@kody-ade/kody-engine 0.4.395 → 0.4.396

package/dist/bin/kody.js

@@ -15,7 +15,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "@kody-ade/kody-engine",
-      version: "0.4.395",
+      version: "0.4.396",
       description: "kody \u2014 autonomous development engine. Single-session Claude Code agent behind a generic executor + declarative implementation profiles.",
       license: "MIT",
       type: "module",
@@ -2549,6 +2549,222 @@ var init_registry = __esm({
   }
 });
 
+// src/chat/convex-client.ts
+import { ConvexHttpClient } from "convex/browser";
+function isPlainObject2(value) {
+  if (value === null || typeof value !== "object") return false;
+  const proto = Object.getPrototypeOf(value);
+  return proto === Object.prototype || proto === null;
+}
+function deepMapKeys(value, mapKey) {
+  if (Array.isArray(value)) return value.map((item) => deepMapKeys(item, mapKey));
+  if (isPlainObject2(value)) {
+    return Object.fromEntries(Object.entries(value).map(([key, item]) => [mapKey(key), deepMapKeys(item, mapKey)]));
+  }
+  return value;
+}
+function deepEscapeKeys(value) {
+  return deepMapKeys(value, (k) => NEEDS_ESCAPE.test(k) ? `${ESCAPE_CHAR}${k}` : k);
+}
+function deepUnescapeKeys(value) {
+  return deepMapKeys(value, (k) => k.startsWith(ESCAPE_CHAR) ? k.slice(1) : k);
+}
+function injectServiceKey(args, serviceKey = process.env.KODY_SERVICE_KEY) {
+  if (!serviceKey) return args;
+  if (args === void 0) return { serviceKey };
+  if (typeof args !== "object" || args === null || Array.isArray(args)) return args;
+  return { ...args, serviceKey };
+}
+function withEscapedKeys(client, serviceKey = process.env.KODY_SERVICE_KEY) {
+  return new Proxy(client, {
+    get(target, prop, receiver) {
+      if (CALL_METHODS.includes(prop)) {
+        const method = Reflect.get(target, prop, target);
+        return async (fn, args) => {
+          const authed = injectServiceKey(args, serviceKey);
+          const result = await method.call(target, fn, authed === void 0 ? void 0 : deepEscapeKeys(authed));
+          return deepUnescapeKeys(result);
+        };
+      }
+      const value = Reflect.get(target, prop, receiver);
+      return typeof value === "function" ? value.bind(target) : value;
+    }
+  });
+}
+function createConvexClientFromEnv(env = process.env) {
+  const url = env.CONVEX_URL?.trim();
+  if (!url) return null;
+  return withEscapedKeys(new ConvexHttpClient(url), env.KODY_SERVICE_KEY);
+}
+var ESCAPE_CHAR, NEEDS_ESCAPE, CALL_METHODS;
+var init_convex_client = __esm({
+  "src/chat/convex-client.ts"() {
+    "use strict";
+    ESCAPE_CHAR = "~";
+    NEEDS_ESCAPE = /^[$_~]/;
+    CALL_METHODS = ["query", "mutation", "action"];
+  }
+});
+
+// src/state-backend.ts
+import { anyApi } from "convex/server";
+function requireTenant(tenantId) {
+  const value = tenantId.trim();
+  if (!/^[^/\s]+\/[^/\s]+$/.test(value)) throw new Error("tenantId must be an owner/repository pair");
+  return value;
+}
+function requireNonEmpty(value, name) {
+  const normalized = value.trim();
+  if (!normalized) throw new Error(`${name} must not be empty`);
+  return normalized;
+}
+function createStateBackendFromEnv(env = process.env, client) {
+  const url = env.CONVEX_URL?.trim();
+  const serviceKey = env.KODY_SERVICE_KEY?.trim();
+  if (!url || !serviceKey) throw new Error("CONVEX_URL and KODY_SERVICE_KEY are required");
+  const transport = client ?? createConvexClientFromEnv(env);
+  return {
+    async get(tenantId, taskKey, kind) {
+      const result = await transport.query(anyApi.taskState.get, {
+        tenantId: requireTenant(tenantId),
