@kody-ade/kody-engine 0.4.409 → 0.4.410

package/dist/bin/kody.js

@@ -15,7 +15,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "@kody-ade/kody-engine",
-      version: "0.4.409",
+      version: "0.4.410",
       description: "kody \u2014 autonomous development engine. Single-session Claude Code agent behind a generic executor + declarative implementation profiles.",
       license: "MIT",
       type: "module",
@@ -2219,6 +2219,108 @@ var init_convex_client = __esm({
   }
 });
 
+// src/kody-api-client.ts
+import { getFunctionName } from "convex/server";
+function apiUrl(env) {
+  return (env.KODY_API_URL?.trim() || DEFAULT_KODY_API_URL).replace(/\/$/, "");
+}
+function oidcRequestUrl(env) {
+  const raw = env.ACTIONS_ID_TOKEN_REQUEST_URL?.trim();
+  if (!raw) throw new Error("GitHub Actions OIDC request URL is unavailable");
+  const url = new URL(raw);
+  if (url.protocol !== "https:") throw new Error("GitHub Actions OIDC request URL must use HTTPS");
+  url.searchParams.set("audience", OIDC_AUDIENCE);
+  return url;
+}
+function tokenExpiry(token) {
+  try {
+    const payload = JSON.parse(Buffer.from(token.split(".")[1] ?? "", "base64url").toString("utf8"));
+    return typeof payload.exp === "number" ? payload.exp * 1e3 : Date.now() + 4 * 6e4;
+  } catch {
+    return Date.now() + 4 * 6e4;
+  }
+}
+async function githubOidcToken(env, force = false) {
+  if (!force && cachedToken && cachedToken.expiresAt - 6e4 > Date.now()) return cachedToken.value;
+  const requestToken = env.ACTIONS_ID_TOKEN_REQUEST_TOKEN?.trim();
+  if (!requestToken) throw new Error("GitHub Actions OIDC request token is unavailable");
+  const response = await fetch(oidcRequestUrl(env), {
+    headers: { Authorization: `Bearer ${requestToken}` },
+    signal: AbortSignal.timeout(15e3)
+  });
+  if (!response.ok) throw new Error(`GitHub Actions identity request failed (${response.status})`);
+  const body = await response.json();
+  if (typeof body.value !== "string" || !body.value) throw new Error("GitHub Actions identity response was invalid");
+  cachedToken = { value: body.value, expiresAt: tokenExpiry(body.value) };
+  return body.value;
+}
+function operationName(fn) {
+  return getFunctionName(fn).replace(":", ".");
+}
+async function callKodyApi(kind, fn, args, env) {
+  const call = async (forceToken) => {
+    const token = await githubOidcToken(env, forceToken);
+    return fetch(`${apiUrl(env)}/api/kody/engine/backend`, {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${token}`,
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify({ kind, operation: operationName(fn), args }),
+      signal: AbortSignal.timeout(3e4)
+    });
+  };
+  let response = await call(false);
+  if (response.status === 401) response = await call(true);
+  if (!response.ok) throw new Error(`Kody backend request failed (${response.status})`);
+  const body = await response.json();
+  return body.result;
+}
+function hasGitHubActionsIdentity(env = process.env) {
+  return Boolean(
+    env.GITHUB_ACTIONS === "true" && env.ACTIONS_ID_TOKEN_REQUEST_URL?.trim() && env.ACTIONS_ID_TOKEN_REQUEST_TOKEN?.trim()
+  );
+}
+function createKodyApiBackendClient(env = process.env) {
+  if (!hasGitHubActionsIdentity(env)) throw new Error("GitHub Actions workflow identity is unavailable");
+  return {
+    query: (fn, args) => callKodyApi("query", fn, args, env),
+    mutation: (fn, args) => callKodyApi("mutation", fn, args, env)
+  };
+}
+async function readRuntimeSecretFromKody(name, env = process.env) {
