@kody-ade/kody-engine 0.4.305 → 0.4.307

package/dist/bin/kody.js

@@ -15,7 +15,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "@kody-ade/kody-engine",
-      version: "0.4.305",
+      version: "0.4.307",
       description: "kody \u2014 autonomous development engine. Single-session Claude Code agent behind a generic executor + declarative executable profiles.",
       license: "MIT",
       type: "module",
@@ -549,11 +549,11 @@ function branchApiPath(config, targetPath) {
 }
 function ensureStateBranch(config, cwd) {
   const parsed = parseStateRepo(config);
-  const cacheKey3 = `${parsed.owner}/${parsed.repo}:${parsed.branch}`;
-  if (ensuredStateBranches.has(cacheKey3)) return;
+  const cacheKey4 = `${parsed.owner}/${parsed.repo}:${parsed.branch}`;
+  if (ensuredStateBranches.has(cacheKey4)) return;
   try {
     gh(["api", `/repos/${parsed.owner}/${parsed.repo}/git/ref/heads/${parsed.branch}`], { cwd });
-    ensuredStateBranches.add(cacheKey3);
+    ensuredStateBranches.add(cacheKey4);
     return;
   } catch (err) {
     if (!is404(err)) throw err;
@@ -572,7 +572,7 @@ function ensureStateBranch(config, cwd) {
   } catch (err) {
     if (!isAlreadyExists(err)) throw err;
   }
-  ensuredStateBranches.add(cacheKey3);
+  ensuredStateBranches.add(cacheKey4);
 }
 function readStateText(config, cwd, filePath) {
   const targetPath = stateRepoPath(config, filePath);
@@ -1914,6 +1914,7 @@ function parseCapabilityConfig(raw) {
     mentions: stringList(raw.mentions).map((m) => m.replace(/^@/, "")),
     tools,
     capabilityTools: tools,
+    capabilityToolMode: parseCapabilityToolMode(raw.capabilityToolMode),
     implementations,
     executables: stringList(raw.executables),
     role: stringField(raw.role),
@@ -1924,6 +1925,11 @@ function parseCapabilityConfig(raw) {
     workflow: parseWorkflow(raw.workflow)
   };
 }
+function parseCapabilityToolMode(raw) {
+  if (raw === void 0 || raw === null || raw === "") return void 0;
+  if (raw === "lock" || raw === "append") return raw;
+  return void 0;
+}
 function parseCapabilityBody(raw, slug2) {
   const trimmed = raw.trim();
   const firstLine2 = trimmed.split("\n", 1)[0] ?? "";
@@ -2414,7 +2420,8 @@ __export(capabilityMcp_exports, {
   parseCapabilityTrustMode: () => parseCapabilityTrustMode,
   readCapabilityTrustMode: () => readCapabilityTrustMode,
   readCheckRuns: () => readCheckRuns,
-  readThread: () => readThread
+  readThread: () => readThread,
+  startCapability: () => startCapability
 });
 import { createSdkMcpServer as createSdkMcpServer4, tool as tool4 } from "@anthropic-ai/claude-agent-sdk";
 import { z as z3 } from "zod";
@@ -2663,6 +2670,9 @@ function dispatchWorkflow(workflowFile, capability, issueNumber, repoSlug) {
     return { ok: false, error: err instanceof Error ? err.message : String(err) };
   }
 }
+function startCapability(workflowFile, name, issue, repoSlug) {
+  return dispatchWorkflow(workflowFile, name, issue, repoSlug);
+}
 function expectedDispatchTarget(capability) {
   const route = resolveCapabilityAction(capability);
   if (!route) return null;
@@ -2835,9 +2845,31 @@ function capabilityToolDefinitions(opts) {
       return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
     }
   };
+  const startCapabilityTool = {
+    name: "start_capability",
+    description: "Start a known Kody capability on an issue or PR through workflow_dispatch. Use this instead of shelling out to `gh workflow run` or posting bot-authored `@kody` command comments. E.g. start_capability({name:'qa-engineer', issue:<n>}). Returns {ok} or {ok:false,error}.",
+    inputSchema: {
+      name: z3.string().min(1).describe("Capability action to start (e.g. 'qa-engineer', 'run', 'sync')."),
+      issue: z3.number().int().positive().optional().describe("Issue or PR number forwarded as issue_number."),
+      issueNumber: z3.number().int().positive().optional().describe("Deprecated alias for issue.")
+    },
+    handler: async (args) => {
+      const name = String(args.name ?? "");
+      const issue = Number(args.issue ?? args.issueNumber);
+      if (!Number.isFinite(issue) || issue <= 0) {
+        return { content: [{ type: "text", text: "Start failed: `issue` is required and must be a positive number." }] };
+      }
+      if (isDispatchGated(name, readCapabilityTrustMode(opts.state, opts.repoSlug, opts.capabilitySlug))) {
+        return { content: [{ type: "text", text: trustRefusal(opts.capabilitySlug) }] };
+      }
+      const result = startCapability(workflowFile, name, issue, opts.repoSlug);
+      const text = result.ok ? `Started capability \`${name}\` on #${issue} via workflow_dispatch.` : `Start failed for capability \`${name}\` on #${issue}: ${result.error}`;
+      return { content: [{ type: "text", text }] };
+    }
+  };
   const dispatchTool = {
     name: "dispatch_workflow",
-    description: "Dispatch a kody.yml workflow_dispatch run for a capability action against an issue (the cross-run bot\u2192engine path; a bot `@kody` comment would be dropped). E.g. dispatch_workflow({capability:'run', issueNumber:<n>}) opens a fix PR from a tracking issue. Returns {ok} or {ok:false,error}.",
+    description: "Legacy alias for start_capability. Dispatches a kody.yml workflow_dispatch run for a capability action against an issue. Prefer start_capability({name:'run', issue:<n>}). Returns {ok} or {ok:false,error}.",
     inputSchema: {
       capability: z3.string().min(1).optional().describe("Capability action to run (e.g. 'run')."),
       executable: z3.string().min(1).optional().describe("Deprecated alias for capability."),
@@ -2849,7 +2881,7 @@ function capabilityToolDefinitions(opts) {
       if (isDispatchGated(capability, readCapabilityTrustMode(opts.state, opts.repoSlug, opts.capabilitySlug))) {
         return { content: [{ type: "text", text: trustRefusal(opts.capabilitySlug) }] };
       }
-      const result = dispatchWorkflow(workflowFile, capability, issueNumber, opts.repoSlug);
+      const result = startCapability(workflowFile, capability, issueNumber, opts.repoSlug);
       const text = result.ok ? `Dispatched capability \`${capability}\` on #${issueNumber} via workflow_dispatch.` : `Dispatch failed for capability \`${capability}\` on #${issueNumber}: ${result.error}`;
       return { content: [{ type: "text", text }] };
     }
@@ -2869,6 +2901,7 @@ function capabilityToolDefinitions(opts) {
     readThreadTool,
     ensureIssueTool,
     ensureCommentTool,
+    startCapabilityTool,
     dispatchTool,
     ...cmsTools
   ];
@@ -2918,6 +2951,7 @@ var init_capabilityMcp = __esm({
       "read_thread",
       "ensure_issue",
       "ensure_comment",
+      "start_capability",
       "dispatch_workflow",
       ...DASHBOARD_CMS_MCP_TOOL_NAMES
     ];
@@ -4264,6 +4298,7 @@ function loadProfile(profilePath) {
         describe: typeof r.describe === "string" ? r.describe : base.describe,
         agent: typeof r.agent === "string" && r.agent.trim() ? r.agent.trim() : base.agent,
         capabilityTools: parseStringArray2(r.capabilityTools ?? r.capabilityTools ?? r.tools) ?? base.capabilityTools,
+        capabilityToolMode: parseCapabilityToolMode2(profilePath, r.capabilityToolMode) ?? base.capabilityToolMode,
         mentions: Array.isArray(r.mentions) ? r.mentions.map((m) => String(m).trim()).filter(Boolean) : base.mentions
       };
     }
@@ -4319,6 +4354,7 @@ function loadProfile(profilePath) {
     agent: typeof r.agent === "string" && r.agent.trim() ? r.agent.trim() : void 0,
     // Locked-toolbox palette + mentions from folder-capability profile metadata.