+        taskKey: requireNonEmpty(taskKey, "taskKey"),
+        kind: requireNonEmpty(kind, "kind")
+      });
+      return result ?? null;
+    },
+    async save(tenantId, taskKey, kind, doc, expectedUpdatedAt) {
+      await transport.mutation(anyApi.taskState.save, {
+        tenantId: requireTenant(tenantId),
+        taskKey: requireNonEmpty(taskKey, "taskKey"),
+        kind: requireNonEmpty(kind, "kind"),
+        doc,
+        updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        ...expectedUpdatedAt ? { expectedUpdatedAt } : {}
+      });
+    },
+    async getRepoDoc(tenantId, kind) {
+      const result = await transport.query(anyApi.repoDocs.get, {
+        tenantId: requireTenant(tenantId),
+        kind: requireNonEmpty(kind, "kind")
+      });
+      return result ?? null;
+    },
+    async listRepoDocs(tenantId, prefix) {
+      const result = await transport.query(anyApi.repoDocs.listByPrefix, {
+        tenantId: requireTenant(tenantId),
+        prefix: requireNonEmpty(prefix, "prefix")
+      });
+      return Array.isArray(result) ? result : [];
+    },
+    async saveRepoDoc(tenantId, kind, doc, expectedUpdatedAt) {
+      await transport.mutation(anyApi.repoDocs.save, {
+        tenantId: requireTenant(tenantId),
+        kind: requireNonEmpty(kind, "kind"),
+        doc,
+        updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        ...expectedUpdatedAt ? { expectedUpdatedAt } : {}
+      });
+    },
+    async getGoal(tenantId, goalId) {
+      const result = await transport.query(anyApi.goals.get, {
+        tenantId: requireTenant(tenantId),
+        goalId: requireNonEmpty(goalId, "goalId")
+      });
+      return result ?? null;
+    },
+    async listGoals(tenantId) {
+      const result = await transport.query(anyApi.goals.list, { tenantId: requireTenant(tenantId) });
+      return Array.isArray(result) ? result : [];
+    },
+    async saveGoal(tenantId, goalId, state, updatedAt, expectedUpdatedAt) {
+      await transport.mutation(anyApi.goals.save, {
+        tenantId: requireTenant(tenantId),
+        goalId: requireNonEmpty(goalId, "goalId"),
+        state,
+        updatedAt,
+        ...expectedUpdatedAt ? { expectedUpdatedAt } : {}
+      });
+    },
+    async appendDailyLog(tenantId, stream, date, entry) {
+      await transport.mutation(anyApi.dailyLogs.append, {
+        tenantId: requireTenant(tenantId),
+        stream,
+        date: requireNonEmpty(date, "date"),
+        entry
+      });
+    },
+    async saveAgencyRun(tenantId, runId, subjectType, subjectId, run, updatedAt) {
+      await transport.mutation(anyApi.agencyRuns.save, {
+        tenantId: requireTenant(tenantId),
+        runId: requireNonEmpty(runId, "runId"),
+        subjectType,
+        subjectId: requireNonEmpty(subjectId, "subjectId"),
+        run,
+        updatedAt
+      });
+    },
+    async appendRunEvent(tenantId, runId, goalId, event, time) {
+      await transport.mutation(anyApi.runEvents.append, {
+        tenantId: requireTenant(tenantId),
+        runId: requireNonEmpty(runId, "runId"),
+        ...goalId ? { goalId: requireNonEmpty(goalId, "goalId") } : {},
+        event,
+        time: requireNonEmpty(time, "time")
+      });
+    },
+    async getManifest(tenantId, kind) {
+      const result = await transport.query(anyApi.manifests.get, {
+        tenantId: requireTenant(tenantId),
+        kind: requireNonEmpty(kind, "kind")
+      });
+      return result ?? null;
+    },
+    async saveReport(tenantId, slug, runId, title, body, meta, updatedAt) {
+      await transport.mutation(anyApi.reports.save, {
+        tenantId: requireTenant(tenantId),
