@kody-ade/kody-engine 0.4.394 → 0.4.396

package/dist/bin/kody.js

@@ -15,7 +15,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "@kody-ade/kody-engine",
-      version: "0.4.394",
+      version: "0.4.396",
       description: "kody \u2014 autonomous development engine. Single-session Claude Code agent behind a generic executor + declarative implementation profiles.",
       license: "MIT",
       type: "module",
@@ -2549,6 +2549,222 @@ var init_registry = __esm({
   }
 });
 
+// src/chat/convex-client.ts
+import { ConvexHttpClient } from "convex/browser";
+function isPlainObject2(value) {
+  if (value === null || typeof value !== "object") return false;
+  const proto = Object.getPrototypeOf(value);
+  return proto === Object.prototype || proto === null;
+}
+function deepMapKeys(value, mapKey) {
+  if (Array.isArray(value)) return value.map((item) => deepMapKeys(item, mapKey));
+  if (isPlainObject2(value)) {
+    return Object.fromEntries(Object.entries(value).map(([key, item]) => [mapKey(key), deepMapKeys(item, mapKey)]));
+  }
+  return value;
+}
+function deepEscapeKeys(value) {
+  return deepMapKeys(value, (k) => NEEDS_ESCAPE.test(k) ? `${ESCAPE_CHAR}${k}` : k);
+}
+function deepUnescapeKeys(value) {
+  return deepMapKeys(value, (k) => k.startsWith(ESCAPE_CHAR) ? k.slice(1) : k);
+}
+function injectServiceKey(args, serviceKey = process.env.KODY_SERVICE_KEY) {
+  if (!serviceKey) return args;
+  if (args === void 0) return { serviceKey };
+  if (typeof args !== "object" || args === null || Array.isArray(args)) return args;
+  return { ...args, serviceKey };
+}
+function withEscapedKeys(client, serviceKey = process.env.KODY_SERVICE_KEY) {
+  return new Proxy(client, {
+    get(target, prop, receiver) {
+      if (CALL_METHODS.includes(prop)) {
+        const method = Reflect.get(target, prop, target);
+        return async (fn, args) => {
+          const authed = injectServiceKey(args, serviceKey);
+          const result = await method.call(target, fn, authed === void 0 ? void 0 : deepEscapeKeys(authed));
+          return deepUnescapeKeys(result);
+        };
+      }
+      const value = Reflect.get(target, prop, receiver);
+      return typeof value === "function" ? value.bind(target) : value;
+    }
+  });
+}
+function createConvexClientFromEnv(env = process.env) {
+  const url = env.CONVEX_URL?.trim();
+  if (!url) return null;
+  return withEscapedKeys(new ConvexHttpClient(url), env.KODY_SERVICE_KEY);
+}
+var ESCAPE_CHAR, NEEDS_ESCAPE, CALL_METHODS;
+var init_convex_client = __esm({
+  "src/chat/convex-client.ts"() {
+    "use strict";
+    ESCAPE_CHAR = "~";
+    NEEDS_ESCAPE = /^[$_~]/;
+    CALL_METHODS = ["query", "mutation", "action"];
+  }
+});
+
+// src/state-backend.ts
+import { anyApi } from "convex/server";
+function requireTenant(tenantId) {
+  const value = tenantId.trim();
+  if (!/^[^/\s]+\/[^/\s]+$/.test(value)) throw new Error("tenantId must be an owner/repository pair");
+  return value;
+}
+function requireNonEmpty(value, name) {
+  const normalized = value.trim();
+  if (!normalized) throw new Error(`${name} must not be empty`);
+  return normalized;
+}
+function createStateBackendFromEnv(env = process.env, client) {
+  const url = env.CONVEX_URL?.trim();
+  const serviceKey = env.KODY_SERVICE_KEY?.trim();
+  if (!url || !serviceKey) throw new Error("CONVEX_URL and KODY_SERVICE_KEY are required");
+  const transport = client ?? createConvexClientFromEnv(env);
+  return {
+    async get(tenantId, taskKey, kind) {
+      const result = await transport.query(anyApi.taskState.get, {