+  const token = await githubOidcToken(env);
+  const response = await fetch(`${apiUrl(env)}/api/kody/engine/secret`, {
+    method: "POST",
+    headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json" },
+    body: JSON.stringify({ name }),
+    signal: AbortSignal.timeout(3e4)
+  });
+  if (response.status === 404) return null;
+  if (!response.ok) throw new Error(`Kody secret request failed (${response.status})`);
+  const body = await response.json();
+  return typeof body.value === "string" ? body.value : null;
+}
+async function readPreviewContextFromKody(env = process.env) {
+  const token = await githubOidcToken(env);
+  const response = await fetch(`${apiUrl(env)}/api/kody/engine/preview-context`, {
+    method: "POST",
+    headers: { Authorization: `Bearer ${token}` },
+    signal: AbortSignal.timeout(3e4)
+  });
+  if (!response.ok) throw new Error(`Kody preview context request failed (${response.status})`);
+  return await response.json();
+}
+var DEFAULT_KODY_API_URL, OIDC_AUDIENCE, cachedToken;
+var init_kody_api_client = __esm({
+  "src/kody-api-client.ts"() {
+    "use strict";
+    DEFAULT_KODY_API_URL = "https://kody-dashboard-khaki.vercel.app";
+    OIDC_AUDIENCE = "kody-api";
+    cachedToken = null;
+  }
+});
+
 // src/state-backend.ts
 import { anyApi } from "convex/server";
 function requireTenant(tenantId2) {
@@ -2236,10 +2338,16 @@ function requireNonEmpty(value, name) {
   return normalized;
 }
 function createStateBackendFromEnv(env = process.env, client) {
-  const url = env.CONVEX_URL?.trim();
-  const serviceKey = env.KODY_SERVICE_KEY?.trim();
-  if (!url || !serviceKey) throw new Error("CONVEX_URL and KODY_SERVICE_KEY are required");
-  const transport = client ?? createConvexClientFromEnv(env);
+  let transport = client;
+  if (!transport && hasGitHubActionsIdentity(env)) transport = createKodyApiBackendClient(env);
+  if (!transport) {
+    const url = env.CONVEX_URL?.trim();
+    const serviceKey = env.KODY_SERVICE_KEY?.trim();
+    if (!url || !serviceKey) {
+      throw new Error("GitHub Actions identity or direct Kody backend credentials are required");
+    }
+    transport = createConvexClientFromEnv(env);
+  }
   return {
     async get(tenantId2, taskKey, kind) {
       const result = await transport.query(anyApi.taskState.get, {
@@ -2412,10 +2520,14 @@ function createStateBackendFromEnv(env = process.env, client) {
     }
   };
 }
+function hasStateBackendConfig(env = process.env) {
+  return hasGitHubActionsIdentity(env) || Boolean(env.CONVEX_URL?.trim() && env.KODY_SERVICE_KEY?.trim());
+}
 var init_state_backend = __esm({
   "src/state-backend.ts"() {
     "use strict";
     init_convex_client();
+    init_kody_api_client();
   }
 });
 
@@ -3699,12 +3811,10 @@ function verifyTaskArtifacts(absDir) {
 }
 async function persistTaskArtifactsToState(config, _cwd, artifacts) {
   const tenantId2 = config.github?.owner && config.github.repo ? `${config.github.owner}/${config.github.repo}` : process.env.GITHUB_REPOSITORY?.trim();
-  if (process.env.GITHUB_ACTIONS === "true" && (!process.env.CONVEX_URL || !process.env.KODY_SERVICE_KEY || !tenantId2)) {
-    throw new Error(
-      "Convex artifact backend is required in GitHub Actions (CONVEX_URL, KODY_SERVICE_KEY, and repository identity)"
-    );
+  if (process.env.GITHUB_ACTIONS === "true" && (!hasStateBackendConfig() || !tenantId2)) {
+    throw new Error("Kody backend access and repository identity are required in GitHub Actions");
   }