     capabilityTools: parseStringArray2(r.capabilityTools ?? r.capabilityTools ?? r.tools),
+    capabilityToolMode: parseCapabilityToolMode2(profilePath, r.capabilityToolMode),
     mentions: Array.isArray(r.mentions) ? r.mentions.map((m) => String(m).trim()).filter(Boolean) : void 0,
     role,
     kind,
@@ -4360,12 +4396,7 @@ function loadProfile(profilePath) {
   const preNames = new Set(profile.scripts.preflight.map((e) => e.script).filter(Boolean));
   const postNames = profile.scripts.postflight.map((e) => e.script).filter(Boolean);
   const needsState = postNames.includes("writeJobStateFile") || postNames.includes("parseJobStateFromAgentResult");
-  const STATE_LOADERS = [
-    "loadCapabilityState",
-    "loadJobFromFile",
-    "runTickScript",
-    "runScheduledExecutableTick"
-  ];
+  const STATE_LOADERS = ["loadCapabilityState", "loadJobFromFile", "runTickScript", "runScheduledExecutableTick"];
   if (needsState && !STATE_LOADERS.some((s) => preNames.has(s))) {
     throw new ProfileError(
       profilePath,
@@ -4375,6 +4406,11 @@ function loadProfile(profilePath) {
   profile.subagentTemplates = captureSubagentTemplates(profile);
   return profile;
 }
+function parseCapabilityToolMode2(profilePath, raw) {
+  if (raw === void 0 || raw === null || raw === "") return void 0;
+  if (raw === "lock" || raw === "append") return raw;
+  throw new ProfileError(profilePath, `"capabilityToolMode" must be "lock" or "append"`);
+}
 function readPromptTemplates(dir) {
   const out = {};
   const read = (p) => {
@@ -4694,6 +4730,7 @@ var init_profile = __esm({
       "capabilityTools",
       "capabilityTools",
       "tools",
+      "capabilityToolMode",
       "mentions",
       "stage",
       "readsFrom",
@@ -8791,12 +8828,12 @@ var init_appendCompanyActivity = __esm({
   }
 });
 
-// src/companyManagerDecision.ts
-function parseCompanyManagerDecisionText(finalText) {
+// src/agencyArchitectDecision.ts
+function parseAgencyArchitectDecisionText(finalText) {
   const raw = extractDecisionJson(finalText);
   const parsed = JSON.parse(raw);
   if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-    throw new Error("company-manager decision must be JSON object");
+    throw new Error("agency-architect decision must be JSON object");
   }
   const input = parsed;
   const actions = Array.isArray(input.actions) ? input.actions.map(parseAction) : [];
@@ -8844,15 +8881,15 @@ function buildAgentLoopState(action) {
   };
 }
 function extractDecisionJson(finalText) {
-  const fence = finalText.match(/```(?:kody-company-manager-decision|json)\s*([\s\S]*?)```/i);
+  const fence = finalText.match(/```(?:kody-agency-architect-decision|json)\s*([\s\S]*?)```/i);
   if (fence?.[1]) return fence[1].trim();
-  const line = finalText.match(/KODY_COMPANY_MANAGER_DECISION=(\{[\s\S]*\})/);
+  const line = finalText.match(/KODY_AGENCY_ARCHITECT_DECISION=(\{[\s\S]*\})/);
   if (line?.[1]) return line[1].trim();
-  throw new Error("missing kody-company-manager-decision JSON");
+  throw new Error("missing kody-agency-architect-decision JSON");
 }
 function parseAction(value) {
   if (!value || typeof value !== "object" || Array.isArray(value)) {
-    throw new Error("company-manager action must be object");
+    throw new Error("agency-architect action must be object");
   }
   const input = value;
   const kind = input.kind;
@@ -8861,7 +8898,7 @@ function parseAction(value) {
   if (kind === "setGoalLifecycle") return parseSetGoalLifecycle(input);
   if (kind === "updateIntentPortfolio") return parseUpdateIntentPortfolio(input);
   if (kind === "note") return parseNote(input);
-  throw new Error(`unsupported company-manager action kind: ${String(kind)}`);
+  throw new Error(`unsupported agency-architect action kind: ${String(kind)}`);
 }
 function parseCreateManagedGoal(input) {
   const route = Array.isArray(input.route) ? input.route.map(parseRouteStep) : [];
@@ -8957,8 +8994,8 @@ function oneOf(value, allowed, fallback) {
   return typeof value === "string" && allowed.includes(value) ? value : fallback;
 }
 var SLUG_RE;
-var init_companyManagerDecision = __esm({
-  "src/companyManagerDecision.ts"() {
+var init_agencyArchitectDecision = __esm({
+  "src/agencyArchitectDecision.ts"() {
     "use strict";
     init_state2();
     SLUG_RE = /^[a-z][a-z0-9-]{0,63}$/;
@@ -8982,11 +9019,13 @@ function normalizeCompanyIntent(path50, raw) {
   if (!id || !isCompanyIntentId(id)) throw new Error(`${path50}: invalid intent id`);
   const createdAt = stringField3(input.createdAt) || nowIso();
   const updatedAt = stringField3(input.updatedAt) || createdAt;
+  const description = stringField3(input.description);
   return {
     version: 1,
     id,
     status: oneOf2(input.status, ["active", "paused", "archived"], "active"),
     for: stringField3(input.for),
+    ...description ? { description } : {},
     priority: numberField(input.priority, 100),
     posture: oneOf2(
       input.posture,
@@ -9105,8 +9144,8 @@ function normalizeAutomationPolicy(raw) {
 function normalizeManager(raw) {
   return {
     agent: "cto",
-    loop: "company-manager-loop",
-    capability: "company-manager",
+    loop: "agency-architect-loop",
+    capability: "agency-architect",
     reviewEvery: oneOf2(raw?.reviewEvery, ["1d", "1w"], "1d"),
     ...typeof raw?.lastReviewedAt === "string" ? { lastReviewedAt: raw.lastReviewedAt } : {}
   };
@@ -9122,7 +9161,7 @@ var init_companyIntent = __esm({
   }
 });
 
-// src/scripts/applyCompanyManagerDecision.ts
+// src/scripts/applyAgencyArchitectDecision.ts
 function applyAction(config, cwd, action) {
   if (action.kind === "createManagedGoal") {
     const existing = fetchGoalState(config, action.id, cwd);
@@ -9191,7 +9230,7 @@ function applied(action, changed, reason, resource) {
 function mergeUnique(left, right) {
   return [.../* @__PURE__ */ new Set([...left, ...right])].sort();
 }
-function logAppliedCompanyManagerActions(config, cwd, appliedActions) {
+function logAppliedAgencyArchitectActions(config, cwd, appliedActions) {
   const at = nowIso();
   for (const action of appliedActions) {
     if (!action.intentId) continue;
@@ -9206,24 +9245,24 @@ function logAppliedCompanyManagerActions(config, cwd, appliedActions) {
     });
   }
 }
-var applyCompanyManagerDecision;
-var init_applyCompanyManagerDecision = __esm({
-  "src/scripts/applyCompanyManagerDecision.ts"() {
+var applyAgencyArchitectDecision;
+var init_applyAgencyArchitectDecision = __esm({
+  "src/scripts/applyAgencyArchitectDecision.ts"() {
     "use strict";
-    init_companyManagerDecision();
+    init_agencyArchitectDecision();
     init_companyIntent();
     init_stateStore();
     init_state2();
-    applyCompanyManagerDecision = async (ctx) => {
-      const decision = ctx.data.companyManagerDecision;
+    applyAgencyArchitectDecision = async (ctx) => {
+      const decision = ctx.data.agencyArchitectDecision;
       if (!decision || !Array.isArray(decision.actions)) return;
       if (ctx.output.exitCode !== 0) return;
       const applied2 = [];
       for (const action of decision.actions) {
         applied2.push(applyAction(ctx.config, ctx.cwd, action));
       }
-      ctx.data.companyManagerApplied = applied2;
-      ctx.data.companyManagerApplySummary = `company-manager applied ${applied2.filter((item) => item.changed).length}/${applied2.length} action(s)`;
+      ctx.data.agencyArchitectApplied = applied2;
+      ctx.data.agencyArchitectApplySummary = `agency-architect applied ${applied2.filter((item) => item.changed).length}/${applied2.length} action(s)`;
