@kody-ade/kody-engine 0.4.304 → 0.4.305

package/dist/bin/kody.js

@@ -15,7 +15,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "@kody-ade/kody-engine",
-      version: "0.4.304",
+      version: "0.4.305",
       description: "kody \u2014 autonomous development engine. Single-session Claude Code agent behind a generic executor + declarative executable profiles.",
       license: "MIT",
       type: "module",
@@ -15826,165 +15826,6 @@ var init_runFlow = __esm({
   }
 });
 
-// src/scripts/previewBuildHelpers.ts
-import { createDecipheriv, createHash as createHash3 } from "crypto";
-function shortHash(s) {
-  return createHash3("sha256").update(s).digest("hex").slice(0, 6);
-}
-function previewAppName(repo, pr) {
-  const [owner, name] = repo.split("/");
-  if (!owner || !name) {
-    throw new Error(`invalid repo "${repo}", expected "owner/name"`);
-  }
-  return `kp-${shortHash(owner)}-${shortHash(name)}-pr-${pr}`;
-}
-function basePreviewAppName(repo) {
-  const [owner, name] = repo.split("/");
-  if (!owner || !name) {
-    throw new Error(`invalid repo "${repo}", expected "owner/name"`);
-  }
-  return `kp-${shortHash(owner)}-${shortHash(name)}-base`;
-}
-function decryptVaultPayload(payload, keyRaw) {
-  const parts = payload.split(":");
-  if (parts.length !== 4 || parts[0] !== "v1") {
-    throw new Error("invalid vault payload format");
-  }
-  const [, ivB64, ctB64, tagB64] = parts;
-  const key = /^[0-9a-fA-F]{64}$/.test(keyRaw) ? Buffer.from(keyRaw, "hex") : Buffer.from(keyRaw, "base64");
-  if (key.length !== 32) {
-    throw new Error("KODY_MASTER_KEY must decode to 32 bytes");
-  }
-  const iv = Buffer.from(ivB64, "base64");
-  const ct = Buffer.from(ctB64, "base64");
-  const tag = Buffer.from(tagB64, "base64");
-  const decipher = createDecipheriv("aes-256-gcm", key, iv);
-  decipher.setAuthTag(tag);
-  return Buffer.concat([decipher.update(ct), decipher.final()]).toString("utf8");
-}
-function buildEnvFromVault(doc) {
-  const buildEnv = {};
-  for (const [name, entry] of Object.entries(doc.secrets ?? {})) {
-    if (!entry?.value) continue;
-    if (NEVER_PASS_TO_BUILD.has(name)) continue;
-    buildEnv[name] = entry.value;
-  }
-  const raw = doc.secrets?.KODY_PREVIEW_BUILD_MODE?.value;
-  const buildMode = raw?.toLowerCase().trim() === "dev" ? "dev" : "prod";
-  return { buildEnv, buildMode };
-}
-function formatPreviewComment(args) {
-  const url = `https://${args.appName}.fly.dev`;
-  return [
-    "<!-- kody-fly-preview -->",
-    `\u2705 **Preview ready:** ${url}`,
-    "",
-    `<sub>App: \`${args.appName}\` \xB7 Commit: \`${args.ref.slice(0, 7)}\` \xB7 Updated: ${args.nowIso}</sub>`
-  ].join("\n");
-}
-function defaultImageTag(repo, ref) {
-  return createHash3("sha256").update(`${repo}@${ref}`).digest("hex").slice(0, 12);
-}
-var NEVER_PASS_TO_BUILD;
-var init_previewBuildHelpers = __esm({
-  "src/scripts/previewBuildHelpers.ts"() {
-    "use strict";
-    NEVER_PASS_TO_BUILD = /* @__PURE__ */ new Set([
-      "FLY_API_TOKEN",
-      "FLY_ORG_SLUG",
-      "FLY_DEFAULT_REGION",
-      "KODY_MASTER_KEY",
-      // Preview-config knob; consumed by the dispatcher before spawn.