+        slug: requireNonEmpty(slug, "slug"),
+        runId: requireNonEmpty(runId, "runId"),
+        title,
+        body,
+        meta,
+        updatedAt
+      });
+    },
+    async listIntents(tenantId) {
+      const result = await transport.query(anyApi.intents.list, { tenantId: requireTenant(tenantId) });
+      return Array.isArray(result) ? result : [];
+    },
+    async getIntent(tenantId, intentId) {
+      const result = await transport.query(anyApi.intents.get, {
+        tenantId: requireTenant(tenantId),
+        intentId: requireNonEmpty(intentId, "intentId")
+      });
+      return result ?? null;
+    },
+    async saveIntent(tenantId, intentId, intent, updatedAt) {
+      await transport.mutation(anyApi.intents.save, {
+        tenantId: requireTenant(tenantId),
+        intentId: requireNonEmpty(intentId, "intentId"),
+        intent,
+        updatedAt
+      });
+    },
+    async appendIntentDecision(tenantId, intentId, decision) {
+      await transport.mutation(anyApi.intents.appendDecision, {
+        tenantId: requireTenant(tenantId),
+        intentId: requireNonEmpty(intentId, "intentId"),
+        decision
+      });
+    }
+  };
+}
+var init_state_backend = __esm({
+  "src/state-backend.ts"() {
+    "use strict";
+    init_convex_client();
+  }
+});
+
 // src/trustPolicy.ts
 function trustSubjectKey(subject) {
   return `${subject.kind}:${subject.id}`;
@@ -2583,6 +2799,20 @@ function readTrustModeOverride(stateOrRepoSlug, repoSlugOrSubject, maybeSubject)
     return null;
   }
 }
+async function readTrustModeOverrideAsync(repoSlug, subject, state) {
+  if (!subject.id) return null;
+  const backendConfigured = Boolean(
+    process.env.CONVEX_URL?.trim() && process.env.KODY_SERVICE_KEY?.trim() && /^[^/\s]+\/[^/\s]+$/.test(repoSlug)
+  );
+  if (backendConfigured) {
+    const stored = await createStateBackendFromEnv().getManifest(repoSlug, "capability-trust");
+    return stored ? parseTrustModeOverride(JSON.stringify(stored.doc), subject) : null;
+  }
+  if (process.env.GITHUB_ACTIONS === "true") {
+    throw new Error("Convex backend is required for trust policy in GitHub Actions");
+  }
+  return readTrustModeOverride(state, repoSlug, subject);
+}
 function defaultStateForRepoSlug(repoSlug) {
   const [owner, repo] = repoSlug.split("/");
   return { repo: `${owner}/kody-state`, path: repo ?? repoSlug };
@@ -2592,6 +2822,7 @@ var init_trustPolicy = __esm({
   "src/trustPolicy.ts"() {
     "use strict";
     init_stateRepo();
+    init_state_backend();
     TRUST_FILE_PATH = "state/trust.json";
   }
 });
@@ -3777,215 +4008,6 @@ var init_agents = __esm({
   }
 });
 
-// src/chat/convex-client.ts
-import { ConvexHttpClient } from "convex/browser";
-function isPlainObject2(value) {
-  if (value === null || typeof value !== "object") return false;
-  const proto = Object.getPrototypeOf(value);
-  return proto === Object.prototype || proto === null;
-}
-function deepMapKeys(value, mapKey) {
-  if (Array.isArray(value)) return value.map((item) => deepMapKeys(item, mapKey));
-  if (isPlainObject2(value)) {
-    return Object.fromEntries(Object.entries(value).map(([key, item]) => [mapKey(key), deepMapKeys(item, mapKey)]));
-  }
-  return value;
-}
-function deepEscapeKeys(value) {
-  return deepMapKeys(value, (k) => NEEDS_ESCAPE.test(k) ? `${ESCAPE_CHAR}${k}` : k);
-}
-function deepUnescapeKeys(value) {
-  return deepMapKeys(value, (k) => k.startsWith(ESCAPE_CHAR) ? k.slice(1) : k);
-}
-function injectServiceKey(args, serviceKey = process.env.KODY_SERVICE_KEY) {
-  if (!serviceKey) return args;
-  if (args === void 0) return { serviceKey };
