min(1).describe("CMS collection name."),
+      data: z2.record(z2.string(), z2.unknown()).describe("Document fields to create.")
+    },
+    handler: async (args) => {
+      const refusal = opts.assertWriteAllowed?.();
+      if (refusal) return { content: [{ type: "text", text: refusal }] };
+      const collection = encodeURIComponent(stringArg(args.collection));
+      return cmsToolResponse(
+        await callDashboardCms(opts, `/api/kody/cms/${collection}`, {
+          method: "POST",
+          body: JSON.stringify(documentArg(args.data))
+        })
+      );
+    }
+  };
+  const cmsUpdateDocumentTool = {
+    name: "cms_update_document",
+    description: "Update one Dashboard CMS document when the caller allows writes and the CMS collection allows update.",
+    inputSchema: {
+      collection: z2.string().min(1).describe("CMS collection name."),
+      id: z2.string().min(1).describe("Document id."),
+      data: z2.record(z2.string(), z2.unknown()).describe("Partial document fields to update.")
+    },
+    handler: async (args) => {
+      const refusal = opts.assertWriteAllowed?.();
+      if (refusal) return { content: [{ type: "text", text: refusal }] };
+      const collection = encodeURIComponent(stringArg(args.collection));
+      const id = encodeURIComponent(normalizeCmsDocumentIdInput(stringArg(args.id)));
+      return cmsToolResponse(
+        await callDashboardCms(opts, `/api/kody/cms/${collection}/${id}`, {
+          method: "PATCH",
+          body: JSON.stringify(documentArg(args.data))
+        })
+      );
+    }
+  };
+  return [
+    cmsListCollectionsTool,
+    cmsListDocumentsTool,
+    cmsGetDocumentTool,
+    cmsCreateDocumentTool,
+    cmsUpdateDocumentTool
+  ];
+}
+function buildDashboardCmsMcpServer(opts) {
+  const tools = dashboardCmsToolDefinitions(opts).map(
+    (def) => tool3(
+      def.name,
+      def.description,
+      def.inputSchema,
+      async (args) => def.handler(args)
+    )
+  );
+  return {
+    server: createSdkMcpServer3({
+      name: "kody-cms",
+      version: "0.1.0",
+      tools
+    })
+  };
+}
+var DASHBOARD_CMS_MCP_TOOL_NAMES;
+var init_dashboardCmsMcp = __esm({
+  "src/dashboardCmsMcp.ts"() {
+    "use strict";
+    DASHBOARD_CMS_MCP_TOOL_NAMES = [
+      "cms_list_collections",
+      "cms_list_documents",
+      "cms_get_document",
+      "cms_create_document",
+      "cms_update_document"
+    ];
+  }
+});
+
 // src/capabilityFolders.ts
 import * as fs4 from "fs";
 import * as path6 from "path";
@@ -1983,8 +2369,8 @@ __export(capabilityMcp_exports, {
   readCheckRuns: () => readCheckRuns,
   readThread: () => readThread
 });
-import { createSdkMcpServer as createSdkMcpServer3, tool as tool3 } from "@anthropic-ai/claude-agent-sdk";
-import { z as z2 } from "zod";
+import { createSdkMcpServer as createSdkMcpServer4, tool as tool4 } from "@anthropic-ai/claude-agent-sdk";
+import { z as z3 } from "zod";
 function summarizeCiStatus(rollup) {
   if (!Array.isArray(rollup) || rollup.length === 0) return "UNKNOWN";
   let hasRunning = false;
@@ -2168,141 +2554,60 @@ ${marker}` });
   } catch (err) {
     return { error: err instanceof Error ? err.message : String(err) };
   }
-}
-function dispatchWorkflow(workflowFile, capability, issueNumber, repoSlug) {
-  const expected = expectedDispatchTarget(capability);
-  if (repoSlug && expected) {
-    const target = readDispatchTargetKind(repoSlug, issueNumber);
-    if (!target.ok) return target;
-    if (expected === "issue" && target.kind === "pr") {
-      return {
-        ok: false,
-        error: `refusing to dispatch ${capability} on PR #${issueNumber}; dispatch the source issue or use a PR action`
-      };
-    }
-    if (expected === "pr" && target.kind === "issue") {
-      return {
-        ok: false,
-        error: `refusing to dispatch ${capability} on issue #${issueNumber}; expected a PR target`
-      };
-    }
-  }
-  try {
-    gh(["workflow", "run", workflowFile, "-f", `capability=${capability}`, "-f", `issue_number=${issueNumber}`]);
-    return { ok: true };
-  } catch (err) {
-    return { ok: false, error: err instanceof Error ? err.message : String(err) };
-  }
-}
-function expectedDispatchTarget(capability) {
-  const route = resolveCapabilityAction(capability);
-  if (!route) return null;
-  const inputs = getProfileInputs(route.executable);
-  const numeric = inputs?.find((input) => input.type === "int" && input.required);
-  if (numeric?.name === "issue") return "issue";
-  if (numeric?.name === "pr") return "pr";
-  return null;
-}
-function readDispatchTargetKind(repoSlug, issueNumber) {
-  try {
-    const raw = gh(["api", `repos/${repoSlug}/issues/${issueNumber}`]);
-    const parsed = JSON.parse(raw);
-    return { ok: true, kind: parsed.pull_request ? "pr" : "issue" };
-  } catch (err) {
-    return {
-      ok: false,
-      error: `could not verify target #${issueNumber}: ${err instanceof Error ? err.message : String(err)}`
-    };
-  }
-}
-function isDispatchGated(capability, mode) {
-  if (mode === "auto") return false;
-  if (capability && GATE_EXEMPT_DUTIES.has(capability)) return false;
-  return true;
-}
-function trustRefusal(capabilitySlug) {
-  return `Not dispatched: capability \`${capabilitySlug ?? "?"}\` is in ASK mode (not trusted for autonomy). Do NOT retry the dispatch. Instead notify the operator (use recommend_to_operator, or rely on the tracking issue that already @-mentions them), then submit_state. To let this capability act on its own, grant it Auto on the dashboard Trust page.`;
-}
-function dashboardBaseUrl() {
-  const raw = process.env.KODY_CMS_DASHBOARD_URL?.trim() || process.env.KODY_DASHBOARD_URL?.trim() || process.env.DASHBOARD_URL?.trim() || "";
-  if (!raw) return null;
-  try {
-    const parsed = new URL(raw);
-    return parsed.origin;
-  } catch {
-    return null;
-  }
-}
-function dashboardCmsToken() {
-  return process.env.KODY_CMS_TOKEN?.trim() || process.env.KODY_DASHBOARD_TOKEN?.trim() || process.env.KODY_TOKEN?.trim() || process.env.GH_TOKEN?.trim() || process.env.GITHUB_TOKEN?.trim() || process.env.GH_PAT?.trim() || null;
-}
-function cmsHeaders(opts) {
-  const token = dashboardCmsToken();
-  const [owner, repo] = opts.repoSlug.split("/");
-  if (!token) {
-    return {
-      ok: false,
-      error: "missing_cms_token",
-      message: "Set KODY_CMS_TOKEN, KODY_DASHBOARD_TOKEN, KODY_TOKEN, GH_TOKEN, GITHUB_TOKEN, or GH_PAT."
-    };
-  }
-  if (!owner || !repo) {
-    return { ok: false, error: "invalid_repo", message: `Invalid repo slug: ${opts.repoSlug}` };
-  }
-  return {
-    ok: true,
-    headers: {
-      "Content-Type": "application/json",
-      "x-kody-token": token,
-      "x-kody-owner": owner,
-      "x-kody-repo": repo
-    }
-  };
-}
-async function callDashboardCms(opts, path50, init = {}) {
-  const baseUrl = dashboardBaseUrl();
-  if (!baseUrl) {
-    return {
-      ok: false,
-      error: "missing_dashboard_url",
-      message: "Set KODY_CMS_DASHBOARD_URL or KODY_DASHBOARD_URL to the Dashboard origin."