-  if (process.env.CONVEX_URL && process.env.KODY_SERVICE_KEY && tenantId2) {
+  if (hasStateBackendConfig() && tenantId2) {
     const backend = createStateBackendFromEnv();
     for (const file of TASK_ARTIFACT_FILES) {
       const full = path11.join(artifacts.absDir, file);
@@ -5834,7 +5944,7 @@ var init_loadMemoryContext = __esm({
     loadMemoryContext = async (ctx) => {
       if (typeof ctx.data.memoryContext === "string") return;
       const tenantId2 = ctx.config.github?.owner && ctx.config.github.repo ? `${ctx.config.github.owner}/${ctx.config.github.repo}` : process.env.GITHUB_REPOSITORY?.trim();
-      if (process.env.CONVEX_URL && process.env.KODY_SERVICE_KEY && tenantId2) {
+      if (hasStateBackendConfig() && tenantId2) {
         try {
           const backend = createStateBackendFromEnv();
           const docs = await backend.listRepoDocs(tenantId2, "memory:");
@@ -9535,7 +9645,7 @@ function subjectCandidates(kind, id, state) {
   return [...ids].map((candidate) => ({ kind, id: candidate }));
 }
 async function firstTrustOverride(ctx, subjects) {
-  const backendConfigured = Boolean(process.env.CONVEX_URL?.trim() && process.env.KODY_SERVICE_KEY?.trim());
+  const backendConfigured = hasStateBackendConfig();
   if (!backendConfigured) return null;
   const repoSlug = ctx.config.github?.owner && ctx.config.github?.repo ? `${ctx.config.github.owner}/${ctx.config.github.repo}` : "";
   for (const subject of subjects) {
@@ -9751,6 +9861,7 @@ var init_advanceManagedGoal = __esm({
     init_typeDefinitions();
     init_issue();
     init_registry();
+    init_state_backend();
     init_trustPolicy();
     init_workflowDefinitions();
     init_goalCapabilityScheduling();
@@ -10048,12 +10159,12 @@ function resolveTrigger(force) {
 }
 async function appendActivity(ctx, record2) {
   const tenantId2 = ctx.config.github?.owner && ctx.config.github.repo ? `${ctx.config.github.owner}/${ctx.config.github.repo}` : process.env.GITHUB_REPOSITORY;
-  if (process.env.CONVEX_URL?.trim() && process.env.KODY_SERVICE_KEY?.trim() && tenantId2) {
+  if (hasStateBackendConfig() && tenantId2) {
     await createStateBackendFromEnv().appendDailyLog(tenantId2, "activity", record2.ts.slice(0, 10), record2);
     return;
   }
   if (process.env.GITHUB_ACTIONS === "true") {
-    throw new Error("Convex backend is required for company activity in GitHub Actions");
+    throw new Error("Kody backend access is required for company activity in GitHub Actions");
   }
 }
 var appendCompanyActivity;
@@ -14773,6 +14884,18 @@ function envSecret(name, env) {
 }
 async function resolveRuntimeSecret(name, ctx, opts = {}) {
   const env = opts.env ?? process.env;
+  if (hasGitHubActionsIdentity(env)) {
+    try {
+      const value = await readRuntimeSecretFromKody(name, env);
+      return value ? { value, source: "vault" } : envSecret(name, env);
+    } catch (err) {
+      const fallback = envSecret(name, env);
+      return {
+        ...fallback,
+        warning: `Kody secret read failed for ${name}: ${err instanceof Error ? err.message : String(err)}`
+      };
+    }
+  }
   const masterRaw = env.KODY_MASTER_KEY?.trim() ?? "";
   if (!masterRaw || !env.CONVEX_URL?.trim() || !env.KODY_SERVICE_KEY?.trim()) return envSecret(name, env);
   try {
@@ -14800,6 +14923,7 @@ var init_runtimeSecrets = __esm({
   "src/scripts/runtimeSecrets.ts"() {
     "use strict";
     init_backendVault();
+    init_kody_api_client();
     init_keys();
   }
 });
@@ -16618,7 +16742,7 @@ var init_publishReport = __esm({