+        tenantId: requireTenant(tenantId),
+        taskKey: requireNonEmpty(taskKey, "taskKey"),
+        kind: requireNonEmpty(kind, "kind")
+      });
+      return result ?? null;
+    },
+    async save(tenantId, taskKey, kind, doc, expectedUpdatedAt) {
+      await transport.mutation(anyApi.taskState.save, {
+        tenantId: requireTenant(tenantId),
+        taskKey: requireNonEmpty(taskKey, "taskKey"),
+        kind: requireNonEmpty(kind, "kind"),
+        doc,
+        updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        ...expectedUpdatedAt ? { expectedUpdatedAt } : {}
+      });
+    },
+    async getRepoDoc(tenantId, kind) {
+      const result = await transport.query(anyApi.repoDocs.get, {
+        tenantId: requireTenant(tenantId),
+        kind: requireNonEmpty(kind, "kind")
+      });
+      return result ?? null;
+    },
+    async listRepoDocs(tenantId, prefix) {
+      const result = await transport.query(anyApi.repoDocs.listByPrefix, {
+        tenantId: requireTenant(tenantId),
+        prefix: requireNonEmpty(prefix, "prefix")
+      });
+      return Array.isArray(result) ? result : [];
+    },
+    async saveRepoDoc(tenantId, kind, doc, expectedUpdatedAt) {
+      await transport.mutation(anyApi.repoDocs.save, {
+        tenantId: requireTenant(tenantId),
+        kind: requireNonEmpty(kind, "kind"),
+        doc,
+        updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        ...expectedUpdatedAt ? { expectedUpdatedAt } : {}
+      });
+    },
+    async getGoal(tenantId, goalId) {
+      const result = await transport.query(anyApi.goals.get, {
+        tenantId: requireTenant(tenantId),
+        goalId: requireNonEmpty(goalId, "goalId")
+      });
+      return result ?? null;
+    },
+    async listGoals(tenantId) {
+      const result = await transport.query(anyApi.goals.list, { tenantId: requireTenant(tenantId) });
+      return Array.isArray(result) ? result : [];
+    },
+    async saveGoal(tenantId, goalId, state, updatedAt, expectedUpdatedAt) {
+      await transport.mutation(anyApi.goals.save, {
+        tenantId: requireTenant(tenantId),
+        goalId: requireNonEmpty(goalId, "goalId"),
+        state,
+        updatedAt,
+        ...expectedUpdatedAt ? { expectedUpdatedAt } : {}
+      });
+    },
+    async appendDailyLog(tenantId, stream, date, entry) {
+      await transport.mutation(anyApi.dailyLogs.append, {
+        tenantId: requireTenant(tenantId),
+        stream,
+        date: requireNonEmpty(date, "date"),
+        entry
+      });
+    },
+    async saveAgencyRun(tenantId, runId, subjectType, subjectId, run, updatedAt) {
+      await transport.mutation(anyApi.agencyRuns.save, {
+        tenantId: requireTenant(tenantId),
+        runId: requireNonEmpty(runId, "runId"),
+        subjectType,
+        subjectId: requireNonEmpty(subjectId, "subjectId"),
+        run,
+        updatedAt
+      });
+    },
+    async appendRunEvent(tenantId, runId, goalId, event, time) {
+      await transport.mutation(anyApi.runEvents.append, {
+        tenantId: requireTenant(tenantId),
+        runId: requireNonEmpty(runId, "runId"),
+        ...goalId ? { goalId: requireNonEmpty(goalId, "goalId") } : {},
+        event,
+        time: requireNonEmpty(time, "time")
+      });
+    },
+    async getManifest(tenantId, kind) {
+      const result = await transport.query(anyApi.manifests.get, {
+        tenantId: requireTenant(tenantId),
+        kind: requireNonEmpty(kind, "kind")
+      });
+      return result ?? null;
+    },