-  if (typeof args !== "object" || args === null || Array.isArray(args)) return args;
-  return { ...args, serviceKey };
-}
-function withEscapedKeys(client, serviceKey = process.env.KODY_SERVICE_KEY) {
-  return new Proxy(client, {
-    get(target, prop, receiver) {
-      if (CALL_METHODS.includes(prop)) {
-        const method = Reflect.get(target, prop, target);
-        return async (fn, args) => {
-          const authed = injectServiceKey(args, serviceKey);
-          const result = await method.call(target, fn, authed === void 0 ? void 0 : deepEscapeKeys(authed));
-          return deepUnescapeKeys(result);
-        };
-      }
-      const value = Reflect.get(target, prop, receiver);
-      return typeof value === "function" ? value.bind(target) : value;
-    }
-  });
-}
-function createConvexClientFromEnv(env = process.env) {
-  const url = env.CONVEX_URL?.trim();
-  if (!url) return null;
-  return withEscapedKeys(new ConvexHttpClient(url), env.KODY_SERVICE_KEY);
-}
-var ESCAPE_CHAR, NEEDS_ESCAPE, CALL_METHODS;
-var init_convex_client = __esm({
-  "src/chat/convex-client.ts"() {
-    "use strict";
-    ESCAPE_CHAR = "~";
-    NEEDS_ESCAPE = /^[$_~]/;
-    CALL_METHODS = ["query", "mutation", "action"];
-  }
-});
-
-// src/state-backend.ts
-import { anyApi } from "convex/server";
-function requireTenant(tenantId) {
-  const value = tenantId.trim();
-  if (!/^[^/\s]+\/[^/\s]+$/.test(value)) throw new Error("tenantId must be an owner/repository pair");
-  return value;
-}
-function requireNonEmpty(value, name) {
-  const normalized = value.trim();
-  if (!normalized) throw new Error(`${name} must not be empty`);
-  return normalized;
-}
-function createStateBackendFromEnv(env = process.env, client) {
-  const url = env.CONVEX_URL?.trim();
-  const serviceKey = env.KODY_SERVICE_KEY?.trim();
-  if (!url || !serviceKey) throw new Error("CONVEX_URL and KODY_SERVICE_KEY are required");
-  const transport = client ?? createConvexClientFromEnv(env);
-  return {
-    async get(tenantId, taskKey, kind) {
-      const result = await transport.query(anyApi.taskState.get, {
-        tenantId: requireTenant(tenantId),
-        taskKey: requireNonEmpty(taskKey, "taskKey"),
-        kind: requireNonEmpty(kind, "kind")
-      });
-      return result ?? null;
-    },
-    async save(tenantId, taskKey, kind, doc, expectedUpdatedAt) {
-      await transport.mutation(anyApi.taskState.save, {
-        tenantId: requireTenant(tenantId),
-        taskKey: requireNonEmpty(taskKey, "taskKey"),
-        kind: requireNonEmpty(kind, "kind"),
-        doc,
-        updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
-        ...expectedUpdatedAt ? { expectedUpdatedAt } : {}
-      });
-    },
-    async getRepoDoc(tenantId, kind) {
-      const result = await transport.query(anyApi.repoDocs.get, {
-        tenantId: requireTenant(tenantId),
-        kind: requireNonEmpty(kind, "kind")
-      });
-      return result ?? null;
-    },
-    async listRepoDocs(tenantId, prefix) {
-      const result = await transport.query(anyApi.repoDocs.listByPrefix, {
-        tenantId: requireTenant(tenantId),
-        prefix: requireNonEmpty(prefix, "prefix")
-      });
-      return Array.isArray(result) ? result : [];
-    },
-    async saveRepoDoc(tenantId, kind, doc, expectedUpdatedAt) {
-      await transport.mutation(anyApi.repoDocs.save, {
-        tenantId: requireTenant(tenantId),
-        kind: requireNonEmpty(kind, "kind"),
-        doc,
-        updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
-        ...expectedUpdatedAt ? { expectedUpdatedAt } : {}
-      });
-    },
