@kody-ade/kody-engine 0.4.379 → 0.4.381

package/dist/bin/kody.js

@@ -15,7 +15,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "@kody-ade/kody-engine",
-      version: "0.4.378",
+      version: "0.4.381",
       description: "kody \u2014 autonomous development engine. Single-session Claude Code agent behind a generic executor + declarative implementation profiles.",
       license: "MIT",
       type: "module",
@@ -53,6 +53,7 @@ var init_package = __esm({
         "@actions/cache": "^6.0.0",
         "@anthropic-ai/claude-agent-sdk": "0.2.119",
         "@modelcontextprotocol/sdk": "^1.29.0",
+        convex: "^1.17.0",
         zod: "^4.0.0"
       },
       devDependencies: {
@@ -1612,7 +1613,7 @@ function cmsHeaders(opts) {
     }
   };
 }
-async function callDashboardCms(opts, path52, init = {}) {
+async function callDashboardCms(opts, path53, init = {}) {
   const baseUrl = dashboardBaseUrl(opts);
   if (!baseUrl) {
     return {
@@ -1624,7 +1625,7 @@ async function callDashboardCms(opts, path52, init = {}) {
   const headerResult = cmsHeaders(opts);
   if (!headerResult.ok) return headerResult;
   try {
-    const res = await fetch(`${baseUrl}${path52}`, {
+    const res = await fetch(`${baseUrl}${path53}`, {
       ...init,
       headers: {
         ...headerResult.headers,
@@ -1696,8 +1697,8 @@ function documentArg(value) {
 function normalizeCmsDocumentIdInput(input) {
   const trimmed = stripWrappingQuotes(input.trim());
   const withoutQuery = trimmed.split(/[?#]/, 1)[0] ?? trimmed;
-  const path52 = parseDocumentPath(withoutQuery);
-  return path52 ?? parseDocumentIdSegment(withoutQuery) ?? withoutQuery;
+  const path53 = parseDocumentPath(withoutQuery);
+  return path53 ?? parseDocumentIdSegment(withoutQuery) ?? withoutQuery;
 }
 function stripWrappingQuotes(value) {
   let current = value;
@@ -1708,9 +1709,9 @@ function stripWrappingQuotes(value) {
   }
 }
 function parseDocumentPath(value) {
-  const path52 = value.startsWith("http://") || value.startsWith("https://") ? urlPathname(value) : value;
-  if (!path52?.includes("/content/entries/")) return null;
-  const parts = path52.split("/").filter(Boolean).map(decodePathPart);
+  const path53 = value.startsWith("http://") || value.startsWith("https://") ? urlPathname(value) : value;
+  if (!path53?.includes("/content/entries/")) return null;
+  const parts = path53.split("/").filter(Boolean).map(decodePathPart);
   const entriesIndex = parts.findIndex((part, index) => part === "content" && parts[index + 1] === "entries");
   const idPart = parts[entriesIndex + 3];
   if (!idPart || idPart === "new") return null;
@@ -1863,6 +1864,16 @@ var init_dashboardCmsMcp = __esm({
 // src/capabilityFolders.ts
 import * as fs4 from "fs";
 import * as path6 from "path";
+function capabilityOutputConditionPaths(config) {
+  const result = config.output?.result;
+  if (!result) return /* @__PURE__ */ new Set();
+  return /* @__PURE__ */ new Set([
+    "result.status",
+    "result.summary",
+    "result.resultClass",
+    ...result.facts.map((fact) => `result.facts.${fact}`)
+  ]);
+}
 function listCapabilityFolderSlugs(absDir) {
   if (!fs4.existsSync(absDir)) return [];
   let entries;
@@ -1923,9 +1934,17 @@ function parseCapabilityConfig(raw) {
     stage: stringField(raw.stage),
     readsFrom: stringList(raw.readsFrom ?? raw.reads_from),
     writesTo: stringList(raw.writesTo ?? raw.writes_to),
+    output: parseCapabilityOutput(raw.output),
     workflow: parseCapabilityWorkflow(raw.workflow)
   };
 }
+function parseCapabilityOutput(raw) {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return void 0;
+  const result = raw.result;
+  if (!result || typeof result !== "object" || Array.isArray(result)) return void 0;
+  const facts = stringList(result.facts);
+  return { result: { facts } };
+}
 function parseCapabilityKind(raw) {
   return raw === "observe" || raw === "act" || raw === "verify" ? raw : void 0;
 }
@@ -4645,6 +4664,7 @@ function loadProfile(profilePath) {
     skills: parseStringArray2(r.skills),
     prompt: typeof r.prompt === "string" && r.prompt.trim() ? r.prompt.trim() : void 0,
     chatTools: parseStringArray2(r.chatTools),
+    auth: parseAuth(profilePath, r.auth),
     describe: typeof r.describe === "string" ? r.describe : "",
     // Optional agent to run as. Empty/blank string → undefined (no agent).
     agent: typeof r.agent === "string" && r.agent.trim() ? r.agent.trim() : void 0,
@@ -4752,6 +4772,80 @@ function parseStringArray2(raw) {
   const values = raw.map((t) => String(t).trim()).filter(Boolean);
   return values.length > 0 ? values : void 0;
 }
+function rejectUnknownAuthFields(p, value, allowed, prefix) {
+  const known = new Set(allowed);
+  const unknown = Object.keys(value).find((key) => !known.has(key));
+  if (unknown) throw new ProfileError(p, `${prefix} has unknown field "${unknown}"`);
+}
+function parseAuth(p, raw) {
+  if (raw === void 0 || raw === null) return void 0;
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+    throw new ProfileError(p, `"auth" must be an object`);
+  }
+  const auth = raw;
+  rejectUnknownAuthFields(p, auth, ["methods"], "auth");
+  const methodsRaw = auth.methods;
+  if (!Array.isArray(methodsRaw) || methodsRaw.length === 0) {
+    throw new ProfileError(p, `auth.methods must be a non-empty array`);
+  }
+  const methods = methodsRaw.map((methodRaw, methodIndex) => {
+    if (!methodRaw || typeof methodRaw !== "object" || Array.isArray(methodRaw)) {
+      throw new ProfileError(p, `auth.methods[${methodIndex}] must be an object`);
+    }
+    const method = methodRaw;
+    rejectUnknownAuthFields(p, method, ["name", "strategy", "adapter", "fields"], `auth.methods[${methodIndex}]`);
+    const name = method.name;
+    if (typeof name !== "string" || !AUTH_TEXT_RE.test(name.trim())) {
+      throw new ProfileError(p, `auth.methods[${methodIndex}].name must be a single-line string of 1-120 characters`);
+    }
+    if (method.strategy !== "browser-storage-state") {
+      throw new ProfileError(p, `auth.methods[${methodIndex}].strategy must be browser-storage-state`);
+    }
+    if (method.adapter !== "kody-repository") {
+      throw new ProfileError(p, `auth.methods[${methodIndex}].adapter must be kody-repository`);
+    }
+    if (!Array.isArray(method.fields) || method.fields.length === 0) {
+      throw new ProfileError(p, `auth.methods[${methodIndex}].fields must be a non-empty array`);
+    }
+    const fields = method.fields.map((fieldRaw, fieldIndex) => {
+      const prefix = `auth.methods[${methodIndex}].fields[${fieldIndex}]`;
+      if (!fieldRaw || typeof fieldRaw !== "object" || Array.isArray(fieldRaw)) {
+        throw new ProfileError(p, `${prefix} must be an object`);
+      }
+      const field = fieldRaw;
+      rejectUnknownAuthFields(p, field, ["label", "source", "key"], prefix);
+      if (typeof field.label !== "string" || !AUTH_TEXT_RE.test(field.label.trim())) {
+        throw new ProfileError(p, `${prefix}.label must be a single-line string of 1-120 characters`);
+      }
+      if (field.source !== "variable" && field.source !== "secret") {
+        throw new ProfileError(p, `${prefix}.source must be variable or secret`);
+      }
+      if (typeof field.key !== "string" || !AUTH_KEY_RE.test(field.key)) {
+        throw new ProfileError(p, `${prefix}.key must be an uppercase variable or secret name`);
+      }
+      return {
+        label: field.label.trim(),
+        source: field.source,
+        key: field.key
+      };
+    });
+    const variableFields = fields.filter((field) => field.source === "variable");
+    const secretFields = fields.filter((field) => field.source === "secret");
+    if (variableFields.length !== 1 || secretFields.length !== 1) {
+      throw new ProfileError(
+        p,
+        `auth.methods[${methodIndex}] kody-repository requires exactly one variable field and one secret field`
+      );
+    }
+    return {
+      name: name.trim(),
+      strategy: method.strategy,
+      adapter: method.adapter,
+      fields
+    };
+  });
+  return { methods };
+}
 function parseCapabilityKind2(raw) {
   return raw === "observe" || raw === "act" || raw === "verify" ? raw : void 0;
 }
@@ -4996,7 +5090,7 @@ function parseScriptList(p, key, raw) {
   }
   return out;
 }
-var VALID_INPUT_TYPES, VALID_PERMISSION_MODES, VALID_ROLES, VALID_CONTAINER_CHILD_TARGETS, VALID_PHASES, KNOWN_PROFILE_KEYS;
+var VALID_INPUT_TYPES, VALID_PERMISSION_MODES, VALID_ROLES, VALID_CONTAINER_CHILD_TARGETS, VALID_PHASES, KNOWN_PROFILE_KEYS, AUTH_KEY_RE, AUTH_TEXT_RE;
 var init_profile = __esm({
   "src/profile.ts"() {
     "use strict";
@@ -5025,6 +5119,7 @@ var init_profile = __esm({
       "skills",
       "prompt",
       "chatTools",
+      "auth",
       "agent",
       "every",
       "capabilityTools",
@@ -5058,6 +5153,8 @@ var init_profile = __esm({
       "resetBetweenChildren",
       "preloadContext"
     ]);
+    AUTH_KEY_RE = /^[A-Z][A-Z0-9_]{0,127}$/;
+    AUTH_TEXT_RE = /^[^\r\n]{1,120}$/;
   }
 });
 