-    };
-  }
-  const headerResult = cmsHeaders(opts);
-  if (!headerResult.ok) return headerResult;
-  try {
-    const res = await fetch(`${baseUrl}${path50}`, {
-      ...init,
-      headers: {
-        ...headerResult.headers,
-        ...init.headers
-      }
-    });
-    const contentType = res.headers.get("content-type") ?? "";
-    const data = contentType.includes("application/json") ? await res.json().catch(() => null) : await res.text().catch(() => "");
-    if (!res.ok) {
+}
+function dispatchWorkflow(workflowFile, capability, issueNumber, repoSlug) {
+  const expected = expectedDispatchTarget(capability);
+  if (repoSlug && expected) {
+    const target = readDispatchTargetKind(repoSlug, issueNumber);
+    if (!target.ok) return target;
+    if (expected === "issue" && target.kind === "pr") {
       return {
         ok: false,
-        status: res.status,
-        error: stringFieldFromRecord(data, "error") ?? "cms_request_failed",
-        message: stringFieldFromRecord(data, "message") ?? `Dashboard CMS request failed with ${res.status}.`,
-        data
+        error: `refusing to dispatch ${capability} on PR #${issueNumber}; dispatch the source issue or use a PR action`
       };
     }
-    return { ok: true, status: res.status, data };
+    if (expected === "pr" && target.kind === "issue") {
+      return {
+        ok: false,
+        error: `refusing to dispatch ${capability} on issue #${issueNumber}; expected a PR target`
+      };
+    }
+  }
+  try {
+    gh(["workflow", "run", workflowFile, "-f", `capability=${capability}`, "-f", `issue_number=${issueNumber}`]);
+    return { ok: true };
+  } catch (err) {
+    return { ok: false, error: err instanceof Error ? err.message : String(err) };
+  }
+}
+function expectedDispatchTarget(capability) {
+  const route = resolveCapabilityAction(capability);
+  if (!route) return null;
+  const inputs = getProfileInputs(route.executable);
+  const numeric = inputs?.find((input) => input.type === "int" && input.required);
+  if (numeric?.name === "issue") return "issue";
+  if (numeric?.name === "pr") return "pr";
+  return null;
+}
+function readDispatchTargetKind(repoSlug, issueNumber) {
+  try {
+    const raw = gh(["api", `repos/${repoSlug}/issues/${issueNumber}`]);
+    const parsed = JSON.parse(raw);
+    return { ok: true, kind: parsed.pull_request ? "pr" : "issue" };
   } catch (err) {
     return {
       ok: false,
-      error: "cms_request_error",
-      message: err instanceof Error ? err.message : String(err)
+      error: `could not verify target #${issueNumber}: ${err instanceof Error ? err.message : String(err)}`
     };
   }
 }
-function cmsToolResponse(result) {
-  return {
-    content: [{ type: "text", text: JSON.stringify(result, null, 2) }],
-    ...result.ok ? {} : { isError: true }
-  };
+function isDispatchGated(capability, mode) {
+  if (mode === "auto") return false;
+  if (capability && GATE_EXEMPT_DUTIES.has(capability)) return false;
+  return true;
+}
+function trustRefusal(capabilitySlug) {
+  return `Not dispatched: capability \`${capabilitySlug ?? "?"}\` is in ASK mode (not trusted for autonomy). Do NOT retry the dispatch. Instead notify the operator (use recommend_to_operator, or rely on the tracking issue that already @-mentions them), then submit_state. To let this capability act on its own, grant it Auto on the dashboard Trust page.`;
 }
 function assertCmsWriteAllowed(opts) {
   if (isDispatchGated(opts.capabilitySlug, readCapabilityTrustMode(opts.state, opts.repoSlug, opts.capabilitySlug))) {
@@ -2310,45 +2615,6 @@ function assertCmsWriteAllowed(opts) {
   }
   return null;
 }
-function cmsQuery(args) {
-  const params = new URLSearchParams();
-  const q = stringArg(args.q);
-  if (q) params.set("q", q);
-  const limit = numberArg(args.limit);
-  if (limit !== void 0) params.set("limit", String(limit));
-  const offset = numberArg(args.offset);
-  if (offset !== void 0) params.set("offset", String(offset));
-  if (args.filters && typeof args.filters === "object" && !Array.isArray(args.filters)) {
-    params.set("filters", JSON.stringify(args.filters));
-  }
-  if (Array.isArray(args.sort)) {
-    const sort = args.sort.flatMap((entry) => {
-      if (!entry || typeof entry !== "object") return [];
-      const field = stringArg(entry.field);
-      if (!field) return [];
-      const direction = entry.direction === "asc" ? "asc" : "desc";
-      return [`${field}:${direction}`];
-    }).join(",");
-    if (sort) params.set("sort", sort);
-  }
-  const value = params.toString();
-  return value ? `?${value}` : "";
-}
-function stringArg(value) {
-  return typeof value === "string" ? value.trim() : "";
-}
-function numberArg(value) {
-  if (value === void 0 || value === null || value === "") return void 0;
-  const n = Number(value);
-  return Number.isFinite(n) ? n : void 0;
-}
-function documentArg(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) return {};
-  return value;
-}
-function stringFieldFromRecord(value, field) {
-  return value && typeof value === "object" && !Array.isArray(value) && typeof value[field] === "string" ? String(value[field]) : void 0;
-}
 function capabilityToolDefinitions(opts) {
   const workflowFile = opts.workflowFile ?? "kody.yml";
   const listTool = {
@@ -2371,7 +2637,7 @@ function capabilityToolDefinitions(opts) {
     name: `${verb.replace("-", "_")}_pr`,
     description: describe,
     inputSchema: {
-      pr: z2.number().int().positive().describe("PR number to repair.")
+      pr: z3.number().int().positive().describe("PR number to repair.")
     },
     handler: async (args) => {
       const pr = Number(args.pr);
@@ -2399,8 +2665,8 @@ function capabilityToolDefinitions(opts) {
     name: "recommend_to_operator",
     description: "Post ONE comment on a PR with the operator @-mention prepended. Use this when a capability is in ASK mode and you want the operator to confirm via the dashboard inbox. The mention handle is substituted from kody.config.json `github.operators` \u2014 do not type it yourself.",
     inputSchema: {
-      pr: z2.number().int().positive().describe("PR number to comment on."),
-      body: z2.string().min(1).describe("Comment body (markdown). Do not include the operator mention \u2014 the engine prepends it.")
+      pr: z3.number().int().positive().describe("PR number to comment on."),
+      body: z3.string().min(1).describe("Comment body (markdown). Do not include the operator mention \u2014 the engine prepends it.")
     },
     handler: async (args) => {
       const pr = Number(args.pr);
@@ -2414,7 +2680,7 @@ function capabilityToolDefinitions(opts) {
     name: "read_ledger",
     description: "Read any sentinel-fenced JSON manifest stored on a labeled issue. Returns `{found, issueNumber, payload}` where payload is the parsed JSON between `<!-- <label>:start -->` and `<!-- <label>:end -->` sentinels.",
     inputSchema: {
-      label: z2.string().min(1).describe("GitHub issue label that identifies the manifest issue.")
+      label: z3.string().min(1).describe("GitHub issue label that identifies the manifest issue.")
     },
     handler: async (args) => {
       const label = String(args.label ?? "");
@@ -2426,8 +2692,8 @@ function capabilityToolDefinitions(opts) {
     name: "read_check_runs",
     description: "Read CI for a branch or commit ref (e.g. 'dev'). Returns {sha, state, failing:[{name,conclusion,detailsUrl}], pending:[{name,status}]}. state is RED (\u22651 check has a terminal-failure conclusion: failure/timed_out/startup_failure/action_required), PENDING (none failed but some still running), or GREEN (all completed, none failed). Kody's own job check-runs (run/kody/capability-tick/\u2026) are excluded by default. This reads the commit's authoritative check-runs \u2014 use it instead of guessing CI health from a run list.",
     inputSchema: {
-      ref: z2.string().min(1).describe("Branch name or commit SHA to read CI for (e.g. 'dev')."),
-      ignoreNames: z2.array(z2.string()).optional().describe("Check names to exclude (default: Kody's own job names).")
+      ref: z3.string().min(1).describe("Branch name or commit SHA to read CI for (e.g. 'dev')."),
+      ignoreNames: z3.array(z3.string()).optional().describe("Check names to exclude (default: Kody's own job names).")
     },
     handler: async (args) => {
       const ref = String(args.ref ?? "");
@@ -2440,8 +2706,8 @@ function capabilityToolDefinitions(opts) {
     name: "read_thread",
     description: "Read an issue or PR's recent comments + labels + title/state. Returns {number, title, state, labels:[...], comments:[{author, createdAt, body}]} (newest last, body truncated). Use this to read a verdict a dispatched check posted back \u2014 e.g. qa-engineer's report or ui-review's PASS/CONCERNS/FAIL \u2014 on a later tick. Read-only; works for both issues AND PRs.",
     inputSchema: {
-      number: z2.number().int().positive().describe("Issue or PR number to read."),
-      limit: z2.number().int().positive().optional().describe("Max recent comments to return (default 10).")
+      number: z3.number().int().positive().describe("Issue or PR number to read."),
+      limit: z3.number().int().positive().optional().describe("Max recent comments to return (default 10).")
     },
     handler: async (args) => {
       const number = Number(args.number);
@@ -2454,11 +2720,11 @@ function capabilityToolDefinitions(opts) {
     name: "ensure_issue",
     description: "Idempotently ensure ONE open tracking issue exists for `key`. Searches OPEN issues (issues API, not the laggy search index) for `key`'s hidden marker; if found, returns {created:false, number} and creates NOTHING; otherwise creates the issue (title + body, marker appended) and returns {created:true, number}. This is the anti-duplication primitive: use one stable `key` per recurring finding so re-ticks reuse the same issue. Only take follow-up actions (dispatch/comment) when created===true.",
     inputSchema: {
-      key: z2.string().min(1).describe(
+      key: z3.string().min(1).describe(
         "Stable dedup identity for this finding (e.g. 'dev-ci-red', 'docs-drift:<feature>'). Same key across ticks = same issue."
       ),
-      title: z2.string().min(1).describe("Issue title (used only on first creation)."),
-      body: z2.string().min(1).describe(
+      title: z3.string().min(1).describe("Issue title (used only on first creation)."),
+      body: z3.string().min(1).describe(
         "Issue body markdown (used only on first creation). Include the operator mention verbatim if the capability body has one."
       )
     },
@@ -2474,9 +2740,9 @@ function capabilityToolDefinitions(opts) {
     name: "ensure_comment",
     description: "Idempotently post ONE comment on an issue for `key`. If a comment carrying `key`'s marker already exists on the issue, returns {posted:false}; otherwise posts the comment (marker appended) and returns {posted:true}. Use for a notify/audit comment that must appear exactly once.",
     inputSchema: {
-      issue: z2.number().int().positive().describe("Issue number to comment on."),
-      key: z2.string().min(1).describe("Stable dedup identity for this comment (e.g. 'dev-ci-red:dispatched')."),
-      body: z2.string().min(1).describe("Comment body markdown.")
+      issue: z3.number().int().positive().describe("Issue number to comment on."),
+      key: z3.string().min(1).describe("Stable dedup identity for this comment (e.g. 'dev-ci-red:dispatched')."),
+      body: z3.string().min(1).describe("Comment body markdown.")
