@kody-ade/kody-engine 0.4.306 → 0.4.307

package/dist/bin/kody.js

@@ -15,7 +15,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "@kody-ade/kody-engine",
-      version: "0.4.306",
+      version: "0.4.307",
       description: "kody \u2014 autonomous development engine. Single-session Claude Code agent behind a generic executor + declarative executable profiles.",
       license: "MIT",
       type: "module",
@@ -549,11 +549,11 @@ function branchApiPath(config, targetPath) {
 }
 function ensureStateBranch(config, cwd) {
   const parsed = parseStateRepo(config);
-  const cacheKey3 = `${parsed.owner}/${parsed.repo}:${parsed.branch}`;
-  if (ensuredStateBranches.has(cacheKey3)) return;
+  const cacheKey4 = `${parsed.owner}/${parsed.repo}:${parsed.branch}`;
+  if (ensuredStateBranches.has(cacheKey4)) return;
   try {
     gh(["api", `/repos/${parsed.owner}/${parsed.repo}/git/ref/heads/${parsed.branch}`], { cwd });
-    ensuredStateBranches.add(cacheKey3);
+    ensuredStateBranches.add(cacheKey4);
     return;
   } catch (err) {
     if (!is404(err)) throw err;
@@ -572,7 +572,7 @@ function ensureStateBranch(config, cwd) {
   } catch (err) {
     if (!isAlreadyExists(err)) throw err;
   }
-  ensuredStateBranches.add(cacheKey3);
+  ensuredStateBranches.add(cacheKey4);
 }
 function readStateText(config, cwd, filePath) {
   const targetPath = stateRepoPath(config, filePath);
@@ -8828,12 +8828,12 @@ var init_appendCompanyActivity = __esm({
   }
 });
 
-// src/companyManagerDecision.ts
-function parseCompanyManagerDecisionText(finalText) {
+// src/agencyArchitectDecision.ts
+function parseAgencyArchitectDecisionText(finalText) {
   const raw = extractDecisionJson(finalText);
   const parsed = JSON.parse(raw);
   if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-    throw new Error("company-manager decision must be JSON object");
+    throw new Error("agency-architect decision must be JSON object");
   }
   const input = parsed;
   const actions = Array.isArray(input.actions) ? input.actions.map(parseAction) : [];
@@ -8881,15 +8881,15 @@ function buildAgentLoopState(action) {
   };
 }
 function extractDecisionJson(finalText) {
-  const fence = finalText.match(/```(?:kody-company-manager-decision|json)\s*([\s\S]*?)```/i);
+  const fence = finalText.match(/```(?:kody-agency-architect-decision|json)\s*([\s\S]*?)```/i);
   if (fence?.[1]) return fence[1].trim();
-  const line = finalText.match(/KODY_COMPANY_MANAGER_DECISION=(\{[\s\S]*\})/);
+  const line = finalText.match(/KODY_AGENCY_ARCHITECT_DECISION=(\{[\s\S]*\})/);
   if (line?.[1]) return line[1].trim();
-  throw new Error("missing kody-company-manager-decision JSON");
+  throw new Error("missing kody-agency-architect-decision JSON");
 }
 function parseAction(value) {
   if (!value || typeof value !== "object" || Array.isArray(value)) {
-    throw new Error("company-manager action must be object");
+    throw new Error("agency-architect action must be object");
   }
   const input = value;
   const kind = input.kind;
@@ -8898,7 +8898,7 @@ function parseAction(value) {
   if (kind === "setGoalLifecycle") return parseSetGoalLifecycle(input);
   if (kind === "updateIntentPortfolio") return parseUpdateIntentPortfolio(input);
   if (kind === "note") return parseNote(input);
-  throw new Error(`unsupported company-manager action kind: ${String(kind)}`);
+  throw new Error(`unsupported agency-architect action kind: ${String(kind)}`);
 }
 function parseCreateManagedGoal(input) {
   const route = Array.isArray(input.route) ? input.route.map(parseRouteStep) : [];
@@ -8994,8 +8994,8 @@ function oneOf(value, allowed, fallback) {
   return typeof value === "string" && allowed.includes(value) ? value : fallback;
 }
 var SLUG_RE;
-var init_companyManagerDecision = __esm({
-  "src/companyManagerDecision.ts"() {
+var init_agencyArchitectDecision = __esm({
+  "src/agencyArchitectDecision.ts"() {
     "use strict";
     init_state2();
     SLUG_RE = /^[a-z][a-z0-9-]{0,63}$/;
@@ -9019,11 +9019,13 @@ function normalizeCompanyIntent(path50, raw) {
   if (!id || !isCompanyIntentId(id)) throw new Error(`${path50}: invalid intent id`);
   const createdAt = stringField3(input.createdAt) || nowIso();
   const updatedAt = stringField3(input.updatedAt) || createdAt;
+  const description = stringField3(input.description);
   return {
     version: 1,
     id,
     status: oneOf2(input.status, ["active", "paused", "archived"], "active"),
     for: stringField3(input.for),
+    ...description ? { description } : {},
     priority: numberField(input.priority, 100),
     posture: oneOf2(
       input.posture,
@@ -9142,8 +9144,8 @@ function normalizeAutomationPolicy(raw) {
 function normalizeManager(raw) {
   return {
     agent: "cto",
-    loop: "company-manager-loop",
-    capability: "company-manager",
+    loop: "agency-architect-loop",
+    capability: "agency-architect",
     reviewEvery: oneOf2(raw?.reviewEvery, ["1d", "1w"], "1d"),
     ...typeof raw?.lastReviewedAt === "string" ? { lastReviewedAt: raw.lastReviewedAt } : {}
   };
@@ -9159,7 +9161,7 @@ var init_companyIntent = __esm({
   }
 });
 
-// src/scripts/applyCompanyManagerDecision.ts
+// src/scripts/applyAgencyArchitectDecision.ts
 function applyAction(config, cwd, action) {
   if (action.kind === "createManagedGoal") {
     const existing = fetchGoalState(config, action.id, cwd);