-      "KODY_PREVIEW_BUILD_MODE"
-    ]);
-  }
-});
-
-// src/scripts/previewBuildRun.ts
-import { spawn as spawn4 } from "child_process";
-async function runCmd(cmd, args, opts = {}) {
-  await new Promise((resolve10, reject) => {
-    const child = spawn4(cmd, args, {
-      cwd: opts.cwd,
-      env: { ...process.env, ...opts.env ?? {} },
-      stdio: opts.input ? ["pipe", "inherit", "inherit"] : "inherit"
-    });
-    if (opts.input && child.stdin) {
-      child.stdin.write(opts.input);
-      child.stdin.end();
-    }
-    child.on("error", reject);
-    child.on("close", (code) => {
-      if (code === 0) resolve10();
-      else reject(new Error(`${cmd} ${args.join(" ")} exited ${code}`));
-    });
-  });
-}
-var init_previewBuildRun = __esm({
-  "src/scripts/previewBuildRun.ts"() {
-    "use strict";
-  }
-});
-
-// src/scripts/previewBuildNamespace.ts
-async function fetchGithubOidcToken(audience) {
-  const url = process.env.ACTIONS_ID_TOKEN_REQUEST_URL?.trim();
-  const requestToken = process.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN?.trim();
-  if (!url || !requestToken) return null;
-  const res = await fetch(`${url}&audience=${encodeURIComponent(audience)}`, {
-    headers: { Authorization: `Bearer ${requestToken}` },
-    signal: AbortSignal.timeout(REQ_TIMEOUT_MS)
-  });
-  if (!res.ok) {
-    throw new Error(`OIDC token request failed: ${res.status} ${res.statusText}`);
-  }
-  const data = await res.json();
-  if (!data.value) throw new Error("OIDC token response missing `value`");
-  return data.value;
-}
-async function setupNamespaceBuilder(opts) {
-  try {
-    await runCmd("bash", ["-c", NSC_INSTALL]);
-    const jwt = await fetchGithubOidcToken(NSC_OIDC_AUDIENCE);
-    if (!jwt) {
-      console.warn("[preview-build] no GitHub OIDC token (id-token: write missing?) \u2014 local docker build");
-      return null;
-    }
-    await runCmd("nsc", ["auth", "exchange-oidc-token", "--tenant_id", opts.tenantId, "--token", jwt]);
-    await runCmd("nsc", ["docker", "buildx", "setup", "--name", opts.builderName]);
-    console.log(`[preview-build] Namespace remote builder ready (${opts.builderName})`);
-    return opts.builderName;
-  } catch (err) {
-    console.warn(
-      "[preview-build] Namespace setup failed \u2014 falling back to local docker:",
-      err instanceof Error ? err.message : String(err)
-    );
-    return null;
-  }
-}
-var NSC_OIDC_AUDIENCE, REQ_TIMEOUT_MS, NSC_INSTALL;
-var init_previewBuildNamespace = __esm({
-  "src/scripts/previewBuildNamespace.ts"() {
-    "use strict";
-    init_previewBuildRun();
-    NSC_OIDC_AUDIENCE = "https://namespace.so";
-    REQ_TIMEOUT_MS = 15e3;
-    NSC_INSTALL = `
-set -euo pipefail
-if [ ! -x /usr/local/bin/nsc ]; then
-  ARCH=$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/')
-  OS=$(uname -s | tr '[:upper:]' '[:lower:]')
-  curl -fsSL "https://get.namespace.so/packages/nsc/latest?arch=\${ARCH}&os=\${OS}" -o /tmp/nsc.tar.gz
-  mkdir -p /tmp/nsc-extract
-  tar -xzf /tmp/nsc.tar.gz -C /tmp/nsc-extract
-  NSC_BIN=$(find /tmp/nsc-extract -type f -name nsc | head -1)
-  sudo install -m 0755 "$NSC_BIN" /usr/local/bin/nsc
-fi
-/usr/local/bin/nsc version
-`;
-  }
-});
-