@@ -6812,6 +6909,29 @@ var init_runIndex = __esm({
   }
 });
 
+// src/runtimeCleanup.ts
+function registeredCleanup(ctx) {
+  return Array.isArray(ctx.data.__runtimeCleanup) ? ctx.data.__runtimeCleanup : [];
+}
+function registerRuntimeCleanup(ctx, cleanup) {
+  ctx.data.__runtimeCleanup = [...registeredCleanup(ctx), cleanup];
+}
+function runRuntimeCleanup(ctx) {
+  const callbacks = registeredCleanup(ctx);
+  delete ctx.data.__runtimeCleanup;
+  for (const cleanup of callbacks.reverse()) {
+    try {
+      cleanup();
+    } catch {
+    }
+  }
+}
+var init_runtimeCleanup = __esm({
+  "src/runtimeCleanup.ts"() {
+    "use strict";
+  }
+});
+
 // src/scripts/evaluateAgencyBoundaries.ts
 function shouldEvaluateAgencyBoundaries(data, profile) {
   return Boolean(agencyBoundaryCapabilityKind(data, profile));
@@ -7723,10 +7843,10 @@ var init_state2 = __esm({
     "use strict";
     VALID_STATES = /* @__PURE__ */ new Set(["active", "abandoned", "closed", "done"]);
     GoalStateError = class extends Error {
-      constructor(path52, message) {
-        super(`Invalid goal state at ${path52}:
+      constructor(path53, message) {
+        super(`Invalid goal state at ${path53}:
   ${message}`);
-        this.path = path52;
+        this.path = path53;
         this.name = "GoalStateError";
       }
       path;
@@ -7739,9 +7859,9 @@ import * as fs25 from "fs";
 function stageGoalRunLogEvent(data, goalId, event, at = nowIso()) {
   const logs = goalRunLogs(data);
   const existing = logs[goalId];
-  const path52 = existing?.path ?? goalRunLogPath(goalId, data);
+  const path53 = existing?.path ?? goalRunLogPath(goalId, data);
   logs[goalId] = {
-    path: path52,
+    path: path53,
     events: [...existing?.events ?? [], buildGoalRunLogEvent(data, goalId, event, at)]
   };
 }
@@ -8563,7 +8683,7 @@ function buildGoalTargetInstance(template, targetId, now) {
   extra.template = targetId;
   extra.sourceTemplate = targetId;
   extra.templateId = targetId;
-  if (!isPlainObject2(extra.facts)) extra.facts = {};
+  if (!isPlainObject3(extra.facts)) extra.facts = {};
   if (!Array.isArray(extra.blockers)) extra.blockers = [];
   const at = isoNoMs(now);
   return {
@@ -8573,7 +8693,7 @@ function buildGoalTargetInstance(template, targetId, now) {
     extra
   };
 }
-function isPlainObject2(value) {
+function isPlainObject3(value) {
   return !!value && typeof value === "object" && !Array.isArray(value);
 }
 function assertSafeGoalId(value, label) {
@@ -8858,6 +8978,7 @@ function validateWorkflow(value, options = {}) {
     if (!step) return;
     const id = text(step.id);
     if (!id) return;
+    const sourceCapability = text(step.capability ?? step.action);
     const transitions = transitionList(step.next);
     adjacency.set(id, []);
     if (transitions.length > maxTransitions) {
@@ -8933,7 +9054,10 @@ function validateWorkflow(value, options = {}) {
       if (raw.default === true && raw.when !== void 0) {
         issue(issues, "conflicting_transition", base, "workflow connection cannot be both conditional and default");
       }
-      if (raw.when !== void 0) validateDataMatch(raw.when, `${base}.when`, issues);
+      if (raw.when !== void 0) {
+        const outputPaths = options.capabilityOutputs?.get(sourceCapability ?? "");
+        validateDataMatch(raw.when, `${base}.when`, issues, outputPaths);
+      }
       const targetIndex = ids.indexOf(target ?? "");
       const iterations = raw.maxIterations;
       if (targetIndex >= 0 && targetIndex <= index) {
@@ -8978,11 +9102,11 @@ function validateWorkflow(value, options = {}) {
 function formatWorkflowValidationIssues(issues) {
   return issues.map((entry) => `${entry.path}: ${entry.message}`);
 }
-function validateDataMatch(value, path52, issues) {
+function validateDataMatch(value, path53, issues, capabilityOutputs) {
   if (value === void 0) return;
   const match = asRecord2(value);
   if (!match || Object.keys(match).length === 0) {
-    issue(issues, "invalid_condition", path52, "workflow condition must contain at least one match");
+    issue(issues, "invalid_condition", path53, "workflow condition must contain at least one match");
     return;
   }
   for (const [field, expected] of Object.entries(match)) {
@@ -8990,12 +9114,20 @@ function validateDataMatch(value, path52, issues) {
       issue(
         issues,
         "invalid_data_path",
-        `${path52}.${field}`,
+        `${path53}.${field}`,
         `workflow condition must read from facts, evidence, artifacts, result, workflow, or lastOutcome`
       );
     }
+    if (capabilityOutputs && field.startsWith("result.") && !capabilityOutputs.has(field)) {
+      issue(
+        issues,
+        "undeclared_result_path",
+        `${path53}.${field}`,
+        `workflow condition reads ${field}, but the source capability does not declare it`
+      );
+    }
     if (!isComparable(expected)) {
-      issue(issues, "invalid_condition_value", `${path52}.${field}`, "workflow condition value must be a JSON scalar");
+      issue(issues, "invalid_condition_value", `${path53}.${field}`, "workflow condition value must be a JSON scalar");
     }
   }
 }
@@ -9013,8 +9145,8 @@ function isComparable(value) {
   if (value === null || ["string", "number", "boolean"].includes(typeof value)) return true;
   return Array.isArray(value) && value.length > 0 && value.every((item) => isComparable(item) && !Array.isArray(item));
 }
-function issue(issues, code, path52, message) {
-  issues.push({ code, path: path52, message });
+function issue(issues, code, path53, message) {
+  issues.push({ code, path: path53, message });
 }
 var SAFE_NAME, SAFE_STEP_ID, SAFE_DATA_PATH, SUPPORTED_STEP_FIELDS, SUPPORTED_TRANSITION_FIELDS;
 var init_workflowValidation = __esm({
@@ -14452,13 +14584,13 @@ function companyIntentPath(id) {
   assertIntentId(id);
   return `intents/${id}/intent.json`;
 }
-function normalizeCompanyIntent(path52, raw) {
+function normalizeCompanyIntent(path53, raw) {
   if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
-    throw new Error(`${path52}: intent must be JSON object`);
+    throw new Error(`${path53}: intent must be JSON object`);
   }
   const input = raw;
   const id = stringField5(input.id);
-  if (!id || !isCompanyIntentId(id)) throw new Error(`${path52}: invalid intent id`);
+  if (!id || !isCompanyIntentId(id)) throw new Error(`${path53}: invalid intent id`);
   const createdAt = stringField5(input.createdAt) || nowIso();
   const updatedAt = stringField5(input.updatedAt) || createdAt;
   const description = stringField5(input.description);
@@ -14498,8 +14630,8 @@ function listCompanyIntents(config, cwd) {
   const records = [];
   for (const entry of entries) {
     if (entry.type !== "dir" || !entry.name || !isCompanyIntentId(entry.name)) continue;
-    const path52 = companyIntentPath(entry.name);
-    const file = readStateText(config, cwd, path52);
+    const path53 = companyIntentPath(entry.name);
+    const file = readStateText(config, cwd, path53);
     if (!file) continue;
     records.push({
       id: entry.name,
@@ -16880,6 +17012,196 @@ var init_postResearchComment = __esm({
   }
 });
 