@@ -9228,7 +9230,7 @@ function applied(action, changed, reason, resource) {
 function mergeUnique(left, right) {
   return [.../* @__PURE__ */ new Set([...left, ...right])].sort();
 }
-function logAppliedCompanyManagerActions(config, cwd, appliedActions) {
+function logAppliedAgencyArchitectActions(config, cwd, appliedActions) {
   const at = nowIso();
   for (const action of appliedActions) {
     if (!action.intentId) continue;
@@ -9243,24 +9245,24 @@ function logAppliedCompanyManagerActions(config, cwd, appliedActions) {
     });
   }
 }
-var applyCompanyManagerDecision;
-var init_applyCompanyManagerDecision = __esm({
-  "src/scripts/applyCompanyManagerDecision.ts"() {
+var applyAgencyArchitectDecision;
+var init_applyAgencyArchitectDecision = __esm({
+  "src/scripts/applyAgencyArchitectDecision.ts"() {
     "use strict";
-    init_companyManagerDecision();
+    init_agencyArchitectDecision();
     init_companyIntent();
     init_stateStore();
     init_state2();
-    applyCompanyManagerDecision = async (ctx) => {
-      const decision = ctx.data.companyManagerDecision;
+    applyAgencyArchitectDecision = async (ctx) => {
+      const decision = ctx.data.agencyArchitectDecision;
       if (!decision || !Array.isArray(decision.actions)) return;
       if (ctx.output.exitCode !== 0) return;
       const applied2 = [];
       for (const action of decision.actions) {
         applied2.push(applyAction(ctx.config, ctx.cwd, action));
       }
-      ctx.data.companyManagerApplied = applied2;
-      ctx.data.companyManagerApplySummary = `company-manager applied ${applied2.filter((item) => item.changed).length}/${applied2.length} action(s)`;
+      ctx.data.agencyArchitectApplied = applied2;
+      ctx.data.agencyArchitectApplySummary = `agency-architect applied ${applied2.filter((item) => item.changed).length}/${applied2.length} action(s)`;
     };
   }
 });
@@ -9270,15 +9272,15 @@ var appendCompanyIntentDecision2;
 var init_appendCompanyIntentDecision = __esm({
   "src/scripts/appendCompanyIntentDecision.ts"() {
     "use strict";
-    init_applyCompanyManagerDecision();
+    init_applyAgencyArchitectDecision();
     appendCompanyIntentDecision2 = async (ctx) => {
-      const applied2 = ctx.data.companyManagerApplied;
+      const applied2 = ctx.data.agencyArchitectApplied;
       if (!applied2 || applied2.length === 0) return;
       try {
-        logAppliedCompanyManagerActions(ctx.config, ctx.cwd, applied2);
+        logAppliedAgencyArchitectActions(ctx.config, ctx.cwd, applied2);
       } catch (err) {
         process.stderr.write(
-          `[company-manager] failed append intent decision log: ${err instanceof Error ? err.message : String(err)}
+          `[agency-architect] failed append intent decision log: ${err instanceof Error ? err.message : String(err)}
 `
         );
       }
@@ -13471,9 +13473,340 @@ var init_kodyVariables = __esm({
   }
 });
 
-// src/scripts/loadQaContext.ts
+// src/pool/keys.ts
+import { hkdfSync } from "crypto";
+function masterKeyBytes(raw) {
+  const v = raw.trim();
+  if (!v) throw new Error("KODY_MASTER_KEY is empty");
+  if (/^[0-9a-fA-F]+$/.test(v) && v.length === 64) {
+    return Buffer.from(v, "hex");
+  }
+  return Buffer.from(v.replace(/-/g, "+").replace(/_/g, "/"), "base64");
+}
+function deriveKey(master, info, length = 32) {
+  return Buffer.from(hkdfSync("sha256", master, Buffer.alloc(0), info, length)).toString("hex");
+}
+function derivePoolApiKey(master) {
+  return deriveKey(master, POOL_API_KEY_INFO);
+}
+function deriveRunnerApiKey(master) {
+  return deriveKey(master, RUNNER_API_KEY_INFO);
+}
+function bearerOk(headerAuth, xApiKey, expected) {
+  const x = (xApiKey ?? "").trim();
+  if (x && timingEqual(x, expected)) return true;
+  const a = (headerAuth ?? "").trim();
+  if (a.toLowerCase().startsWith("bearer ")) {
+    return timingEqual(a.slice(7).trim(), expected);
+  }
+  return false;
+}
+function timingEqual(a, b) {
+  if (a.length !== b.length) return false;
+  let diff = 0;
+  for (let i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  return diff === 0;
+}
+var POOL_API_KEY_INFO, RUNNER_API_KEY_INFO;
+var init_keys = __esm({
+  "src/pool/keys.ts"() {
+    "use strict";
+    POOL_API_KEY_INFO = "kody-pool-api:v1";
+    RUNNER_API_KEY_INFO = "kody-runner-api:v1";
+  }
+});
+
+// src/stateRepoGithub.ts
 import * as fs37 from "fs";
 import * as path35 from "path";
+function recordValue3(value) {
+  return value && typeof value === "object" && !Array.isArray(value) ? value : null;
+}
+function contentsUrl(owner, repo, filePath) {
+  const encodedPath = filePath.split("/").filter(Boolean).map((part) => encodeURIComponent(part)).join("/");
+  return `${GITHUB_API}/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}/contents/${encodedPath}`;
+}
+async function githubContentsFile(opts) {
+  const doFetch = opts.fetchImpl ?? fetch;
+  const res = await doFetch(contentsUrl(opts.owner, opts.repo, opts.path), {
+    headers: {
+      Authorization: `Bearer ${opts.githubToken}`,
+      Accept: "application/vnd.github+json",
+      "X-GitHub-Api-Version": "2022-11-28",
+      "User-Agent": "kody-engine"
+    },
+    signal: AbortSignal.timeout(REQ_TIMEOUT_MS)
+  });
+  if (res.status === 404) return null;
+  if (!res.ok) {
+    throw new Error(