 // src/stateRepoGithub.ts
 import * as fs39 from "fs";
 import * as path37 from "path";
@@ -16004,7 +15845,7 @@ async function githubContentsFile(opts) {
       "X-GitHub-Api-Version": "2022-11-28",
       "User-Agent": "kody-engine"
     },
-    signal: AbortSignal.timeout(REQ_TIMEOUT_MS2)
+    signal: AbortSignal.timeout(REQ_TIMEOUT_MS)
   });
   if (res.status === 404) return null;
   if (!res.ok) {
@@ -16103,7 +15944,7 @@ async function writeGithubStateTextWithConfig(opts) {
       "User-Agent": "kody-engine"
     },
     body: JSON.stringify(payload),
-    signal: AbortSignal.timeout(REQ_TIMEOUT_MS2)
+    signal: AbortSignal.timeout(REQ_TIMEOUT_MS)
   });
   if (!res.ok) {
     throw new Error(
@@ -16157,13 +15998,196 @@ async function persistJsonlFileToGithubState(opts) {
     }
   }
 }
-var GITHUB_API, REQ_TIMEOUT_MS2;
+var GITHUB_API, REQ_TIMEOUT_MS;
 var init_stateRepoGithub = __esm({
   "src/stateRepoGithub.ts"() {
     "use strict";
     init_stateRepo();
     GITHUB_API = "https://api.github.com";
-    REQ_TIMEOUT_MS2 = 3e4;
+    REQ_TIMEOUT_MS = 3e4;
+  }
+});
+
+// src/scripts/previewBuildHelpers.ts
+import { createDecipheriv, createHash as createHash3, hkdfSync } from "crypto";
+function shortHash(s) {
+  return createHash3("sha256").update(s).digest("hex").slice(0, 6);
+}
+function previewAppName(repo, pr) {
+  const [owner, name] = repo.split("/");
+  if (!owner || !name) {
+    throw new Error(`invalid repo "${repo}", expected "owner/name"`);
+  }
+  return `kp-${shortHash(owner)}-${shortHash(name)}-pr-${pr}`;
+}
+function basePreviewAppName(repo) {
+  const [owner, name] = repo.split("/");
+  if (!owner || !name) {
+    throw new Error(`invalid repo "${repo}", expected "owner/name"`);
+  }
+  return `kp-${shortHash(owner)}-${shortHash(name)}-base`;
+}
+function decryptVaultPayload(payload, keyRaw) {
+  const parts = payload.split(":");
+  if (parts.length !== 4 || parts[0] !== "v1") {
+    throw new Error("invalid vault payload format");
+  }
+  const [, ivB64, ctB64, tagB64] = parts;
+  const key = decodeMasterKey(keyRaw);
+  if (key.length !== 32) {
+    throw new Error("KODY_MASTER_KEY must decode to 32 bytes");
+  }
+  const iv = Buffer.from(ivB64, "base64");
+  const ct = Buffer.from(ctB64, "base64");
+  const tag = Buffer.from(tagB64, "base64");
+  const decipher = createDecipheriv("aes-256-gcm", key, iv);
+  decipher.setAuthTag(tag);
+  return Buffer.concat([decipher.update(ct), decipher.final()]).toString("utf8");
+}
+function decodeMasterKey(keyRaw) {
+  if (/^[0-9a-fA-F]{64}$/.test(keyRaw)) return Buffer.from(keyRaw, "hex");
+  return Buffer.from(keyRaw.replace(/-/g, "+").replace(/_/g, "/"), "base64");
+}
+function derivePreviewVerifyKey(masterKeyRaw) {
+  const masterKey = decodeMasterKey(masterKeyRaw);
+  if (masterKey.length !== 32) {
+    throw new Error("KODY_MASTER_KEY must decode to 32 bytes");
+  }
+  return Buffer.from(hkdfSync("sha256", masterKey, Buffer.alloc(0), PREVIEW_KEY_INFO, 32)).toString("hex");
+}
+function previewRuntimeEnv(args) {
+  return {
+    ...args.buildEnv,
+    KODY_PREVIEW_VERIFY_KEY: derivePreviewVerifyKey(args.masterKey),
+    KODY_REPO_CONTEXT: args.repo,
+    KODY_PR: String(args.pr)
+  };
+}
+function buildEnvFromVault(doc) {