     },
     handler: async (args) => {
       const issue = Number(args.issue);
@@ -2490,9 +2756,9 @@ function capabilityToolDefinitions(opts) {
     name: "dispatch_workflow",
     description: "Dispatch a kody.yml workflow_dispatch run for a capability action against an issue (the cross-run bot\u2192engine path; a bot `@kody` comment would be dropped). E.g. dispatch_workflow({capability:'run', issueNumber:<n>}) opens a fix PR from a tracking issue. Returns {ok} or {ok:false,error}.",
     inputSchema: {
-      capability: z2.string().min(1).optional().describe("Capability action to run (e.g. 'run')."),
-      executable: z2.string().min(1).optional().describe("Deprecated alias for capability."),
-      issueNumber: z2.number().int().positive().describe("Issue (or PR) number forwarded as issue_number.")
+      capability: z3.string().min(1).optional().describe("Capability action to run (e.g. 'run')."),
+      executable: z3.string().min(1).optional().describe("Deprecated alias for capability."),
+      issueNumber: z3.number().int().positive().describe("Issue (or PR) number forwarded as issue_number.")
     },
     handler: async (args) => {
       const capability = String(args.capability ?? args.executable ?? "");
@@ -2505,86 +2771,10 @@ function capabilityToolDefinitions(opts) {
       return { content: [{ type: "text", text }] };
     }
   };
-  const cmsListCollectionsTool = {
-    name: "cms_list_collections",
-    description: "List configured Dashboard CMS collections and their supported operations. Read-only.",
-    inputSchema: {},
-    handler: async () => cmsToolResponse(await callDashboardCms(opts, "/api/kody/cms"))
-  };
-  const cmsListDocumentsTool = {
-    name: "cms_list_documents",
-    description: "List or search Dashboard CMS documents from one configured collection. Read-only.",
-    inputSchema: {
-      collection: z2.string().min(1).describe("CMS collection name."),
-      q: z2.string().optional().describe("Optional search query."),
-      filters: z2.record(z2.string(), z2.unknown()).optional().describe("Optional filter object keyed by field."),
-      sort: z2.array(
-        z2.object({
-          field: z2.string().min(1),
-          direction: z2.enum(["asc", "desc"]).default("desc")
-        })
-      ).optional(),
-      limit: z2.number().int().min(1).max(100).optional(),
-      offset: z2.number().int().min(0).optional()
-    },
-    handler: async (args) => {
-      const collection = encodeURIComponent(stringArg(args.collection));
-      return cmsToolResponse(await callDashboardCms(opts, `/api/kody/cms/${collection}${cmsQuery(args)}`));
-    }
-  };
-  const cmsGetDocumentTool = {
-    name: "cms_get_document",
-    description: "Get one Dashboard CMS document by collection and id. Read-only.",
-    inputSchema: {
-      collection: z2.string().min(1).describe("CMS collection name."),
-      id: z2.string().min(1).describe("Document id.")
-    },
-    handler: async (args) => {
-      const collection = encodeURIComponent(stringArg(args.collection));
-      const id = encodeURIComponent(stringArg(args.id));
-      return cmsToolResponse(await callDashboardCms(opts, `/api/kody/cms/${collection}/${id}`));
-    }
-  };
-  const cmsCreateDocumentTool = {
-    name: "cms_create_document",
-    description: "Create one Dashboard CMS document when the capability is trusted and the CMS collection allows create.",
-    inputSchema: {
-      collection: z2.string().min(1).describe("CMS collection name."),
-      data: z2.record(z2.string(), z2.unknown()).describe("Document fields to create.")
-    },
-    handler: async (args) => {
-      const refusal = assertCmsWriteAllowed(opts);
-      if (refusal) return { content: [{ type: "text", text: refusal }] };
-      const collection = encodeURIComponent(stringArg(args.collection));
-      return cmsToolResponse(
-        await callDashboardCms(opts, `/api/kody/cms/${collection}`, {
-          method: "POST",
-          body: JSON.stringify(documentArg(args.data))
-        })
-      );
-    }
-  };
-  const cmsUpdateDocumentTool = {
-    name: "cms_update_document",
-    description: "Update one Dashboard CMS document when the capability is trusted and the CMS collection allows update.",
-    inputSchema: {
-      collection: z2.string().min(1).describe("CMS collection name."),
-      id: z2.string().min(1).describe("Document id."),
-      data: z2.record(z2.string(), z2.unknown()).describe("Partial document fields to update.")
-    },
-    handler: async (args) => {
-      const refusal = assertCmsWriteAllowed(opts);
-      if (refusal) return { content: [{ type: "text", text: refusal }] };
-      const collection = encodeURIComponent(stringArg(args.collection));
-      const id = encodeURIComponent(stringArg(args.id));
-      return cmsToolResponse(
-        await callDashboardCms(opts, `/api/kody/cms/${collection}/${id}`, {
-          method: "PATCH",
-          body: JSON.stringify(documentArg(args.data))
-        })
-      );
-    }
-  };
+  const cmsTools = dashboardCmsToolDefinitions({
+    repoSlug: opts.repoSlug,
+    assertWriteAllowed: () => assertCmsWriteAllowed(opts)
+  });
   return [
     listTool,
     syncTool,
@@ -2597,24 +2787,20 @@ function capabilityToolDefinitions(opts) {
     ensureIssueTool,
     ensureCommentTool,
     dispatchTool,
-    cmsListCollectionsTool,
-    cmsListDocumentsTool,
-    cmsGetDocumentTool,
-    cmsCreateDocumentTool,
-    cmsUpdateDocumentTool
+    ...cmsTools
   ];
 }
 function buildCapabilityMcpServer(opts) {
   const definitions = capabilityToolDefinitions(opts);
   const tools = definitions.map(
-    (def) => tool3(
+    (def) => tool4(
       def.name,
       def.description,
       def.inputSchema,
       async (args) => def.handler(args)
     )
   );
-  const server = createSdkMcpServer3({
+  const server = createSdkMcpServer4({
     name: "kody-capability",
     version: "0.1.0",
     tools
@@ -2625,6 +2811,7 @@ var FAIL_CONCLUSIONS, RUNNING_STATUSES, TRUST_FILE_PATH, THREAD_BODY_MAX, CHECK_
 var init_capabilityMcp = __esm({
   "src/capabilityMcp.ts"() {
     "use strict";
+    init_dashboardCmsMcp();
     init_issue();
     init_registry();
     init_stateRepo();
@@ -2649,11 +2836,7 @@ var init_capabilityMcp = __esm({
       "ensure_issue",
       "ensure_comment",
       "dispatch_workflow",
-      "cms_list_collections",
-      "cms_list_documents",
-      "cms_get_document",
-      "cms_create_document",
-      "cms_update_document"
+      ...DASHBOARD_CMS_MCP_TOOL_NAMES
     ];
   }
 });
@@ -2701,7 +2884,7 @@ var init_repoWorkspace = __esm({
     defaultCloneRepo = (repo, token, dir) => {
       fs7.mkdirSync(path9.dirname(dir), { recursive: true });
       const authUrl = token ? `https://x-access-token:${token}@github.com/${repo}.git` : `https://github.com/${repo}.git`;
-      return new Promise((resolve8, reject) => {
+      return new Promise((resolve9, reject) => {
         const child = spawn2("git", ["clone", "--depth=1", authUrl, dir], {
           stdio: "inherit"
         });
@@ -2717,7 +2900,7 @@ var init_repoWorkspace = __esm({
             spawnSync("git", ["-C", dir, "config", "user.email", email]);
           } catch {
           }
-          resolve8();
+          resolve9();
         });
         child.on("error", reject);
       });
@@ -2731,8 +2914,8 @@ __export(fetchRepoMcp_exports, {
   buildFetchRepoMcpServer: () => buildFetchRepoMcpServer,
   fetchRepoToolDefinition: () => fetchRepoToolDefinition
 });
-import { createSdkMcpServer as createSdkMcpServer4, tool as tool4 } from "@anthropic-ai/claude-agent-sdk";
-import { z as z3 } from "zod";
+import { createSdkMcpServer as createSdkMcpServer5, tool as tool5 } from "@anthropic-ai/claude-agent-sdk";
+import { z as z4 } from "zod";
 function fetchRepoToolDefinition(opts) {
   return {
     name: "fetch_repo",
@@ -2767,10 +2950,10 @@ Use Read/Grep/Glob/Bash at that absolute path to explore it. It now lives in you
 }
 function buildFetchRepoMcpServer(opts) {
   const def = fetchRepoToolDefinition(opts);
-  const fetchTool = tool4(def.name, def.description, def.inputSchema, async (args) => {
+  const fetchTool = tool5(def.name, def.description, def.inputSchema, async (args) => {
     return def.handler({ repo: String(args.repo ?? "") });
   });
-  return createSdkMcpServer4({
+  return createSdkMcpServer5({
     name: "kody-fetch-repo",
     version: "0.1.0",
     tools: [fetchTool]
@@ -2783,7 +2966,7 @@ var init_fetchRepoMcp = __esm({
     init_repoWorkspace();
     DESCRIPTION3 = 'Clone another GitHub repository into your workspace so you can read and work on it. Pass `repo` as "owner/name" (e.g. "A-Guy-educ/A-Guy"). Returns the absolute path of the clone \u2014 then use your Read/Grep/Glob/Bash tools at that path to inspect it. Already-fetched repos are reused instantly. Use this whenever the user asks about a repository other than your current one \u2014 you are NOT limited to a single repo.';
     INPUT_SCHEMA3 = {
-      repo: z3.string().describe('GitHub repository as "owner/name", e.g. "A-Guy-educ/A-Guy".')