+      `GitHub ${opts.owner}/${opts.repo}:${opts.path}: ${res.status} ${(await res.text().catch(() => "")).slice(0, 160)}`
+    );
+  }
+  return await res.json();
+}
+function decodeContentsFile(file, label) {
+  if (file.type !== "file" || file.encoding !== "base64" || typeof file.content !== "string") {
+    throw new Error(`${label} is not a base64 file`);
+  }
+  if (typeof file.sha !== "string") {
+    throw new Error(`${label} response missing sha`);
+  }
+  return {
+    path: label,
+    content: Buffer.from(file.content, "base64").toString("utf-8"),
+    sha: file.sha
+  };
+}
+async function loadGithubStateConfig(opts) {
+  const configFile = await githubContentsFile({
+    owner: opts.owner,
+    repo: opts.repo,
+    path: "kody.config.json",
+    githubToken: opts.githubToken,
+    fetchImpl: opts.fetchImpl
+  });
+  let raw = {};
+  if (configFile) {
+    const decoded = decodeContentsFile(configFile, "kody.config.json");
+    try {
+      raw = JSON.parse(decoded.content);
+    } catch (err) {
+      throw new Error(`kody.config.json is invalid JSON: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+  const githubRaw = recordValue3(raw.github) ?? {};
+  const github = {
+    owner: typeof githubRaw.owner === "string" && githubRaw.owner.trim() ? githubRaw.owner.trim() : opts.owner,
+    repo: typeof githubRaw.repo === "string" && githubRaw.repo.trim() ? githubRaw.repo.trim() : opts.repo
+  };
+  const nestedState = recordValue3(raw.state) ?? {};
+  const repoRaw = typeof raw.stateRepo === "string" ? raw.stateRepo : nestedState.repo;
+  const pathRaw = typeof raw.statePath === "string" ? raw.statePath : nestedState.path;
+  const stateRepo = typeof repoRaw === "string" && repoRaw.trim().length > 0 ? repoRaw.trim() : `https://github.com/${github.owner}/kody-state`;
+  parseStateRepoSlug(stateRepo);
+  const statePath = typeof pathRaw === "string" && pathRaw.trim().length > 0 ? pathRaw.trim() : github.repo;
+  return {
+    github,
+    state: {
+      repo: stateRepo,
+      path: normalizeStatePath(statePath)
+    }
+  };
+}
+async function readGithubStateText(opts) {
+  const config = await loadGithubStateConfig(opts);
+  return readGithubStateTextWithConfig({
+    config,
+    filePath: opts.filePath,
+    githubToken: opts.githubToken,
+    fetchImpl: opts.fetchImpl
+  });
+}
+async function readGithubStateTextWithConfig(opts) {
+  const target = stateRepoPath(opts.config, opts.filePath);
+  const parsed = parseStateRepo(opts.config);
+  const file = await githubContentsFile({
+    owner: parsed.owner,
+    repo: parsed.repo,
+    path: target,
+    githubToken: opts.githubToken,
+    fetchImpl: opts.fetchImpl
+  });
+  return file ? decodeContentsFile(file, target) : null;
+}
+async function writeGithubStateTextWithConfig(opts) {
+  const target = stateRepoPath(opts.config, opts.filePath);
+  const parsed = parseStateRepo(opts.config);
+  const payload = {
+    message: opts.message,
+    content: Buffer.from(opts.content, "utf-8").toString("base64")
+  };
+  if (opts.sha) payload.sha = opts.sha;
+  const doFetch = opts.fetchImpl ?? fetch;
+  const res = await doFetch(contentsUrl(parsed.owner, parsed.repo, target), {
+    method: "PUT",
+    headers: {
+      Authorization: `Bearer ${opts.githubToken}`,
+      Accept: "application/vnd.github+json",
+      "Content-Type": "application/json",
+      "X-GitHub-Api-Version": "2022-11-28",
+      "User-Agent": "kody-engine"
+    },
+    body: JSON.stringify(payload),
+    signal: AbortSignal.timeout(REQ_TIMEOUT_MS)
+  });
+  if (!res.ok) {
+    throw new Error(
+      `GitHub write ${parsed.owner}/${parsed.repo}:${target}: ${res.status} ${(await res.text().catch(() => "")).slice(0, 160)}`
+    );
+  }
+}
+function jsonlLines(text) {
+  return text.split("\n").filter((line) => line.length > 0);
+}
+function renderJsonl(lines) {
+  return lines.length > 0 ? `${lines.join("\n")}
+` : "";
+}
+function mergeJsonl(localText, remoteText) {
+  const remoteLines = jsonlLines(remoteText);
+  const seen = new Set(remoteLines);
+  const localOnly = jsonlLines(localText).filter((line) => !seen.has(line));
+  return renderJsonl([...remoteLines, ...localOnly]);
+}
+async function syncJsonlFileFromGithubState(opts) {
+  const remote = await readGithubStateTextWithConfig(opts);
+  if (!remote) return;
+  const local = fs37.existsSync(opts.localPath) ? fs37.readFileSync(opts.localPath, "utf-8") : "";
+  const next = mergeJsonl(local, remote.content);
+  if (next === local) return;
+  fs37.mkdirSync(path35.dirname(opts.localPath), { recursive: true });
+  fs37.writeFileSync(opts.localPath, next);
+}
+async function persistJsonlFileToGithubState(opts) {
+  if (!fs37.existsSync(opts.localPath)) return;
+  const localText = fs37.readFileSync(opts.localPath, "utf-8");
+  for (let attempt = 1; attempt <= 3; attempt += 1) {
+    const remote = await readGithubStateTextWithConfig(opts);
+    const body = mergeJsonl(localText, remote?.content ?? "");
+    try {
+      await writeGithubStateTextWithConfig({
+        config: opts.config,
+        filePath: opts.filePath,
+        content: body,
+        message: opts.message,
+        githubToken: opts.githubToken,
+        sha: remote?.sha,
+        fetchImpl: opts.fetchImpl
+      });
+      return;