+    async saveReport(tenantId, slug, runId, title, body, meta, updatedAt) {
+      await transport.mutation(anyApi.reports.save, {
+        tenantId: requireTenant(tenantId),
+        slug: requireNonEmpty(slug, "slug"),
+        runId: requireNonEmpty(runId, "runId"),
+        title,
+        body,
+        meta,
+        updatedAt
+      });
+    },
+    async listIntents(tenantId) {
+      const result = await transport.query(anyApi.intents.list, { tenantId: requireTenant(tenantId) });
+      return Array.isArray(result) ? result : [];
+    },
+    async getIntent(tenantId, intentId) {
+      const result = await transport.query(anyApi.intents.get, {
+        tenantId: requireTenant(tenantId),
+        intentId: requireNonEmpty(intentId, "intentId")
+      });
+      return result ?? null;
+    },
+    async saveIntent(tenantId, intentId, intent, updatedAt) {
+      await transport.mutation(anyApi.intents.save, {
+        tenantId: requireTenant(tenantId),
+        intentId: requireNonEmpty(intentId, "intentId"),
+        intent,
+        updatedAt
+      });
+    },
+    async appendIntentDecision(tenantId, intentId, decision) {
+      await transport.mutation(anyApi.intents.appendDecision, {
+        tenantId: requireTenant(tenantId),
+        intentId: requireNonEmpty(intentId, "intentId"),
+        decision
+      });
+    }
+  };
+}
+var init_state_backend = __esm({
+  "src/state-backend.ts"() {
+    "use strict";
+    init_convex_client();
+  }
+});
+
 // src/trustPolicy.ts
 function trustSubjectKey(subject) {
   return `${subject.kind}:${subject.id}`;
@@ -2583,6 +2799,20 @@ function readTrustModeOverride(stateOrRepoSlug, repoSlugOrSubject, maybeSubject)
     return null;
   }
 }
+async function readTrustModeOverrideAsync(repoSlug, subject, state) {
+  if (!subject.id) return null;
+  const backendConfigured = Boolean(
+    process.env.CONVEX_URL?.trim() && process.env.KODY_SERVICE_KEY?.trim() && /^[^/\s]+\/[^/\s]+$/.test(repoSlug)
+  );
+  if (backendConfigured) {
+    const stored = await createStateBackendFromEnv().getManifest(repoSlug, "capability-trust");
+    return stored ? parseTrustModeOverride(JSON.stringify(stored.doc), subject) : null;
+  }
+  if (process.env.GITHUB_ACTIONS === "true") {
+    throw new Error("Convex backend is required for trust policy in GitHub Actions");
+  }
+  return readTrustModeOverride(state, repoSlug, subject);
+}
 function defaultStateForRepoSlug(repoSlug) {
   const [owner, repo] = repoSlug.split("/");
   return { repo: `${owner}/kody-state`, path: repo ?? repoSlug };
@@ -2592,6 +2822,7 @@ var init_trustPolicy = __esm({
   "src/trustPolicy.ts"() {
     "use strict";
     init_stateRepo();
+    init_state_backend();
     TRUST_FILE_PATH = "state/trust.json";
   }
 });
@@ -3777,196 +4008,6 @@ var init_agents = __esm({
   }
 });
 
-// src/chat/convex-client.ts
-import { ConvexHttpClient } from "convex/browser";
-function isPlainObject2(value) {
-  if (value === null || typeof value !== "object") return false;
-  const proto = Object.getPrototypeOf(value);
-  return proto === Object.prototype || proto === null;
-}
-function deepMapKeys(value, mapKey) {
-  if (Array.isArray(value)) return value.map((item) => deepMapKeys(item, mapKey));
-  if (isPlainObject2(value)) {
-    return Object.fromEntries(Object.entries(value).map(([key, item]) => [mapKey(key), deepMapKeys(item, mapKey)]));
-  }
-  return value;
-}
-function deepEscapeKeys(value) {
-  return deepMapKeys(value, (k) => NEEDS_ESCAPE.test(k) ? `${ESCAPE_CHAR}${k}` : k);
-}
-function deepUnescapeKeys(value) {