     };
   }
 });
@@ -9233,15 +9272,15 @@ var appendCompanyIntentDecision2;
 var init_appendCompanyIntentDecision = __esm({
   "src/scripts/appendCompanyIntentDecision.ts"() {
     "use strict";
-    init_applyCompanyManagerDecision();
+    init_applyAgencyArchitectDecision();
     appendCompanyIntentDecision2 = async (ctx) => {
-      const applied2 = ctx.data.companyManagerApplied;
+      const applied2 = ctx.data.agencyArchitectApplied;
       if (!applied2 || applied2.length === 0) return;
       try {
-        logAppliedCompanyManagerActions(ctx.config, ctx.cwd, applied2);
+        logAppliedAgencyArchitectActions(ctx.config, ctx.cwd, applied2);
       } catch (err) {
         process.stderr.write(
-          `[company-manager] failed append intent decision log: ${err instanceof Error ? err.message : String(err)}
+          `[agency-architect] failed append intent decision log: ${err instanceof Error ? err.message : String(err)}
 `
         );
       }
@@ -13074,10 +13113,16 @@ var init_loadCapabilityState = __esm({
             `loadCapabilityState: capability '${slug2}' declared capabilityTools not in the kody-capability palette: ${unknown.join(", ")}. Available: ${[...CAPABILITY_MCP_TOOL_NAMES].join(", ")}`
           );
         }
+        const mode = profile.capabilityToolMode ?? "lock";
         ctx.data.capabilityTools = declaredTools;
+        ctx.data.capabilityToolMode = mode;
         ctx.data.capabilityToolsList = declaredTools.map((name) => `- \`${name}\``).join("\n");
         ctx.data.capabilityOperatorMention = mentions;
         const mcpToolNames = declaredTools.map((name) => `mcp__kody-capability__${name}`);
+        if (mode === "append") {
+          profile.claudeCode.tools = [.../* @__PURE__ */ new Set([...profile.claudeCode.tools ?? [], ...mcpToolNames])];
+          return;
+        }
         profile.claudeCode.tools = [...mcpToolNames, "mcp__kody-submit__submit_state"];
         profile.claudeCode.enableSubmitTool = true;
       }
@@ -13289,8 +13334,8 @@ var CAPABILITY_TOOL_PALETTE2, loadJobFromFile;
 var init_loadJobFromFile = __esm({
   "src/scripts/loadJobFromFile.ts"() {
     "use strict";
-    init_capabilityMcp();
     init_agents();
+    init_capabilityMcp();
     init_registry();
     init_jobState();
     CAPABILITY_TOOL_PALETTE2 = new Set(CAPABILITY_MCP_TOOL_NAMES);
@@ -13304,9 +13349,7 @@ var init_loadJobFromFile = __esm({
       }
       const capability = resolveCapabilityFolder(slug2, path33.join(ctx.cwd, jobsDir));
       if (!capability) {
-        throw new Error(
-          `loadJobFromFile: capability folder not found or incomplete: ${path33.join(ctx.cwd, jobsDir, slug2)}`
-        );
+        throw new Error(`loadJobFromFile: capability folder not found or incomplete: ${path33.join(ctx.cwd, jobsDir, slug2)}`);
       }
       const { title, body, config } = capability;
       const mentions = (config.mentions ?? []).map((login) => `@${login}`).join(" ");
@@ -13351,10 +13394,16 @@ var init_loadJobFromFile = __esm({
           );
         }
         const mcpToolNames = declaredTools.map((name) => `mcp__kody-capability__${name}`);
-        profile.claudeCode.tools = [...mcpToolNames, "mcp__kody-submit__submit_state"];
+        const mode = config.capabilityToolMode ?? "lock";
+        if (mode === "append") {
+          profile.claudeCode.tools = [.../* @__PURE__ */ new Set([...profile.claudeCode.tools ?? [], ...mcpToolNames])];
+        } else {
+          profile.claudeCode.tools = [...mcpToolNames, "mcp__kody-submit__submit_state"];
+          ctx.data.promptTemplate = "prompts/locked.md";
+        }
         ctx.data.capabilityTools = declaredTools;
+        ctx.data.capabilityToolMode = mode;
         ctx.data.capabilityOperatorMention = mentions;
-        ctx.data.promptTemplate = "prompts/locked.md";
         ctx.data.capabilityToolsList = declaredTools.map((name) => `- \`${name}\``).join("\n");
       }
     };
@@ -13424,155 +13473,489 @@ var init_kodyVariables = __esm({
   }
 });
 
-// src/scripts/loadQaContext.ts
-import * as fs37 from "fs";
-import * as path35 from "path";
-function parseSlugList(value) {
-  const inner = value.startsWith("[") && value.endsWith("]") ? value.slice(1, -1) : value;
-  return inner.split(",").map(
-    (s) => s.trim().replace(/^["']|["']$/g, "").toLowerCase()
-  ).filter(Boolean);
+// src/pool/keys.ts
+import { hkdfSync } from "crypto";
+function masterKeyBytes(raw) {
+  const v = raw.trim();
+  if (!v) throw new Error("KODY_MASTER_KEY is empty");
+  if (/^[0-9a-fA-F]+$/.test(v) && v.length === 64) {
+    return Buffer.from(v, "hex");
+  }
+  return Buffer.from(v.replace(/-/g, "+").replace(/_/g, "/"), "base64");
 }
-function readProfileAgents(raw) {
-  const m = FRONTMATTER_RE.exec(raw);
-  if (!m) return { agent: ["kody"], body: raw };
-  const body = raw.slice(m[0].length);
-  let agent = null;
-  let legacy = null;
-  for (const line of (m[1] ?? "").split(/\r?\n/)) {
-    const t = line.trim();
-    const c = t.indexOf(":");
-    if (c < 0) continue;
-    const key = t.slice(0, c).trim();
-    const value = t.slice(c + 1).trim();
-    if (key === "agent") {
-      agent = parseSlugList(value);
-    } else if (key === "audience" || key === "for") {
-      const mapped = parseSlugList(value).map((tok) => LEGACY_AUDIENCE_TO_AGENT[tok]).filter(Boolean);
-      if (mapped.length > 0) legacy = mapped;
-    }
+function deriveKey(master, info, length = 32) {
+  return Buffer.from(hkdfSync("sha256", master, Buffer.alloc(0), info, length)).toString("hex");
+}
+function derivePoolApiKey(master) {
+  return deriveKey(master, POOL_API_KEY_INFO);
+}
+function deriveRunnerApiKey(master) {
+  return deriveKey(master, RUNNER_API_KEY_INFO);
+}
+function bearerOk(headerAuth, xApiKey, expected) {
+  const x = (xApiKey ?? "").trim();
+  if (x && timingEqual(x, expected)) return true;
+  const a = (headerAuth ?? "").trim();
+  if (a.toLowerCase().startsWith("bearer ")) {
+    return timingEqual(a.slice(7).trim(), expected);
   }
-  return { agent: agent ?? legacy ?? ["kody"], body };
+  return false;
 }
-function readProfile(cwd) {
-  const dir = path35.join(cwd, CONTEXT_DIR_REL_PATH);
-  if (!fs37.existsSync(dir)) return "";
-  let entries;
-  try {
-    entries = fs37.readdirSync(dir).filter((f) => f.endsWith(".md")).sort();
-  } catch {
-    return "";
+function timingEqual(a, b) {
+  if (a.length !== b.length) return false;
+  let diff = 0;
+  for (let i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  return diff === 0;
+}
+var POOL_API_KEY_INFO, RUNNER_API_KEY_INFO;
+var init_keys = __esm({
+  "src/pool/keys.ts"() {
+    "use strict";
+    POOL_API_KEY_INFO = "kody-pool-api:v1";
+    RUNNER_API_KEY_INFO = "kody-runner-api:v1";
   }
-  const blocks = [];
-  for (const file of entries) {
-    try {
-      const raw = fs37.readFileSync(path35.join(dir, file), "utf-8");
-      const { agent, body } = readProfileAgents(raw);
-      if (!agent.includes(QA_AGENT) && !agent.includes(ALL_AGENTS)) continue;
-      blocks.push(`## ${file}
+});
 
-${body.trim()}`);
-    } catch {
-    }
-  }
-  return blocks.join("\n\n");
+// src/stateRepoGithub.ts
+import * as fs37 from "fs";
+import * as path35 from "path";
+function recordValue3(value) {
+  return value && typeof value === "object" && !Array.isArray(value) ? value : null;
 }
-function composeAuthBlock(authProfile, login, password) {
-  if (authProfile && authProfile.trim().length > 0) {