+      repo: z4.string().describe('GitHub repository as "owner/name", e.g. "A-Guy-educ/A-Guy".')
     };
   }
 });
@@ -2867,7 +3050,7 @@ async function runAgent(opts) {
   const turnTimeoutMs = resolveTurnTimeoutMs(opts);
   let outcome = "failed";
   let outcomeKind = "generic_failed";
-  let errorMessage;
+  let errorMessage2;
   let tokens = { input: 0, output: 0, cacheRead: 0, cacheCreate: 0 };
   let messageCount = 0;
   let finalText = "";
@@ -2883,7 +3066,7 @@ async function runAgent(opts) {
     const resultTexts = [];
     outcome = "failed";
     outcomeKind = "generic_failed";
-    errorMessage = void 0;
+    errorMessage2 = void 0;
     tokens = { input: 0, output: 0, cacheRead: 0, cacheCreate: 0 };
     messageCount = 0;
     let sawMutatingTool = false;
@@ -2941,6 +3124,24 @@ async function runAgent(opts) {
         });
         mcpEntries.push(["kody-capability", dutyHandle.server]);
       }
+      if (opts.enableDashboardCmsTool) {
+        const { buildDashboardCmsMcpServer: buildDashboardCmsMcpServer2, DASHBOARD_CMS_MCP_TOOL_NAMES: DASHBOARD_CMS_MCP_TOOL_NAMES2 } = await Promise.resolve().then(() => (init_dashboardCmsMcp(), dashboardCmsMcp_exports));
+        if (!opts.cmsRepoSlug) {
+          throw new Error("enableDashboardCmsTool requires cmsRepoSlug (owner/name)");
+        }
+        const cmsHandle = buildDashboardCmsMcpServer2({
+          repoSlug: opts.cmsRepoSlug,
+          dashboardUrl: opts.cmsDashboardUrl,
+          token: opts.cmsToken,
+          storeRepoUrl: opts.cmsStoreRepoUrl,
+          storeRef: opts.cmsStoreRef
+        });
+        mcpEntries.push(["kody-cms", cmsHandle.server]);
+        for (const toolName of DASHBOARD_CMS_MCP_TOOL_NAMES2) {
+          ;
+          queryOptions.allowedTools.push(`mcp__kody-cms__${toolName}`);
+        }
+      }
       if (opts.enableFetchRepoTool && opts.reposRoot) {
         const { buildFetchRepoMcpServer: buildFetchRepoMcpServer2 } = await Promise.resolve().then(() => (init_fetchRepoMcp(), fetchRepoMcp_exports));
         const fetchServer = buildFetchRepoMcpServer2({
@@ -3007,10 +3208,10 @@ async function runAgent(opts) {
         let timer;
         let next;
         if (turnTimeoutMs > 0) {
-          const timeoutPromise = new Promise((resolve8) => {
+          const timeoutPromise = new Promise((resolve9) => {
             timer = setTimeout(() => {
               timedOut = true;
-              resolve8({ done: true, value: void 0 });
+              resolve9({ done: true, value: void 0 });
             }, turnTimeoutMs);
           });
           next = await Promise.race([nextPromise, timeoutPromise]);
@@ -3021,7 +3222,7 @@ async function runAgent(opts) {
         if (timedOut) {
           outcome = "failed";
           outcomeKind = "stalled";
-          errorMessage = `agent stalled: no SDK message in ${Math.round(turnTimeoutMs / 1e3)}s`;
+          errorMessage2 = `agent stalled: no SDK message in ${Math.round(turnTimeoutMs / 1e3)}s`;
           if (typeof iterator.return === "function") {
             try {
               await iterator.return(void 0);
@@ -3125,17 +3326,17 @@ async function runAgent(opts) {
           } else {
             outcome = "failed";
             outcomeKind = classifySubtype(m.subtype);
-            errorMessage = `result subtype: ${m.subtype ?? "unknown"}`;
+            errorMessage2 = `result subtype: ${m.subtype ?? "unknown"}`;
           }
         }
       }
     } catch (e) {
       if (sawTerminalSuccess) {
-        errorMessage = e instanceof Error ? e.message : String(e);
+        errorMessage2 = e instanceof Error ? e.message : String(e);
       } else {
         outcome = "failed";
         outcomeKind = "model_error";
-        errorMessage = e instanceof Error ? e.message : String(e);
+        errorMessage2 = e instanceof Error ? e.message : String(e);
       }
     } finally {
       try {
@@ -3153,7 +3354,7 @@ async function runAgent(opts) {
     if (outcome === "completed" && sawLoginRequired) {
       outcome = "failed";
       outcomeKind = "model_error";
-      errorMessage = "Claude Code reported it is not logged in; refusing to mark agent run successful";
+      errorMessage2 = "Claude Code reported it is not logged in; refusing to mark agent run successful";
     }
     if (outcome === "completed" && !sawMutatingTool) {
       const backendDead = opts.isBackendHealthy ? !await opts.isBackendHealthy() : false;
@@ -3162,14 +3363,14 @@ async function runAgent(opts) {
         outcome = "failed";
         outcomeKind = "model_error";
         noWorkSuccess = true;
-        errorMessage = errorMessage ?? (backendDead ? "model backend unreachable after a reported success \u2014 proxy crashed mid-request (hollow success)" : "session reported success but produced no model output (0 output tokens) \u2014 backend likely unreachable");
+        errorMessage2 = errorMessage2 ?? (backendDead ? "model backend unreachable after a reported success \u2014 proxy crashed mid-request (hollow success)" : "session reported success but produced no model output (0 output tokens) \u2014 backend likely unreachable");
       }
     }
-    const shouldRetry = outcome === "failed" && attempt < MAX_CONNECTION_RETRIES && !sawMutatingTool && (isTransientConnectionError(errorMessage) || noWorkSuccess);
+    const shouldRetry = outcome === "failed" && attempt < MAX_CONNECTION_RETRIES && !sawMutatingTool && (isTransientConnectionError(errorMessage2) || noWorkSuccess);
     if (!shouldRetry) break;
     const delayMs = CONNECTION_RETRY_BASE_MS * 2 ** attempt;
     process.stderr.write(
-      `[kody agent] transient connection error (attempt ${attempt + 1}/${MAX_CONNECTION_RETRIES + 1}); retrying in ${Math.round(delayMs / 1e3)}s: ${errorMessage}
+      `[kody agent] transient connection error (attempt ${attempt + 1}/${MAX_CONNECTION_RETRIES + 1}); retrying in ${Math.round(delayMs / 1e3)}s: ${errorMessage2}
 `
     );
     if (opts.ensureBackend) {
@@ -3188,7 +3389,7 @@ async function runAgent(opts) {
     outcomeKind,
     finalText,
     ...submittedState ? { submittedState } : {},
-    error: errorMessage,
+    error: errorMessage2,
     ndjsonPath,
     durationMs: Date.now() - startedAt,
     tokens,
@@ -5813,7 +6014,7 @@ var init_litellm = __esm({
 
 // src/pushWithRetry.ts
 import { execFileSync as execFileSync6 } from "child_process";
-function sleepSync(ms) {
+function sleepSync2(ms) {
   if (ms <= 0) return;
   Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
 }
@@ -5874,7 +6075,7 @@ function pushWithRetry(opts = {}) {
       };
     }
     const delay = Math.min(baseBackoff * 2 ** (attempt - 1), MAX_BACKOFF_MS);
-    sleepSync(delay);
+    sleepSync2(delay);
   }
   return {
     ok: false,
@@ -6119,6 +6320,13 @@ function jobMetaFromData(data) {
     why: typeof data.jobWhy === "string" ? data.jobWhy : void 0
   };
 }
+function applyStandaloneTerminalState(state, ctx, profile) {
+  if (profile.lifecycleConfig?.finalize !== true || state.flow?.issueNumber) return;
+  const delivered = ctx.output.exitCode === 0 && !!state.core.prUrl;
+  state.core.phase = delivered ? "shipped" : "failed";
+  state.core.status = delivered ? "succeeded" : "failed";
+  state.core.currentExecutable = null;
+}
 function synthesizeAction(ctx) {
   const ok = ctx.output.exitCode === 0;
   return {
@@ -6149,6 +6357,7 @@ var init_saveTaskState = __esm({
       });
       if (ctx.output.prUrl) next.core.prUrl = ctx.output.prUrl;
       if (typeof ctx.data.runUrl === "string") next.core.runUrl = ctx.data.runUrl;
+      applyStandaloneTerminalState(next, ctx, profile);
       writeTaskState(target, number, next, ctx.cwd, ctx.config);
       ctx.data.taskState = next;
       ctx.data.taskStateRendered = renderStateComment(next);
