@kody-ade/kody-engine 0.4.407 → 0.4.409

package/dist/bin/kody.js

@@ -15,7 +15,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "@kody-ade/kody-engine",
-      version: "0.4.407",
+      version: "0.4.409",
       description: "kody \u2014 autonomous development engine. Single-session Claude Code agent behind a generic executor + declarative implementation profiles.",
       license: "MIT",
       type: "module",
@@ -2990,6 +2990,17 @@ var init_capabilityMcp = __esm({
 import { spawn as spawn2, spawnSync } from "child_process";
 import * as fs7 from "fs";
 import * as path8 from "path";
+function buildCloneProcess(repo, token, baseEnv = process.env) {
+  const url = `https://github.com/${repo}.git`;
+  const env = { ...baseEnv };
+  if (!token) return { url, env };
+  const parsedCount = Number.parseInt(env.GIT_CONFIG_COUNT ?? "0", 10);
+  const count = Number.isInteger(parsedCount) && parsedCount >= 0 ? parsedCount : 0;
+  env.GIT_CONFIG_COUNT = String(count + 1);
+  env[`GIT_CONFIG_KEY_${count}`] = "http.https://github.com/.extraHeader";
+  env[`GIT_CONFIG_VALUE_${count}`] = `Authorization: Basic ${Buffer.from(`x-access-token:${token}`).toString("base64")}`;
+  return { url, env };
+}
 async function resolveAndClone(reposRoot, repo, repoToken, cloneRepo) {
   const name = repo?.trim();
   if (!name || !REPO_RE.test(name)) return null;
@@ -3020,17 +3031,19 @@ async function fetchRepo(opts) {
   }
   return dir;
 }
-var REPO_RE, repoClones, defaultCloneRepo;
+var REPO_RE, repoClones, GIT_CREDENTIAL_HELPER, defaultCloneRepo;
 var init_repoWorkspace = __esm({
   "src/repoWorkspace.ts"() {
     "use strict";
     REPO_RE = /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/;
     repoClones = /* @__PURE__ */ new Map();
+    GIT_CREDENTIAL_HELPER = `!f() { if [ "$1" = get ] && [ -n "$GITHUB_TOKEN" ]; then printf '%s\\n' username=x-access-token "password=$GITHUB_TOKEN"; fi; }; f`;
     defaultCloneRepo = (repo, token, dir) => {
       fs7.mkdirSync(path8.dirname(dir), { recursive: true });
-      const authUrl = token ? `https://x-access-token:${token}@github.com/${repo}.git` : `https://github.com/${repo}.git`;
+      const clone = buildCloneProcess(repo, token);
       return new Promise((resolve16, reject) => {
-        const child = spawn2("git", ["clone", "--depth=1", authUrl, dir], {
+        const child = spawn2("git", ["clone", "--depth=1", clone.url, dir], {
+          env: clone.env,
           stdio: "inherit"
         });
         child.on("exit", (code) => {
@@ -3043,6 +3056,9 @@ var init_repoWorkspace = __esm({
             const email = process.env.GIT_AUTHOR_EMAIL ?? "kody-bot@users.noreply.github.com";
             spawnSync("git", ["-C", dir, "config", "user.name", name]);
             spawnSync("git", ["-C", dir, "config", "user.email", email]);
+            if (token) {
+              spawnSync("git", ["-C", dir, "config", "credential.helper", GIT_CREDENTIAL_HELPER]);
+            }
           } catch {
           }
           resolve16();
@@ -3169,24 +3185,26 @@ function stripAgentSecrets(env) {
   }
   return out;
 }
-async function runAgent(opts) {
-  const ndjsonDir = opts.ndjsonDir ?? agentRunDir(opts.cwd);
-  fs8.mkdirSync(ndjsonDir, { recursive: true });
-  const ndjsonPath = path9.join(ndjsonDir, "last-run.jsonl");
+function buildAgentEnvironment(baseEnv, repoToken) {
   const env = stripAgentSecrets({
-    ...process.env,
+    ...baseEnv,
     SKIP_HOOKS: "1",
     HUSKY: "0",
-    CI: process.env.CI ?? "1",
-    // MCP servers are spawned asynchronously by the SDK. With the default
-    // non-blocking behavior, the SDK announces its tool list at session
-    // init while servers are still in `pending`, so their tools never
-    // reach the model. Block until each MCP completes its handshake (or
-    // the timeout below elapses) so the tool list is complete on first
-    // turn.