+  const buildEnv = {};
+  for (const [name, entry] of Object.entries(doc.secrets ?? {})) {
+    if (!entry?.value) continue;
+    if (NEVER_PASS_TO_BUILD.has(name)) continue;
+    buildEnv[name] = entry.value;
+  }
+  const raw = doc.secrets?.KODY_PREVIEW_BUILD_MODE?.value;
+  const buildMode = raw?.toLowerCase().trim() === "dev" ? "dev" : "prod";
+  return { buildEnv, buildMode };
+}
+function formatPreviewComment(args) {
+  const url = `https://${args.appName}.fly.dev`;
+  return [
+    "<!-- kody-fly-preview -->",
+    `\u2705 **Preview ready:** ${url}`,
+    "",
+    `<sub>App: \`${args.appName}\` \xB7 Commit: \`${args.ref.slice(0, 7)}\` \xB7 Updated: ${args.nowIso}</sub>`
+  ].join("\n");
+}
+function defaultImageTag(repo, ref) {
+  return createHash3("sha256").update(`${repo}@${ref}`).digest("hex").slice(0, 12);
+}
+var NEVER_PASS_TO_BUILD, PREVIEW_KEY_INFO;
+var init_previewBuildHelpers = __esm({
+  "src/scripts/previewBuildHelpers.ts"() {
+    "use strict";
+    NEVER_PASS_TO_BUILD = /* @__PURE__ */ new Set([
+      "FLY_API_TOKEN",
+      "FLY_ORG_SLUG",
+      "FLY_DEFAULT_REGION",
+      "KODY_MASTER_KEY",
+      // Preview-config knob; consumed by the dispatcher before spawn.
+      "KODY_PREVIEW_BUILD_MODE",
+      "KODY_PREVIEW_VERIFY_KEY",
+      "KODY_REPO_CONTEXT",
+      "KODY_PR",
+      "KODY_BRANCH"
+    ]);
+    PREVIEW_KEY_INFO = "kody-preview:v1";
+  }
+});
+
+// src/scripts/previewBuildRun.ts
+import { spawn as spawn4 } from "child_process";
+async function runCmd(cmd, args, opts = {}) {
+  await new Promise((resolve10, reject) => {
+    const child = spawn4(cmd, args, {
+      cwd: opts.cwd,
+      env: { ...process.env, ...opts.env ?? {} },
+      stdio: opts.input ? ["pipe", "inherit", "inherit"] : "inherit"
+    });
+    if (opts.input && child.stdin) {
+      child.stdin.write(opts.input);
+      child.stdin.end();
+    }
+    child.on("error", reject);
+    child.on("close", (code) => {
+      if (code === 0) resolve10();
+      else reject(new Error(`${cmd} ${args.join(" ")} exited ${code}`));
+    });
+  });
+}
+var init_previewBuildRun = __esm({
+  "src/scripts/previewBuildRun.ts"() {
+    "use strict";
+  }
+});
+
+// src/scripts/previewBuildNamespace.ts
+async function fetchGithubOidcToken(audience) {
+  const url = process.env.ACTIONS_ID_TOKEN_REQUEST_URL?.trim();
+  const requestToken = process.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN?.trim();
+  if (!url || !requestToken) return null;
+  const res = await fetch(`${url}&audience=${encodeURIComponent(audience)}`, {
+    headers: { Authorization: `Bearer ${requestToken}` },
+    signal: AbortSignal.timeout(REQ_TIMEOUT_MS2)
+  });
+  if (!res.ok) {
+    throw new Error(`OIDC token request failed: ${res.status} ${res.statusText}`);
+  }
+  const data = await res.json();
+  if (!data.value) throw new Error("OIDC token response missing `value`");
+  return data.value;
+}
+async function setupNamespaceBuilder(opts) {
+  try {
+    await runCmd("bash", ["-c", NSC_INSTALL]);
+    const jwt = await fetchGithubOidcToken(NSC_OIDC_AUDIENCE);
+    if (!jwt) {
+      console.warn("[preview-build] no GitHub OIDC token (id-token: write missing?) \u2014 local docker build");