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      const conflict = /409|422|does not match|is at|but expected/i.test(msg);
+      if (!conflict || attempt === 3) throw err;
+    }
+  }
+}
+var GITHUB_API, REQ_TIMEOUT_MS;
+var init_stateRepoGithub = __esm({
+  "src/stateRepoGithub.ts"() {
+    "use strict";
+    init_stateRepo();
+    GITHUB_API = "https://api.github.com";
+    REQ_TIMEOUT_MS = 3e4;
+  }
+});
+
+// src/stateRepoVault.ts
+import { createDecipheriv, createHash as createHash3 } from "crypto";
+function cacheKey2(owner, repo, masterKey) {
+  const keyHash = createHash3("sha256").update(masterKey).digest("hex").slice(0, 16);
+  return `${owner}/${repo}:${keyHash}`.toLowerCase();
+}
+function decryptVault(payload, masterKey) {
+  const parts = payload.split(":");
+  if (parts.length !== 4 || parts[0] !== "v1") {
+    throw new Error("invalid vault payload format");
+  }
+  const [, ivB64, ctB64, tagB64] = parts;
+  const iv = Buffer.from(ivB64, "base64");
+  const ct = Buffer.from(ctB64, "base64");
+  const tag = Buffer.from(tagB64, "base64");
+  const decipher = createDecipheriv("aes-256-gcm", masterKey, iv);
+  decipher.setAuthTag(tag);
+  return Buffer.concat([decipher.update(ct), decipher.final()]).toString("utf8");
+}
+async function readVaultSecrets(opts) {
+  const key = cacheKey2(opts.owner, opts.repo, opts.masterKey);
+  const hit = cache.get(key);
+  if (hit && hit.expiresAt > Date.now()) return hit.secrets;
+  const file = await readGithubStateText({
+    owner: opts.owner,
+    repo: opts.repo,
+    filePath: VAULT_PATH,
+    githubToken: opts.githubToken,
+    fetchImpl: opts.fetchImpl
+  });
+  if (!file) {
+    cache.set(key, { secrets: {}, expiresAt: Date.now() + CACHE_TTL_MS });
+    return {};
+  }
+  const ciphertext = file.content.trim();
+  const doc = JSON.parse(decryptVault(ciphertext, opts.masterKey));
+  const flat = {};
+  for (const [name, entry] of Object.entries(doc.secrets ?? {})) {
+    if (entry && typeof entry.value === "string") flat[name] = entry.value;
+  }
+  cache.set(key, { secrets: flat, expiresAt: Date.now() + CACHE_TTL_MS });
+  return flat;
+}
+async function readRepoSecret(opts) {
+  const secrets = await readVaultSecrets(opts);
+  const v = secrets[opts.name];
+  return v?.trim() ? v : null;
+}
+async function readRepoSecrets(opts) {
+  return readVaultSecrets(opts);
+}
+var VAULT_PATH, CACHE_TTL_MS, cache;
+var init_stateRepoVault = __esm({
+  "src/stateRepoVault.ts"() {
+    "use strict";
+    init_stateRepoGithub();
+    VAULT_PATH = "secrets.enc";
+    CACHE_TTL_MS = 6e4;
+    cache = /* @__PURE__ */ new Map();
+  }
+});
+
+// src/scripts/runtimeSecrets.ts
+function tokenFromEnv(env) {
+  return (env.KODY_TOKEN ?? env.GH_TOKEN ?? env.GITHUB_TOKEN ?? env.GH_PAT ?? "").trim();
+}
+function envSecret(name, env) {
+  const value = env[name]?.trim() ? env[name] : "";
+  return value ? { value, source: "env" } : { value: "", source: "missing" };
+}
+async function resolveRuntimeSecret(name, ctx, opts = {}) {
+  const env = opts.env ?? process.env;
+  const masterRaw = env.KODY_MASTER_KEY?.trim() ?? "";
+  const githubToken2 = tokenFromEnv(env);
+  if (!masterRaw || !githubToken2) return envSecret(name, env);
+  try {
+    const masterKey = masterKeyBytes(masterRaw);
+    if (masterKey.length !== 32) {
+      throw new Error("KODY_MASTER_KEY must decode to 32 bytes");
+    }
+    const value = await readRepoSecret({
+      owner: ctx.config.github.owner,
+      repo: ctx.config.github.repo,
+      name,
+      githubToken: githubToken2,
+      masterKey,
+      fetchImpl: opts.fetchImpl
+    });
+    if (value) return { value, source: "vault" };
+  } catch (err) {
+    const fallback = envSecret(name, env);
+    return {
+      ...fallback,
+      warning: `vault read failed for ${name}: ${err instanceof Error ? err.message : String(err)}`
+    };
+  }
+  return envSecret(name, env);
+}
+var init_runtimeSecrets = __esm({
+  "src/scripts/runtimeSecrets.ts"() {
+    "use strict";
+    init_keys();
+    init_stateRepoVault();
+  }
+});
+
+// src/scripts/loadQaContext.ts
+import * as fs38 from "fs";
+import * as path36 from "path";
 function parseSlugList(value) {
   const inner = value.startsWith("[") && value.endsWith("]") ? value.slice(1, -1) : value;
   return inner.split(",").map(
@@ -13502,18 +13835,18 @@ function readProfileAgents(raw) {
   return { agent: agent ?? legacy ?? ["kody"], body };
 }
 function readProfile(cwd) {
-  const dir = path35.join(cwd, CONTEXT_DIR_REL_PATH);
-  if (!fs37.existsSync(dir)) return "";
+  const dir = path36.join(cwd, CONTEXT_DIR_REL_PATH);
+  if (!fs38.existsSync(dir)) return "";
   let entries;
   try {
-    entries = fs37.readdirSync(dir).filter((f) => f.endsWith(".md")).sort();
+    entries = fs38.readdirSync(dir).filter((f) => f.endsWith(".md")).sort();
   } catch {
     return "";
   }
   const blocks = [];
   for (const file of entries) {
     try {
-      const raw = fs37.readFileSync(path35.join(dir, file), "utf-8");
+      const raw = fs38.readFileSync(path36.join(dir, file), "utf-8");
       const { agent, body } = readProfileAgents(raw);
       if (!agent.includes(QA_AGENT) && !agent.includes(ALL_AGENTS)) continue;
       blocks.push(`## ${file}
@@ -13541,6 +13874,7 @@ var init_loadQaContext = __esm({
   "src/scripts/loadQaContext.ts"() {
     "use strict";
     init_kodyVariables();