+// src/scripts/prepareBrowserAuth.ts
+import * as fs42 from "fs";
+import * as os7 from "os";
+import * as path40 from "path";
+function appendAuthMessage(ctx, message) {
+  const current = typeof ctx.data.qaAuthBlock === "string" ? ctx.data.qaAuthBlock.trim() : "";
+  ctx.data.qaAuthBlock = current ? `${current}
+
+${message}` : message;
+}
+function githubRepositoryParts(repoUrl) {
+  const parsed = new URL(repoUrl);
+  if (parsed.protocol !== "https:" || parsed.hostname.toLowerCase() !== "github.com") {
+    throw new Error("repository must be an https://github.com/owner/repo URL");
+  }
+  const parts = parsed.pathname.split("/").filter(Boolean);
+  if (parts.length !== 2) throw new Error("repository URL must contain exactly owner/repo");
+  const repo = parts[1].replace(/\.git$/, "");
+  if (!parts[0] || !repo) throw new Error("repository URL is incomplete");
+  return { owner: parts[0], repo };
+}
+function browserOrigin(ctx) {
+  const raw = typeof ctx.data.previewUrl === "string" ? ctx.data.previewUrl : "";
+  if (!raw) throw new Error("QA target URL is unavailable");
+  const parsed = new URL(raw);
+  if (parsed.protocol !== "https:" && parsed.protocol !== "http:") {
+    throw new Error("QA target URL must use http or https");
+  }
+  return parsed.origin;
+}
+async function githubJson(url, token) {
+  const response = await fetch(url, {
+    headers: {
+      Accept: "application/vnd.github+json",
+      Authorization: `Bearer ${token}`,
+      "X-GitHub-Api-Version": "2022-11-28"
+    }
+  });
+  if (!response.ok) throw new Error(`GitHub returned ${response.status}`);
+  return await response.json();
+}
+function writeKodyStorageState(input) {
+  const directory = fs42.mkdtempSync(path40.join(os7.tmpdir(), "kody-browser-auth-"));
+  fs42.chmodSync(directory, 448);
+  const file = path40.join(directory, "storage-state.json");
+  const now = Date.now();
+  const repoEntry = {
+    repoUrl: input.repoUrl,
+    owner: input.owner,
+    repo: input.repo,
+    token: input.token,
+    addedAt: now,
+    isLogin: true,
+    user: input.user
+  };
+  const auth = {
+    repoUrl: input.repoUrl,
+    owner: input.owner,
+    repo: input.repo,
+    token: input.token,
+    user: input.user,
+    loggedInAt: now,
+    repos: [repoEntry],
+    currentRepoIndex: 0
+  };
+  const storageState = {
+    cookies: [],
+    origins: [
+      {
+        origin: input.origin,
+        localStorage: [{ name: "kody_auth", value: JSON.stringify(auth) }]
+      }
+    ]
+  };
+  fs42.writeFileSync(file, JSON.stringify(storageState), { mode: 384 });
+  return { directory, file };
+}
+function configurePlaywright(profile, storageStatePath) {
+  const playwright = profile.claudeCode.mcpServers.find((server) => server.name === "playwright");
+  if (!playwright) throw new Error("Playwright MCP server is not configured");
+  const args = [];
+  const currentArgs = playwright.args ?? [];
+  for (let index = 0; index < currentArgs.length; index += 1) {
+    const arg = currentArgs[index];
+    if (arg === "--storage-state") {
+      index += 1;
+      continue;
+    }
+    if (arg.startsWith("--storage-state=")) continue;
+    args.push(arg);
+  }
+  if (!args.includes("--isolated")) args.push("--isolated");
+  args.push("--storage-state", storageStatePath);
+  playwright.args = args;
+}
+function fieldsForKodyRepository(method) {
+  const variables = method.fields.filter((field) => field.source === "variable");
+  const secrets = method.fields.filter((field) => field.source === "secret");
+  if (variables.length !== 1 || secrets.length !== 1) {
+    throw new Error("kody-repository auth requires one variable field and one secret field");
+  }
+  return { repositoryKey: variables[0].key, credentialKey: secrets[0].key };
+}
+async function prepareMethod(ctx, profile, method) {
+  const { repositoryKey, credentialKey } = fieldsForKodyRepository(method);
+  const variables = readKodyVariables(ctx.cwd);
+  const repositoryUrl = variables[repositoryKey]?.trim() ?? "";
+  const credential = await resolveRuntimeSecret(credentialKey, ctx);
+  ctx.data.qaAuthSecretSources = {
+    ...ctx.data.qaAuthSecretSources ?? {},
+    [credentialKey]: credential.source
+  };
+  if (credential.warning) {
+    const warnings = Array.isArray(ctx.data.qaAuthWarnings) ? ctx.data.qaAuthWarnings : [];
+    ctx.data.qaAuthWarnings = [...warnings, credential.warning];
+  }
+  if (!repositoryUrl && !credential.value) return false;
+  if (!repositoryUrl) {
+    appendAuthMessage(
+      ctx,
+      `Auth: ${method.name} is incomplete because no \`${repositoryKey}\` variable was found. Note this authenticated surface as a gap.`
+    );
+    return false;
+  }
+  if (!credential.value) {
+    appendAuthMessage(
+      ctx,
+      `Auth: ${method.name} is incomplete because no \`${credentialKey}\` secret was found. Note this authenticated surface as a gap.`
+    );
+    return false;
+  }
+  let state;
+  try {
+    const requested = githubRepositoryParts(repositoryUrl);
+    const [user, repository] = await Promise.all([
+      githubJson("https://api.github.com/user", credential.value),
+      githubJson(
+        `https://api.github.com/repos/${encodeURIComponent(requested.owner)}/${encodeURIComponent(requested.repo)}`,
+        credential.value
+      )
+    ]);
+    const [owner, repo] = repository.full_name.split("/");
+    if (!owner || !repo || !user.login || !user.avatar_url || typeof user.id !== "number") {
+      throw new Error("GitHub returned incomplete identity data");
+    }
+    state = writeKodyStorageState({
+      origin: browserOrigin(ctx),
+      repoUrl: `https://github.com/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}`,
+      owner,
+      repo,
+      token: credential.value,
+      user
+    });
+    configurePlaywright(profile, state.file);
+    const authDirectory = state.directory;
+    registerRuntimeCleanup(ctx, () => {
+      fs42.rmSync(authDirectory, { recursive: true, force: true });
+    });
+    appendAuthMessage(
+      ctx,
+      `Auth: ${method.name} is already authenticated by the engine-provided browser session. The credential is not available to you; never request, reveal, or report it.`
+    );
+    return true;
+  } catch (error) {
+    if (state) fs42.rmSync(state.directory, { recursive: true, force: true });
+    const reason = error instanceof Error ? error.message : String(error);
+    appendAuthMessage(
+      ctx,
+      `Auth: the engine could not prepare ${method.name} (${reason}). Note this authenticated surface as a gap.`
+    );
+    return false;
+  }
+}
+var prepareBrowserAuth;
+var init_prepareBrowserAuth = __esm({
+  "src/scripts/prepareBrowserAuth.ts"() {
+    "use strict";
+    init_runtimeCleanup();
+    init_kodyVariables();
+    init_runtimeSecrets();
+    prepareBrowserAuth = async (ctx, profile) => {
+      const methods = profile.auth?.methods ?? [];
+      for (const method of methods) {
+        if (method.strategy !== "browser-storage-state" || method.adapter !== "kody-repository") continue;
+        if (await prepareMethod(ctx, profile, method)) return;
+      }
+    };
+  }
+});
+
 // src/scripts/promoteQaGoal.ts
 var REPORT_JSON_OPEN2, promoteQaGoal;
 var init_promoteQaGoal = __esm({
@@ -16967,9 +17289,9 @@ function latestResult(raw, agentResult) {
 function recordField6(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : null;
 }
-function resolveDotted(root, path52) {
-  if (!path52) return void 0;
-  return path52.split(".").reduce((value, key) => recordField6(value)?.[key], root);
+function resolveDotted(root, path53) {
+  if (!path53) return void 0;
+  return path53.split(".").reduce((value, key) => recordField6(value)?.[key], root);
 }
 function stringValue4(value) {
   return typeof value === "string" && value.trim() ? value.trim() : null;
@@ -17948,12 +18270,12 @@ fi
 
 // src/scripts/runPreviewBuild.ts
 import { copyFile, writeFile } from "fs/promises";
-import * as path40 from "path";
+import * as path41 from "path";
 import { fileURLToPath } from "url";
 function bundledDockerfilePath(mode) {
-  const here = path40.dirname(fileURLToPath(import.meta.url));
+  const here = path41.dirname(fileURLToPath(import.meta.url));
   const file = mode === "dev" ? "default-Dockerfile.preview.dev" : "default-Dockerfile.preview.prod";
-  return path40.join(here, "preview-build-templates", file);
+  return path41.join(here, "preview-build-templates", file);
 }
 function required(name) {
   const v = (process.env[name] ?? "").trim();
@@ -18204,10 +18526,10 @@ var init_runPreviewBuild = __esm({
         console.log(`[preview-build] vault: ${Object.keys(buildEnv).length} secrets, mode=${buildMode}`);
         if (Object.keys(buildEnv).length > 0) {
           const lines = Object.entries(buildEnv).map(([k, v]) => `${k}=${JSON.stringify(v)}`);
-          await writeFile(path40.join(ctx.cwd, ".env.production.local"), `${lines.join("\n")}
+          await writeFile(path41.join(ctx.cwd, ".env.production.local"), `${lines.join("\n")}
 `, "utf8");
         }
-        const consumerDockerfile = path40.join(ctx.cwd, "Dockerfile.preview");
+        const consumerDockerfile = path41.join(ctx.cwd, "Dockerfile.preview");
         const { stat } = await import("fs/promises");
         let hasConsumerDockerfile = false;
         try {
@@ -18391,8 +18713,8 @@ var init_tickShellRunner = __esm({
 });
 
 // src/scripts/runScheduledImplementationTick.ts
-import * as fs42 from "fs";
-import * as path41 from "path";
+import * as fs43 from "fs";
+import * as path42 from "path";
 var runScheduledImplementationTick;
 var init_runScheduledImplementationTick = __esm({
   "src/scripts/runScheduledImplementationTick.ts"() {
@@ -18412,14 +18734,14 @@ var init_runScheduledImplementationTick = __esm({
         ctx.output.reason = `runScheduledImplementationTick: args.slug or ctx.args.${slugArg} must be non-empty capability slug`;
         return;
       }
-      const capability = resolveCapabilityFolder(slug, path41.join(ctx.cwd, jobsDir));
+      const capability = resolveCapabilityFolder(slug, path42.join(ctx.cwd, jobsDir));
       if (!capability) {
         ctx.output.exitCode = 99;
         ctx.output.reason = `runScheduledImplementationTick: capability folder not found or incomplete: ${slug} (searched ${jobsDir} and company store)`;
         return;
       }
-      const shellPath = path41.join(profile.dir, shell);
-      if (!fs42.existsSync(shellPath)) {
+      const shellPath = path42.join(profile.dir, shell);
+      if (!fs43.existsSync(shellPath)) {
         ctx.output.exitCode = 99;
         ctx.output.reason = `runScheduledImplementationTick: shell not found: ${shell} (looked in ${profile.dir})`;
         return;
@@ -18450,8 +18772,8 @@ var init_runScheduledImplementationTick = __esm({
 });
 