@@ -11478,12 +11687,9 @@ var init_finalizeTerminal = __esm({
       const issueNumber = ctx.args.issue;
       const targetNumber = ctx.data.commentTargetNumber ?? issueNumber;
       if (!targetNumber) return;
-      let prUrl;
-      try {
-        prUrl = readTaskState(target, targetNumber, ctx.cwd, ctx.config).core.prUrl;
-      } catch {
-        prUrl = void 0;
-      }
+      const cachedState = ctx.data.taskState;
+      let state = cachedState;
+      const prUrl = cachedState?.core.prUrl ?? ctx.output.prUrl ?? ctx.data.prResult?.url;
       const delivered = ctx.output.exitCode === 0 && !!prUrl;
       const spec = delivered ? DONE : FAILED;
       const phase = delivered ? "shipped" : "failed";
@@ -11491,12 +11697,28 @@ var init_finalizeTerminal = __esm({
       if (issueNumber) setKodyLabel(issueNumber, spec, ctx.cwd);
       const prNumber = prUrl ? parsePrNumber(prUrl) : null;
       if (prNumber && prNumber !== issueNumber) setKodyLabel(prNumber, spec, ctx.cwd);
+      if (!state) {
+        try {
+          state = readTaskState(target, targetNumber, ctx.cwd, ctx.config);
+        } catch {
+          state = void 0;
+        }
+      }
+      if (!state) return;
+      const alreadyTerminal = state.core.phase === phase && state.core.status === status && state.core.currentExecutable === null;
+      if (alreadyTerminal) return;
+      const next = {
+        ...state,
+        core: {
+          ...state.core,
+          phase,
+          status,
+          currentExecutable: null
+        }
+      };
+      ctx.data.taskState = next;
       try {
-        const state = readTaskState(target, targetNumber, ctx.cwd, ctx.config);
-        state.core.phase = phase;
-        state.core.status = status;
-        state.core.currentExecutable = null;
-        writeTaskState(target, targetNumber, state, ctx.cwd, ctx.config);
+        writeTaskState(target, targetNumber, next, ctx.cwd, ctx.config);
       } catch (err) {
         process.stderr.write(
           `[kody finalizeTerminal] failed to write terminal state on ${target} #${targetNumber}: ${err instanceof Error ? err.message : String(err)}
@@ -12436,7 +12658,7 @@ function retryDelaysMs() {
 }
 function sleep(ms) {
   if (ms <= 0) return Promise.resolve();
-  return new Promise((resolve8) => setTimeout(resolve8, ms));
+  return new Promise((resolve9) => setTimeout(resolve9, ms));
 }
 async function fetchGoalStateWithRetry(config, goalId, cwd) {
   let state = fetchGoalState(config, goalId, cwd);
@@ -13161,17 +13383,22 @@ var init_mirrorStateToPr = __esm({
       const issueNumber = ctx.data.commentTargetNumber;
       const issueTarget = ctx.data.commentTargetType;
       if (!issueNumber || issueTarget !== "issue") return;
-      const prUrl = ctx.output.prUrl ?? ctx.data.prResult?.url;
+      let state = ctx.data.taskState;
+      const prUrl = ctx.output.prUrl ?? ctx.data.prResult?.url ?? state?.core.prUrl;
       if (!prUrl) return;
       const prNumber = parsePrNumber4(prUrl);
       if (!prNumber) return;
-      let state;
-      try {
-        state = readTaskState("issue", issueNumber, ctx.cwd, ctx.config);
-      } catch {
-        return;
+      if (!state) {
+        try {
+          state = readTaskState("issue", issueNumber, ctx.cwd, ctx.config);
+        } catch {
+          return;
+        }
+      }
+      if (prUrl && !state.core.prUrl) {
+        state = { ...state, core: { ...state.core, prUrl } };
+        ctx.data.taskState = state;
       }
-      if (prUrl && !state.core.prUrl) state.core.prUrl = prUrl;
       try {
         writeTaskState("pr", prNumber, state, ctx.cwd, ctx.config);
       } catch (err) {
@@ -15099,7 +15326,7 @@ var init_previewBuildHelpers = __esm({
 // src/scripts/previewBuildRun.ts
 import { spawn as spawn4 } from "child_process";
 async function runCmd(cmd, args, opts = {}) {
-  await new Promise((resolve8, reject) => {
+  await new Promise((resolve9, reject) => {
     const child = spawn4(cmd, args, {
       cwd: opts.cwd,
       env: { ...process.env, ...opts.env ?? {} },
@@ -15111,7 +15338,7 @@ async function runCmd(cmd, args, opts = {}) {
     }
     child.on("error", reject);
     child.on("close", (code) => {
-      if (code === 0) resolve8();
+      if (code === 0) resolve9();
       else reject(new Error(`${cmd} ${args.join(" ")} exited ${code}`));
     });
   });
@@ -16235,7 +16462,7 @@ function stripAnsi2(s) {
   return s.replace(ANSI_RE2, "");
 }
 function runCommand2(command, cwd) {
-  return new Promise((resolve8) => {
+  return new Promise((resolve9) => {
     const child = spawn5(command, {
       cwd,
       shell: true,
@@ -16262,11 +16489,11 @@ function runCommand2(command, cwd) {
     }, TEST_TIMEOUT_MS);
     child.on("exit", (code) => {
       clearTimeout(timer);
-      resolve8({ exitCode: code ?? -1, output: Buffer.concat(buffers).toString("utf-8") });
+      resolve9({ exitCode: code ?? -1, output: Buffer.concat(buffers).toString("utf-8") });
     });
     child.on("error", (err) => {
       clearTimeout(timer);
-      resolve8({ exitCode: -1, output: err.message });
+      resolve9({ exitCode: -1, output: err.message });
     });
   });
 }
@@ -16671,21 +16898,21 @@ function lineStream(stream) {
     tryDeliver();
   });
   return {
-    next: (timeoutMs) => new Promise((resolve8) => {
+    next: (timeoutMs) => new Promise((resolve9) => {
       if (queue.length > 0) {
-        resolve8(queue.shift());
+        resolve9(queue.shift());
         return;
       }
       if (ended) {
-        resolve8(null);
+        resolve9(null);
         return;
       }
-      waiter = resolve8;
+      waiter = resolve9;
       const t = setTimeout(
         () => {
-          if (waiter === resolve8) {
+          if (waiter === resolve9) {
             waiter = null;
-            resolve8(null);
+            resolve9(null);
           }
         },
         Math.max(0, timeoutMs)
@@ -17068,42 +17295,111 @@ var init_scripts = __esm({
 });
 
 // src/stateWorkspace.ts
+import { execFileSync as execFileSync24 } from "child_process";
+import * as crypto3 from "crypto";
 import * as fs43 from "fs";
+import * as os7 from "os";
 import * as path41 from "path";
 function writeLocalFile(cwd, relativePath, content) {
   const fullPath = path41.join(cwd, relativePath);
   fs43.mkdirSync(path41.dirname(fullPath), { recursive: true });
   fs43.writeFileSync(fullPath, content);
 }
-function hydrateDirectory(config, cwd, stateDir, localDir) {
-  const entries = listStateDirectory(config, cwd, stateDir);
-  if (entries.length === 0) return;
-  for (const entry of entries) {
-    if (!entry.name || !entry.type) continue;
-    const childState = path41.posix.join(stateDir, entry.name);
-    const childLocal = path41.join(localDir, entry.name);
-    if (entry.type === "dir") {
-      fs43.rmSync(path41.join(cwd, childLocal), { recursive: true, force: true });
-      hydrateDirectory(config, cwd, childState, childLocal);
-    } else if (entry.type === "file") {
-      const file = readStateText(config, cwd, childState);
-      if (file) writeLocalFile(cwd, childLocal, file.content);
-    }
+function copyPath(source, target) {
+  const st = fs43.lstatSync(source);
+  fs43.rmSync(target, { recursive: true, force: true });
+  if (st.isSymbolicLink()) return;
+  fs43.mkdirSync(path41.dirname(target), { recursive: true });
+  fs43.cpSync(source, target, { recursive: true, force: true });
+}
+function overlayDirectoryChildren(cwd, sourceDir, localDir) {
+  if (!fs43.existsSync(sourceDir)) return;
+  for (const entry of fs43.readdirSync(sourceDir, { withFileTypes: true })) {
+    const source = path41.join(sourceDir, entry.name);
+    const target = path41.join(cwd, localDir, entry.name);
+    copyPath(source, target);
   }
 }