-    MCP_CONNECTION_NONBLOCKING: process.env.MCP_CONNECTION_NONBLOCKING ?? "false",
-    MCP_TIMEOUT: process.env.MCP_TIMEOUT ?? "60000"
+    CI: baseEnv.CI ?? "1",
+    MCP_CONNECTION_NONBLOCKING: baseEnv.MCP_CONNECTION_NONBLOCKING ?? "false",
+    MCP_TIMEOUT: baseEnv.MCP_TIMEOUT ?? "60000"
   });
+  if (repoToken) {
+    env.GITHUB_TOKEN = repoToken;
+    env.GH_TOKEN = repoToken;
+  }
+  return env;
+}
+async function runAgent(opts) {
+  const ndjsonDir = opts.ndjsonDir ?? agentRunDir(opts.cwd);
+  fs8.mkdirSync(ndjsonDir, { recursive: true });
+  const ndjsonPath = path9.join(ndjsonDir, "last-run.jsonl");
+  const env = buildAgentEnvironment(process.env, opts.repoToken);
   if (opts.litellmUrl) {
     env.ANTHROPIC_BASE_URL = opts.litellmUrl;
     env.ANTHROPIC_API_KEY = getAnthropicApiKeyOrDummy();
@@ -11432,12 +11450,54 @@ var init_composePrompt = __esm({
 });
 
 // src/scripts/postReviewResult.ts
+function words(value) {
+  return value.trim().split(/\s+/).filter(Boolean);
+}
+function removeForbiddenReviewSections(body) {
+  const kept = [];
+  let skipping = false;
+  for (const line of body.split("\n")) {
+    const heading = line.match(/^\s*(?:#{1,6}\s+(.+?)|\*\*(.+?)\*\*)\s*$/);
+    if (heading) {
+      const title = (heading[1] ?? heading[2] ?? "").replace(/[*_`]/g, "").trim();
+      skipping = FORBIDDEN_REVIEW_SECTION.test(title);
+    }
+    if (!skipping) kept.push(line);
+  }
+  return kept.join("\n").replace(/\n{3,}/g, "\n\n").trim();
+}
+function prepareReviewBody(rawBody) {
+  let body = rawBody.trim();
+  const verdict = body.match(/(^|\n)(\s*#{1,6}\s*Verdict\s*:?\s*(?:PASS|CONCERNS|FAIL)\b)/i);
+  if (verdict?.index !== void 0) {
+    body = body.slice(verdict.index + verdict[1].length).trim();
+  }
+  body = removeForbiddenReviewSections(body);
+  const bodyWords = words(body);
+  if (bodyWords.length <= MAX_REVIEW_WORDS) return body;
+  const noteWords = words(REVIEW_TRUNCATION_NOTE);
+  const retainedWordCount = MAX_REVIEW_WORDS - noteWords.length;
+  const matches = [...body.matchAll(/\S+/g)];
+  const retainedEnd = matches[retainedWordCount - 1].index + matches[retainedWordCount - 1][0].length;
+  return `${body.slice(0, retainedEnd).trimEnd()}
+
+${REVIEW_TRUNCATION_NOTE}`;
+}
 function inferVerdictFromReviewText(body) {
   const structuredVerdict = body.match(/"verdict"\s*:\s*"(pass|concerns|fail|partial)"/i);
   if (structuredVerdict) {
     const value = structuredVerdict[1].toUpperCase();
     return value === "PARTIAL" ? "CONCERNS" : value;
   }
+  const status = body.match(
+    /(^|\n)\s*(?:#{1,6}\s*)?(?:\*\*Status:\*\*|Status:)\s*(PASS|CONCERNS|FAIL|WARN|NONE|BLOCK|NEEDS_CONTEXT)\b/i
+  );
+  if (status) {
+    const value = status[2].toUpperCase();
+    if (value === "PASS" || value === "NONE") return "PASS";
+    if (value === "CONCERNS" || value === "WARN") return "CONCERNS";
+    return "FAIL";
+  }
   if (/\bpartial\b/i.test(body) && /\b(finding|gap|unverified|unverifiable|blocker|issue)s?\b/i.test(body)) {
     return "CONCERNS";
   }
@@ -11480,11 +11540,14 @@ function reviewAction(verdict, payload) {
 function failedAction(reason) {
   return { type: "REVIEW_FAILED", payload: { reason }, timestamp: (/* @__PURE__ */ new Date()).toISOString() };
 }
-var postReviewResult;
+var MAX_REVIEW_WORDS, REVIEW_TRUNCATION_NOTE, FORBIDDEN_REVIEW_SECTION, postReviewResult;
 var init_postReviewResult = __esm({
   "src/scripts/postReviewResult.ts"() {
     "use strict";
     init_issue();
+    MAX_REVIEW_WORDS = 600;
+    REVIEW_TRUNCATION_NOTE = "> Review truncated to the highest-priority findings.";
+    FORBIDDEN_REVIEW_SECTION = /^(?:clean\b|strengths?\b|suggest(?:ion|ed)s?\b|follow[- ]?ups?\b|verification\b|notes?\b|nits?\b|non[- ]issues?\b)/i;
     postReviewResult = async (ctx, _profile, agentResult) => {
       const prNumber = ctx.data.commentTargetNumber;
       if (!prNumber) {