 // src/scripts/runTickScript.ts
-import * as fs43 from "fs";
-import * as path42 from "path";
+import * as fs44 from "fs";
+import * as path43 from "path";
 var runTickScript;
 var init_runTickScript = __esm({
   "src/scripts/runTickScript.ts"() {
@@ -18470,10 +18792,10 @@ var init_runTickScript = __esm({
         ctx.output.reason = `runTickScript: ctx.args.${slugArg} must be a non-empty slug`;
         return;
       }
-      const capability = readCapabilityFolder(path42.join(ctx.cwd, jobsDir), slug);
+      const capability = readCapabilityFolder(path43.join(ctx.cwd, jobsDir), slug);
       if (!capability) {
         ctx.output.exitCode = 99;
-        ctx.output.reason = `runTickScript: capability folder not found or incomplete: ${path42.join(ctx.cwd, jobsDir, slug)}`;
+        ctx.output.reason = `runTickScript: capability folder not found or incomplete: ${path43.join(ctx.cwd, jobsDir, slug)}`;
         return;
       }
       const tickScript = capability.config.tickScript;
@@ -18482,8 +18804,8 @@ var init_runTickScript = __esm({
         ctx.output.reason = `runTickScript: capability ${slug} has no \`tickScript\` in profile.json \u2014 route via capability-tick instead`;
         return;
       }
-      const scriptPath = path42.isAbsolute(tickScript) ? tickScript : path42.join(ctx.cwd, tickScript);
-      if (!fs43.existsSync(scriptPath)) {
+      const scriptPath = path43.isAbsolute(tickScript) ? tickScript : path43.join(ctx.cwd, tickScript);
+      if (!fs44.existsSync(scriptPath)) {
         ctx.output.exitCode = 99;
         ctx.output.reason = `runTickScript: tickScript not found: ${scriptPath}`;
         return;
@@ -18765,7 +19087,7 @@ var init_syncFlow = __esm({
 });
 
 // src/scripts/validateAgencyModelProposal.ts
-import * as path43 from "path";
+import * as path44 from "path";
 function validateModelBundle(bundle, expectedKind, options = {}) {
   const failures = [];
   validateOneModel(bundle.model, bundle.files, "model", true, failures, expectedKind, options);
@@ -18862,8 +19184,11 @@ function validateFilesForKind(kind, slug, files, strictSingleModel, failures, op
         const known = options.capabilityRoot ? getCapabilityRoots(options.capabilityRoot).flatMap((root) => listCapabilityFolderSlugs(root)) : [];
         const uniqueKnown = [...new Set(known)];
         const capabilityInputs = /* @__PURE__ */ new Map();
+        const capabilityOutputs = /* @__PURE__ */ new Map();
         if (options.capabilityRoot) {
           for (const capability of uniqueKnown) {
+            const folder = getCapabilityRoots(options.capabilityRoot).map((root) => readCapabilityFolder(root, capability)).find((entry) => entry !== null);
+            capabilityOutputs.set(capability, folder ? capabilityOutputConditionPaths(folder.config) : /* @__PURE__ */ new Set());
             const inputs = getCapabilityActionInputs(capability, options.capabilityRoot);
             if (inputs) {
               capabilityInputs.set(
@@ -18877,7 +19202,8 @@ function validateFilesForKind(kind, slug, files, strictSingleModel, failures, op
           ...formatWorkflowValidationIssues(
             validateWorkflow(workflow, {
               ...uniqueKnown.length > 0 ? { knownCapabilities: new Set(uniqueKnown) } : {},
-              ...capabilityInputs.size > 0 ? { capabilityInputs } : {}
+              ...capabilityInputs.size > 0 ? { capabilityInputs } : {},
+              ...capabilityOutputs.size > 0 ? { capabilityOutputs } : {}
             })
           )
         );
@@ -19087,7 +19413,7 @@ var init_validateAgencyModelProposal = __esm({
       const bundle = parseAgencyModelProposal(raw);
       const expectedKind = readExpectedModelKind(args);
       const failures = validateModelBundle(bundle, expectedKind, {
-        capabilityRoot: path43.join(ctx.cwd, ".kody", "capabilities")
+        capabilityRoot: path44.join(ctx.cwd, ".kody", "capabilities")
       });
       if (failures.length > 0) {
         throw new Error(`validateAgencyModelProposal: ${failures.join("; ")}`);
@@ -19638,7 +19964,7 @@ var init_warmupMcp = __esm({
 });
 
 // src/scripts/writeAgentRunSummary.ts
-import * as fs44 from "fs";
+import * as fs45 from "fs";
 var writeAgentRunSummary;
 var init_writeAgentRunSummary = __esm({
   "src/scripts/writeAgentRunSummary.ts"() {
@@ -19664,7 +19990,7 @@ var init_writeAgentRunSummary = __esm({
       if (reason) lines.push(`- **Reason:** ${reason}`);
       lines.push("");
       try {
-        fs44.appendFileSync(summaryPath, `${lines.join("\n")}
+        fs45.appendFileSync(summaryPath, `${lines.join("\n")}
 `);
       } catch {
       }
@@ -19843,6 +20169,7 @@ var init_scripts = __esm({
     init_postPlanComment();
     init_postResearchComment();
     init_postReviewResult();
+    init_prepareBrowserAuth();
     init_promoteQaGoal();
     init_publishReport();
     init_recordClassification();
@@ -19901,6 +20228,7 @@ var init_scripts = __esm({
       loadMemoryContext,
       loadPriorArt,
       loadQaContext,
+      prepareBrowserAuth,
       buildSyntheticPlugin,
       resolveArtifacts,
       discoverQaContext,
@@ -19987,53 +20315,53 @@ var init_scripts = __esm({
 // src/stateWorkspace.ts
 import { execFileSync as execFileSync24 } from "child_process";
 import * as crypto3 from "crypto";
-import * as fs45 from "fs";
-import * as os7 from "os";
-import * as path44 from "path";
+import * as fs46 from "fs";
+import * as os8 from "os";
+import * as path45 from "path";
 function writeLocalFile(cwd, relativePath, content) {
-  const fullPath = path44.join(cwd, relativePath);
-  fs45.mkdirSync(path44.dirname(fullPath), { recursive: true });
-  fs45.writeFileSync(fullPath, content);
+  const fullPath = path45.join(cwd, relativePath);
+  fs46.mkdirSync(path45.dirname(fullPath), { recursive: true });
+  fs46.writeFileSync(fullPath, content);
 }
 function copyPath(source, target) {
-  const st = fs45.lstatSync(source);
-  fs45.rmSync(target, { recursive: true, force: true });
+  const st = fs46.lstatSync(source);
+  fs46.rmSync(target, { recursive: true, force: true });
   if (st.isSymbolicLink()) return;
-  fs45.mkdirSync(path44.dirname(target), { recursive: true });
-  fs45.cpSync(source, target, { recursive: true, force: true });
+  fs46.mkdirSync(path45.dirname(target), { recursive: true });
+  fs46.cpSync(source, target, { recursive: true, force: true });
 }
 function overlayDirectoryChildren(cwd, sourceDir, localDir) {
-  if (!fs45.existsSync(sourceDir)) return;
-  for (const entry of fs45.readdirSync(sourceDir, { withFileTypes: true })) {
-    const source = path44.join(sourceDir, entry.name);
-    const target = path44.join(cwd, localDir, entry.name);
+  if (!fs46.existsSync(sourceDir)) return;
+  for (const entry of fs46.readdirSync(sourceDir, { withFileTypes: true })) {
+    const source = path45.join(sourceDir, entry.name);
+    const target = path45.join(cwd, localDir, entry.name);
     copyPath(source, target);
   }
 }
 function hydrateStateWorkspace(config, cwd) {
   if (process.env.VITEST && process.env[TEST_FETCH_ENV] !== "1") return;
   const parsed = parseStateRepo(config);
-  const hydrateKey = `${path44.resolve(cwd)}|${parsed.owner}/${parsed.repo}|${parsed.basePath}|${parsed.branch}`;
+  const hydrateKey = `${path45.resolve(cwd)}|${parsed.owner}/${parsed.repo}|${parsed.basePath}|${parsed.branch}`;
   if (hydratedWorkspaces.has(hydrateKey)) return;
   const snapshotRoot = fetchStateSnapshot(parsed);
   for (const mapping of DIR_MAPPINGS) {
-    overlayDirectoryChildren(cwd, path44.join(snapshotRoot, mapping.stateDir), mapping.localDir);
+    overlayDirectoryChildren(cwd, path45.join(snapshotRoot, mapping.stateDir), mapping.localDir);
   }
   for (const mapping of FILE_MAPPINGS) {
-    const source = path44.join(snapshotRoot, mapping.statePath);
-    if (fs45.existsSync(source) && !fs45.lstatSync(source).isSymbolicLink() && fs45.statSync(source).isFile()) {
-      writeLocalFile(cwd, mapping.localPath, fs45.readFileSync(source, "utf-8"));
+    const source = path45.join(snapshotRoot, mapping.statePath);
+    if (fs46.existsSync(source) && !fs46.lstatSync(source).isSymbolicLink() && fs46.statSync(source).isFile()) {
+      writeLocalFile(cwd, mapping.localPath, fs46.readFileSync(source, "utf-8"));
     }
   }
   hydratedWorkspaces.add(hydrateKey);
 }
 function fetchStateSnapshot(parsed) {
-  const cacheDir = path44.join(cacheRoot2(), cacheKey3(parsed));
+  const cacheDir = path45.join(cacheRoot2(), cacheKey3(parsed));
   const url = `https://github.com/${parsed.owner}/${parsed.repo}.git`;
   try {
-    fs45.mkdirSync(path44.dirname(cacheDir), { recursive: true });
-    if (!fs45.existsSync(path44.join(cacheDir, ".git"))) {
-      fs45.rmSync(cacheDir, { recursive: true, force: true });
+    fs46.mkdirSync(path45.dirname(cacheDir), { recursive: true });
+    if (!fs46.existsSync(path45.join(cacheDir, ".git"))) {
+      fs46.rmSync(cacheDir, { recursive: true, force: true });
       runGit3(["clone", "--no-checkout", "--filter=blob:none", url, cacheDir]);
     }
     runGit3(["-C", cacheDir, "remote", "set-url", "origin", url]);
@@ -20048,10 +20376,10 @@ function fetchStateSnapshot(parsed) {
       `stateWorkspace: failed to fetch ${parsed.owner}/${parsed.repo}:${parsed.basePath}@${parsed.branch}: ${msg}`
     );
   }
-  return path44.join(cacheDir, parsed.basePath);
+  return path45.join(cacheDir, parsed.basePath);
 }
 function cacheRoot2() {
-  return process.env[CACHE_ENV2]?.trim() || path44.join(os7.homedir(), ".cache", "kody", "state-repo");
+  return process.env[CACHE_ENV2]?.trim() || path45.join(os8.homedir(), ".cache", "kody", "state-repo");
 }
 function cacheKey3(parsed) {
   return crypto3.createHash("sha256").update(`${parsed.owner}/${parsed.repo}#${parsed.branch}#${parsed.basePath}`).digest("hex").slice(0, 24);
@@ -20091,16 +20419,16 @@ var init_stateWorkspace = __esm({
     "use strict";
     init_stateRepo();
     DIR_MAPPINGS = [
-      { stateDir: "capabilities", localDir: path44.join(".kody", "capabilities") },
-      { stateDir: "agents", localDir: path44.join(".kody", "agents") },
-      { stateDir: "context", localDir: path44.join(".kody", "context") },
-      { stateDir: "memory", localDir: path44.join(".kody", "memory") }
+      { stateDir: "capabilities", localDir: path45.join(".kody", "capabilities") },
+      { stateDir: "agents", localDir: path45.join(".kody", "agents") },
+      { stateDir: "context", localDir: path45.join(".kody", "context") },
+      { stateDir: "memory", localDir: path45.join(".kody", "memory") }
     ];
     FILE_MAPPINGS = [
-      { statePath: "instructions.md", localPath: path44.join(".kody", "instructions.md") },
-      { statePath: "system-prompt.md", localPath: path44.join(".kody", "system-prompt.md") },
-      { statePath: "variables.json", localPath: path44.join(".kody", "variables.json") },
-      { statePath: "secrets.enc", localPath: path44.join(".kody", "secrets.enc") }
+      { statePath: "instructions.md", localPath: path45.join(".kody", "instructions.md") },
+      { statePath: "system-prompt.md", localPath: path45.join(".kody", "system-prompt.md") },
+      { statePath: "variables.json", localPath: path45.join(".kody", "variables.json") },
+      { statePath: "secrets.enc", localPath: path45.join(".kody", "secrets.enc") }
     ];
     CACHE_ENV2 = "KODY_STATE_REPO_CACHE";
     TEST_FETCH_ENV = "KODY_STATE_WORKSPACE_FETCH_FOR_TESTS";
@@ -20174,9 +20502,9 @@ var init_tools = __esm({
 