-    async getGoal(tenantId, goalId) {
-      const result = await transport.query(anyApi.goals.get, {
-        tenantId: requireTenant(tenantId),
-        goalId: requireNonEmpty(goalId, "goalId")
-      });
-      return result ?? null;
-    },
-    async listGoals(tenantId) {
-      const result = await transport.query(anyApi.goals.list, { tenantId: requireTenant(tenantId) });
-      return Array.isArray(result) ? result : [];
-    },
-    async saveGoal(tenantId, goalId, state, updatedAt, expectedUpdatedAt) {
-      await transport.mutation(anyApi.goals.save, {
-        tenantId: requireTenant(tenantId),
-        goalId: requireNonEmpty(goalId, "goalId"),
-        state,
-        updatedAt,
-        ...expectedUpdatedAt ? { expectedUpdatedAt } : {}
-      });
-    },
-    async appendDailyLog(tenantId, stream, date, entry) {
-      await transport.mutation(anyApi.dailyLogs.append, {
-        tenantId: requireTenant(tenantId),
-        stream,
-        date: requireNonEmpty(date, "date"),
-        entry
-      });
-    },
-    async saveAgencyRun(tenantId, runId, subjectType, subjectId, run, updatedAt) {
-      await transport.mutation(anyApi.agencyRuns.save, {
-        tenantId: requireTenant(tenantId),
-        runId: requireNonEmpty(runId, "runId"),
-        subjectType,
-        subjectId: requireNonEmpty(subjectId, "subjectId"),
-        run,
-        updatedAt
-      });
-    },
-    async appendRunEvent(tenantId, runId, goalId, event, time) {
-      await transport.mutation(anyApi.runEvents.append, {
-        tenantId: requireTenant(tenantId),
-        runId: requireNonEmpty(runId, "runId"),
-        ...goalId ? { goalId: requireNonEmpty(goalId, "goalId") } : {},
-        event,
-        time: requireNonEmpty(time, "time")
-      });
-    },
-    async saveReport(tenantId, slug, runId, title, body, meta, updatedAt) {
-      await transport.mutation(anyApi.reports.save, {
-        tenantId: requireTenant(tenantId),
-        slug: requireNonEmpty(slug, "slug"),
-        runId: requireNonEmpty(runId, "runId"),
-        title,
-        body,
-        meta,
-        updatedAt
-      });
-    },
-    async listIntents(tenantId) {
-      const result = await transport.query(anyApi.intents.list, { tenantId: requireTenant(tenantId) });
-      return Array.isArray(result) ? result : [];
-    },
-    async getIntent(tenantId, intentId) {
-      const result = await transport.query(anyApi.intents.get, {
-        tenantId: requireTenant(tenantId),
-        intentId: requireNonEmpty(intentId, "intentId")
-      });
-      return result ?? null;
-    },
-    async saveIntent(tenantId, intentId, intent, updatedAt) {
-      await transport.mutation(anyApi.intents.save, {
-        tenantId: requireTenant(tenantId),
-        intentId: requireNonEmpty(intentId, "intentId"),
-        intent,
-        updatedAt
-      });
-    },
-    async appendIntentDecision(tenantId, intentId, decision) {
-      await transport.mutation(anyApi.intents.appendDecision, {
-        tenantId: requireTenant(tenantId),
-        intentId: requireNonEmpty(intentId, "intentId"),
-        decision
-      });
-    }
-  };
-}
-var init_state_backend = __esm({
-  "src/state-backend.ts"() {
-    "use strict";
-    init_convex_client();
-  }
-});
-
 // src/task-artifacts.ts
 import fs10 from "fs";
 import path12 from "path";
@@ -8971,7 +8993,9 @@ function decodeGoal(doc) {
 async function fetchGoalStateAsync(config, goalId, cwd) {
   const tenantId = backendTenant(config);
   if (backendEnabled(config) && tenantId) {
-    return decodeGoal(await createStateBackendFromEnv().getGoal(tenantId, goalId));