-    return `Auth: a saved Playwright \`storageState.json\` is available at \`${authProfile}\`. Pass it to the browser via the \`storageState\` parameter so the session starts pre-authenticated.`;
+function contentsUrl(owner, repo, filePath) {
+  const encodedPath = filePath.split("/").filter(Boolean).map((part) => encodeURIComponent(part)).join("/");
+  return `${GITHUB_API}/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}/contents/${encodedPath}`;
+}
+async function githubContentsFile(opts) {
+  const doFetch = opts.fetchImpl ?? fetch;
+  const res = await doFetch(contentsUrl(opts.owner, opts.repo, opts.path), {
+    headers: {
+      Authorization: `Bearer ${opts.githubToken}`,
+      Accept: "application/vnd.github+json",
+      "X-GitHub-Api-Version": "2022-11-28",
+      "User-Agent": "kody-engine"
+    },
+    signal: AbortSignal.timeout(REQ_TIMEOUT_MS)
+  });
+  if (res.status === 404) return null;
+  if (!res.ok) {
+    throw new Error(
+      `GitHub ${opts.owner}/${opts.repo}:${opts.path}: ${res.status} ${(await res.text().catch(() => "")).slice(0, 160)}`
+    );
   }
-  if (login && password) {
-    return `Auth: log in once at the app's login page. Username: \`${login}\` \xB7 Password: \`${password}\`. Type each field key-by-key (Playwright \`locator.pressSequentially()\` / the MCP \`browser_type\` tool), NOT a one-shot \`fill()\` or value assignment: pasting a value in a single step often fails to fire the login form's framework onChange handler, so the form submits empty and you get a FALSE "invalid email or password". After typing, confirm the field shows the value before clicking submit; if the first attempt is rejected, re-type key-by-key before treating the credentials as wrong. If a login form's inputs don't respond to typing-by-label/placeholder, inspect the DOM and target them by their \`id\`/\`name\` attribute instead \u2014 e.g. a Payload CMS admin login at \`/admin\` uses \`#field-email\` and \`#field-password\`. The app may have TWO separate logins (a public/frontend one and a Payload \`/admin\` one); if a change you must verify lives behind the admin, log into that form too. Re-use the session afterwards.`;
+  return await res.json();
+}
+function decodeContentsFile(file, label) {
+  if (file.type !== "file" || file.encoding !== "base64" || typeof file.content !== "string") {
+    throw new Error(`${label} is not a base64 file`);
   }
-  if (login) {
-    return `Auth: username \`${login}\` is configured but no \`LOGIN_PASSWORD\` secret was found. Note auth-gated surfaces as gaps.`;
+  if (typeof file.sha !== "string") {
+    throw new Error(`${label} response missing sha`);
   }
-  return "Auth: no QA credentials configured (set the `LOGIN_USER` variable and the `LOGIN_PASSWORD` vault secret). Browse public routes only; note auth-gated surfaces as gaps.";
+  return {
+    path: label,
+    content: Buffer.from(file.content, "base64").toString("utf-8"),
+    sha: file.sha
+  };
 }
-var CONTEXT_DIR_REL_PATH, QA_AGENT, ALL_AGENTS, LEGACY_AUDIENCE_TO_AGENT, FRONTMATTER_RE, loadQaContext;
-var init_loadQaContext = __esm({
-  "src/scripts/loadQaContext.ts"() {
-    "use strict";
-    init_kodyVariables();
-    CONTEXT_DIR_REL_PATH = ".kody/context";
-    QA_AGENT = "qa-engineer";
-    ALL_AGENTS = "*";
-    LEGACY_AUDIENCE_TO_AGENT = { chat: "kody", qa: QA_AGENT };
-    FRONTMATTER_RE = /^---\r?\n([\s\S]*?)\r?\n---\r?\n?/;
-    loadQaContext = async (ctx) => {
-      const vars = readKodyVariables(ctx.cwd);
-      const login = vars.LOGIN_USER ?? "";
-      const password = process.env.LOGIN_PASSWORD ?? "";
-      const authProfile = ctx.args.authProfile;
-      ctx.data.qaLogin = login;
-      ctx.data.qaProfile = readProfile(ctx.cwd);
-      ctx.data.qaAuthBlock = composeAuthBlock(authProfile, login, password);
-    };
+async function loadGithubStateConfig(opts) {
+  const configFile = await githubContentsFile({
+    owner: opts.owner,
+    repo: opts.repo,
+    path: "kody.config.json",
+    githubToken: opts.githubToken,
+    fetchImpl: opts.fetchImpl
+  });
+  let raw = {};
+  if (configFile) {
+    const decoded = decodeContentsFile(configFile, "kody.config.json");
+    try {
+      raw = JSON.parse(decoded.content);
+    } catch (err) {
+      throw new Error(`kody.config.json is invalid JSON: ${err instanceof Error ? err.message : String(err)}`);
+    }
   }
-});
-
-// src/taskContext.ts
-import * as fs38 from "fs";
-import * as path36 from "path";
-function buildTaskContext(args) {
+  const githubRaw = recordValue3(raw.github) ?? {};
+  const github = {
+    owner: typeof githubRaw.owner === "string" && githubRaw.owner.trim() ? githubRaw.owner.trim() : opts.owner,
+    repo: typeof githubRaw.repo === "string" && githubRaw.repo.trim() ? githubRaw.repo.trim() : opts.repo
+  };
+  const nestedState = recordValue3(raw.state) ?? {};
+  const repoRaw = typeof raw.stateRepo === "string" ? raw.stateRepo : nestedState.repo;
+  const pathRaw = typeof raw.statePath === "string" ? raw.statePath : nestedState.path;
+  const stateRepo = typeof repoRaw === "string" && repoRaw.trim().length > 0 ? repoRaw.trim() : `https://github.com/${github.owner}/kody-state`;
+  parseStateRepoSlug(stateRepo);
+  const statePath = typeof pathRaw === "string" && pathRaw.trim().length > 0 ? pathRaw.trim() : github.repo;
   return {
-    schemaVersion: TASK_CONTEXT_SCHEMA_VERSION,
-    builtAt: (/* @__PURE__ */ new Date()).toISOString(),
-    runId: args.runId,
-    issue: args.issue,
-    conventions: args.conventions ?? [],
-    priorArt: args.priorArt ?? "",
-    memoryContext: args.memoryContext ?? "",
-    coverageRules: args.coverageRules ?? []
+    github,
+    state: {
+      repo: stateRepo,
+      path: normalizeStatePath(statePath)
+    }
   };
 }
-function persistTaskContext(cwd, ctx) {
-  try {
-    const dir = runtimeStatePath(cwd, "agent-runs", ctx.runId);
-    fs38.mkdirSync(dir, { recursive: true });
-    const file = path36.join(dir, "task-context.json");
-    fs38.writeFileSync(file, `${JSON.stringify(ctx, null, 2)}
-`);
-    return file;
-  } catch (err) {
-    const msg = err instanceof Error ? err.message : String(err);
-    process.stderr.write(`[kody taskContext] persist failed: ${msg}
-`);
-    return null;
-  }
+async function readGithubStateText(opts) {
+  const config = await loadGithubStateConfig(opts);
+  return readGithubStateTextWithConfig({
+    config,
+    filePath: opts.filePath,
+    githubToken: opts.githubToken,
+    fetchImpl: opts.fetchImpl
+  });
 }
-var TASK_CONTEXT_SCHEMA_VERSION;
-var init_taskContext = __esm({
-  "src/taskContext.ts"() {
-    "use strict";
-    init_runtimePaths();
-    TASK_CONTEXT_SCHEMA_VERSION = 1;
-  }
-});
-
-// src/scripts/loadTaskContext.ts
-var loadTaskContext;
-var init_loadTaskContext = __esm({
-  "src/scripts/loadTaskContext.ts"() {
-    "use strict";
-    init_events();
-    init_taskContext();
-    loadTaskContext = async (ctx) => {
-      const runId = resolveRunId();
-      const rawIssue = ctx.data.issue;
-      const issue = rawIssue ? {
-        ...rawIssue,
-        commentsFormatted: rawIssue.commentsFormatted ?? "",
-        labelsFormatted: rawIssue.labelsFormatted ?? ""
-      } : void 0;
-      const taskContext = buildTaskContext({
-        runId,
-        issue,
-        conventions: ctx.data.conventions,
-        priorArt: typeof ctx.data.priorArt === "string" ? ctx.data.priorArt : "",
-        memoryContext: typeof ctx.data.memoryContext === "string" ? ctx.data.memoryContext : "",
-        coverageRules: ctx.data.coverageRules
-      });
+async function readGithubStateTextWithConfig(opts) {