-  return deepMapKeys(value, (k) => k.startsWith(ESCAPE_CHAR) ? k.slice(1) : k);
-}
-function injectServiceKey(args, serviceKey = process.env.KODY_SERVICE_KEY) {
-  if (!serviceKey) return args;
-  if (args === void 0) return { serviceKey };
-  if (typeof args !== "object" || args === null || Array.isArray(args)) return args;
-  return { ...args, serviceKey };
-}
-function withEscapedKeys(client, serviceKey = process.env.KODY_SERVICE_KEY) {
-  return new Proxy(client, {
-    get(target, prop, receiver) {
-      if (CALL_METHODS.includes(prop)) {
-        const method = Reflect.get(target, prop, target);
-        return async (fn, args) => {
-          const authed = injectServiceKey(args, serviceKey);
-          const result = await method.call(target, fn, authed === void 0 ? void 0 : deepEscapeKeys(authed));
-          return deepUnescapeKeys(result);
-        };
-      }
-      const value = Reflect.get(target, prop, receiver);
-      return typeof value === "function" ? value.bind(target) : value;
-    }
-  });
-}
-function createConvexClientFromEnv(env = process.env) {
-  const url = env.CONVEX_URL?.trim();
-  if (!url) return null;
-  return withEscapedKeys(new ConvexHttpClient(url), env.KODY_SERVICE_KEY);
-}
-var ESCAPE_CHAR, NEEDS_ESCAPE, CALL_METHODS;
-var init_convex_client = __esm({
-  "src/chat/convex-client.ts"() {
-    "use strict";
-    ESCAPE_CHAR = "~";
-    NEEDS_ESCAPE = /^[$_~]/;
-    CALL_METHODS = ["query", "mutation", "action"];
-  }
-});
-
-// src/state-backend.ts
-import { anyApi } from "convex/server";
-function requireTenant(tenantId) {
-  const value = tenantId.trim();
-  if (!/^[^/\s]+\/[^/\s]+$/.test(value)) throw new Error("tenantId must be an owner/repository pair");
-  return value;
-}
-function requireNonEmpty(value, name) {
-  const normalized = value.trim();
-  if (!normalized) throw new Error(`${name} must not be empty`);
-  return normalized;
-}
-function createStateBackendFromEnv(env = process.env, client) {
-  const url = env.CONVEX_URL?.trim();
-  const serviceKey = env.KODY_SERVICE_KEY?.trim();
-  if (!url || !serviceKey) throw new Error("CONVEX_URL and KODY_SERVICE_KEY are required");
-  const transport = client ?? createConvexClientFromEnv(env);
-  return {
-    async get(tenantId, taskKey, kind) {
-      const result = await transport.query(anyApi.taskState.get, {
-        tenantId: requireTenant(tenantId),
-        taskKey: requireNonEmpty(taskKey, "taskKey"),
-        kind: requireNonEmpty(kind, "kind")
-      });
-      return result ?? null;
-    },
-    async save(tenantId, taskKey, kind, doc, expectedUpdatedAt) {
-      await transport.mutation(anyApi.taskState.save, {
-        tenantId: requireTenant(tenantId),
-        taskKey: requireNonEmpty(taskKey, "taskKey"),
-        kind: requireNonEmpty(kind, "kind"),
-        doc,
-        updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
-        ...expectedUpdatedAt ? { expectedUpdatedAt } : {}
-      });
-    },
-    async getRepoDoc(tenantId, kind) {
-      const result = await transport.query(anyApi.repoDocs.get, {
-        tenantId: requireTenant(tenantId),
-        kind: requireNonEmpty(kind, "kind")
-      });
-      return result ?? null;
-    },
-    async listRepoDocs(tenantId, prefix) {
-      const result = await transport.query(anyApi.repoDocs.listByPrefix, {
-        tenantId: requireTenant(tenantId),
-        prefix: requireNonEmpty(prefix, "prefix")
-      });
-      return Array.isArray(result) ? result : [];
-    },
-    async saveRepoDoc(tenantId, kind, doc, expectedUpdatedAt) {