 // src/executor.ts
 import { spawn as spawn7 } from "child_process";
-import * as fs46 from "fs";
-import * as os8 from "os";
-import * as path45 from "path";
+import * as fs47 from "fs";
+import * as os9 from "os";
+import * as path46 from "path";
 function isMutatingPostflight(scriptName) {
   return MUTATING_POSTFLIGHTS.has(scriptName ?? "");
 }
@@ -20399,7 +20727,7 @@ async function runImplementation(profileName, input) {
   const jobWhyBlock = typeof ctx.data.jobWhy === "string" ? operatorRequestBlock(ctx.data.jobWhy) : null;
   const jobRefBlock = jobReferenceBlock(profileName, profile, ctx.data);
   const invokeAgent = async (prompt) => {
-    const externalPlugins = (profile.claudeCode.plugins ?? []).map((p) => path45.isAbsolute(p) ? p : path45.resolve(profile.dir, p)).filter((p) => p.length > 0);
+    const externalPlugins = (profile.claudeCode.plugins ?? []).map((p) => path46.isAbsolute(p) ? p : path46.resolve(profile.dir, p)).filter((p) => p.length > 0);
     const syntheticPath = ctx.data.syntheticPluginPath;
     const pluginPaths = [...externalPlugins, ...syntheticPath ? [syntheticPath] : []];
     const agents = loadSubagents(profile);
@@ -20655,6 +20983,7 @@ async function runImplementation(profileName, input) {
     const msg = err instanceof Error ? err.message : String(err);
     return finishAndEnd({ exitCode: 99, reason: ctx.output.reason ?? msg });
   } finally {
+    runRuntimeCleanup(ctx);
     clearStampedLifecycleLabels(profile, ctx);
     if (taskArtifacts) {
       try {
@@ -20837,17 +21166,17 @@ function clearStampedLifecycleLabels(profile, ctx) {
 function resolveProfilePath(profileName) {
   const found = resolveImplementation(profileName);
   if (found) return found;
-  const here = path45.dirname(new URL(import.meta.url).pathname);
+  const here = path46.dirname(new URL(import.meta.url).pathname);
   const candidates = [
-    path45.join(here, "implementations", profileName, "profile.json"),
+    path46.join(here, "implementations", profileName, "profile.json"),
     // same-dir sibling (dev)
-    path45.join(here, "..", "implementations", profileName, "profile.json"),
+    path46.join(here, "..", "implementations", profileName, "profile.json"),
     // up one (prod: dist/bin → dist/implementations)
-    path45.join(here, "..", "src", "implementations", profileName, "profile.json")
+    path46.join(here, "..", "src", "implementations", profileName, "profile.json")
     // fallback
   ];
   for (const c of candidates) {
-    if (fs46.existsSync(c)) return c;
+    if (fs47.existsSync(c)) return c;
   }
   return candidates[0];
 }
@@ -20962,16 +21291,16 @@ function resolveShellTimeoutMs(entry) {
 }
 async function runShellEntry(entry, ctx, profile) {
   const shellName = entry.shell;
-  const shellPath = path45.join(profile.dir, shellName);
-  if (!fs46.existsSync(shellPath)) {
+  const shellPath = path46.join(profile.dir, shellName);
+  if (!fs47.existsSync(shellPath)) {
     ctx.skipAgent = true;
     ctx.output.exitCode = 99;
     ctx.output.reason = `shell script not found: ${shellName} (looked in ${profile.dir})`;
     return;
   }
   const positional = entry.with ? Object.values(entry.with).map((v) => String(v)) : [];
-  const outputFile = path45.join(
-    os8.tmpdir(),
+  const outputFile = path46.join(
+    os9.tmpdir(),
     `kody-shell-output-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`
   );
   const env = { ...process.env, HUSKY: "0", SKIP_HOOKS: "1", KODY_OUTPUT: outputFile };
@@ -21042,9 +21371,9 @@ async function runShellEntry(entry, ctx, profile) {
   }
   let sideChannelText = "";
   try {
-    if (fs46.existsSync(outputFile)) {
-      sideChannelText = fs46.readFileSync(outputFile, "utf-8");
-      fs46.rmSync(outputFile, { force: true });
+    if (fs47.existsSync(outputFile)) {
+      sideChannelText = fs47.readFileSync(outputFile, "utf-8");
+      fs47.rmSync(outputFile, { force: true });
     }
   } catch {
   }
@@ -21117,6 +21446,7 @@ var init_executor = __esm({
     init_profile();
     init_registry();
     init_runIndex();
+    init_runtimeCleanup();
     init_runtimePaths();
     init_evaluateAgencyBoundaries();
     init_scripts();
@@ -21181,11 +21511,11 @@ function readWorkflowRunState(config, cwd, workflowId, runId) {
   }
 }
 function writeWorkflowRunState(config, cwd, workflowId, runId, state) {
-  const path52 = workflowRunStatePath(workflowId, runId);
+  const path53 = workflowRunStatePath(workflowId, runId);
   upsertStateText(
     config,
     cwd,
-    path52,
+    path53,
     `${JSON.stringify(state, null, 2)}
 `,
     `chore(workflows): update ${workflowId} run ${runId}`
@@ -21212,7 +21542,7 @@ __export(job_exports, {
   stableJobKey: () => stableJobKey,
   validateJob: () => validateJob
 });
-import * as path46 from "path";
+import * as path47 from "path";
 function newJobId(flavor) {
   localJobSeq += 1;
   const runId = process.env.GITHUB_RUN_ID;
@@ -21280,7 +21610,7 @@ function parseJobEvidence(job) {
 async function runJob(job, base) {
   const valid = validateJob(job);
   const action = valid.action ?? valid.capability;
-  const projectCapabilitiesRoot = path46.join(base.cwd, ".kody", "capabilities");
+  const projectCapabilitiesRoot = path47.join(base.cwd, ".kody", "capabilities");
   const resolvedCapability = !valid.workflow && action ? resolveCapabilityAction(action, projectCapabilitiesRoot) : null;
   const capabilityIdentity = valid.capability ?? resolvedCapability?.capability;
   const capabilityContext = valid.workflow ? null : loadCapabilityContext(capabilityIdentity, base.cwd);
@@ -21471,15 +21801,20 @@ function isGraphWorkflow(workflow) {
   return workflow.startAt !== void 0 || workflow.steps.some((step) => step.id !== void 0 || step.next !== void 0 || step.inputs !== void 0);
 }
 function workflowError(workflow, base) {
-  const projectCapabilitiesRoot = path46.join(base.cwd, ".kody", "capabilities");
+  const projectCapabilitiesRoot = path47.join(base.cwd, ".kody", "capabilities");
   const knownCapabilities = /* @__PURE__ */ new Set();
   const capabilityInputs = /* @__PURE__ */ new Map();
+  const capabilityOutputs = /* @__PURE__ */ new Map();
   for (const step of workflow.steps) {
     const action = step.action ?? step.capability;
     const resolvedAction = resolveCapabilityAction(action, projectCapabilitiesRoot);
     const resolvedFolder = resolveCapabilityFolder(step.capability, projectCapabilitiesRoot);
     if (!resolvedAction && !resolvedFolder) continue;
     knownCapabilities.add(step.capability);
+    capabilityOutputs.set(
+      step.capability,
+      resolvedFolder ? capabilityOutputConditionPaths(resolvedFolder.config) : /* @__PURE__ */ new Set()
+    );
     const inputs = getCapabilityActionInputs(action, projectCapabilitiesRoot);
     if (inputs) {
       capabilityInputs.set(
@@ -21488,7 +21823,9 @@ function workflowError(workflow, base) {
       );
     }
   }
-  return formatWorkflowValidationIssues(validateWorkflow(workflow, { knownCapabilities, capabilityInputs }))[0] ?? null;
+  return formatWorkflowValidationIssues(
+    validateWorkflow(workflow, { knownCapabilities, capabilityInputs, capabilityOutputs })
+  )[0] ?? null;
 }
 function initialWorkflowState(parent, workflow) {
   const prior = parent.workflowState;
@@ -21611,6 +21948,14 @@ async function runGraphCapabilityWorkflow(parent, workflow, capability, base, ch
       checkpoint?.(state);
       return withWorkflowBoundaryEval(capability, { ...result, workflowState: state });
     }
+    const resultConditionPaths = workflowResultConditionPaths(step.next);
+    if (resultConditionPaths.length > 0 && !result.capabilityResults?.at(-1)) {
+      const reason = `workflow step ${step.id} did not emit the structured result required by its conditions: ${resultConditionPaths.join(", ")}`;
+      state.status = "blocked";
+      state.blocker = reason;
+      checkpoint?.(state);
+      return { ...result, exitCode: 64, reason, workflowState: state };
+    }
     const transition = selectWorkflowTransition(step, chainData, state.transitionCounts);
     if (!transition) {
       const reason = `workflow step ${step.id} has no available connection`;
@@ -21658,8 +22003,13 @@ function selectWorkflowTransition(step, data, counts) {
   }
   return fallback;
 }
+function workflowResultConditionPaths(transitions) {
+  return transitions.flatMap(
+    (transition) => Object.keys(transition.when ?? {}).filter((path53) => path53.startsWith("result."))
+  );
+}
 function conditionMatches(condition, context) {
-  return Object.entries(condition).every(([path52, expected]) => valueMatches(resolveDottedPath2(context, path52), expected));
+  return Object.entries(condition).every(([path53, expected]) => valueMatches(resolveDottedPath2(context, path53), expected));
 }
 function withWorkflowBoundaryEval(capability, result) {
   const capabilityKind = capability.config.capabilityKind;
@@ -21755,14 +22105,10 @@ function workflowConditionContext(data) {
   };
 }
 function resolveDottedPath2(root, dotted) {
-  const direct = dotted.split(".").reduce((cur, part) => {
+  return dotted.split(".").reduce((cur, part) => {
     if (!cur || typeof cur !== "object") return void 0;
     return cur[part];
   }, root);
-  if (direct !== void 0 || !dotted.startsWith("result.")) return direct;
-  const result = resolveDottedPath2(root, "result");
-  if (!result || typeof result !== "object" || Array.isArray(result)) return direct;
-  return resolveDottedPath2(result.facts, dotted.slice("result.".length));
 }
 function valueMatches(actual, expected) {
   if (Array.isArray(expected)) return expected.some((entry) => valueMatches(actual, entry));
@@ -21818,7 +22164,7 @@ function composeStepWhy(parentWhy, step) {
 }
 function loadCapabilityContext(slug, cwd) {
   if (!slug) return null;
-  return resolveCapabilityFolder(slug, path46.join(cwd, ".kody", "capabilities"));
+  return resolveCapabilityFolder(slug, path47.join(cwd, ".kody", "capabilities"));
 }
 function loadWorkflowContext(slug, base) {
   if (!slug || !base.config || !isWorkflowDefinitionId(slug)) return null;
@@ -21854,6 +22200,7 @@ var init_job = __esm({
   "src/job.ts"() {
     "use strict";
     init_agencyBoundaryEval();
+    init_capabilityFolders();
     init_executor();
     init_registry();
     init_workflowDefinitions();
@@ -21979,9 +22326,9 @@ function translateOpenAISseToBrain(opts) {
 }
 