+  const target = stateRepoPath(opts.config, opts.filePath);
+  const parsed = parseStateRepo(opts.config);
+  const file = await githubContentsFile({
+    owner: parsed.owner,
+    repo: parsed.repo,
+    path: target,
+    githubToken: opts.githubToken,
+    fetchImpl: opts.fetchImpl
+  });
+  return file ? decodeContentsFile(file, target) : null;
+}
+async function writeGithubStateTextWithConfig(opts) {
+  const target = stateRepoPath(opts.config, opts.filePath);
+  const parsed = parseStateRepo(opts.config);
+  const payload = {
+    message: opts.message,
+    content: Buffer.from(opts.content, "utf-8").toString("base64")
+  };
+  if (opts.sha) payload.sha = opts.sha;
+  const doFetch = opts.fetchImpl ?? fetch;
+  const res = await doFetch(contentsUrl(parsed.owner, parsed.repo, target), {
+    method: "PUT",
+    headers: {
+      Authorization: `Bearer ${opts.githubToken}`,
+      Accept: "application/vnd.github+json",
+      "Content-Type": "application/json",
+      "X-GitHub-Api-Version": "2022-11-28",
+      "User-Agent": "kody-engine"
+    },
+    body: JSON.stringify(payload),
+    signal: AbortSignal.timeout(REQ_TIMEOUT_MS)
+  });
+  if (!res.ok) {
+    throw new Error(
+      `GitHub write ${parsed.owner}/${parsed.repo}:${target}: ${res.status} ${(await res.text().catch(() => "")).slice(0, 160)}`
+    );
+  }
+}
+function jsonlLines(text) {
+  return text.split("\n").filter((line) => line.length > 0);
+}
+function renderJsonl(lines) {
+  return lines.length > 0 ? `${lines.join("\n")}
+` : "";
+}
+function mergeJsonl(localText, remoteText) {
+  const remoteLines = jsonlLines(remoteText);
+  const seen = new Set(remoteLines);
+  const localOnly = jsonlLines(localText).filter((line) => !seen.has(line));
+  return renderJsonl([...remoteLines, ...localOnly]);
+}
+async function syncJsonlFileFromGithubState(opts) {
+  const remote = await readGithubStateTextWithConfig(opts);
+  if (!remote) return;
+  const local = fs37.existsSync(opts.localPath) ? fs37.readFileSync(opts.localPath, "utf-8") : "";
+  const next = mergeJsonl(local, remote.content);
+  if (next === local) return;
+  fs37.mkdirSync(path35.dirname(opts.localPath), { recursive: true });
+  fs37.writeFileSync(opts.localPath, next);
+}
+async function persistJsonlFileToGithubState(opts) {
+  if (!fs37.existsSync(opts.localPath)) return;
+  const localText = fs37.readFileSync(opts.localPath, "utf-8");
+  for (let attempt = 1; attempt <= 3; attempt += 1) {
+    const remote = await readGithubStateTextWithConfig(opts);
+    const body = mergeJsonl(localText, remote?.content ?? "");
+    try {
+      await writeGithubStateTextWithConfig({
+        config: opts.config,
+        filePath: opts.filePath,
+        content: body,
+        message: opts.message,
+        githubToken: opts.githubToken,
+        sha: remote?.sha,
+        fetchImpl: opts.fetchImpl
+      });
+      return;
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      const conflict = /409|422|does not match|is at|but expected/i.test(msg);
+      if (!conflict || attempt === 3) throw err;
+    }
+  }
+}
+var GITHUB_API, REQ_TIMEOUT_MS;
+var init_stateRepoGithub = __esm({
+  "src/stateRepoGithub.ts"() {
+    "use strict";
+    init_stateRepo();
+    GITHUB_API = "https://api.github.com";
+    REQ_TIMEOUT_MS = 3e4;
+  }
+});
+
+// src/stateRepoVault.ts
+import { createDecipheriv, createHash as createHash3 } from "crypto";
+function cacheKey2(owner, repo, masterKey) {
+  const keyHash = createHash3("sha256").update(masterKey).digest("hex").slice(0, 16);
+  return `${owner}/${repo}:${keyHash}`.toLowerCase();
+}
+function decryptVault(payload, masterKey) {
+  const parts = payload.split(":");
+  if (parts.length !== 4 || parts[0] !== "v1") {
+    throw new Error("invalid vault payload format");
+  }
+  const [, ivB64, ctB64, tagB64] = parts;
+  const iv = Buffer.from(ivB64, "base64");
+  const ct = Buffer.from(ctB64, "base64");
+  const tag = Buffer.from(tagB64, "base64");
+  const decipher = createDecipheriv("aes-256-gcm", masterKey, iv);
+  decipher.setAuthTag(tag);
+  return Buffer.concat([decipher.update(ct), decipher.final()]).toString("utf8");
+}
+async function readVaultSecrets(opts) {
+  const key = cacheKey2(opts.owner, opts.repo, opts.masterKey);
+  const hit = cache.get(key);
+  if (hit && hit.expiresAt > Date.now()) return hit.secrets;
+  const file = await readGithubStateText({
+    owner: opts.owner,
+    repo: opts.repo,
+    filePath: VAULT_PATH,
+    githubToken: opts.githubToken,
+    fetchImpl: opts.fetchImpl
+  });
+  if (!file) {
+    cache.set(key, { secrets: {}, expiresAt: Date.now() + CACHE_TTL_MS });
+    return {};
+  }
+  const ciphertext = file.content.trim();
+  const doc = JSON.parse(decryptVault(ciphertext, opts.masterKey));
+  const flat = {};
+  for (const [name, entry] of Object.entries(doc.secrets ?? {})) {
+    if (entry && typeof entry.value === "string") flat[name] = entry.value;
+  }
+  cache.set(key, { secrets: flat, expiresAt: Date.now() + CACHE_TTL_MS });
+  return flat;
+}
+async function readRepoSecret(opts) {
+  const secrets = await readVaultSecrets(opts);
+  const v = secrets[opts.name];
+  return v?.trim() ? v : null;
+}
+async function readRepoSecrets(opts) {
+  return readVaultSecrets(opts);
+}
+var VAULT_PATH, CACHE_TTL_MS, cache;
+var init_stateRepoVault = __esm({
+  "src/stateRepoVault.ts"() {
+    "use strict";
+    init_stateRepoGithub();
+    VAULT_PATH = "secrets.enc";
+    CACHE_TTL_MS = 6e4;
+    cache = /* @__PURE__ */ new Map();
+  }
+});
+
+// src/scripts/runtimeSecrets.ts
+function tokenFromEnv(env) {
+  return (env.KODY_TOKEN ?? env.GH_TOKEN ?? env.GITHUB_TOKEN ?? env.GH_PAT ?? "").trim();
+}
+function envSecret(name, env) {
+  const value = env[name]?.trim() ? env[name] : "";
+  return value ? { value, source: "env" } : { value: "", source: "missing" };
+}
+async function resolveRuntimeSecret(name, ctx, opts = {}) {
+  const env = opts.env ?? process.env;
+  const masterRaw = env.KODY_MASTER_KEY?.trim() ?? "";
+  const githubToken2 = tokenFromEnv(env);
+  if (!masterRaw || !githubToken2) return envSecret(name, env);
+  try {
+    const masterKey = masterKeyBytes(masterRaw);
+    if (masterKey.length !== 32) {
+      throw new Error("KODY_MASTER_KEY must decode to 32 bytes");
+    }
+    const value = await readRepoSecret({
+      owner: ctx.config.github.owner,
+      repo: ctx.config.github.repo,
+      name,
+      githubToken: githubToken2,
+      masterKey,
+      fetchImpl: opts.fetchImpl
+    });
+    if (value) return { value, source: "vault" };
+  } catch (err) {
+    const fallback = envSecret(name, env);
+    return {
+      ...fallback,
+      warning: `vault read failed for ${name}: ${err instanceof Error ? err.message : String(err)}`
+    };
+  }
+  return envSecret(name, env);
+}
+var init_runtimeSecrets = __esm({
+  "src/scripts/runtimeSecrets.ts"() {
+    "use strict";
+    init_keys();
+    init_stateRepoVault();
+  }
+});
+
+// src/scripts/loadQaContext.ts
+import * as fs38 from "fs";
+import * as path36 from "path";
+function parseSlugList(value) {
+  const inner = value.startsWith("[") && value.endsWith("]") ? value.slice(1, -1) : value;
+  return inner.split(",").map(
+    (s) => s.trim().replace(/^["']|["']$/g, "").toLowerCase()
+  ).filter(Boolean);
+}
+function readProfileAgents(raw) {
+  const m = FRONTMATTER_RE.exec(raw);
+  if (!m) return { agent: ["kody"], body: raw };
+  const body = raw.slice(m[0].length);
+  let agent = null;
+  let legacy = null;
+  for (const line of (m[1] ?? "").split(/\r?\n/)) {