       });
       const runId = generatedAt.replace(/\.\d{3}Z$/, "Z").replace(/:/g, "-");
       const tenantId2 = ctx.config.github?.owner && ctx.config.github.repo ? `${ctx.config.github.owner}/${ctx.config.github.repo}` : process.env.GITHUB_REPOSITORY;
-      if (process.env.CONVEX_URL?.trim() && process.env.KODY_SERVICE_KEY?.trim() && tenantId2) {
+      if (hasStateBackendConfig() && tenantId2) {
         await createStateBackendFromEnv().saveReport(
           tenantId2,
           slug,
@@ -16634,7 +16758,7 @@ var init_publishReport = __esm({
           generatedAt
         );
       } else if (process.env.GITHUB_ACTIONS === "true") {
-        throw new Error("Convex backend is required for reports in GitHub Actions");
+        throw new Error("Kody backend access is required for reports in GitHub Actions");
       }
     };
   }
@@ -17447,53 +17571,14 @@ function basePreviewAppName(repo) {
   }
   return `kp-${shortHash(owner)}-${shortHash(name)}-base`;
 }
-function decryptVaultPayload(payload, keyRaw) {
-  const parts = payload.split(":");
-  if (parts.length !== 4 || parts[0] !== "v1") {
-    throw new Error("invalid vault payload format");
-  }
-  const [, ivB64, ctB64, tagB64] = parts;
-  const key = decodeMasterKey(keyRaw);
-  if (key.length !== 32) {
-    throw new Error("KODY_MASTER_KEY must decode to 32 bytes");
-  }
-  const iv = Buffer.from(ivB64, "base64");
-  const ct = Buffer.from(ctB64, "base64");
-  const tag = Buffer.from(tagB64, "base64");
-  const decipher = createDecipheriv2("aes-256-gcm", key, iv);
-  decipher.setAuthTag(tag);
-  return Buffer.concat([decipher.update(ct), decipher.final()]).toString("utf8");
-}
-function decodeMasterKey(keyRaw) {
-  if (/^[0-9a-fA-F]{64}$/.test(keyRaw)) return Buffer.from(keyRaw, "hex");
-  return Buffer.from(keyRaw.replace(/-/g, "+").replace(/_/g, "/"), "base64");
-}
-function derivePreviewVerifyKey(masterKeyRaw) {
-  const masterKey = decodeMasterKey(masterKeyRaw);
-  if (masterKey.length !== 32) {
-    throw new Error("KODY_MASTER_KEY must decode to 32 bytes");
-  }
-  return Buffer.from(hkdfSync2("sha256", masterKey, Buffer.alloc(0), PREVIEW_KEY_INFO, 32)).toString("hex");
-}
 function previewRuntimeEnv(args) {
   return {
     ...args.buildEnv,
-    KODY_PREVIEW_VERIFY_KEY: derivePreviewVerifyKey(args.masterKey),
+    KODY_PREVIEW_VERIFY_KEY: args.previewVerifyKey,
     KODY_REPO_CONTEXT: args.repo,
     KODY_PR: String(args.pr)
   };
 }
-function buildEnvFromVault(doc) {
-  const buildEnv = {};
-  for (const [name, entry] of Object.entries(doc.secrets ?? {})) {
-    if (!entry?.value) continue;
-    if (NEVER_PASS_TO_BUILD.has(name)) continue;
-    buildEnv[name] = entry.value;
-  }
-  const raw = doc.secrets?.KODY_PREVIEW_BUILD_MODE?.value;
-  const buildMode = raw?.toLowerCase().trim() === "dev" ? "dev" : "prod";
-  return { buildEnv, buildMode };
-}
 function formatPreviewComment(args) {
   return [
     "<!-- kody-fly-preview -->",
@@ -17505,23 +17590,9 @@ function formatPreviewComment(args) {
 function defaultImageTag(repo, ref) {
   return createHash4("sha256").update(`${repo}@${ref}`).digest("hex").slice(0, 12);
 }
-var NEVER_PASS_TO_BUILD, PREVIEW_KEY_INFO;
 var init_previewBuildHelpers = __esm({
   "src/scripts/previewBuildHelpers.ts"() {
     "use strict";
-    NEVER_PASS_TO_BUILD = /* @__PURE__ */ new Set([
-      "FLY_API_TOKEN",
-      "FLY_ORG_SLUG",
-      "FLY_DEFAULT_REGION",
-      "KODY_MASTER_KEY",
-      // Preview-config knob; consumed by the dispatcher before spawn.