+      return null;
+    }
+    await runCmd("nsc", ["auth", "exchange-oidc-token", "--tenant_id", opts.tenantId, "--token", jwt]);
+    await runCmd("nsc", ["docker", "buildx", "setup", "--name", opts.builderName]);
+    console.log(`[preview-build] Namespace remote builder ready (${opts.builderName})`);
+    return opts.builderName;
+  } catch (err) {
+    console.warn(
+      "[preview-build] Namespace setup failed \u2014 falling back to local docker:",
+      err instanceof Error ? err.message : String(err)
+    );
+    return null;
+  }
+}
+var NSC_OIDC_AUDIENCE, REQ_TIMEOUT_MS2, NSC_INSTALL;
+var init_previewBuildNamespace = __esm({
+  "src/scripts/previewBuildNamespace.ts"() {
+    "use strict";
+    init_previewBuildRun();
+    NSC_OIDC_AUDIENCE = "https://namespace.so";
+    REQ_TIMEOUT_MS2 = 15e3;
+    NSC_INSTALL = `
+set -euo pipefail
+if [ ! -x /usr/local/bin/nsc ]; then
+  ARCH=$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/')
+  OS=$(uname -s | tr '[:upper:]' '[:lower:]')
+  curl -fsSL "https://get.namespace.so/packages/nsc/latest?arch=\${ARCH}&os=\${OS}" -o /tmp/nsc.tar.gz
+  mkdir -p /tmp/nsc-extract
+  tar -xzf /tmp/nsc.tar.gz -C /tmp/nsc-extract
+  NSC_BIN=$(find /tmp/nsc-extract -type f -name nsc | head -1)
+  sudo install -m 0755 "$NSC_BIN" /usr/local/bin/nsc
+fi
+/usr/local/bin/nsc version
+`;
   }
 });
 
@@ -16375,10 +16399,10 @@ var FLY_MACHINES, FLY_GRAPHQL, REQ_TIMEOUT_MS3, runPreviewBuild;
 var init_runPreviewBuild = __esm({
   "src/scripts/runPreviewBuild.ts"() {
     "use strict";
+    init_stateRepoGithub();
     init_previewBuildHelpers();
     init_previewBuildNamespace();
     init_previewBuildRun();
-    init_stateRepoGithub();
     FLY_MACHINES = "https://api.machines.dev/v1";
     FLY_GRAPHQL = "https://api.fly.io/graphql";
     REQ_TIMEOUT_MS3 = 3e4;
@@ -16503,7 +16527,7 @@ var init_runPreviewBuild = __esm({
             appName,
             region,
             image: `registry.fly.io/${appName}:${tag}`,
-            env: buildEnv
+            env: previewRuntimeEnv({ buildEnv, masterKey, pr, repo })
           },
           flyToken
         );
@@ -23060,7 +23084,7 @@ async function runCapabilityFallbackTick(deps) {
 }
 
 // src/pool/keys.ts
-import { hkdfSync } from "crypto";
+import { hkdfSync as hkdfSync2 } from "crypto";
 var POOL_API_KEY_INFO = "kody-pool-api:v1";
 var RUNNER_API_KEY_INFO = "kody-runner-api:v1";
 function masterKeyBytes(raw) {
@@ -23072,7 +23096,7 @@ function masterKeyBytes(raw) {
   return Buffer.from(v.replace(/-/g, "+").replace(/_/g, "/"), "base64");
 }
 function deriveKey(master, info, length = 32) {
-  return Buffer.from(hkdfSync("sha256", master, Buffer.alloc(0), info, length)).toString("hex");
+  return Buffer.from(hkdfSync2("sha256", master, Buffer.alloc(0), info, length)).toString("hex");
 }
 function derivePoolApiKey(master) {
   return deriveKey(master, POOL_API_KEY_INFO);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kody-ade/kody-engine",
-  "version": "0.4.304",
+  "version": "0.4.305",
   "description": "kody — autonomous development engine. Single-session Claude Code agent behind a generic executor + declarative executable profiles.",
   "license": "MIT",
   "type": "module",