-      await transport.mutation(anyApi.repoDocs.save, {
-        tenantId: requireTenant(tenantId),
-        kind: requireNonEmpty(kind, "kind"),
-        doc,
-        updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
-        ...expectedUpdatedAt ? { expectedUpdatedAt } : {}
-      });
-    },
-    async getGoal(tenantId, goalId) {
-      const result = await transport.query(anyApi.goals.get, {
-        tenantId: requireTenant(tenantId),
-        goalId: requireNonEmpty(goalId, "goalId")
-      });
-      return result ?? null;
-    },
-    async listGoals(tenantId) {
-      const result = await transport.query(anyApi.goals.list, { tenantId: requireTenant(tenantId) });
-      return Array.isArray(result) ? result : [];
-    },
-    async saveGoal(tenantId, goalId, state, updatedAt, expectedUpdatedAt) {
-      await transport.mutation(anyApi.goals.save, {
-        tenantId: requireTenant(tenantId),
-        goalId: requireNonEmpty(goalId, "goalId"),
-        state,
-        updatedAt,
-        ...expectedUpdatedAt ? { expectedUpdatedAt } : {}
-      });
-    },
-    async appendDailyLog(tenantId, stream, date, entry) {
-      await transport.mutation(anyApi.dailyLogs.append, {
-        tenantId: requireTenant(tenantId),
-        stream,
-        date: requireNonEmpty(date, "date"),
-        entry
-      });
-    },
-    async saveReport(tenantId, slug, runId, title, body, meta, updatedAt) {
-      await transport.mutation(anyApi.reports.save, {
-        tenantId: requireTenant(tenantId),
-        slug: requireNonEmpty(slug, "slug"),
-        runId: requireNonEmpty(runId, "runId"),
-        title,
-        body,
-        meta,
-        updatedAt
-      });
-    },
-    async listIntents(tenantId) {
-      const result = await transport.query(anyApi.intents.list, { tenantId: requireTenant(tenantId) });
-      return Array.isArray(result) ? result : [];
-    },
-    async getIntent(tenantId, intentId) {
-      const result = await transport.query(anyApi.intents.get, {
-        tenantId: requireTenant(tenantId),
-        intentId: requireNonEmpty(intentId, "intentId")
-      });
-      return result ?? null;
-    },
-    async saveIntent(tenantId, intentId, intent, updatedAt) {
-      await transport.mutation(anyApi.intents.save, {
-        tenantId: requireTenant(tenantId),
-        intentId: requireNonEmpty(intentId, "intentId"),
-        intent,
-        updatedAt
-      });
-    },
-    async appendIntentDecision(tenantId, intentId, decision) {
-      await transport.mutation(anyApi.intents.appendDecision, {
-        tenantId: requireTenant(tenantId),
-        intentId: requireNonEmpty(intentId, "intentId"),
-        decision
-      });
-    }
-  };
-}
-var init_state_backend = __esm({
-  "src/state-backend.ts"() {
-    "use strict";
-    init_convex_client();
-  }
-});
-
 // src/task-artifacts.ts
 import fs10 from "fs";
 import path12 from "path";
@@ -7010,15 +7051,36 @@ function upsertRunIndexRowBestEffort(config, cwd, row) {
 `);
   }
 }
+async function upsertRunIndexRowBestEffortAsync(config, cwd, row) {
+  if (!row) return;
+  const tenantId = tenantIdForRun(config);
+  const backendConfigured = Boolean(process.env.CONVEX_URL?.trim() && process.env.KODY_SERVICE_KEY?.trim() && tenantId);
+  if (backendConfigured) {
+    const backend = createStateBackendFromEnv();
+    await backend.saveAgencyRun(
+      tenantId,
+      row.id,
+      row.subjectType,
+      row.subjectId,
+      row,
+      row.updatedAt
+    );
+    return;
+  }
+  if (process.env.GITHUB_ACTIONS === "true") {