+    init_runtimeSecrets();
     CONTEXT_DIR_REL_PATH = ".kody/context";
     QA_AGENT = "qa-engineer";
     ALL_AGENTS = "*";
@@ -13549,18 +13883,20 @@ var init_loadQaContext = __esm({
     loadQaContext = async (ctx) => {
       const vars = readKodyVariables(ctx.cwd);
       const login = vars.LOGIN_USER ?? "";
-      const password = process.env.LOGIN_PASSWORD ?? "";
+      const password = await resolveRuntimeSecret("LOGIN_PASSWORD", ctx);
       const authProfile = ctx.args.authProfile;
       ctx.data.qaLogin = login;
+      ctx.data.qaPasswordSource = password.source;
+      if (password.warning) ctx.data.qaPasswordWarning = password.warning;
       ctx.data.qaProfile = readProfile(ctx.cwd);
-      ctx.data.qaAuthBlock = composeAuthBlock(authProfile, login, password);
+      ctx.data.qaAuthBlock = composeAuthBlock(authProfile, login, password.value);
     };
   }
 });
 
 // src/taskContext.ts
-import * as fs38 from "fs";
-import * as path36 from "path";
+import * as fs39 from "fs";
+import * as path37 from "path";
 function buildTaskContext(args) {
   return {
     schemaVersion: TASK_CONTEXT_SCHEMA_VERSION,
@@ -13576,9 +13912,9 @@ function buildTaskContext(args) {
 function persistTaskContext(cwd, ctx) {
   try {
     const dir = runtimeStatePath(cwd, "agent-runs", ctx.runId);
-    fs38.mkdirSync(dir, { recursive: true });
-    const file = path36.join(dir, "task-context.json");
-    fs38.writeFileSync(file, `${JSON.stringify(ctx, null, 2)}
+    fs39.mkdirSync(dir, { recursive: true });
+    const file = path37.join(dir, "task-context.json");
+    fs39.writeFileSync(file, `${JSON.stringify(ctx, null, 2)}
 `);
     return file;
   } catch (err) {
@@ -14349,32 +14685,32 @@ var init_parseAgentResult = __esm({
   }
 });
 
-// src/scripts/parseCompanyManagerDecision.ts
+// src/scripts/parseAgencyArchitectDecision.ts
 function makeAction3(type, payload) {
   return { type, payload, timestamp: (/* @__PURE__ */ new Date()).toISOString() };
 }
-var parseCompanyManagerDecision;
-var init_parseCompanyManagerDecision = __esm({
-  "src/scripts/parseCompanyManagerDecision.ts"() {
+var parseAgencyArchitectDecision;
+var init_parseAgencyArchitectDecision = __esm({
+  "src/scripts/parseAgencyArchitectDecision.ts"() {
     "use strict";
-    init_companyManagerDecision();
-    parseCompanyManagerDecision = async (ctx, _profile, agentResult) => {
+    init_agencyArchitectDecision();
+    parseAgencyArchitectDecision = async (ctx, _profile, agentResult) => {
       if (!agentResult) {
-        ctx.data.companyManagerDecision = { summary: "", actions: [] };
-        ctx.data.action = makeAction3("COMPANY_MANAGER_NOT_RUN", { reason: "no agent result" });
+        ctx.data.agencyArchitectDecision = { summary: "", actions: [] };
+        ctx.data.action = makeAction3("AGENCY_ARCHITECT_NOT_RUN", { reason: "no agent result" });
         return;
       }
       try {
-        const decision = parseCompanyManagerDecisionText(agentResult.finalText);
-        ctx.data.companyManagerDecision = decision;
-        ctx.data.action = makeAction3("COMPANY_MANAGER_DECIDED", {
+        const decision = parseAgencyArchitectDecisionText(agentResult.finalText);
+        ctx.data.agencyArchitectDecision = decision;
+        ctx.data.action = makeAction3("AGENCY_ARCHITECT_DECIDED", {
           summary: decision.summary,
           actionCount: decision.actions.length
         });
       } catch (err) {
         const reason = err instanceof Error ? err.message : String(err);
-        ctx.data.companyManagerDecisionError = reason;
-        ctx.data.action = makeAction3("COMPANY_MANAGER_FAILED", { reason });
+        ctx.data.agencyArchitectDecisionError = reason;
+        ctx.data.action = makeAction3("AGENCY_ARCHITECT_FAILED", { reason });
         ctx.output.exitCode = 1;
         ctx.output.reason = reason;
       }
@@ -15873,192 +16209,10 @@ var init_runFlow = __esm({
   }
 });
 
-// src/stateRepoGithub.ts
-import * as fs39 from "fs";
-import * as path37 from "path";
-function recordValue3(value) {
-  return value && typeof value === "object" && !Array.isArray(value) ? value : null;
-}
-function contentsUrl(owner, repo, filePath) {
-  const encodedPath = filePath.split("/").filter(Boolean).map((part) => encodeURIComponent(part)).join("/");
-  return `${GITHUB_API}/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}/contents/${encodedPath}`;
-}
-async function githubContentsFile(opts) {
-  const doFetch = opts.fetchImpl ?? fetch;
-  const res = await doFetch(contentsUrl(opts.owner, opts.repo, opts.path), {
-    headers: {
-      Authorization: `Bearer ${opts.githubToken}`,
-      Accept: "application/vnd.github+json",
-      "X-GitHub-Api-Version": "2022-11-28",
-      "User-Agent": "kody-engine"
-    },
-    signal: AbortSignal.timeout(REQ_TIMEOUT_MS)
-  });
-  if (res.status === 404) return null;
-  if (!res.ok) {
-    throw new Error(
-      `GitHub ${opts.owner}/${opts.repo}:${opts.path}: ${res.status} ${(await res.text().catch(() => "")).slice(0, 160)}`
-    );
-  }
-  return await res.json();
-}
-function decodeContentsFile(file, label) {
-  if (file.type !== "file" || file.encoding !== "base64" || typeof file.content !== "string") {
-    throw new Error(`${label} is not a base64 file`);
-  }
-  if (typeof file.sha !== "string") {
-    throw new Error(`${label} response missing sha`);