@@ -11504,7 +11567,7 @@ var init_postReviewResult = __esm({
         ctx.data.action = failedAction(reason);
         return;
       }
-      const reviewBody = agentResult.finalText.trim();
+      const reviewBody = prepareReviewBody(agentResult.finalText);
       if (!reviewBody) {
         try {
           postPrReviewComment(prNumber, `\u26A0\uFE0F kody review FAILED: agent produced no review body`, ctx.cwd);
@@ -19833,6 +19896,9 @@ function jobReferenceBlock(profileName, profile, data) {
   ];
   return lines.join("\n");
 }
+function shouldPromptForTaskArtifacts(tools) {
+  return tools.some((tool6) => TASK_ARTIFACT_WRITE_TOOLS.has(tool6));
+}
 async function runImplementation(profileName, input) {
   const stageStartedAt = Date.now();
   let finishRunIndex = null;
@@ -19983,6 +20049,7 @@ async function runImplementation(profileName, input) {
       })
     };
   })() : null;
+  const agentTaskArtifacts = taskArtifacts && shouldPromptForTaskArtifacts(profile.claudeCode.tools) ? taskArtifacts : null;
   const ndjsonDir = agentRunDir(input.cwd);
   const agentSlug = typeof profile.agent === "string" && profile.agent.length > 0 ? profile.agent : typeof ctx.data.jobAgent === "string" && ctx.data.jobAgent.length > 0 ? ctx.data.jobAgent : null;
   const agentIdentityBlock = agentSlug ? frameAgentIdentity(agentSlug, loadAgentIdentity(input.cwd, agentSlug)) : null;
@@ -20015,7 +20082,7 @@ async function runImplementation(profileName, input) {
       verbose: input.verbose,
       quiet: input.quiet,
       ndjsonDir,
-      additionalDirectories: taskArtifacts ? [taskArtifacts.absDir] : void 0,
+      additionalDirectories: agentTaskArtifacts ? [agentTaskArtifacts.absDir] : void 0,
       allowedToolsOverride: profile.claudeCode.tools,
       permissionModeOverride: profile.claudeCode.permissionMode,
       mcpServers: profile.claudeCode.mcpServers.length > 0 ? profile.claudeCode.mcpServers : void 0,
@@ -20033,7 +20100,7 @@ async function runImplementation(profileName, input) {
         jobRefBlock,
         jobWhyBlock,
         profile.claudeCode.systemPromptAppend,
-        taskArtifacts?.promptAddendum
+        agentTaskArtifacts?.promptAddendum
       ].filter((s) => typeof s === "string" && s.length > 0).join("\n\n") || void 0,
       cacheable: profile.claudeCode.cacheable,
       enableVerifyTool: profile.claudeCode.enableVerifyTool,
@@ -20690,7 +20757,7 @@ function flattenConfig(obj, prefix = "") {
   }
   return out;
 }
-var MUTATING_POSTFLIGHTS, SHELL_MARKER_RE, MAX_CHAIN_HOPS, DEFAULT_SHELL_TIMEOUT_MS, SIGKILL_GRACE_MS;
+var MUTATING_POSTFLIGHTS, SHELL_MARKER_RE, TASK_ARTIFACT_WRITE_TOOLS, MAX_CHAIN_HOPS, DEFAULT_SHELL_TIMEOUT_MS, SIGKILL_GRACE_MS;
 var init_executor = __esm({
   "src/executor.ts"() {
     "use strict";
@@ -20723,6 +20790,7 @@ var init_executor = __esm({
       "openAgencyModelReviewPr"
     ]);
     SHELL_MARKER_RE = /^KODY_(SKIP_AGENT|PR_URL|REASON|CAPABILITY_REPORT|CAPABILITY_RESULT)=/m;
+    TASK_ARTIFACT_WRITE_TOOLS = /* @__PURE__ */ new Set(["Write", "Edit", "NotebookEdit"]);
     MAX_CHAIN_HOPS = 60;
     DEFAULT_SHELL_TIMEOUT_MS = 3e5;
     SIGKILL_GRACE_MS = 5e3;
@@ -22321,6 +22389,7 @@ async function runChatTurn(opts) {
     ],
     systemPromptAppend: systemPrompt,
     ...opts.reasoningEffort ? { reasoningEffort: opts.reasoningEffort } : {},
+    ...opts.repoToken ? { repoToken: opts.repoToken } : {},
     // Cross-repo work is opt-in. Repo Brain's default path remains focused
     // on the selected repo even though the server stores clones under
     // reposRoot.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kody-ade/kody-engine",
-  "version": "0.4.407",
+  "version": "0.4.409",
   "description": "kody — autonomous development engine. Single-session Claude Code agent behind a generic executor + declarative implementation profiles.",
   "license": "MIT",
   "type": "module",