+    throw new Error("Convex backend is required for the run index in GitHub Actions");
+  }
+  upsertRunIndexRowBestEffort(config, cwd, row);
+}
 function stageRunIndexFinalization(data, row) {
   if (!row) return;
   const rows = stagedRunIndexRows(data);
   rows[row.id] = row;
 }
-function finalizeStagedRunIndexRows(config, cwd, data, result) {
+async function finalizeStagedRunIndexRowsAsync(config, cwd, data, result) {
   const rows = stagedRunIndexRows(data);
   for (const row of Object.values(rows)) {
-    upsertRunIndexRowBestEffort(config, cwd, finalizedRunIndexRow(row, result));
+    await upsertRunIndexRowBestEffortAsync(config, cwd, finalizedRunIndexRow(row, result));
   }
   data[STAGED_RUN_INDEX_ROWS_KEY] = {};
 }
@@ -7216,6 +7278,10 @@ function isConflict(err) {
   const msg = err instanceof Error ? err.message : String(err);
   return /HTTP 409/i.test(msg) || /HTTP 422/i.test(msg) || /does not match|is at|but expected/i.test(msg);
 }
+function tenantIdForRun(config) {
+  if (config.github?.owner && config.github.repo) return `${config.github.owner}/${config.github.repo}`;
+  return process.env.GITHUB_REPOSITORY?.trim() || void 0;
+}
 function recordValue2(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : null;
 }
@@ -7232,6 +7298,7 @@ var RUN_INDEX_PATH, MAX_RUNS, STAGED_RUN_INDEX_ROWS_KEY;
 var init_runIndex = __esm({
   "src/runIndex.ts"() {
     "use strict";
+    init_state_backend();
     init_stateRepo();
     RUN_INDEX_PATH = "runs/index.json";
     MAX_RUNS = 200;
@@ -8221,9 +8288,14 @@ async function flushGoalRunLogEventsAsync(config, cwd, data) {
   for (const [goalId, log2] of Object.entries(goalRunLogs(data))) {
     if (log2.events.length === 0) continue;
     const enrichedEvents = log2.events.map((event) => enrichGoalRunLogEvent(config, data, log2.path, event));
+    const row = runIndexRowFromGoalEvents(goalId, log2.path, enrichedEvents);
+    if (!row) continue;
     for (const event of enrichedEvents) {
       await backend.appendDailyLog(tenantId, "events", event.time.slice(0, 10), event);
+      await backend.appendRunEvent(tenantId, row.id, goalId, event, event.time);
     }
+    await upsertRunIndexRowBestEffortAsync(config, cwd, row);
+    stageRunIndexFinalization(data, row);
     log2.events = [];
   }
 }
@@ -8921,7 +8993,9 @@ function decodeGoal(doc) {
 async function fetchGoalStateAsync(config, goalId, cwd) {
   const tenantId = backendTenant(config);
   if (backendEnabled(config) && tenantId) {
-    return decodeGoal(await createStateBackendFromEnv().getGoal(tenantId, goalId));
+    const fromBackend = decodeGoal(await createStateBackendFromEnv().getGoal(tenantId, goalId));
+    if (fromBackend) return fromBackend;
+    return fetchGoalStateLegacy(config, goalId, cwd);
   }
   if (backendRequired()) throw new Error("Convex backend is required for goal state in GitHub Actions");
   return fetchGoalStateLegacy(config, goalId, cwd);
@@ -10306,12 +10380,12 @@ function scalarFacts(facts) {
 async function autonomyBlockReason(ctx, goalId, goal, goalState, dispatch2, options = {}) {
   if (ctx.data.jobForce === true) return null;
   const selfKind = managedModelKind(goal);
-  const selfMode = selfKind === "Goal" ? firstTrustOverride(ctx, subjectCandidates("goal", goalId, goalState)) : null;
+  const selfMode = selfKind === "Goal" ? await firstTrustOverride(ctx, subjectCandidates("goal", goalId, goalState)) : null;
   if (selfKind === "Goal" && (selfMode === "ask" || selfMode !== "auto" && goal.runWithoutApproval !== true)) {
     return `Run without approval is off for ${managedModelKind(goal)} ${goalId}`;