+    const t = line.trim();
+    const c = t.indexOf(":");
+    if (c < 0) continue;
+    const key = t.slice(0, c).trim();
+    const value = t.slice(c + 1).trim();
+    if (key === "agent") {
+      agent = parseSlugList(value);
+    } else if (key === "audience" || key === "for") {
+      const mapped = parseSlugList(value).map((tok) => LEGACY_AUDIENCE_TO_AGENT[tok]).filter(Boolean);
+      if (mapped.length > 0) legacy = mapped;
+    }
+  }
+  return { agent: agent ?? legacy ?? ["kody"], body };
+}
+function readProfile(cwd) {
+  const dir = path36.join(cwd, CONTEXT_DIR_REL_PATH);
+  if (!fs38.existsSync(dir)) return "";
+  let entries;
+  try {
+    entries = fs38.readdirSync(dir).filter((f) => f.endsWith(".md")).sort();
+  } catch {
+    return "";
+  }
+  const blocks = [];
+  for (const file of entries) {
+    try {
+      const raw = fs38.readFileSync(path36.join(dir, file), "utf-8");
+      const { agent, body } = readProfileAgents(raw);
+      if (!agent.includes(QA_AGENT) && !agent.includes(ALL_AGENTS)) continue;
+      blocks.push(`## ${file}
+
+${body.trim()}`);
+    } catch {
+    }
+  }
+  return blocks.join("\n\n");
+}
+function composeAuthBlock(authProfile, login, password) {
+  if (authProfile && authProfile.trim().length > 0) {
+    return `Auth: a saved Playwright \`storageState.json\` is available at \`${authProfile}\`. Pass it to the browser via the \`storageState\` parameter so the session starts pre-authenticated.`;
+  }
+  if (login && password) {
+    return `Auth: log in once at the app's login page. Username: \`${login}\` \xB7 Password: \`${password}\`. Type each field key-by-key (Playwright \`locator.pressSequentially()\` / the MCP \`browser_type\` tool), NOT a one-shot \`fill()\` or value assignment: pasting a value in a single step often fails to fire the login form's framework onChange handler, so the form submits empty and you get a FALSE "invalid email or password". After typing, confirm the field shows the value before clicking submit; if the first attempt is rejected, re-type key-by-key before treating the credentials as wrong. If a login form's inputs don't respond to typing-by-label/placeholder, inspect the DOM and target them by their \`id\`/\`name\` attribute instead \u2014 e.g. a Payload CMS admin login at \`/admin\` uses \`#field-email\` and \`#field-password\`. The app may have TWO separate logins (a public/frontend one and a Payload \`/admin\` one); if a change you must verify lives behind the admin, log into that form too. Re-use the session afterwards.`;
+  }
+  if (login) {
+    return `Auth: username \`${login}\` is configured but no \`LOGIN_PASSWORD\` secret was found. Note auth-gated surfaces as gaps.`;
+  }
+  return "Auth: no QA credentials configured (set the `LOGIN_USER` variable and the `LOGIN_PASSWORD` vault secret). Browse public routes only; note auth-gated surfaces as gaps.";
+}
+var CONTEXT_DIR_REL_PATH, QA_AGENT, ALL_AGENTS, LEGACY_AUDIENCE_TO_AGENT, FRONTMATTER_RE, loadQaContext;
+var init_loadQaContext = __esm({
+  "src/scripts/loadQaContext.ts"() {
+    "use strict";
+    init_kodyVariables();
+    init_runtimeSecrets();
+    CONTEXT_DIR_REL_PATH = ".kody/context";
+    QA_AGENT = "qa-engineer";
+    ALL_AGENTS = "*";
+    LEGACY_AUDIENCE_TO_AGENT = { chat: "kody", qa: QA_AGENT };
+    FRONTMATTER_RE = /^---\r?\n([\s\S]*?)\r?\n---\r?\n?/;
+    loadQaContext = async (ctx) => {
+      const vars = readKodyVariables(ctx.cwd);
+      const login = vars.LOGIN_USER ?? "";
+      const password = await resolveRuntimeSecret("LOGIN_PASSWORD", ctx);
+      const authProfile = ctx.args.authProfile;
+      ctx.data.qaLogin = login;
+      ctx.data.qaPasswordSource = password.source;
+      if (password.warning) ctx.data.qaPasswordWarning = password.warning;
+      ctx.data.qaProfile = readProfile(ctx.cwd);
+      ctx.data.qaAuthBlock = composeAuthBlock(authProfile, login, password.value);
+    };
+  }
+});
+
+// src/taskContext.ts
+import * as fs39 from "fs";
+import * as path37 from "path";
+function buildTaskContext(args) {
+  return {
+    schemaVersion: TASK_CONTEXT_SCHEMA_VERSION,
+    builtAt: (/* @__PURE__ */ new Date()).toISOString(),
+    runId: args.runId,
+    issue: args.issue,
+    conventions: args.conventions ?? [],
+    priorArt: args.priorArt ?? "",
+    memoryContext: args.memoryContext ?? "",
+    coverageRules: args.coverageRules ?? []
+  };
+}
+function persistTaskContext(cwd, ctx) {
+  try {
+    const dir = runtimeStatePath(cwd, "agent-runs", ctx.runId);
+    fs39.mkdirSync(dir, { recursive: true });
+    const file = path37.join(dir, "task-context.json");
+    fs39.writeFileSync(file, `${JSON.stringify(ctx, null, 2)}
+`);
+    return file;
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    process.stderr.write(`[kody taskContext] persist failed: ${msg}
+`);
+    return null;
+  }
+}
+var TASK_CONTEXT_SCHEMA_VERSION;
+var init_taskContext = __esm({
+  "src/taskContext.ts"() {
+    "use strict";
+    init_runtimePaths();
+    TASK_CONTEXT_SCHEMA_VERSION = 1;
+  }
+});
+
+// src/scripts/loadTaskContext.ts
+var loadTaskContext;
+var init_loadTaskContext = __esm({
+  "src/scripts/loadTaskContext.ts"() {
+    "use strict";
+    init_events();
+    init_taskContext();
+    loadTaskContext = async (ctx) => {
+      const runId = resolveRunId();
+      const rawIssue = ctx.data.issue;
+      const issue = rawIssue ? {
+        ...rawIssue,
+        commentsFormatted: rawIssue.commentsFormatted ?? "",
+        labelsFormatted: rawIssue.labelsFormatted ?? ""
+      } : void 0;
+      const taskContext = buildTaskContext({
+        runId,
+        issue,
+        conventions: ctx.data.conventions,
+        priorArt: typeof ctx.data.priorArt === "string" ? ctx.data.priorArt : "",
+        memoryContext: typeof ctx.data.memoryContext === "string" ? ctx.data.memoryContext : "",
+        coverageRules: ctx.data.coverageRules
+      });
       ctx.data.taskContext = taskContext;
       const persistedPath = persistTaskContext(ctx.cwd, taskContext);
       if (persistedPath && ctx.verbose) {
@@ -14302,32 +14685,32 @@ var init_parseAgentResult = __esm({
   }
 });
 
-// src/scripts/parseCompanyManagerDecision.ts
+// src/scripts/parseAgencyArchitectDecision.ts
 function makeAction3(type, payload) {
   return { type, payload, timestamp: (/* @__PURE__ */ new Date()).toISOString() };
 }
-var parseCompanyManagerDecision;
-var init_parseCompanyManagerDecision = __esm({
-  "src/scripts/parseCompanyManagerDecision.ts"() {
+var parseAgencyArchitectDecision;
+var init_parseAgencyArchitectDecision = __esm({
+  "src/scripts/parseAgencyArchitectDecision.ts"() {
     "use strict";
-    init_companyManagerDecision();
-    parseCompanyManagerDecision = async (ctx, _profile, agentResult) => {
+    init_agencyArchitectDecision();
+    parseAgencyArchitectDecision = async (ctx, _profile, agentResult) => {
       if (!agentResult) {
-        ctx.data.companyManagerDecision = { summary: "", actions: [] };
-        ctx.data.action = makeAction3("COMPANY_MANAGER_NOT_RUN", { reason: "no agent result" });
+        ctx.data.agencyArchitectDecision = { summary: "", actions: [] };
+        ctx.data.action = makeAction3("AGENCY_ARCHITECT_NOT_RUN", { reason: "no agent result" });
         return;
       }
       try {
-        const decision = parseCompanyManagerDecisionText(agentResult.finalText);
-        ctx.data.companyManagerDecision = decision;
-        ctx.data.action = makeAction3("COMPANY_MANAGER_DECIDED", {