-  }
-  return {
-    path: label,
-    content: Buffer.from(file.content, "base64").toString("utf-8"),
-    sha: file.sha
-  };
-}
-async function loadGithubStateConfig(opts) {
-  const configFile = await githubContentsFile({
-    owner: opts.owner,
-    repo: opts.repo,
-    path: "kody.config.json",
-    githubToken: opts.githubToken,
-    fetchImpl: opts.fetchImpl
-  });
-  let raw = {};
-  if (configFile) {
-    const decoded = decodeContentsFile(configFile, "kody.config.json");
-    try {
-      raw = JSON.parse(decoded.content);
-    } catch (err) {
-      throw new Error(`kody.config.json is invalid JSON: ${err instanceof Error ? err.message : String(err)}`);
-    }
-  }
-  const githubRaw = recordValue3(raw.github) ?? {};
-  const github = {
-    owner: typeof githubRaw.owner === "string" && githubRaw.owner.trim() ? githubRaw.owner.trim() : opts.owner,
-    repo: typeof githubRaw.repo === "string" && githubRaw.repo.trim() ? githubRaw.repo.trim() : opts.repo
-  };
-  const nestedState = recordValue3(raw.state) ?? {};
-  const repoRaw = typeof raw.stateRepo === "string" ? raw.stateRepo : nestedState.repo;
-  const pathRaw = typeof raw.statePath === "string" ? raw.statePath : nestedState.path;
-  const stateRepo = typeof repoRaw === "string" && repoRaw.trim().length > 0 ? repoRaw.trim() : `https://github.com/${github.owner}/kody-state`;
-  parseStateRepoSlug(stateRepo);
-  const statePath = typeof pathRaw === "string" && pathRaw.trim().length > 0 ? pathRaw.trim() : github.repo;
-  return {
-    github,
-    state: {
-      repo: stateRepo,
-      path: normalizeStatePath(statePath)
-    }
-  };
-}
-async function readGithubStateText(opts) {
-  const config = await loadGithubStateConfig(opts);
-  return readGithubStateTextWithConfig({
-    config,
-    filePath: opts.filePath,
-    githubToken: opts.githubToken,
-    fetchImpl: opts.fetchImpl
-  });
-}
-async function readGithubStateTextWithConfig(opts) {
-  const target = stateRepoPath(opts.config, opts.filePath);
-  const parsed = parseStateRepo(opts.config);
-  const file = await githubContentsFile({
-    owner: parsed.owner,
-    repo: parsed.repo,
-    path: target,
-    githubToken: opts.githubToken,
-    fetchImpl: opts.fetchImpl
-  });
-  return file ? decodeContentsFile(file, target) : null;
-}
-async function writeGithubStateTextWithConfig(opts) {
-  const target = stateRepoPath(opts.config, opts.filePath);
-  const parsed = parseStateRepo(opts.config);
-  const payload = {
-    message: opts.message,
-    content: Buffer.from(opts.content, "utf-8").toString("base64")
-  };
-  if (opts.sha) payload.sha = opts.sha;
-  const doFetch = opts.fetchImpl ?? fetch;
-  const res = await doFetch(contentsUrl(parsed.owner, parsed.repo, target), {
-    method: "PUT",
-    headers: {
-      Authorization: `Bearer ${opts.githubToken}`,
-      Accept: "application/vnd.github+json",
-      "Content-Type": "application/json",
-      "X-GitHub-Api-Version": "2022-11-28",
-      "User-Agent": "kody-engine"
-    },
-    body: JSON.stringify(payload),
-    signal: AbortSignal.timeout(REQ_TIMEOUT_MS)
-  });
-  if (!res.ok) {
-    throw new Error(
-      `GitHub write ${parsed.owner}/${parsed.repo}:${target}: ${res.status} ${(await res.text().catch(() => "")).slice(0, 160)}`
-    );
-  }
-}
-function jsonlLines(text) {
-  return text.split("\n").filter((line) => line.length > 0);
-}
-function renderJsonl(lines) {
-  return lines.length > 0 ? `${lines.join("\n")}
-` : "";
-}
-function mergeJsonl(localText, remoteText) {
-  const remoteLines = jsonlLines(remoteText);
-  const seen = new Set(remoteLines);
-  const localOnly = jsonlLines(localText).filter((line) => !seen.has(line));
-  return renderJsonl([...remoteLines, ...localOnly]);
-}
-async function syncJsonlFileFromGithubState(opts) {
-  const remote = await readGithubStateTextWithConfig(opts);
-  if (!remote) return;
-  const local = fs39.existsSync(opts.localPath) ? fs39.readFileSync(opts.localPath, "utf-8") : "";
-  const next = mergeJsonl(local, remote.content);
-  if (next === local) return;
-  fs39.mkdirSync(path37.dirname(opts.localPath), { recursive: true });
-  fs39.writeFileSync(opts.localPath, next);
-}
-async function persistJsonlFileToGithubState(opts) {
-  if (!fs39.existsSync(opts.localPath)) return;
-  const localText = fs39.readFileSync(opts.localPath, "utf-8");
-  for (let attempt = 1; attempt <= 3; attempt += 1) {
-    const remote = await readGithubStateTextWithConfig(opts);
-    const body = mergeJsonl(localText, remote?.content ?? "");
-    try {
-      await writeGithubStateTextWithConfig({
-        config: opts.config,
-        filePath: opts.filePath,
-        content: body,
-        message: opts.message,
-        githubToken: opts.githubToken,
-        sha: remote?.sha,
-        fetchImpl: opts.fetchImpl
-      });
-      return;
-    } catch (err) {
-      const msg = err instanceof Error ? err.message : String(err);
-      const conflict = /409|422|does not match|is at|but expected/i.test(msg);
-      if (!conflict || attempt === 3) throw err;
-    }
-  }
-}
-var GITHUB_API, REQ_TIMEOUT_MS;
-var init_stateRepoGithub = __esm({
-  "src/stateRepoGithub.ts"() {
-    "use strict";
-    init_stateRepo();
-    GITHUB_API = "https://api.github.com";
-    REQ_TIMEOUT_MS = 3e4;
-  }
-});
-
 // src/scripts/previewBuildHelpers.ts