   }
   if (dispatch2.workflow && selfKind === "Goal") {
-    const workflowMode = firstTrustOverride(ctx, [{ kind: "workflow", id: dispatch2.workflow }]);
+    const workflowMode = await firstTrustOverride(ctx, [{ kind: "workflow", id: dispatch2.workflow }]);
     const workflow = workflowMode === "auto" ? null : readWorkflowDefinition(ctx.config, ctx.cwd, dispatch2.workflow);
     if (workflowMode === "ask" || workflowMode !== "auto" && workflow && workflow.runWithoutApproval !== true) {
       return `Run without approval is off for workflow ${dispatch2.workflow}`;
@@ -10322,7 +10396,7 @@ async function autonomyBlockReason(ctx, goalId, goal, goalState, dispatch2, opti
     const target = await fetchGoalStateAsync(ctx.config, targetGoal, ctx.cwd);
     const targetManaged = target ? managedGoalFromState(expandManagedGoalState(target)) : null;
     const targetIsGoal = targetManaged ? managedModelKind(targetManaged) === "Goal" : false;
-    const targetMode = targetManaged && targetIsGoal ? firstTrustOverride(ctx, subjectCandidates("goal", targetGoal, target)) : null;
+    const targetMode = targetManaged && targetIsGoal ? await firstTrustOverride(ctx, subjectCandidates("goal", targetGoal, target)) : null;
     if (targetIsGoal && (targetMode === "ask" || targetMode !== "auto" && targetManaged && targetManaged.runWithoutApproval !== true)) {
       return `Run without approval is off for goal ${targetGoal}`;
     }
@@ -10366,11 +10440,14 @@ function subjectCandidates(kind, id, state) {
   }
   return [...ids].map((candidate) => ({ kind, id: candidate }));
 }
-function firstTrustOverride(ctx, subjects) {
-  if (!ctx.config.state) return null;
+async function firstTrustOverride(ctx, subjects) {
+  const backendConfigured = Boolean(
+    process.env.CONVEX_URL?.trim() && process.env.KODY_SERVICE_KEY?.trim()
+  );
+  if (!ctx.config.state && !backendConfigured) return null;
   const repoSlug = ctx.config.github?.owner && ctx.config.github?.repo ? `${ctx.config.github.owner}/${ctx.config.github.repo}` : "";
   for (const subject of subjects) {
-    const mode = readTrustModeOverride(ctx.config.state, repoSlug, subject);
+    const mode = await readTrustModeOverrideAsync(repoSlug, subject, ctx.config.state);
     if (mode) return mode;
   }
   return null;
@@ -21056,8 +21133,8 @@ async function runImplementation(profileName, input) {
   const stageStartedAt = Date.now();
   let finishRunIndex = null;
   emitEvent(input.cwd, { implementation: profileName, kind: "stage_start" });
-  const finishAndEnd = (out) => {
-    finishRunIndex?.(out);
+  const finishAndEnd = async (out) => {
+    await finishRunIndex?.(out);
     emitEvent(input.cwd, {
       implementation: profileName,
       kind: "stage_end",
@@ -21148,7 +21225,7 @@ async function runImplementation(profileName, input) {
   if (reasoningEffort) ctx.data.jobReasoningEffort = reasoningEffort;
   const runIndexStartedAt = new Date(stageStartedAt).toISOString();
   if (!input.skipConfig) {
-    upsertRunIndexRowBestEffort(
+    await upsertRunIndexRowBestEffortAsync(
       config,
       input.cwd,
       runIndexRowFromJobContext({
@@ -21160,10 +21237,10 @@ async function runImplementation(profileName, input) {
         updatedAt: runIndexStartedAt
       })
     );
-    finishRunIndex = (out) => {
+    finishRunIndex = async (out) => {
       const finishedAt = (/* @__PURE__ */ new Date()).toISOString();
       const status = statusFromExitCode(out.exitCode);
-      upsertRunIndexRowBestEffort(
+      await upsertRunIndexRowBestEffortAsync(