 // src/servers/brain-serve.ts
-import * as fs49 from "fs";
+import * as fs50 from "fs";
 import { createServer as createServer2 } from "http";
-import * as path49 from "path";
+import * as path50 from "path";
 
 // src/chat/loop.ts
 init_agent();
@@ -22117,6 +22464,61 @@ function makeRunId(sessionId, suffix) {
   return `chat-${sessionId}-${suffix}`;
 }
 
+// src/chat/session-store.ts
+import { anyApi } from "convex/server";
+
+// src/chat/convex-client.ts
+import { ConvexHttpClient } from "convex/browser";
+var ESCAPE_CHAR = "~";
+var NEEDS_ESCAPE = /^[$_~]/;
+function isPlainObject2(value) {
+  if (value === null || typeof value !== "object") return false;
+  const proto = Object.getPrototypeOf(value);
+  return proto === Object.prototype || proto === null;
+}
+function deepMapKeys(value, mapKey) {
+  if (Array.isArray(value)) return value.map((item) => deepMapKeys(item, mapKey));
+  if (isPlainObject2(value)) {
+    return Object.fromEntries(Object.entries(value).map(([key, item]) => [mapKey(key), deepMapKeys(item, mapKey)]));
+  }
+  return value;
+}
+function deepEscapeKeys(value) {
+  return deepMapKeys(value, (k) => NEEDS_ESCAPE.test(k) ? `${ESCAPE_CHAR}${k}` : k);
+}
+function deepUnescapeKeys(value) {
+  return deepMapKeys(value, (k) => k.startsWith(ESCAPE_CHAR) ? k.slice(1) : k);
+}
+var CALL_METHODS = ["query", "mutation", "action"];
+function injectServiceKey(args) {
+  const serviceKey = process.env.KODY_SERVICE_KEY;
+  if (!serviceKey) return args;
+  if (args === void 0) return { serviceKey };
+  if (typeof args !== "object" || args === null || Array.isArray(args)) return args;
+  return { ...args, serviceKey };
+}
+function withEscapedKeys(client) {
+  return new Proxy(client, {
+    get(target, prop, receiver) {
+      if (CALL_METHODS.includes(prop)) {
+        const method = Reflect.get(target, prop, target);
+        return async (fn, args) => {
+          const authed = injectServiceKey(args);
+          const result = await method.call(target, fn, authed === void 0 ? void 0 : deepEscapeKeys(authed));
+          return deepUnescapeKeys(result);
+        };
+      }
+      const value = Reflect.get(target, prop, receiver);
+      return typeof value === "function" ? value.bind(target) : value;
+    }
+  });
+}
+function createConvexClientFromEnv(env = process.env) {
+  const url = env.CONVEX_URL?.trim();
+  if (!url) return null;
+  return withEscapedKeys(new ConvexHttpClient(url));
+}
+
 // src/chat/session.ts
 import * as fs13 from "fs";
 import * as path15 from "path";
@@ -22182,6 +22584,103 @@ function seedInitialMessage(file, message) {
   return true;
 }
 