-import { createDecipheriv, createHash as createHash3, hkdfSync } from "crypto";
+import { createDecipheriv as createDecipheriv2, createHash as createHash4, hkdfSync as hkdfSync2 } from "crypto";
 function shortHash(s) {
-  return createHash3("sha256").update(s).digest("hex").slice(0, 6);
+  return createHash4("sha256").update(s).digest("hex").slice(0, 6);
 }
 function previewAppName(repo, pr) {
   const [owner, name] = repo.split("/");
@@ -16087,7 +16241,7 @@ function decryptVaultPayload(payload, keyRaw) {
   const iv = Buffer.from(ivB64, "base64");
   const ct = Buffer.from(ctB64, "base64");
   const tag = Buffer.from(tagB64, "base64");
-  const decipher = createDecipheriv("aes-256-gcm", key, iv);
+  const decipher = createDecipheriv2("aes-256-gcm", key, iv);
   decipher.setAuthTag(tag);
   return Buffer.concat([decipher.update(ct), decipher.final()]).toString("utf8");
 }
@@ -16100,7 +16254,7 @@ function derivePreviewVerifyKey(masterKeyRaw) {
   if (masterKey.length !== 32) {
     throw new Error("KODY_MASTER_KEY must decode to 32 bytes");
   }
-  return Buffer.from(hkdfSync("sha256", masterKey, Buffer.alloc(0), PREVIEW_KEY_INFO, 32)).toString("hex");
+  return Buffer.from(hkdfSync2("sha256", masterKey, Buffer.alloc(0), PREVIEW_KEY_INFO, 32)).toString("hex");
 }
 function previewRuntimeEnv(args) {
   return {
@@ -16131,7 +16285,7 @@ function formatPreviewComment(args) {
   ].join("\n");
 }
 function defaultImageTag(repo, ref) {
-  return createHash3("sha256").update(`${repo}@${ref}`).digest("hex").slice(0, 12);
+  return createHash4("sha256").update(`${repo}@${ref}`).digest("hex").slice(0, 12);
 }
 var NEVER_PASS_TO_BUILD, PREVIEW_KEY_INFO;
 var init_previewBuildHelpers = __esm({
@@ -17746,7 +17900,7 @@ var init_scripts = __esm({
     init_appendCompanyActivity();
     init_appendCompanyIntentDecision();
     init_applyCapabilityReports();
-    init_applyCompanyManagerDecision();
+    init_applyAgencyArchitectDecision();
     init_buildSyntheticPlugin();
     init_checkCoverageWithRetry();
     init_classifyByLabel();
@@ -17793,7 +17947,7 @@ var init_scripts = __esm({
     init_openAgentFactoryStatePr();
     init_openQaIssue();
     init_parseAgentResult();
-    init_parseCompanyManagerDecision();
+    init_parseAgencyArchitectDecision();
     init_parseIssueStateFromAgentResult();
     init_parseJobStateFromAgentResult();
     init_parseReproOutput();
@@ -17888,7 +18042,7 @@ var init_scripts = __esm({
     };
     postflightScripts = {
       parseAgentResult: parseAgentResult2,
-      parseCompanyManagerDecision,
+      parseAgencyArchitectDecision,
       parseIssueStateFromAgentResult,
       parseJobStateFromAgentResult,
       parseReproOutput,
@@ -17896,7 +18050,7 @@ var init_scripts = __esm({
       writeJobStateFile,
       appendCompanyActivity,
       appendCompanyIntentDecision: appendCompanyIntentDecision2,
-      applyCompanyManagerDecision,
+      applyAgencyArchitectDecision,
       requireFeedbackActions,
       requirePlanDeviations,
       verify,
@@ -17987,7 +18141,7 @@ function hydrateStateWorkspace(config, cwd) {
   hydratedWorkspaces.add(hydrateKey);
 }
 function fetchStateSnapshot(parsed) {
-  const cacheDir = path41.join(cacheRoot2(), cacheKey2(parsed));
+  const cacheDir = path41.join(cacheRoot2(), cacheKey3(parsed));
   const url = `https://github.com/${parsed.owner}/${parsed.repo}.git`;
   try {
     fs43.mkdirSync(path41.dirname(cacheDir), { recursive: true });
@@ -18012,7 +18166,7 @@ function fetchStateSnapshot(parsed) {
 function cacheRoot2() {
   return process.env[CACHE_ENV2]?.trim() || path41.join(os7.homedir(), ".cache", "kody", "state-repo");
 }
-function cacheKey2(parsed) {
+function cacheKey3(parsed) {
   return crypto3.createHash("sha256").update(`${parsed.owner}/${parsed.repo}#${parsed.branch}#${parsed.basePath}`).digest("hex").slice(0, 24);
 }
 function runGit3(args) {
@@ -23130,42 +23284,8 @@ async function runCapabilityFallbackTick(deps) {
   return { ran: true, claimed };
 }
 
-// src/pool/keys.ts
-import { hkdfSync as hkdfSync2 } from "crypto";
-var POOL_API_KEY_INFO = "kody-pool-api:v1";
-var RUNNER_API_KEY_INFO = "kody-runner-api:v1";
-function masterKeyBytes(raw) {
-  const v = raw.trim();
-  if (!v) throw new Error("KODY_MASTER_KEY is empty");
-  if (/^[0-9a-fA-F]+$/.test(v) && v.length === 64) {
-    return Buffer.from(v, "hex");
-  }
-  return Buffer.from(v.replace(/-/g, "+").replace(/_/g, "/"), "base64");
-}
-function deriveKey(master, info, length = 32) {
-  return Buffer.from(hkdfSync2("sha256", master, Buffer.alloc(0), info, length)).toString("hex");
-}
-function derivePoolApiKey(master) {
-  return deriveKey(master, POOL_API_KEY_INFO);
-}
-function deriveRunnerApiKey(master) {
-  return deriveKey(master, RUNNER_API_KEY_INFO);
-}
-function bearerOk(headerAuth, xApiKey, expected) {
-  const x = (xApiKey ?? "").trim();
-  if (x && timingEqual(x, expected)) return true;
-  const a = (headerAuth ?? "").trim();
-  if (a.toLowerCase().startsWith("bearer ")) {
-    return timingEqual(a.slice(7).trim(), expected);
-  }
-  return false;
-}
-function timingEqual(a, b) {
-  if (a.length !== b.length) return false;
-  let diff = 0;
-  for (let i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
-  return diff === 0;
-}
+// src/servers/pool-serve.ts
+init_keys();
 
 // src/pool/fly.ts