 function hydrateStateWorkspace(config, cwd) {
+  if (process.env.VITEST && process.env[TEST_FETCH_ENV] !== "1") return;
+  const parsed = parseStateRepo(config);
+  const hydrateKey = `${path41.resolve(cwd)}|${parsed.owner}/${parsed.repo}|${parsed.basePath}|${STATE_BRANCH}`;
+  if (hydratedWorkspaces.has(hydrateKey)) return;
+  const snapshotRoot = fetchStateSnapshot(parsed);
   for (const mapping of DIR_MAPPINGS) {
-    hydrateDirectory(config, cwd, mapping.stateDir, mapping.localDir);
+    overlayDirectoryChildren(cwd, path41.join(snapshotRoot, mapping.stateDir), mapping.localDir);
   }
   for (const mapping of FILE_MAPPINGS) {
-    const file = readStateText(config, cwd, mapping.statePath);
-    if (file) writeLocalFile(cwd, mapping.localPath, file.content);
+    const source = path41.join(snapshotRoot, mapping.statePath);
+    if (fs43.existsSync(source) && !fs43.lstatSync(source).isSymbolicLink() && fs43.statSync(source).isFile()) {
+      writeLocalFile(cwd, mapping.localPath, fs43.readFileSync(source, "utf-8"));
+    }
+  }
+  hydratedWorkspaces.add(hydrateKey);
+}
+function fetchStateSnapshot(parsed) {
+  const cacheDir = path41.join(cacheRoot2(), cacheKey2(parsed));
+  const url = `https://github.com/${parsed.owner}/${parsed.repo}.git`;
+  try {
+    fs43.mkdirSync(path41.dirname(cacheDir), { recursive: true });
+    if (!fs43.existsSync(path41.join(cacheDir, ".git"))) {
+      fs43.rmSync(cacheDir, { recursive: true, force: true });
+      runGit3(["clone", "--no-checkout", "--filter=blob:none", url, cacheDir]);
+    }
+    runGit3(["-C", cacheDir, "remote", "set-url", "origin", url]);
+    runGit3(["-C", cacheDir, "fetch", "--depth=1", "origin", STATE_BRANCH]);
+    runGit3(["-C", cacheDir, "sparse-checkout", "init", "--cone"]);
+    runGit3(["-C", cacheDir, "sparse-checkout", "set", parsed.basePath]);
+    runGit3(["-C", cacheDir, "checkout", "--force", "--detach", "FETCH_HEAD"]);
+    runGit3(["-C", cacheDir, "clean", "-fdx"]);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    throw new Error(
+      `stateWorkspace: failed to fetch ${parsed.owner}/${parsed.repo}:${parsed.basePath}@${STATE_BRANCH}: ${msg}`
+    );
+  }
+  return path41.join(cacheDir, parsed.basePath);
+}
+function cacheRoot2() {
+  return process.env[CACHE_ENV2]?.trim() || path41.join(os7.homedir(), ".cache", "kody", "state-repo");
+}
+function cacheKey2(parsed) {
+  return crypto3.createHash("sha256").update(`${parsed.owner}/${parsed.repo}#${STATE_BRANCH}#${parsed.basePath}`).digest("hex").slice(0, 24);
+}
+function runGit3(args) {
+  try {
+    execFileSync24("git", args, {
+      encoding: "utf-8",
+      env: githubAuthEnv(),
+      stdio: ["ignore", "ignore", "pipe"],
+      timeout: 12e4
+    });
+  } catch (err) {
+    const stderr = err.stderr;
+    const detail = Buffer.isBuffer(stderr) ? stderr.toString("utf-8").trim() : typeof stderr === "string" ? stderr.trim() : "";
+    throw new Error(detail || `git ${args[0] ?? "command"} failed`);
   }
 }
-var DIR_MAPPINGS, FILE_MAPPINGS;
+function githubAuthEnv() {
+  const token = githubToken();
+  if (!token) return process.env;
+  const encoded = Buffer.from(`x-access-token:${token}`).toString("base64");
+  const existingCount = /^\d+$/.test(process.env.GIT_CONFIG_COUNT ?? "") ? Number(process.env.GIT_CONFIG_COUNT) : 0;
+  return {
+    ...process.env,
+    GIT_CONFIG_COUNT: String(existingCount + 1),
+    [`GIT_CONFIG_KEY_${existingCount}`]: "http.https://github.com/.extraheader",
+    [`GIT_CONFIG_VALUE_${existingCount}`]: `AUTHORIZATION: basic ${encoded}`
+  };
+}
+function githubToken() {
+  return process.env.KODY_TOKEN?.trim() || process.env.GH_TOKEN?.trim() || process.env.GITHUB_TOKEN?.trim() || process.env.GH_PAT?.trim() || void 0;
+}
+var DIR_MAPPINGS, FILE_MAPPINGS, CACHE_ENV2, TEST_FETCH_ENV, hydratedWorkspaces;
 var init_stateWorkspace = __esm({
   "src/stateWorkspace.ts"() {
     "use strict";
+    init_stateBranch();
     init_stateRepo();
     DIR_MAPPINGS = [
       { stateDir: "executables", localDir: path41.join(".kody", "executables") },
@@ -17117,11 +17413,14 @@ var init_stateWorkspace = __esm({
       { statePath: "variables.json", localPath: path41.join(".kody", "variables.json") },
       { statePath: "secrets.enc", localPath: path41.join(".kody", "secrets.enc") }
     ];
+    CACHE_ENV2 = "KODY_STATE_REPO_CACHE";
+    TEST_FETCH_ENV = "KODY_STATE_WORKSPACE_FETCH_FOR_TESTS";
+    hydratedWorkspaces = /* @__PURE__ */ new Set();
   }
 });
 
 // src/tools.ts
-import { execFileSync as execFileSync24 } from "child_process";
+import { execFileSync as execFileSync25 } from "child_process";
 function verifyCliTools(tools, cwd) {
   const out = [];
   for (const t of tools) out.push(verifyOne(t, cwd));
@@ -17135,30 +17434,30 @@ function firstRequiredFailure(results, tools) {
   }
   return null;
 }
-function verifyOne(tool5, cwd) {
-  const result = { name: tool5.name, present: false, verified: false };
-  const checkRes = runShell(tool5.install.checkCommand, cwd);
+function verifyOne(tool6, cwd) {
+  const result = { name: tool6.name, present: false, verified: false };
+  const checkRes = runShell(tool6.install.checkCommand, cwd);
   let present = checkRes.ok;
-  if (!present && tool5.install.installCommand) {
-    runShell(tool5.install.installCommand, cwd, 12e4);
-    present = runShell(tool5.install.checkCommand, cwd).ok;
+  if (!present && tool6.install.installCommand) {
+    runShell(tool6.install.installCommand, cwd, 12e4);
+    present = runShell(tool6.install.checkCommand, cwd).ok;
   }
   result.present = present;
   if (!present) {
-    result.error = `tool "${tool5.name}" not on PATH (check: ${tool5.install.checkCommand})`;
+    result.error = `tool "${tool6.name}" not on PATH (check: ${tool6.install.checkCommand})`;
     return result;
   }
-  const verifyRes = runShell(tool5.verify, cwd);
+  const verifyRes = runShell(tool6.verify, cwd);
   result.verified = verifyRes.ok;
   if (!verifyRes.ok) {
     const tail = formatStderrTail(verifyRes.stderr, verifyRes.stdout);
-    result.error = `tool "${tool5.name}" failed verify: ${tool5.verify}${tail ? ` \u2014 ${tail}` : ""}`;
+    result.error = `tool "${tool6.name}" failed verify: ${tool6.verify}${tail ? ` \u2014 ${tail}` : ""}`;
   }
   return result;
 }
 function runShell(cmd, cwd, timeoutMs = 3e4) {
   try {
-    const stdout = execFileSync24("sh", ["-c", cmd], {
+    const stdout = execFileSync25("sh", ["-c", cmd], {
       cwd,
       stdio: ["ignore", "pipe", "pipe"],
       timeout: timeoutMs,
@@ -17904,14 +18203,14 @@ async function runShellEntry(entry, ctx, profile) {
   let killTimer;
   let escalateTimer;
   const result = await new Promise(
-    (resolve8) => {
+    (resolve9) => {
       let settled = false;
       const settle = (code, signal, spawnErr) => {
         if (settled) return;
         settled = true;
         if (killTimer) clearTimeout(killTimer);
         if (escalateTimer) clearTimeout(escalateTimer);
-        resolve8({ code, signal, spawnErr });
+        resolve9({ code, signal, spawnErr });
       };
       child.on("error", (err) => settle(null, null, err));
       child.on("close", (code, signal) => settle(code, signal));
@@ -18864,6 +19163,12 @@ var CROSS_REPO_PROMPT = [
   "instantly. When the user asks about a different repo \u2014 or to compare repos \u2014",
   "fetch it instead of saying you are scoped to a single repo."
 ].join("\n");
+var DASHBOARD_CMS_PROMPT = [
+  "# Dashboard CMS",
+  "Use Dashboard CMS tools for CMS content. The Dashboard is the source of truth.",
+  "Do not query Mongo directly for CMS content and do not infer CMS data from repository files.",
+  "Use cms_list_documents first when you need to find content, then pass the raw id or cmsDocumentId to cms_get_document."
