@kody-ade/kody-engine 0.4.372 → 0.4.374

package/dist/implementations/types.ts

@@ -364,9 +364,12 @@ export interface ScriptEntry {
    * Filename of a shell script colocated with the implementation
    * (e.g. "apply-prefer.sh"). Resolved relative to the profile's
    * directory. Invoked via `bash <path> <with-args>` with ctx.args
-   * exposed as env vars (KODY_ARG_<UPPER_NAME>=<value>). A stdout
-   * line `KODY_SKIP_AGENT=true` signals the executor to bypass the
-   * agent. Non-zero exit is treated as a preflight failure.
+   * exposed as env vars (KODY_ARG_<UPPER_NAME>=<value>). Side-channel
+   * markers (KODY_SKIP_AGENT=true, KODY_PR_URL=, KODY_REASON=,
+   * KODY_CAPABILITY_RESULT=, KODY_CAPABILITY_REPORT=) are read from the
+   * file named by $KODY_OUTPUT (preferred — not forgeable by echoed
+   * untrusted text); plain-stdout markers remain a deprecated fallback.
+   * Non-zero exit is treated as a preflight failure.
    */
   shell?: string
   /**
@@ -535,6 +538,10 @@ export interface Job {
   cliArgs: Record<string, unknown>
   /** Internal workflow resume context. Not passed to capability CLI args. */
   workflowFacts?: Record<string, unknown>
+  /** Durable execution cursor for a graph-shaped workflow. */
+  workflowState?: WorkflowRunState
+  /** Stable id used to load and persist one workflow execution. */
+  workflowRunId?: string
   /** Evidence this capability run is expected to report, independent of who consumes it. */
   evidence?: string
   /** Run once now ("instant") or on the schedule ("scheduled"). */
@@ -548,3 +555,14 @@ export interface Job {
   /** Internal parent context used by postflights to attach neutral capability output. */
   resultTarget?: CapabilityResultTarget
 }
+
+export interface WorkflowRunState {
+  status: "running" | "blocked" | "failed" | "done"
+  currentStepId?: string
+  completedStepIds: string[]
+  transitionCounts: Record<string, number>
+  facts: Record<string, unknown>
+  evidence: Record<string, boolean>
+  artifacts: Array<{ label: string; url?: string; path?: string }>
+  blocker?: string
+}

package/dist/plugins/hooks/block-git.json

@@ -7,7 +7,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "node -e 'let s=\"\";process.stdin.on(\"data\",c=>s+=c).on(\"end\",()=>{try{const d=JSON.parse(s);const cmd=(d.tool_input&&d.tool_input.command)||\"\";if(cmd.split(/[;&|\\n]+/).some(p=>/^(git|gh)(\\s|$)/.test(p.trim()))){process.stderr.write(\"kody blocks git/gh — the wrapper handles VCS; do not run git or gh commands\\n\");process.exit(2)}}catch{}})'"
+            "command": "node -e 'let s=\"\";process.stdin.on(\"data\",c=>s+=c).on(\"end\",()=>{try{const d=JSON.parse(s);const cmd=(d.tool_input&&d.tool_input.command)||\"\";const vcs=t=>/^(?:\\S*\\/)?(git|gh)$/.test(t);const wrap=new Set([\"command\",\"exec\",\"xargs\",\"env\",\"nohup\",\"time\",\"nice\",\"sudo\",\"doas\"]);const seg=cmd.split(/[;&|\\n]+/).some(p=>{const t=p.trim().split(/\\s+/).filter(Boolean);let i=0;while(i<t.length&&(wrap.has(t[i])||/^[A-Za-z_][A-Za-z0-9_]*=/.test(t[i])))i++;return t[i]!==undefined&&vcs(t[i])});const shc=/\\b(?:ba|z|da|k)?sh\\s+[^;|&]*-c\\s*[\"\\x27`]+\\s*(?:\\S*\\/)?(?:git|gh)\\b/.test(cmd);const sub=/[$`]\\(?\\s*(?:\\S*\\/)?(?:git|gh)\\s/.test(cmd);if(seg||shc||sub){process.stderr.write(\"kody blocks git/gh — the wrapper handles VCS; do not run git or gh commands (any invocation form)\\n\");process.exit(2)}}catch{}})'"
           }
         ]
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kody-ade/kody-engine",
-  "version": "0.4.372",
+  "version": "0.4.374",
   "description": "kody — autonomous development engine. Single-session Claude Code agent behind a generic executor + declarative implementation profiles.",
   "license": "MIT",
   "type": "module",