 var FLY_API_BASE = "https://api.machines.dev/v1";
@@ -23530,59 +23650,8 @@ function isSuspendedWithIp(m) {
   return (m.state === "suspended" || m.state === "suspending") && !!m.private_ip;
 }
 
-// src/pool/vault.ts
-init_stateRepoGithub();
-import { createDecipheriv as createDecipheriv2 } from "crypto";
-var VAULT_PATH = "secrets.enc";
-var CACHE_TTL_MS = 6e4;
-var cache = /* @__PURE__ */ new Map();
-function decryptVault(payload, masterKey) {
-  const parts = payload.split(":");
-  if (parts.length !== 4 || parts[0] !== "v1") {
-    throw new Error("invalid vault payload format");
-  }
-  const [, ivB64, ctB64, tagB64] = parts;
-  const iv = Buffer.from(ivB64, "base64");
-  const ct = Buffer.from(ctB64, "base64");
-  const tag = Buffer.from(tagB64, "base64");
-  const decipher = createDecipheriv2("aes-256-gcm", masterKey, iv);
-  decipher.setAuthTag(tag);
-  return Buffer.concat([decipher.update(ct), decipher.final()]).toString("utf8");
-}
-async function readVaultSecrets(opts) {
-  const key = `${opts.owner}/${opts.repo}`.toLowerCase();
-  const hit = cache.get(key);
-  if (hit && hit.expiresAt > Date.now()) return hit.secrets;
-  const file = await readGithubStateText({
-    owner: opts.owner,
-    repo: opts.repo,
-    filePath: VAULT_PATH,
-    githubToken: opts.githubToken,
-    fetchImpl: opts.fetchImpl
-  });
-  if (!file) {
-    cache.set(key, { secrets: {}, expiresAt: Date.now() + CACHE_TTL_MS });
-    return {};
-  }
-  const ciphertext = file.content.trim();
-  const doc = JSON.parse(decryptVault(ciphertext, opts.masterKey));
-  const flat = {};
-  for (const [name, entry] of Object.entries(doc.secrets ?? {})) {
-    if (entry && typeof entry.value === "string") flat[name] = entry.value;
-  }
-  cache.set(key, { secrets: flat, expiresAt: Date.now() + CACHE_TTL_MS });
-  return flat;
-}
-async function readRepoSecret(opts) {
-  const secrets = await readVaultSecrets(opts);
-  const v = secrets[opts.name];
-  return v?.trim() ? v : null;
-}
-async function readRepoSecrets(opts) {
-  return readVaultSecrets(opts);
-}
-
 // src/pool/registry.ts
+init_stateRepoVault();
 var POOL_MIN_VAULT_KEY = "POOL_MIN";
 var POOL_MIN_MAX = 10;
 function parsePoolMin(raw, dflt) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kody-ade/kody-engine",
-  "version": "0.4.306",
+  "version": "0.4.307",
   "description": "kody — autonomous development engine. Single-session Claude Code agent behind a generic executor + declarative executable profiles.",
   "license": "MIT",
   "type": "module",
@@ -12,28 +12,6 @@
     "templates",
     "kody.config.schema.json"
   ],
-  "scripts": {
-    "kody:run": "tsx bin/kody.ts",
-    "serve": "tsx bin/kody.ts serve",
-    "serve:vscode": "tsx bin/kody.ts serve vscode",
-    "serve:claude": "tsx bin/kody.ts serve claude",
-    "clean:dist": "node scripts/clean-dist.cjs",
-    "build": "pnpm clean:dist && tsup && node scripts/copy-assets.cjs",
-    "check:modularity": "tsx scripts/check-script-modularity.ts",
-    "pretest": "pnpm check:modularity",
-    "test": "vitest run tests/unit tests/int --coverage",
-    "posttest": "tsx scripts/check-coverage-floor.ts",
-    "test:smoke": "vitest run tests/smoke --no-coverage",
-    "test:e2e": "vitest run tests/e2e --no-coverage",
-    "test:all": "vitest run tests --no-coverage",
-    "typecheck": "tsc --noEmit",
-    "lint": "biome check",
-    "lint:fix": "biome check --write",
-    "format": "biome format --write",
-    "verify:package": "node scripts/verify-package-tarball.cjs",
-    "brain:publish": "docker buildx build --platform linux/amd64 -f runner/Dockerfile.brain -t ghcr.io/${KODY_BRAIN_GHCR_OWNER:-aharonyaircohen}/kody-brain:latest --push runner",
-    "prepublishOnly": "pnpm typecheck && vitest run tests/unit tests/int --no-coverage && pnpm build && pnpm verify:package"
-  },
   "dependencies": {
     "@actions/cache": "^6.0.0",
     "@anthropic-ai/claude-agent-sdk": "0.2.119",
@@ -57,5 +35,26 @@
     "url": "git+https://github.com/aharonyaircohen/kody-engine.git"
   },
   "homepage": "https://github.com/aharonyaircohen/kody-engine",
-  "bugs": "https://github.com/aharonyaircohen/kody-engine/issues"
-}
+  "bugs": "https://github.com/aharonyaircohen/kody-engine/issues",
+  "scripts": {
+    "kody:run": "tsx bin/kody.ts",
+    "serve": "tsx bin/kody.ts serve",
+    "serve:vscode": "tsx bin/kody.ts serve vscode",
+    "serve:claude": "tsx bin/kody.ts serve claude",
+    "clean:dist": "node scripts/clean-dist.cjs",
+    "build": "pnpm clean:dist && tsup && node scripts/copy-assets.cjs",
+    "check:modularity": "tsx scripts/check-script-modularity.ts",
+    "pretest": "pnpm check:modularity",
+    "test": "vitest run tests/unit tests/int --coverage",
+    "posttest": "tsx scripts/check-coverage-floor.ts",
+    "test:smoke": "vitest run tests/smoke --no-coverage",
+    "test:e2e": "vitest run tests/e2e --no-coverage",
+    "test:all": "vitest run tests --no-coverage",
+    "typecheck": "tsc --noEmit",
+    "lint": "biome check",
+    "lint:fix": "biome check --write",
+    "format": "biome format --write",
+    "verify:package": "node scripts/verify-package-tarball.cjs",
+    "brain:publish": "docker buildx build --platform linux/amd64 -f runner/Dockerfile.brain -t ghcr.io/${KODY_BRAIN_GHCR_OWNER:-aharonyaircohen}/kody-brain:latest --push runner"
+  }
+}