+        const decision = parseAgencyArchitectDecisionText(agentResult.finalText);
+        ctx.data.agencyArchitectDecision = decision;
+        ctx.data.action = makeAction3("AGENCY_ARCHITECT_DECIDED", {
           summary: decision.summary,
           actionCount: decision.actions.length
         });
       } catch (err) {
         const reason = err instanceof Error ? err.message : String(err);
-        ctx.data.companyManagerDecisionError = reason;
-        ctx.data.action = makeAction3("COMPANY_MANAGER_FAILED", { reason });
+        ctx.data.agencyArchitectDecisionError = reason;
+        ctx.data.action = makeAction3("AGENCY_ARCHITECT_FAILED", { reason });
         ctx.output.exitCode = 1;
         ctx.output.reason = reason;
       }
@@ -15826,192 +16209,10 @@ var init_runFlow = __esm({
   }
 });
 
-// src/stateRepoGithub.ts
-import * as fs39 from "fs";
-import * as path37 from "path";
-function recordValue3(value) {
-  return value && typeof value === "object" && !Array.isArray(value) ? value : null;
-}
-function contentsUrl(owner, repo, filePath) {
-  const encodedPath = filePath.split("/").filter(Boolean).map((part) => encodeURIComponent(part)).join("/");
-  return `${GITHUB_API}/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}/contents/${encodedPath}`;
-}
-async function githubContentsFile(opts) {
-  const doFetch = opts.fetchImpl ?? fetch;
-  const res = await doFetch(contentsUrl(opts.owner, opts.repo, opts.path), {
-    headers: {
-      Authorization: `Bearer ${opts.githubToken}`,
-      Accept: "application/vnd.github+json",
-      "X-GitHub-Api-Version": "2022-11-28",
-      "User-Agent": "kody-engine"
-    },
-    signal: AbortSignal.timeout(REQ_TIMEOUT_MS)
-  });
-  if (res.status === 404) return null;
-  if (!res.ok) {
-    throw new Error(
-      `GitHub ${opts.owner}/${opts.repo}:${opts.path}: ${res.status} ${(await res.text().catch(() => "")).slice(0, 160)}`
-    );
-  }
-  return await res.json();
-}
-function decodeContentsFile(file, label) {
-  if (file.type !== "file" || file.encoding !== "base64" || typeof file.content !== "string") {
-    throw new Error(`${label} is not a base64 file`);
-  }
-  if (typeof file.sha !== "string") {
-    throw new Error(`${label} response missing sha`);
-  }
-  return {
-    path: label,
-    content: Buffer.from(file.content, "base64").toString("utf-8"),
-    sha: file.sha
-  };
-}
-async function loadGithubStateConfig(opts) {
-  const configFile = await githubContentsFile({
-    owner: opts.owner,
-    repo: opts.repo,
-    path: "kody.config.json",
-    githubToken: opts.githubToken,
-    fetchImpl: opts.fetchImpl
-  });
-  let raw = {};
-  if (configFile) {
-    const decoded = decodeContentsFile(configFile, "kody.config.json");
-    try {
-      raw = JSON.parse(decoded.content);
-    } catch (err) {
-      throw new Error(`kody.config.json is invalid JSON: ${err instanceof Error ? err.message : String(err)}`);
-    }
-  }
-  const githubRaw = recordValue3(raw.github) ?? {};
-  const github = {
-    owner: typeof githubRaw.owner === "string" && githubRaw.owner.trim() ? githubRaw.owner.trim() : opts.owner,
-    repo: typeof githubRaw.repo === "string" && githubRaw.repo.trim() ? githubRaw.repo.trim() : opts.repo
-  };
-  const nestedState = recordValue3(raw.state) ?? {};
-  const repoRaw = typeof raw.stateRepo === "string" ? raw.stateRepo : nestedState.repo;
-  const pathRaw = typeof raw.statePath === "string" ? raw.statePath : nestedState.path;
-  const stateRepo = typeof repoRaw === "string" && repoRaw.trim().length > 0 ? repoRaw.trim() : `https://github.com/${github.owner}/kody-state`;
-  parseStateRepoSlug(stateRepo);
-  const statePath = typeof pathRaw === "string" && pathRaw.trim().length > 0 ? pathRaw.trim() : github.repo;
-  return {
-    github,
-    state: {
-      repo: stateRepo,
-      path: normalizeStatePath(statePath)
-    }
-  };
-}
-async function readGithubStateText(opts) {
-  const config = await loadGithubStateConfig(opts);
-  return readGithubStateTextWithConfig({
-    config,
-    filePath: opts.filePath,
-    githubToken: opts.githubToken,
-    fetchImpl: opts.fetchImpl
-  });
-}
-async function readGithubStateTextWithConfig(opts) {
-  const target = stateRepoPath(opts.config, opts.filePath);
-  const parsed = parseStateRepo(opts.config);
-  const file = await githubContentsFile({
-    owner: parsed.owner,
-    repo: parsed.repo,
-    path: target,
-    githubToken: opts.githubToken,
-    fetchImpl: opts.fetchImpl
-  });
-  return file ? decodeContentsFile(file, target) : null;
-}
-async function writeGithubStateTextWithConfig(opts) {
-  const target = stateRepoPath(opts.config, opts.filePath);
-  const parsed = parseStateRepo(opts.config);
-  const payload = {
-    message: opts.message,
-    content: Buffer.from(opts.content, "utf-8").toString("base64")
-  };
-  if (opts.sha) payload.sha = opts.sha;
-  const doFetch = opts.fetchImpl ?? fetch;
-  const res = await doFetch(contentsUrl(parsed.owner, parsed.repo, target), {
-    method: "PUT",
-    headers: {
-      Authorization: `Bearer ${opts.githubToken}`,
-      Accept: "application/vnd.github+json",
-      "Content-Type": "application/json",
-      "X-GitHub-Api-Version": "2022-11-28",
-      "User-Agent": "kody-engine"
-    },
-    body: JSON.stringify(payload),
-    signal: AbortSignal.timeout(REQ_TIMEOUT_MS)
-  });
-  if (!res.ok) {
-    throw new Error(
-      `GitHub write ${parsed.owner}/${parsed.repo}:${target}: ${res.status} ${(await res.text().catch(() => "")).slice(0, 160)}`
-    );
-  }
-}
-function jsonlLines(text) {
-  return text.split("\n").filter((line) => line.length > 0);
-}
-function renderJsonl(lines) {
-  return lines.length > 0 ? `${lines.join("\n")}
-` : "";
-}
-function mergeJsonl(localText, remoteText) {
-  const remoteLines = jsonlLines(remoteText);
-  const seen = new Set(remoteLines);
-  const localOnly = jsonlLines(localText).filter((line) => !seen.has(line));
-  return renderJsonl([...remoteLines, ...localOnly]);
-}
-async function syncJsonlFileFromGithubState(opts) {
-  const remote = await readGithubStateTextWithConfig(opts);
-  if (!remote) return;
-  const local = fs39.existsSync(opts.localPath) ? fs39.readFileSync(opts.localPath, "utf-8") : "";
-  const next = mergeJsonl(local, remote.content);
-  if (next === local) return;
-  fs39.mkdirSync(path37.dirname(opts.localPath), { recursive: true });
-  fs39.writeFileSync(opts.localPath, next);
-}
-async function persistJsonlFileToGithubState(opts) {
-  if (!fs39.existsSync(opts.localPath)) return;
-  const localText = fs39.readFileSync(opts.localPath, "utf-8");
-  for (let attempt = 1; attempt <= 3; attempt += 1) {
-    const remote = await readGithubStateTextWithConfig(opts);
-    const body = mergeJsonl(localText, remote?.content ?? "");
-    try {
-      await writeGithubStateTextWithConfig({
-        config: opts.config,
-        filePath: opts.filePath,
-        content: body,
-        message: opts.message,
-        githubToken: opts.githubToken,
-        sha: remote?.sha,
-        fetchImpl: opts.fetchImpl
-      });
-      return;
-    } catch (err) {
-      const msg = err instanceof Error ? err.message : String(err);
-      const conflict = /409|422|does not match|is at|but expected/i.test(msg);
-      if (!conflict || attempt === 3) throw err;
-    }
-  }
-}
-var GITHUB_API, REQ_TIMEOUT_MS;
-var init_stateRepoGithub = __esm({
-  "src/stateRepoGithub.ts"() {
-    "use strict";
-    init_stateRepo();
-    GITHUB_API = "https://api.github.com";
-    REQ_TIMEOUT_MS = 3e4;
-  }
-});
-
 // src/scripts/previewBuildHelpers.ts