+    const fromBackend = decodeGoal(await createStateBackendFromEnv().getGoal(tenantId, goalId));
+    if (fromBackend) return fromBackend;
+    return fetchGoalStateLegacy(config, goalId, cwd);
   }
   if (backendRequired()) throw new Error("Convex backend is required for goal state in GitHub Actions");
   return fetchGoalStateLegacy(config, goalId, cwd);
@@ -10356,12 +10380,12 @@ function scalarFacts(facts) {
 async function autonomyBlockReason(ctx, goalId, goal, goalState, dispatch2, options = {}) {
   if (ctx.data.jobForce === true) return null;
   const selfKind = managedModelKind(goal);
-  const selfMode = selfKind === "Goal" ? firstTrustOverride(ctx, subjectCandidates("goal", goalId, goalState)) : null;
+  const selfMode = selfKind === "Goal" ? await firstTrustOverride(ctx, subjectCandidates("goal", goalId, goalState)) : null;
   if (selfKind === "Goal" && (selfMode === "ask" || selfMode !== "auto" && goal.runWithoutApproval !== true)) {
     return `Run without approval is off for ${managedModelKind(goal)} ${goalId}`;
   }
   if (dispatch2.workflow && selfKind === "Goal") {
-    const workflowMode = firstTrustOverride(ctx, [{ kind: "workflow", id: dispatch2.workflow }]);
+    const workflowMode = await firstTrustOverride(ctx, [{ kind: "workflow", id: dispatch2.workflow }]);
     const workflow = workflowMode === "auto" ? null : readWorkflowDefinition(ctx.config, ctx.cwd, dispatch2.workflow);
     if (workflowMode === "ask" || workflowMode !== "auto" && workflow && workflow.runWithoutApproval !== true) {
       return `Run without approval is off for workflow ${dispatch2.workflow}`;
@@ -10372,7 +10396,7 @@ async function autonomyBlockReason(ctx, goalId, goal, goalState, dispatch2, opti
     const target = await fetchGoalStateAsync(ctx.config, targetGoal, ctx.cwd);
     const targetManaged = target ? managedGoalFromState(expandManagedGoalState(target)) : null;
     const targetIsGoal = targetManaged ? managedModelKind(targetManaged) === "Goal" : false;
-    const targetMode = targetManaged && targetIsGoal ? firstTrustOverride(ctx, subjectCandidates("goal", targetGoal, target)) : null;
+    const targetMode = targetManaged && targetIsGoal ? await firstTrustOverride(ctx, subjectCandidates("goal", targetGoal, target)) : null;
     if (targetIsGoal && (targetMode === "ask" || targetMode !== "auto" && targetManaged && targetManaged.runWithoutApproval !== true)) {
       return `Run without approval is off for goal ${targetGoal}`;
     }
@@ -10416,11 +10440,14 @@ function subjectCandidates(kind, id, state) {
   }
   return [...ids].map((candidate) => ({ kind, id: candidate }));
 }
-function firstTrustOverride(ctx, subjects) {
-  if (!ctx.config.state) return null;
+async function firstTrustOverride(ctx, subjects) {
+  const backendConfigured = Boolean(
+    process.env.CONVEX_URL?.trim() && process.env.KODY_SERVICE_KEY?.trim()
+  );
+  if (!ctx.config.state && !backendConfigured) return null;
   const repoSlug = ctx.config.github?.owner && ctx.config.github?.repo ? `${ctx.config.github.owner}/${ctx.config.github.repo}` : "";
   for (const subject of subjects) {
-    const mode = readTrustModeOverride(ctx.config.state, repoSlug, subject);
+    const mode = await readTrustModeOverrideAsync(repoSlug, subject, ctx.config.state);
     if (mode) return mode;
   }
   return null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kody-ade/kody-engine",
-  "version": "0.4.395",
+  "version": "0.4.396",
   "description": "kody — autonomous development engine. Single-session Claude Code agent behind a generic executor + declarative implementation profiles.",
   "license": "MIT",
   "type": "module",