+].join("\n");
 function buildExecutableCatalog() {
   let discovered;
   try {
@@ -18922,6 +19227,8 @@ async function runChatTurn(opts) {
   const memoryBlock = readMemoryIndexBlock(opts.cwd);
   const instructionsBlock = readInstructionsBlock(opts.cwd);
   const crossRepoBlock = opts.reposRoot ? CROSS_REPO_PROMPT : null;
+  const dashboardCmsEnabled = Boolean(opts.cmsDashboardUrl && opts.cmsRepoSlug && opts.cmsToken);
+  const dashboardCmsBlock = dashboardCmsEnabled ? DASHBOARD_CMS_PROMPT : null;
   const imageBlock = imagePaths.length > 0 ? [
     "# Attached images",
     "The user attached one or more images on this turn. They are saved as",
@@ -18936,6 +19243,7 @@ async function runChatTurn(opts) {
     memoryBlock,
     instructionsBlock,
     crossRepoBlock,
+    dashboardCmsBlock,
     imageBlock,
     catalog,
     artifactAddendum
@@ -18963,6 +19271,14 @@ async function runChatTurn(opts) {
       reposRoot: opts.reposRoot,
       repoToken: opts.repoToken
     } : {},
+    ...dashboardCmsEnabled ? {
+      enableDashboardCmsTool: true,
+      cmsDashboardUrl: opts.cmsDashboardUrl,
+      cmsRepoSlug: opts.cmsRepoSlug,
+      cmsToken: opts.cmsToken,
+      cmsStoreRepoUrl: opts.cmsStoreRepoUrl,
+      cmsStoreRef: opts.cmsStoreRef
+    } : {},
     onProgress: async (ev) => {
       progressSeq += 1;
       if (ev.kind === "thinking") {
@@ -19061,7 +19377,9 @@ function readMemoryIndexBlock(cwd) {
   }
   const trimmed = raw.trim();
   if (!trimmed) return "";
-  const body = trimmed.length > MAX_INDEX_BYTES ? trimmed.slice(0, MAX_INDEX_BYTES) + "\n\n_\u2026 (memory index truncated; use recall_search to read more)_" : trimmed;
+  const body = trimmed.length > MAX_INDEX_BYTES ? `${trimmed.slice(0, MAX_INDEX_BYTES)}
+
+_\u2026 (memory index truncated; use recall_search to read more)_` : trimmed;
   return [
     "# Project memory index (state repo `memory/INDEX.md`)",
     "",
@@ -19131,7 +19449,7 @@ _\u2026 (instructions truncated)_` : trimmed;
 init_config();
 
 // src/kody-cli.ts
-import { execFileSync as execFileSync25 } from "child_process";
+import { execFileSync as execFileSync26 } from "child_process";
 import * as fs46 from "fs";
 import * as path45 from "path";
 
@@ -19788,7 +20106,7 @@ function recoverCheckoutToken(env = process.env, cwd = process.cwd()) {
   if (env.GITHUB_TOKEN?.trim()) return env.GITHUB_TOKEN.trim();
   let header = "";
   try {
-    header = execFileSync25("git", ["config", "--local", "--get", "http.https://github.com/.extraheader"], {
+    header = execFileSync26("git", ["config", "--local", "--get", "http.https://github.com/.extraheader"], {
       cwd,
       encoding: "utf-8",
       stdio: ["ignore", "pipe", "ignore"]
@@ -19850,7 +20168,7 @@ function shouldChainScheduledWatch(match) {
 }
 function shellOut(cmd, args, cwd, stream = true) {
   try {
-    execFileSync25(cmd, args, {
+    execFileSync26(cmd, args, {
       cwd,
       stdio: stream ? "inherit" : "pipe",
       env: { ...process.env, HUSKY: "0", SKIP_HOOKS: "1", CI: process.env.CI ?? "1" }
@@ -19863,7 +20181,7 @@ function shellOut(cmd, args, cwd, stream = true) {
 }
 function isOnPath(bin) {
   try {
-    execFileSync25("which", [bin], { stdio: "pipe" });
+    execFileSync26("which", [bin], { stdio: "pipe" });
     return true;
   } catch {
     return false;
@@ -19904,7 +20222,7 @@ function installLitellmIfNeeded(cwd) {
   } catch {
   }
   try {
-    execFileSync25("python3", ["-c", "import litellm"], { stdio: "pipe" });
+    execFileSync26("python3", ["-c", "import litellm"], { stdio: "pipe" });
     process.stdout.write("\u2192 kody: litellm already installed\n");
     return 0;
   } catch {
@@ -19914,16 +20232,16 @@ function installLitellmIfNeeded(cwd) {
 }
 function configureGitIdentity(cwd) {
   try {
-    const name = execFileSync25("git", ["config", "user.name"], { cwd, stdio: "pipe", encoding: "utf-8" }).trim();
+    const name = execFileSync26("git", ["config", "user.name"], { cwd, stdio: "pipe", encoding: "utf-8" }).trim();
     if (name) return;
   } catch {
   }
   try {
-    execFileSync25("git", ["config", "user.name", "github-actions[bot]"], { cwd, stdio: "pipe" });
+    execFileSync26("git", ["config", "user.name", "github-actions[bot]"], { cwd, stdio: "pipe" });
   } catch {
   }
   try {
-    execFileSync25("git", ["config", "user.email", "41898282+github-actions[bot]@users.noreply.github.com"], {
+    execFileSync26("git", ["config", "user.email", "41898282+github-actions[bot]@users.noreply.github.com"], {
       cwd,
       stdio: "pipe"
     });
@@ -20533,17 +20851,17 @@ function authOk(req, expected) {
   return false;
 }
 function readJsonBody(req) {
-  return new Promise((resolve8, reject) => {
+  return new Promise((resolve9, reject) => {
     const chunks = [];
     req.on("data", (c) => chunks.push(c));
     req.on("end", () => {
       const raw = Buffer.concat(chunks).toString("utf-8");
       if (!raw.trim()) {
-        resolve8({});
+        resolve9({});
         return;
       }
       try {
-        resolve8(JSON.parse(raw));
+        resolve9(JSON.parse(raw));
       } catch (err) {
         reject(err instanceof Error ? err : new Error(String(err)));
       }
@@ -20689,6 +21007,9 @@ async function handleChatTurn(req, res, chatId, opts) {
   }
   const repo = strField(body, "repo");
   const repoToken = strField(body, "repoToken");
+  const dashboardUrl = strField(body, "dashboardUrl");
+  const storeRepoUrl = strField(body, "storeRepoUrl");
+  const storeRef = strField(body, "storeRef");
   let agentCwd;
   try {
     agentCwd = await ensureRepoCwd({
@@ -20765,7 +21086,14 @@ async function handleChatTurn(req, res, chatId, opts) {
         sink,
         // Let the agent clone + work on OTHER repos via the fetch_repo tool.
         reposRoot: opts.reposRoot,
-        repoToken
+        repoToken,
+        ...dashboardUrl && repo && stateToken ? {
+          cmsDashboardUrl: dashboardUrl,
+          cmsRepoSlug: repo,
+          cmsToken: stateToken,
+          cmsStoreRepoUrl: storeRepoUrl,
+          cmsStoreRef: storeRef
+        } : {}
       });
     } catch (err) {
       const errMsg3 = err instanceof Error ? err.message : String(err);
@@ -20885,11 +21213,11 @@ async function brainServe(opts) {
     model,
     litellmUrl
   });
-  await new Promise((resolve8) => {
+  await new Promise((resolve9) => {
     server.listen(port, "0.0.0.0", () => {
       process.stdout.write(`[brain-serve] listening on 0.0.0.0:${port} (cwd=${opts.cwd})
 `);
-      resolve8();
+      resolve9();
     });
   });
   const shutdown = (signal) => {
@@ -21022,7 +21350,10 @@ async function proxyToBrainServe(args) {
     body: JSON.stringify({
       message: args.body.message,
       ...args.body.repo ? { repo: args.body.repo } : {},
-      ...args.body.repoToken ? { repoToken: args.body.repoToken } : {}
+      ...args.body.repoToken ? { repoToken: args.body.repoToken } : {},
+      ...args.body.dashboardUrl ? { dashboardUrl: args.body.dashboardUrl } : {},
+      ...args.body.storeRepoUrl ? { storeRepoUrl: args.body.storeRepoUrl } : {},
+      ...args.body.storeRef ? { storeRef: args.body.storeRef } : {}
     })
   });
   if (!upstream.ok || !upstream.body) {
@@ -21139,14 +21470,14 @@ async function startBrainProxy(opts) {
   const { httpServer, handler } = buildBrainProxy(opts);
   const port = opts.port ?? 0;
   const host = opts.host ?? "127.0.0.1";
-  await new Promise((resolve8) => httpServer.listen(port, host, () => resolve8()));
+  await new Promise((resolve9) => httpServer.listen(port, host, () => resolve9()));
   const addr = httpServer.address();
   return {
     httpServer,
     port: addr.port,
     url: `http://${host}:${addr.port}`,
-    stop: () => new Promise((resolve8) => {
-      httpServer.close(() => resolve8());
+    stop: () => new Promise((resolve9) => {
+      httpServer.close(() => resolve9());
     }),
     handler
   };
@@ -21237,15 +21568,15 @@ function buildMcpHttpServer(opts) {
     transports.set(route.path, transport);
     routes.set(route.path, route.name);
     const mcpServer = new McpServer({ name: route.name, version: route.version });
-    for (const tool5 of route.tools) {
+    for (const tool6 of route.tools) {
       mcpServer.registerTool(
-        tool5.name,
+        tool6.name,
         {
-          description: tool5.description,
-          inputSchema: tool5.inputSchema
+          description: tool6.description,
+          inputSchema: tool6.inputSchema
         },
         async (args) => {
-          const result = await tool5.handler(args);
+          const result = await tool6.handler(args);
           return {
             content: result.content,
             ...result.isError ? { isError: true } : {}
@@ -21296,23 +21627,23 @@ function buildMcpHttpServer(opts) {
     httpServer,
     routes,
     port,
-    stop: () => new Promise((resolve8) => {
+    stop: () => new Promise((resolve9) => {
       let pending = transports.size;
       if (pending === 0) {
-        httpServer.close(() => resolve8());
+        httpServer.close(() => resolve9());
         return;
       }
       for (const transport of transports.values()) {
         void transport.close().finally(() => {
           pending--;
-          if (pending === 0) httpServer.close(() => resolve8());
+          if (pending === 0) httpServer.close(() => resolve9());
         });
       }
     })
   };
 }
 function listenMcpHttpServer(server, host = "127.0.0.1") {
-  return new Promise((resolve8, reject) => {
+  return new Promise((resolve9, reject) => {
     server.httpServer.once("error", reject);
     server.httpServer.listen(server.port, host, () => {
       server.httpServer.off("error", reject);