+// src/chat/session-store.ts
+function isChatTurn(value) {
+  if (!value || typeof value !== "object") return false;
+  const t = value;
+  return (t.role === "user" || t.role === "assistant") && typeof t.content === "string";
+}
+function createSessionStore(opts) {
+  const logger = opts.logger ?? {
+    info: (m) => process.stdout.write(`[kody:chat:store] ${m}
+`),
+    warn: (m) => process.stderr.write(`[kody:chat:store] ${m}
+`)
+  };
+  const client = opts.client !== void 0 ? opts.client : createConvexClientFromEnv();
+  const tenantId = opts.tenantId ?? process.env.GITHUB_REPOSITORY ?? "";
+  if (client && tenantId) {
+    logger.info(`session ${opts.sessionId}: using Convex transcript store (tenant ${tenantId})`);
+    return createConvexStore({
+      client,
+      tenantId,
+      sessionId: opts.sessionId,
+      sessionFile: opts.sessionFile,
+      logger
+    });
+  }
+  if (client && !tenantId) {
+    logger.warn(`session ${opts.sessionId}: CONVEX_URL set but no tenant (GITHUB_REPOSITORY unset) \u2014 using JSONL`);
+  } else {
+    logger.info(`session ${opts.sessionId}: CONVEX_URL unset \u2014 using legacy state-repo JSONL store`);
+  }
+  return createJsonlStore(opts.sessionFile);
+}
+function createJsonlStore(sessionFile) {
+  return {
+    backend: "jsonl",
+    readTurns: async () => readSession(sessionFile),
+    appendTurn: async (turn) => {
+      appendTurn(sessionFile, turn);
+    }
+  };
+}
+function normalizeTurn(turn) {
+  return {
+    role: turn.role,
+    content: turn.content,
+    timestamp: turn.timestamp,
+    toolCalls: turn.toolCalls ?? []
+  };
+}
+function createConvexStore(args) {
+  const { client, tenantId, sessionId, sessionFile, logger } = args;
+  let sessionUpserted = false;
+  const appendToConvex = async (turn) => {
+    if (!sessionUpserted) {
+      try {
+        const meta = readMeta(sessionFile) ?? { type: "meta", mode: "one-shot" };
+        await client.mutation(anyApi.chatSessions.upsert, {
+          tenantId,
+          sessionId,
+          meta,
+          updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+        });
+        sessionUpserted = true;
+      } catch (err) {
+        logger.warn(`session ${sessionId}: chatSessions.upsert failed: ${err instanceof Error ? err.message : String(err)}`);
+      }
+    }
+    await client.mutation(anyApi.chatTurns.append, { tenantId, sessionId, turn });
+  };
+  return {
+    backend: "convex",
+    readTurns: async () => {
+      const docs = await client.query(anyApi.chatTurns.list, { tenantId, sessionId });
+      const convexTurns = [...docs].sort((a, b) => a.seq - b.seq).map((doc) => doc.turn).filter(isChatTurn);
+      const localTurns = readSession(sessionFile);
+      if (localTurns.length <= convexTurns.length) return convexTurns;
+      const tail = localTurns.slice(convexTurns.length).map(normalizeTurn);
+      logger.info(
+        `session ${sessionId}: backfilling ${tail.length} local JSONL turn(s) into Convex (convex=${convexTurns.length}, local=${localTurns.length})`
+      );
+      for (const turn of tail) {
+        await appendToConvex(turn);
+      }
+      return [...convexTurns, ...tail];
+    },
+    appendTurn: async (turn) => {
+      const normalized = normalizeTurn(turn);
+      await appendToConvex(normalized);
+      try {
+        appendTurn(sessionFile, normalized);
+      } catch (err) {
+        logger.warn(`session ${sessionId}: local JSONL mirror failed: ${err instanceof Error ? err.message : String(err)}`);
+      }
+    }
+  };
+}
+
 // src/chat/loop.ts
 var CHAT_SYSTEM_PROMPT = [
   "You are Kody, an AI assistant for the Kody Operations Dashboard. Reply to the",
@@ -22324,7 +22823,8 @@ function buildImplementationCatalog() {
   return lines.join("\n");
 }
 async function runChatTurn(opts) {
-  const turns = readSession(opts.sessionFile);
+  const store = opts.store ?? createSessionStore({ sessionId: opts.sessionId, sessionFile: opts.sessionFile });
+  const turns = await store.readTurns();
   if (turns.length === 0) {
     const error = "session file is empty \u2014 nothing to reply to";
     await emit(opts.sink, "chat.error", opts.sessionId, "error", { error });
@@ -22379,7 +22879,7 @@ async function runChatTurn(opts) {
       opts,
       turns: promptTurns,
       systemPrompt,
-      sessionFile: opts.sessionFile
+      store
     });
   }
   let progressSeq = 0;
@@ -22455,7 +22955,7 @@ async function runChatTurn(opts) {
     return { exitCode: 99, error };
   }
   const now = (/* @__PURE__ */ new Date()).toISOString();
-  appendTurn(opts.sessionFile, {
+  await store.appendTurn({
     role: "assistant",
     content: reply,
     timestamp: now
@@ -22491,7 +22991,7 @@ function readAgentIdentityBlock(cwd, agentIdentity) {
   return frameAgentIdentity(slug, body);
 }
 async function runOpenAIChatTurn(args) {
-  const { opts, turns, systemPrompt, sessionFile } = args;
+  const { opts, turns, systemPrompt, store } = args;
   const doFetch = opts.fetchImpl ?? fetch;
   const url = `${opts.litellmUrl.replace(/\/+$/, "")}/v1/chat/completions`;
   try {
@@ -22524,7 +23024,7 @@ async function runOpenAIChatTurn(args) {
       return { exitCode: 99, error };
     }
     const now = (/* @__PURE__ */ new Date()).toISOString();
-    appendTurn(sessionFile, {
+    await store.appendTurn({
       role: "assistant",
       content: reply,
       timestamp: now
@@ -22668,8 +23168,8 @@ init_config();
 
 // src/kody-cli.ts
 import { execFileSync as execFileSync26 } from "child_process";
-import * as fs47 from "fs";
-import * as path47 from "path";
+import * as fs48 from "fs";
+import * as path48 from "path";
 
 // src/app-auth.ts
 import { createSign } from "crypto";
@@ -23467,9 +23967,9 @@ async function resolveAuthToken(env = process.env) {
   return void 0;
 }
 function detectPackageManager2(cwd) {
-  if (fs47.existsSync(path47.join(cwd, "pnpm-lock.yaml"))) return "pnpm";
-  if (fs47.existsSync(path47.join(cwd, "yarn.lock"))) return "yarn";
-  if (fs47.existsSync(path47.join(cwd, "bun.lockb"))) return "bun";
+  if (fs48.existsSync(path48.join(cwd, "pnpm-lock.yaml"))) return "pnpm";
+  if (fs48.existsSync(path48.join(cwd, "yarn.lock"))) return "yarn";
+  if (fs48.existsSync(path48.join(cwd, "bun.lockb"))) return "bun";
   return "npm";
 }
 function shouldChainScheduledWatch(match) {
@@ -23562,8 +24062,8 @@ function postFailureTail(issueNumber, cwd, reason) {
   const logPath = lastRunLogPath(cwd);
   let tail = "";
   try {
-    if (fs47.existsSync(logPath)) {
-      const content = fs47.readFileSync(logPath, "utf-8");
+    if (fs48.existsSync(logPath)) {
+      const content = fs48.readFileSync(logPath, "utf-8");
       tail = content.slice(-3e3);
     }
   } catch {
@@ -23592,7 +24092,7 @@ async function runCi(argv) {
     return 0;
   }
   const args = parseCiArgs(argv);
-  const cwd = args.cwd ? path47.resolve(args.cwd) : process.cwd();
+  const cwd = args.cwd ? path48.resolve(args.cwd) : process.cwd();
   try {
     const n = unpackAllSecrets();
     if (n > 0) process.stdout.write(`\u2192 kody: unpacked ${n} secret(s) from ALL_SECRETS
@@ -23652,9 +24152,9 @@ async function runCi(argv) {
       forceRunCliArgs = { goal: envForceMessage };
     }
   }
-  if (!args.issueNumber && !autoFallback && !forceRunAction && !runRequestFanOut && eventName === "workflow_dispatch" && dispatchEventPath && fs47.existsSync(dispatchEventPath)) {
+  if (!args.issueNumber && !autoFallback && !forceRunAction && !runRequestFanOut && eventName === "workflow_dispatch" && dispatchEventPath && fs48.existsSync(dispatchEventPath)) {
     try {
-      const evt = JSON.parse(fs47.readFileSync(dispatchEventPath, "utf-8"));
+      const evt = JSON.parse(fs48.readFileSync(dispatchEventPath, "utf-8"));
       const inputs = objectValue2(evt.inputs);
       applyCompanyStoreRuntimeConfig(inputs);
       const issueInput = parseInt(String(inputs?.issue_number ?? ""), 10);
@@ -24028,8 +24528,8 @@ init_repoWorkspace();
 
 // src/scripts/brainTurnLog.ts
 init_runtimePaths();
-import * as fs48 from "fs";
-import * as path48 from "path";
+import * as fs49 from "fs";
+import * as path49 from "path";
 import posixPath4 from "path/posix";
 var live = /* @__PURE__ */ new Map();
 function brainEventsFilePath(dir, chatId) {
@@ -24040,8 +24540,8 @@ function brainEventsStatePath(chatId) {
 }
 function lastPersistedSeq(dir, chatId) {
   const p = brainEventsFilePath(dir, chatId);
-  if (!fs48.existsSync(p)) return 0;
-  const lines = fs48.readFileSync(p, "utf-8").split("\n").filter(Boolean);
+  if (!fs49.existsSync(p)) return 0;
+  const lines = fs49.readFileSync(p, "utf-8").split("\n").filter(Boolean);
   if (lines.length === 0) return 0;
   try {
     return JSON.parse(lines[lines.length - 1]).seq || 0;
@@ -24051,9 +24551,9 @@ function lastPersistedSeq(dir, chatId) {
 }
 function readSince(dir, chatId, since) {
   const p = brainEventsFilePath(dir, chatId);
-  if (!fs48.existsSync(p)) return [];
+  if (!fs49.existsSync(p)) return [];
   const out = [];
-  for (const line of fs48.readFileSync(p, "utf-8").split("\n")) {
+  for (const line of fs49.readFileSync(p, "utf-8").split("\n")) {
     if (!line) continue;
     try {
       const rec = JSON.parse(line);
@@ -24079,12 +24579,12 @@ function beginTurn(dir, chatId) {
   };
   live.set(chatId, state);
   const p = brainEventsFilePath(dir, chatId);
-  fs48.mkdirSync(path48.dirname(p), { recursive: true });
+  fs49.mkdirSync(path49.dirname(p), { recursive: true });
   return (event) => {
     state.seq += 1;
     const rec = { seq: state.seq, turn, ts: Date.now(), event };
     try {
-      fs48.appendFileSync(p, `${JSON.stringify(rec)}
+      fs49.appendFileSync(p, `${JSON.stringify(rec)}
 `);
     } catch (err) {
       process.stderr.write(
@@ -24123,7 +24623,7 @@ function endTurnIfUnterminated(dir, chatId, errMessage) {
     event: { type: "error", error: errMessage || "turn ended unexpectedly", chatId }
   };
   try {
-    fs48.appendFileSync(brainEventsFilePath(dir, chatId), `${JSON.stringify(rec)}
+    fs49.appendFileSync(brainEventsFilePath(dir, chatId), `${JSON.stringify(rec)}
 `);
   } catch {
   }
@@ -24457,7 +24957,7 @@ async function handleChatTurn(req, res, chatId, opts) {
       );
     }
   }
-  fs49.mkdirSync(path49.dirname(sessionFile), { recursive: true });
+  fs50.mkdirSync(path50.dirname(sessionFile), { recursive: true });
   appendTurn(sessionFile, {
     role: "user",
     content: message,
@@ -24532,7 +25032,7 @@ async function handleChatTurn(req, res, chatId, opts) {
 function buildServer(opts) {
   const runTurn = opts.runTurn ?? runChatTurn;
   const cloneRepo = opts.cloneRepo ?? defaultCloneRepo;
-  const reposRoot = opts.reposRoot ?? path49.join(path49.dirname(path49.resolve(opts.cwd)), "repos");
+  const reposRoot = opts.reposRoot ?? path50.join(path50.dirname(path50.resolve(opts.cwd)), "repos");
   return createServer2(async (req, res) => {
     if (!req.method || !req.url) {
       sendJson(res, 400, { error: "bad request" });
@@ -25135,8 +25635,8 @@ async function loadConfigSafe() {
 }
 