-import { createDecipheriv, createHash as createHash3, hkdfSync } from "crypto";
+import { createDecipheriv as createDecipheriv2, createHash as createHash4, hkdfSync as hkdfSync2 } from "crypto";
 function shortHash(s) {
-  return createHash3("sha256").update(s).digest("hex").slice(0, 6);
+  return createHash4("sha256").update(s).digest("hex").slice(0, 6);
 }
 function previewAppName(repo, pr) {
   const [owner, name] = repo.split("/");
@@ -16040,7 +16241,7 @@ function decryptVaultPayload(payload, keyRaw) {
   const iv = Buffer.from(ivB64, "base64");
   const ct = Buffer.from(ctB64, "base64");
   const tag = Buffer.from(tagB64, "base64");
-  const decipher = createDecipheriv("aes-256-gcm", key, iv);
+  const decipher = createDecipheriv2("aes-256-gcm", key, iv);
   decipher.setAuthTag(tag);
   return Buffer.concat([decipher.update(ct), decipher.final()]).toString("utf8");
 }
@@ -16053,7 +16254,7 @@ function derivePreviewVerifyKey(masterKeyRaw) {
   if (masterKey.length !== 32) {
     throw new Error("KODY_MASTER_KEY must decode to 32 bytes");
   }
-  return Buffer.from(hkdfSync("sha256", masterKey, Buffer.alloc(0), PREVIEW_KEY_INFO, 32)).toString("hex");
+  return Buffer.from(hkdfSync2("sha256", masterKey, Buffer.alloc(0), PREVIEW_KEY_INFO, 32)).toString("hex");
 }
 function previewRuntimeEnv(args) {
   return {
@@ -16084,7 +16285,7 @@ function formatPreviewComment(args) {
   ].join("\n");
 }
 function defaultImageTag(repo, ref) {
-  return createHash3("sha256").update(`${repo}@${ref}`).digest("hex").slice(0, 12);
+  return createHash4("sha256").update(`${repo}@${ref}`).digest("hex").slice(0, 12);
 }
 var NEVER_PASS_TO_BUILD, PREVIEW_KEY_INFO;
 var init_previewBuildHelpers = __esm({
@@ -17699,7 +17900,7 @@ var init_scripts = __esm({
     init_appendCompanyActivity();
     init_appendCompanyIntentDecision();
     init_applyCapabilityReports();
-    init_applyCompanyManagerDecision();
+    init_applyAgencyArchitectDecision();
     init_buildSyntheticPlugin();
     init_checkCoverageWithRetry();
     init_classifyByLabel();
@@ -17746,7 +17947,7 @@ var init_scripts = __esm({
     init_openAgentFactoryStatePr();
     init_openQaIssue();
     init_parseAgentResult();
-    init_parseCompanyManagerDecision();
+    init_parseAgencyArchitectDecision();
     init_parseIssueStateFromAgentResult();
     init_parseJobStateFromAgentResult();
     init_parseReproOutput();
@@ -17841,7 +18042,7 @@ var init_scripts = __esm({
     };
     postflightScripts = {
       parseAgentResult: parseAgentResult2,
-      parseCompanyManagerDecision,
+      parseAgencyArchitectDecision,
       parseIssueStateFromAgentResult,
       parseJobStateFromAgentResult,
       parseReproOutput,
@@ -17849,7 +18050,7 @@ var init_scripts = __esm({
       writeJobStateFile,
       appendCompanyActivity,
       appendCompanyIntentDecision: appendCompanyIntentDecision2,
-      applyCompanyManagerDecision,
+      applyAgencyArchitectDecision,
       requireFeedbackActions,
       requirePlanDeviations,
       verify,
@@ -17940,7 +18141,7 @@ function hydrateStateWorkspace(config, cwd) {
   hydratedWorkspaces.add(hydrateKey);
 }
 function fetchStateSnapshot(parsed) {
-  const cacheDir = path41.join(cacheRoot2(), cacheKey2(parsed));
+  const cacheDir = path41.join(cacheRoot2(), cacheKey3(parsed));
   const url = `https://github.com/${parsed.owner}/${parsed.repo}.git`;
   try {
     fs43.mkdirSync(path41.dirname(cacheDir), { recursive: true });
@@ -17965,7 +18166,7 @@ function fetchStateSnapshot(parsed) {
 function cacheRoot2() {
   return process.env[CACHE_ENV2]?.trim() || path41.join(os7.homedir(), ".cache", "kody", "state-repo");
 }
-function cacheKey2(parsed) {
+function cacheKey3(parsed) {
   return crypto3.createHash("sha256").update(`${parsed.owner}/${parsed.repo}#${parsed.branch}#${parsed.basePath}`).digest("hex").slice(0, 24);
 }
 function runGit3(args) {
@@ -23083,42 +23284,8 @@ async function runCapabilityFallbackTick(deps) {
   return { ran: true, claimed };
 }
 
-// src/pool/keys.ts
-import { hkdfSync as hkdfSync2 } from "crypto";
-var POOL_API_KEY_INFO = "kody-pool-api:v1";
-var RUNNER_API_KEY_INFO = "kody-runner-api:v1";
-function masterKeyBytes(raw) {
-  const v = raw.trim();
-  if (!v) throw new Error("KODY_MASTER_KEY is empty");
-  if (/^[0-9a-fA-F]+$/.test(v) && v.length === 64) {
-    return Buffer.from(v, "hex");
-  }
-  return Buffer.from(v.replace(/-/g, "+").replace(/_/g, "/"), "base64");
-}
-function deriveKey(master, info, length = 32) {
-  return Buffer.from(hkdfSync2("sha256", master, Buffer.alloc(0), info, length)).toString("hex");
-}
-function derivePoolApiKey(master) {
-  return deriveKey(master, POOL_API_KEY_INFO);
-}
-function deriveRunnerApiKey(master) {
-  return deriveKey(master, RUNNER_API_KEY_INFO);
-}
-function bearerOk(headerAuth, xApiKey, expected) {
-  const x = (xApiKey ?? "").trim();
-  if (x && timingEqual(x, expected)) return true;
-  const a = (headerAuth ?? "").trim();
-  if (a.toLowerCase().startsWith("bearer ")) {
-    return timingEqual(a.slice(7).trim(), expected);
-  }
-  return false;
-}
-function timingEqual(a, b) {
-  if (a.length !== b.length) return false;
-  let diff = 0;
-  for (let i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
-  return diff === 0;
-}
+// src/servers/pool-serve.ts
+init_keys();
 
 // src/pool/fly.ts
 var FLY_API_BASE = "https://api.machines.dev/v1";
@@ -23483,59 +23650,8 @@ function isSuspendedWithIp(m) {
   return (m.state === "suspended" || m.state === "suspending") && !!m.private_ip;
 }
 
-// src/pool/vault.ts
-init_stateRepoGithub();
-import { createDecipheriv as createDecipheriv2 } from "crypto";
-var VAULT_PATH = "secrets.enc";
-var CACHE_TTL_MS = 6e4;
-var cache = /* @__PURE__ */ new Map();
-function decryptVault(payload, masterKey) {
-  const parts = payload.split(":");
-  if (parts.length !== 4 || parts[0] !== "v1") {
-    throw new Error("invalid vault payload format");
-  }
-  const [, ivB64, ctB64, tagB64] = parts;
-  const iv = Buffer.from(ivB64, "base64");
-  const ct = Buffer.from(ctB64, "base64");
-  const tag = Buffer.from(tagB64, "base64");
-  const decipher = createDecipheriv2("aes-256-gcm", masterKey, iv);
-  decipher.setAuthTag(tag);
-  return Buffer.concat([decipher.update(ct), decipher.final()]).toString("utf8");
-}
-async function readVaultSecrets(opts) {
-  const key = `${opts.owner}/${opts.repo}`.toLowerCase();
-  const hit = cache.get(key);
-  if (hit && hit.expiresAt > Date.now()) return hit.secrets;
-  const file = await readGithubStateText({
-    owner: opts.owner,
-    repo: opts.repo,
-    filePath: VAULT_PATH,
-    githubToken: opts.githubToken,
-    fetchImpl: opts.fetchImpl
-  });
-  if (!file) {
-    cache.set(key, { secrets: {}, expiresAt: Date.now() + CACHE_TTL_MS });
-    return {};
-  }
-  const ciphertext = file.content.trim();
-  const doc = JSON.parse(decryptVault(ciphertext, opts.masterKey));
-  const flat = {};
-  for (const [name, entry] of Object.entries(doc.secrets ?? {})) {
-    if (entry && typeof entry.value === "string") flat[name] = entry.value;
-  }
-  cache.set(key, { secrets: flat, expiresAt: Date.now() + CACHE_TTL_MS });
-  return flat;
-}
-async function readRepoSecret(opts) {
-  const secrets = await readVaultSecrets(opts);
-  const v = secrets[opts.name];
-  return v?.trim() ? v : null;
-}
-async function readRepoSecrets(opts) {
-  return readVaultSecrets(opts);
-}
-
 // src/pool/registry.ts
+init_stateRepoVault();
 var POOL_MIN_VAULT_KEY = "POOL_MIN";
 var POOL_MIN_MAX = 10;
 function parsePoolMin(raw, dflt) {