         config,
         input.cwd,
         runIndexRowFromJobContext({
@@ -21176,7 +21253,7 @@ async function runImplementation(profileName, input) {
           reason: out.reason
         })
       );
-      finalizeStagedRunIndexRows(config, input.cwd, ctx.data, {
+      await finalizeStagedRunIndexRowsAsync(config, input.cwd, ctx.data, {
         status,
         updatedAt: finishedAt,
         reason: out.reason

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kody-ade/kody-engine",
-  "version": "0.4.394",
+  "version": "0.4.396",
   "description": "kody — autonomous development engine. Single-session Claude Code agent behind a generic executor + declarative implementation profiles.",
   "license": "MIT",
   "type": "module",
@@ -12,6 +12,28 @@
     "templates",
     "kody.config.schema.json"
   ],
+  "scripts": {
+    "kody:run": "tsx bin/kody.ts",
+    "serve": "tsx bin/kody.ts serve",
+    "serve:vscode": "tsx bin/kody.ts serve vscode",
+    "serve:claude": "tsx bin/kody.ts serve claude",
+    "clean:dist": "node scripts/clean-dist.cjs",
+    "build": "pnpm clean:dist && tsup && node scripts/copy-assets.cjs",
+    "check:modularity": "tsx scripts/check-script-modularity.ts",
+    "pretest": "pnpm check:modularity",
+    "test": "vitest run tests/unit tests/int --coverage",
+    "posttest": "tsx scripts/check-coverage-floor.ts",
+    "test:smoke": "vitest run tests/smoke --no-coverage",
+    "test:e2e": "vitest run tests/e2e --no-coverage",
+    "test:all": "vitest run tests --no-coverage",
+    "typecheck": "tsc --noEmit",
+    "lint": "biome check",
+    "lint:fix": "biome check --write",
+    "format": "biome format --write",
+    "verify:package": "node scripts/verify-package-tarball.cjs",
+    "brain:publish": "docker buildx build --platform linux/amd64 -f runner/Dockerfile.brain -t ghcr.io/${KODY_BRAIN_GHCR_OWNER:-aharonyaircohen}/kody-brain:latest --push runner",
+    "prepublishOnly": "pnpm typecheck && vitest run tests/unit tests/int --no-coverage && pnpm build && pnpm verify:package"
+  },
   "dependencies": {
     "@actions/cache": "^6.0.0",
     "@anthropic-ai/claude-agent-sdk": "0.2.119",
@@ -36,26 +58,5 @@
     "url": "git+https://github.com/aharonyaircohen/kody-engine.git"
   },
   "homepage": "https://github.com/aharonyaircohen/kody-engine",
-  "bugs": "https://github.com/aharonyaircohen/kody-engine/issues",
-  "scripts": {
-    "kody:run": "tsx bin/kody.ts",
-    "serve": "tsx bin/kody.ts serve",
-    "serve:vscode": "tsx bin/kody.ts serve vscode",
-    "serve:claude": "tsx bin/kody.ts serve claude",
-    "clean:dist": "node scripts/clean-dist.cjs",
-    "build": "pnpm clean:dist && tsup && node scripts/copy-assets.cjs",
-    "check:modularity": "tsx scripts/check-script-modularity.ts",
-    "pretest": "pnpm check:modularity",
-    "test": "vitest run tests/unit tests/int --coverage",
-    "posttest": "tsx scripts/check-coverage-floor.ts",
-    "test:smoke": "vitest run tests/smoke --no-coverage",
-    "test:e2e": "vitest run tests/e2e --no-coverage",
-    "test:all": "vitest run tests --no-coverage",
-    "typecheck": "tsc --noEmit",
-    "lint": "biome check",
-    "lint:fix": "biome check --write",
-    "format": "biome format --write",
-    "verify:package": "node scripts/verify-package-tarball.cjs",
-    "brain:publish": "docker buildx build --platform linux/amd64 -f runner/Dockerfile.brain -t ghcr.io/${KODY_BRAIN_GHCR_OWNER:-aharonyaircohen}/kody-brain:latest --push runner"
-  }
-}
+  "bugs": "https://github.com/aharonyaircohen/kody-engine/issues"
+}