@kody-ade/kody-engine 0.4.300 → 0.4.301

package/dist/bin/kody.js

@@ -15,7 +15,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "@kody-ade/kody-engine",
-      version: "0.4.300",
+      version: "0.4.301",
       description: "kody \u2014 autonomous development engine. Single-session Claude Code agent behind a generic executor + declarative executable profiles.",
       license: "MIT",
       type: "module",
@@ -20302,6 +20302,13 @@ function autoDispatch(opts) {
   const afterTag = extractAfterTag(body);
   const firstTokenRaw = extractSubcommand(afterTag);
   const firstToken = firstTokenRaw && POLITE_WORDS.has(firstTokenRaw) ? null : firstTokenRaw;
+  if (isBotAuthor && firstToken) {
+    process.stderr.write(
+      `[kody] dispatch: rejecting bot self-dispatch comment (author=${authorLogin || authorType}, firstToken=${firstToken})
+`
+    );
+    return null;
+  }
   const aliases = opts?.config?.aliases ?? BUILTIN_ALIASES;
   const aliased = firstToken ? aliases[firstToken] ?? firstToken : null;
   let route = null;
@@ -20382,13 +20389,6 @@ function autoDispatchTyped(opts) {
   if (!hasKodyMention(rawBody)) {
     return { kind: "silent", reason: "comment does not mention @kody" };
   }
-  if (authorLogin === "kody-bot" || authorType === "Bot") {
-    return { kind: "silent", reason: `bot-authored comment (${authorLogin || authorType})` };
-  }
-  if (!associationAllowed(event, opts?.config)) {
-    const assoc = String(comment?.author_association ?? "").toUpperCase() || "<none>";
-    return { kind: "silent", reason: `commenter association '${assoc}' not in access.allowedAssociations` };
-  }
   const targetNum = Number(issue?.number ?? 0);
   const isPr = !!issue?.pull_request;
   if (!targetNum) {
@@ -20396,6 +20396,23 @@ function autoDispatchTyped(opts) {
   }
   const afterTag = extractAfterTag(rawBody.toLowerCase());
   const tokenRaw = extractSubcommand(afterTag) ?? "";
+  if ((authorLogin === "kody-bot" || authorType === "Bot") && tokenRaw && !POLITE_WORDS.has(tokenRaw)) {
+    return {
+      kind: "rejected",
+      reason: "bot_self_dispatch",
+      token: tokenRaw,
+      target: targetNum,
+      isPr,
+      author: authorLogin || authorType
+    };
+  }
+  if (authorLogin === "kody-bot" || authorType === "Bot") {
+    return { kind: "silent", reason: `bot-authored comment (${authorLogin || authorType})` };
+  }
+  if (!associationAllowed(event, opts?.config)) {
+    const assoc = String(comment?.author_association ?? "").toUpperCase() || "<none>";
+    return { kind: "silent", reason: `commenter association '${assoc}' not in access.allowedAssociations` };
+  }
   if (!tokenRaw || POLITE_WORDS.has(tokenRaw)) {
     return {
       kind: "silent",
@@ -20553,6 +20570,7 @@ function coerceBare(spec, value) {
 init_gha();
 init_issue();
 init_job();
+init_lifecycleLabels();
 init_registry();
 
 // src/run-request.ts
@@ -20618,6 +20636,11 @@ function readRunRequestFromEnv(env = process.env) {
 // src/kody-cli.ts
 init_runtimePaths();
 init_stateWorkspace();
+var FAILED_DISPATCH_LABEL = {
+  label: "kody:failed",
+  color: "e11d21",
+  description: "Kody failed or rejected the run"
+};
 var CI_HELP = `kody ci \u2014 minimal-YAML autonomous engineer (CI preflight + run)
 
 Usage:
@@ -20889,6 +20912,7 @@ ${tail}
     postIssueComment(issueNumber, body, cwd);
   } catch {
   }
+  setKodyLabel(issueNumber, FAILED_DISPATCH_LABEL, cwd);
 }
 function shouldPostRunFailureTail(exitCode) {
   return exitCode !== 0 && exitCode !== 1 && exitCode !== 2 && exitCode !== 3;
@@ -21045,6 +21069,33 @@ async function runCi(argv) {
   }
   if (!args.issueNumber && !autoFallback && process.env.GITHUB_EVENT_NAME) {
     const outcome = autoDispatchTyped({ config: earlyConfig });
+    if (outcome.kind === "rejected") {
+      try {
+        unpackAllSecrets();
+        await resolveAuthToken();
+      } catch {
+      }
+      const body = [
+        `\u26A0\uFE0F kody rejected this trigger: bot-authored \`@kody ${outcome.token}\` comments cannot dispatch work.`,
+        "",
+        "Use workflow_dispatch or runExecutableChain for engine-owned continuation instead."
+      ].join("\n");
+      try {
+        if (outcome.isPr) postPrReviewComment(outcome.target, body, cwd);
+        else postIssueComment(outcome.target, body, cwd);
+      } catch (err) {
+        process.stderr.write(
+          `[kody] dispatch: failed to post rejected-trigger feedback: ${err instanceof Error ? err.message : String(err)}
+`
+        );
+      }
+      setKodyLabel(outcome.target, FAILED_DISPATCH_LABEL, cwd);
+      process.stderr.write(
+        `[kody] dispatch: rejected bot self-dispatch by ${outcome.author} on #${outcome.target} (${outcome.token})
+`
+      );
+      return 64;
+    }
     if (outcome.kind === "unrecognized") {
       try {
         unpackAllSecrets();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kody-ade/kody-engine",
-  "version": "0.4.300",
+  "version": "0.4.301",
   "description": "kody — autonomous development engine. Single-session Claude Code agent behind a generic executor + declarative executable profiles.",
   "license": "MIT",
   "type": "module",