@@ -21320,7 +21651,7 @@ function listenMcpHttpServer(server, host = "127.0.0.1") {
       if (addr && typeof addr === "object") {
         server.port = addr.port;
       }
-      resolve8();
+      resolve9();
     });
   });
 }
@@ -21409,7 +21740,7 @@ import * as fs50 from "fs";
 import * as path49 from "path";
 
 // src/chat/inbox.ts
-import { execFileSync as execFileSync26 } from "child_process";
+import { execFileSync as execFileSync27 } from "child_process";
 var DEFAULT_POLL_MS = 3e3;
 async function waitForNextUserMessage(opts) {
   const pollMs = opts.pollIntervalMs ?? DEFAULT_POLL_MS;
@@ -21433,13 +21764,13 @@ async function waitForNextUserMessage(opts) {
       try {
         const branch = currentBranch(opts.cwd);
         if (branch) {
-          execFileSync26("git", ["fetch", "--quiet", "origin", branch], { cwd: opts.cwd, stdio: "pipe" });
-          execFileSync26("git", ["merge", "--ff-only", "--quiet", `origin/${branch}`], {
+          execFileSync27("git", ["fetch", "--quiet", "origin", branch], { cwd: opts.cwd, stdio: "pipe" });
+          execFileSync27("git", ["merge", "--ff-only", "--quiet", `origin/${branch}`], {
             cwd: opts.cwd,
             stdio: "pipe"
           });
         } else {
-          execFileSync26("git", ["fetch", "--quiet", "--all"], { cwd: opts.cwd, stdio: "pipe" });
+          execFileSync27("git", ["fetch", "--quiet", "--all"], { cwd: opts.cwd, stdio: "pipe" });
         }
       } catch (err) {
         const msg = err instanceof Error ? err.message : String(err);
@@ -21461,11 +21792,11 @@ async function waitForNextUserMessage(opts) {
   }
 }
 function sleep3(ms) {
-  return new Promise((resolve8) => setTimeout(resolve8, ms));
+  return new Promise((resolve9) => setTimeout(resolve9, ms));
 }
 function currentBranch(cwd) {
   try {
-    const out = execFileSync26("git", ["symbolic-ref", "--short", "HEAD"], {
+    const out = execFileSync27("git", ["symbolic-ref", "--short", "HEAD"], {
       cwd,
       stdio: ["ignore", "pipe", "ignore"]
     });
@@ -22551,7 +22882,7 @@ var PERF_GUEST = {
   medium: { cpu_kind: "performance", cpus: 1, memory_mb: 2048 },
   high: { cpu_kind: "performance", cpus: 2, memory_mb: 4096 }
 };
-function envInt(name, dflt) {
+function envInt2(name, dflt) {
   const v = Number(process.env[name]);
   return Number.isFinite(v) && v > 0 ? v : dflt;
 }
@@ -22564,14 +22895,14 @@ function sendJson2(res, status, body) {
   res.end(JSON.stringify(body));
 }
 function readJsonBody2(req) {
-  return new Promise((resolve8, reject) => {
+  return new Promise((resolve9, reject) => {
     const chunks = [];
     req.on("data", (c) => chunks.push(c));
     req.on("end", () => {
       const raw = Buffer.concat(chunks).toString("utf-8");
-      if (!raw.trim()) return resolve8({});
+      if (!raw.trim()) return resolve9({});
       try {
-        resolve8(JSON.parse(raw));
+        resolve9(JSON.parse(raw));
       } catch (err) {
         reject(err instanceof Error ? err : new Error(String(err)));
       }
@@ -22662,8 +22993,8 @@ function synthesizeLegacyClaimRequest(input) {
 async function poolServe() {
   const masterRaw = process.env.KODY_MASTER_KEY?.trim();
   if (!masterRaw) throw new Error("KODY_MASTER_KEY required for pool-serve");
-  const githubToken = process.env.GITHUB_TOKEN?.trim();
-  if (!githubToken) throw new Error("GITHUB_TOKEN required for pool-serve (reads per-repo vaults)");
+  const githubToken2 = process.env.GITHUB_TOKEN?.trim();
+  if (!githubToken2) throw new Error("GITHUB_TOKEN required for pool-serve (reads per-repo vaults)");
   const master = masterKeyBytes(masterRaw);
   const poolApiKey = derivePoolApiKey(master);
   const runnerApiKey = deriveRunnerApiKey(master);
@@ -22671,12 +23002,12 @@ async function poolServe() {
   const region = process.env.POOL_REGION ?? "fra";
   const perf = process.env.POOL_PERF ?? "medium";
   const guest = PERF_GUEST[perf] ?? PERF_GUEST.medium;
-  const min = envInt("POOL_MIN", 2);
-  const runnerPort = envInt("RUNNER_PORT", 8080);
-  const apiPort = envInt("POOL_API_PORT", 4100);
-  const healthTimeoutMs = envInt("POOL_HEALTH_TIMEOUT_MS", 12e4);
+  const min = envInt2("POOL_MIN", 2);
+  const runnerPort = envInt2("RUNNER_PORT", 8080);
+  const apiPort = envInt2("POOL_API_PORT", 4100);
+  const healthTimeoutMs = envInt2("POOL_HEALTH_TIMEOUT_MS", 12e4);
   const registry = new PoolRegistry({
-    githubToken,
+    githubToken: githubToken2,
     masterKey: master,
     base: {
       min,
@@ -22690,12 +23021,12 @@ async function poolServe() {
     },
     log
   });
-  const refillMs = envInt("POOL_REFILL_INTERVAL_MS", 6e4);
+  const refillMs = envInt2("POOL_REFILL_INTERVAL_MS", 6e4);
   const tick = setInterval(() => {
     registry.resyncAll().catch((err) => log(`resync tick failed: ${err instanceof Error ? err.message : String(err)}`));
   }, refillMs);
   const dutyTickEnabled = (process.env.POOL_CAPABILITY_TICK ?? "1") !== "0";
-  const dutyTickMs = envInt("POOL_CAPABILITY_TICK_MS", 15 * 6e4);
+  const dutyTickMs = envInt2("POOL_CAPABILITY_TICK_MS", 15 * 6e4);
   const dutyTick = dutyTickEnabled ? setInterval(() => {
     runCapabilityFallbackTick({
       isDegraded: () => gitHubActionsDegraded(),
@@ -22753,10 +23084,10 @@ async function poolServe() {
     }
   });
   const apiHost = process.env.POOL_API_HOST ?? "::";
-  await new Promise((resolve8) => {
+  await new Promise((resolve9) => {
     server.listen(apiPort, apiHost, () => {
       log(`listening on ${apiHost}:${apiPort} (min=${min}, app=${app}, region=${region})`);
-      resolve8();
+      resolve9();
     });
   });
   const shutdown = (signal) => {
@@ -22795,17 +23126,17 @@ function authOk2(req, expected) {
   return false;
 }
 function readJsonBody3(req) {
-  return new Promise((resolve8, reject) => {
+  return new Promise((resolve9, reject) => {
     const chunks = [];
     req.on("data", (c) => chunks.push(c));
     req.on("end", () => {
       const raw = Buffer.concat(chunks).toString("utf-8");
       if (!raw.trim()) {
-        resolve8({});
+        resolve9({});
         return;
       }
       try {
-        resolve8(JSON.parse(raw));
+        resolve9(JSON.parse(raw));
       } catch (err) {
         reject(err instanceof Error ? err : new Error(String(err)));
       }
@@ -22824,8 +23155,8 @@ function parseJob(body) {
   if (!jobId) return { error: "jobId required" };
   const repo = typeof b.repo === "string" ? b.repo.trim() : "";
   if (!/^[^/\s]+\/[^/\s]+$/.test(repo)) return { error: "repo must be 'owner/name'" };
-  const githubToken = typeof b.githubToken === "string" ? b.githubToken.trim() : "";
-  if (!githubToken) return { error: "githubToken required" };
+  const githubToken2 = typeof b.githubToken === "string" ? b.githubToken.trim() : "";
+  if (!githubToken2) return { error: "githubToken required" };
   const action = typeof b.action === "string" && b.action.trim() ? b.action.trim() : void 0;
   const message = typeof b.message === "string" && b.message.trim() ? b.message.trim() : void 0;
   const mode = b.mode === "interactive" ? "interactive" : b.mode === "scheduled" ? "scheduled" : "issue";
@@ -22837,7 +23168,7 @@ function parseJob(body) {
     message
   });
   if ("error" in runRequest) return { error: runRequest.error };
-  const job = { jobId, repo, githubToken, runRequest: runRequest.request };
+  const job = { jobId, repo, githubToken: githubToken2, runRequest: runRequest.request };
   if (job.runRequest.target.type === "issue") {
     job.issueNumber = job.runRequest.target.id;
   } else if (job.runRequest.target.type === "chat") {
@@ -22939,13 +23270,13 @@ async function defaultRunJob(job) {
     ...interactive && job.idleExitMs ? { KODY_IDLE_EXIT_MS: String(job.idleExitMs) } : {},
     ...interactive && job.hardCapMs ? { KODY_HARD_CAP_MS: String(job.hardCapMs) } : {}
   };
-  const run = (cmd, args, cwd) => new Promise((resolve8) => {
+  const run = (cmd, args, cwd) => new Promise((resolve9) => {
     const child = spawn8(cmd, args, { stdio: "inherit", env: childEnv, cwd });
-    child.on("exit", (code) => resolve8(code ?? 0));
+    child.on("exit", (code) => resolve9(code ?? 0));
     child.on("error", (err) => {
       process.stderr.write(`[runner-serve] ${cmd} failed: ${err.message}
 `);
-      resolve8(1);
+      resolve9(1);
     });
   });
   process.stdout.write(`[runner-serve] job ${job.jobId}: cloning ${job.repo}@${branch}
@@ -23021,11 +23352,11 @@ async function runnerServe() {
   const port = Number(process.env.PORT ?? DEFAULT_PORT2);
   const server = buildServer2({ apiKey });
   const host = process.env.RUNNER_HOST ?? "::";
-  await new Promise((resolve8) => {
+  await new Promise((resolve9) => {
     server.listen(port, host, () => {
       process.stdout.write(`[runner-serve] listening on ${host}:${port} (idle, awaiting job)
 `);
-      resolve8();
+      resolve9();
     });
   });
   const shutdown = (signal) => {
@@ -23094,14 +23425,14 @@ async function serve(opts) {
 `);
     const args = ["--dangerously-skip-permissions", "--model", model.model];
     const child = spawn9("claude", args, { stdio: "inherit", env: editorEnv, cwd: opts.cwd });
-    const exitCode = await new Promise((resolve8) => {
-      child.on("exit", (code) => resolve8(code ?? 0));
+    const exitCode = await new Promise((resolve9) => {
+      child.on("exit", (code) => resolve9(code ?? 0));
       child.on("error", (err) => {
         process.stderr.write(`[kody serve] failed to launch Claude Code: ${err.message}
 `);
         process.stderr.write(`  Install: https://docs.anthropic.com/claude/docs/claude-code
 `);
-        resolve8(1);
+        resolve9(1);
       });
     });
     killProxy();