 // src/chat-cli.ts
-import * as fs51 from "fs";
-import * as path51 from "path";
+import * as fs52 from "fs";
+import * as path52 from "path";
 
 // src/chat/inbox.ts
 import { execFileSync as execFileSync27 } from "child_process";
@@ -25152,7 +25652,8 @@ async function waitForNextUserMessage(opts) {
     const now = Date.now();
     if (now >= opts.deadlineMs) return { kind: "deadline" };
     if (now - idleStart >= opts.idleTimeoutMs) return { kind: "idle-timeout" };
-    if (opts.sync && !opts.skipPull) {
+    if (opts.readTurns) {
+    } else if (opts.sync && !opts.skipPull) {
       try {
         opts.sync();
       } catch (err) {
@@ -25176,7 +25677,18 @@ async function waitForNextUserMessage(opts) {
         logger.warn(`git pull failed (will retry): ${msg}`);
       }
     }
-    const turns = readSession(opts.sessionFile);
+    let turns;
+    if (opts.readTurns) {
+      try {
+        turns = await opts.readTurns();
+      } catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        logger.warn(`convex transcript poll failed (will retry): ${msg}`);
+        turns = [];
+      }
+    } else {
+      turns = readSession(opts.sessionFile);
+    }
     for (let i = opts.watermark; i < turns.length; i++) {
       const t = turns[i];
       if (t.role === "user") {
@@ -25208,8 +25720,8 @@ function currentBranch(cwd) {
 
 // src/chat/state-sync.ts
 init_stateRepo();
-import * as fs50 from "fs";
-import * as path50 from "path";
+import * as fs51 from "fs";
+import * as path51 from "path";
 function jsonlLines2(text2) {
   return text2.split("\n").filter((line) => line.length > 0);
 }
@@ -25226,15 +25738,15 @@ function mergeJsonl2(localText, remoteText) {
 function syncJsonlFileFromState(opts) {
   const remote = readStateText(opts.config, opts.cwd, opts.statePath);
   if (!remote) return;
-  const local = fs50.existsSync(opts.localPath) ? fs50.readFileSync(opts.localPath, "utf-8") : "";
+  const local = fs51.existsSync(opts.localPath) ? fs51.readFileSync(opts.localPath, "utf-8") : "";
   const next = mergeJsonl2(local, remote.content);
   if (next === local) return;
-  fs50.mkdirSync(path50.dirname(opts.localPath), { recursive: true });
-  fs50.writeFileSync(opts.localPath, next);
+  fs51.mkdirSync(path51.dirname(opts.localPath), { recursive: true });
+  fs51.writeFileSync(opts.localPath, next);
 }
 function persistJsonlFileToState(opts) {
-  if (!fs50.existsSync(opts.localPath)) return;
-  const localText = fs50.readFileSync(opts.localPath, "utf-8");
+  if (!fs51.existsSync(opts.localPath)) return;
+  const localText = fs51.readFileSync(opts.localPath, "utf-8");
   for (let attempt = 1; attempt <= 3; attempt += 1) {
     const remote = readStateText(opts.config, opts.cwd, opts.statePath);
     const body = mergeJsonl2(localText, remote?.content ?? "");
@@ -25293,6 +25805,7 @@ var DEFAULT_HARD_CAP_MS = 30 * 6e4;
 var DEFAULT_POLL_MS2 = 3e3;
 async function runInteractiveMode(opts) {
   const sessionFile = sessionFilePath(opts.cwd, opts.sessionId);
+  const store = opts.store ?? createSessionStore({ sessionId: opts.sessionId, sessionFile });
   const idleExitMs = opts.meta.idleExitMs ?? DEFAULT_IDLE_EXIT_MS;
   const hardCapMs = opts.meta.hardCapMs ?? DEFAULT_HARD_CAP_MS;
   const startedAt = Date.now();
@@ -25323,10 +25836,10 @@ async function runInteractiveMode(opts) {
   let watermark = 0;
   let turnsCompleted = 0;
   while (true) {
-    if (opts.stateConfig && !opts.skipGit) {
+    if (store.backend !== "convex" && opts.stateConfig && !opts.skipGit) {
       syncChatSessionFromState(opts.stateConfig, opts.cwd, opts.sessionId);
     }
-    const turns = readSession(sessionFile);
+    const turns = await store.readTurns();
     const pendingIdx = findNextUserTurn(turns, watermark);
     if (pendingIdx === -1) {
       const result = await waitForNextUserMessage({
@@ -25337,7 +25850,7 @@ async function runInteractiveMode(opts) {
         deadlineMs,
         pollIntervalMs: opts.pollIntervalMs ?? DEFAULT_POLL_MS2,
         skipPull: opts.skipGit,
-        ...opts.stateConfig ? {
+        ...store.backend === "convex" ? { readTurns: () => store.readTurns() } : opts.stateConfig ? {
           sync: () => syncChatSessionFromState(opts.stateConfig, opts.cwd, opts.sessionId)
         } : {}
       });
@@ -25365,6 +25878,7 @@ async function runInteractiveMode(opts) {
         quiet: opts.quiet,
         invokeAgent: opts.invokeAgent,
         stateConfig: opts.stateConfig,
+        store,
         ...opts.reasoningEffort ? { reasoningEffort: opts.reasoningEffort } : {}
       });
     } catch (err) {
@@ -25380,7 +25894,7 @@ async function runInteractiveMode(opts) {
       turnsCompleted += 1;
       if (!opts.skipGit) commitTurn(opts.cwd, opts.sessionId, opts.verbose ?? false, opts.stateConfig ?? null);
     }
-    watermark = readSession(sessionFile).length;
+    watermark = (await store.readTurns()).length;
   }
 }
 function findNextUserTurn(turns, fromIdx) {
@@ -25499,7 +26013,7 @@ async function runChat(argv) {
 ${CHAT_HELP}`);
     return 64;
   }
-  const cwd = args.cwd ? path51.resolve(args.cwd) : process.cwd();
+  const cwd = args.cwd ? path52.resolve(args.cwd) : process.cwd();
   const sessionId = args.sessionId;
   const runRequest = readRunRequestFromEnv();
   if (runRequest && "request" in runRequest) {
@@ -25564,7 +26078,7 @@ ${CHAT_HELP}`);
   const sink = buildSink(cwd, sessionId, args.dashboardUrl);
   const meta = readMeta(sessionFile);
   process.stdout.write(
-    `\u2192 kody:chat: session file=${sessionFile} exists=${fs51.existsSync(sessionFile)} meta=${meta ? meta.mode : "none"}
+    `\u2192 kody:chat: session file=${sessionFile} exists=${fs52.existsSync(sessionFile)} meta=${meta ? meta.mode : "none"}
 `
   );
   try {
@@ -25679,8 +26193,8 @@ var FlyClient = class {
   get fetch() {
     return this.opts.fetchImpl ?? fetch;
   }
-  async call(path52, init = {}) {
-    const res = await this.fetch(`${FLY_API_BASE}${path52}`, {
+  async call(path53, init = {}) {
+    const res = await this.fetch(`${FLY_API_BASE}${path53}`, {
       method: init.method ?? "GET",
       headers: {
         Authorization: `Bearer ${this.opts.token}`,
@@ -25691,7 +26205,7 @@ var FlyClient = class {
     if (res.status === 404 && init.allow404) return null;
     if (!res.ok) {
       const text2 = await res.text().catch(() => "");
-      throw new Error(`Fly API ${res.status} on ${path52}: ${text2.slice(0, 200) || res.statusText}`);
+      throw new Error(`Fly API ${res.status} on ${path53}: ${text2.slice(0, 200) || res.statusText}`);
     }
     if (res.status === 204) return null;
     const raw = await res.text();
@@ -26447,7 +26961,7 @@ async function poolServe() {
 
 // src/servers/runner-serve.ts
 import { spawn as spawn8 } from "child_process";
-import * as fs52 from "fs";
+import * as fs53 from "fs";
 import { createServer as createServer6 } from "http";
 var DEFAULT_PORT2 = 8080;
 var DEFAULT_WORKDIR = "/workspace/repo";
@@ -26582,8 +27096,8 @@ async function defaultRunJob(job) {
   const workdir = process.env.RUNNER_WORKDIR ?? DEFAULT_WORKDIR;
   const branch = job.ref ?? "main";
   const authUrl = `https://x-access-token:${job.githubToken}@github.com/${job.repo}.git`;
-  fs52.rmSync(workdir, { recursive: true, force: true });
-  fs52.mkdirSync(workdir, { recursive: true });
+  fs53.rmSync(workdir, { recursive: true, force: true });
+  fs53.mkdirSync(workdir, { recursive: true });
   const allSecrets = typeof job.allSecrets === "string" ? job.allSecrets : JSON.stringify(job.allSecrets ?? {});
   const target = job.runRequest.target;
   const interactive = target.type === "chat";