-      "KODY_PREVIEW_BUILD_MODE",
-      "KODY_PREVIEW_VERIFY_KEY",
-      "KODY_REPO_CONTEXT",
-      "KODY_PR",
-      "KODY_BRANCH"
-    ]);
-    PREVIEW_KEY_INFO = "kody-preview:v1";
   }
 });
 
@@ -17630,16 +17701,6 @@ function flyHeaders(token) {
     "Content-Type": "application/json"
   };
 }
-async function fetchVaultDoc(repo, masterKey) {
-  const [owner, name] = repo.split("/", 2);
-  if (!owner || !name) throw new Error(`invalid GITHUB_REPOSITORY "${repo}"`);
-  const record2 = await createStateBackendFromEnv().getRepoDoc(`${owner}/${name}`, "secrets.enc");
-  const raw = record2?.doc;
-  const payload = raw && typeof raw === "object" && !Array.isArray(raw) && typeof raw.ciphertext === "string" ? raw.ciphertext : "";
-  if (!payload) throw new Error("backend vault is empty \u2014 save secrets from the dashboard first");
-  const plaintext = decryptVaultPayload(payload, masterKey);
-  return JSON.parse(plaintext);
-}
 async function flyAppExists(name, token) {
   const res = await fetch(`${FLY_MACHINES}/apps/${encodeURIComponent(name)}`, {
     headers: flyHeaders(token),
@@ -17814,7 +17875,7 @@ var FLY_MACHINES, FLY_GRAPHQL, REQ_TIMEOUT_MS2, runPreviewBuild;
 var init_runPreviewBuild = __esm({
   "src/scripts/runPreviewBuild.ts"() {
     "use strict";
-    init_state_backend();
+    init_kody_api_client();
     init_previewBuildHelpers();
     init_previewBuildNamespace();
     init_previewBuildRun();
@@ -17831,12 +17892,10 @@ var init_runPreviewBuild = __esm({
       }
       let repo;
       let ref;
-      let masterKey;
       let ghToken3;
       try {
         repo = required("GITHUB_REPOSITORY");
         ref = required("GITHUB_SHA");
-        masterKey = required("KODY_MASTER_KEY");
         ghToken3 = (process.env.KODY_TOKEN ?? process.env.GH_TOKEN ?? process.env.GITHUB_TOKEN ?? process.env.GH_PAT ?? "").trim();
         if (!ghToken3) {
           throw new Error("GitHub auth token missing (KODY_TOKEN / GH_TOKEN / GITHUB_TOKEN / GH_PAT all empty)");
@@ -17850,17 +17909,17 @@ var init_runPreviewBuild = __esm({
       const appName = previewAppName(repo, pr);
       const tag = defaultImageTag(repo, ref);
       try {
-        const doc = await fetchVaultDoc(repo, masterKey);
-        const { buildEnv, buildMode } = buildEnvFromVault(doc);
-        const flyToken = doc.secrets?.FLY_API_TOKEN?.value?.trim();
+        const previewContext = await readPreviewContextFromKody();
+        const { buildEnv, buildMode } = previewContext;
+        const flyToken = previewContext.flyApiToken?.trim();
         if (!flyToken) {
           ctx.output.exitCode = 99;
           ctx.output.reason = "runPreviewBuild: vault has no FLY_API_TOKEN \u2014 add it via the dashboard's /secrets page";
           return;
         }
-        const orgSlug = doc.secrets?.FLY_ORG_SLUG?.value?.trim() || (process.env.FLY_ORG_SLUG ?? "personal").trim();
-        const region = doc.secrets?.FLY_DEFAULT_REGION?.value?.trim() || (process.env.FLY_REGION ?? "fra").trim();
-        const nscTenantId = doc.secrets?.NSC_TENANT_ID?.value?.trim() || "";
+        const orgSlug = previewContext.flyOrgSlug?.trim() || (process.env.FLY_ORG_SLUG ?? "personal").trim();
+        const region = previewContext.flyRegion?.trim() || (process.env.FLY_REGION ?? "fra").trim();
+        const nscTenantId = previewContext.namespaceTenantId?.trim() || "";
         console.log(`[preview-build] vault: ${Object.keys(buildEnv).length} secrets, mode=${buildMode}`);
         if (Object.keys(buildEnv).length > 0) {
           const lines = Object.entries(buildEnv).map(([k, v]) => `${k}=${JSON.stringify(v)}`);
@@ -17942,7 +18001,7 @@ var init_runPreviewBuild = __esm({
             appName,
             region,
             image: `registry.fly.io/${appName}:${tag}`,
-            env: previewRuntimeEnv({ buildEnv, masterKey, pr, repo })
+            env: previewRuntimeEnv({ buildEnv, previewVerifyKey: previewContext.previewVerifyKey, pr, repo })
           },
           flyToken
         );
@@ -19725,10 +19784,10 @@ async function hydrateWorkflows(backend, tenant, cwd) {
 }
 async function hydrateStateWorkspace(config, cwd, backendOverride) {
   const tenant = tenantId(config);
-  const configured = Boolean(process.env.CONVEX_URL?.trim()) && Boolean(process.env.KODY_SERVICE_KEY?.trim());
+  const configured = hasStateBackendConfig();
   if (!tenant || !configured) {
     if (process.env.GITHUB_ACTIONS === "true")
-      throw new Error("Convex backend is required for runtime workspace documents");
+      throw new Error("Kody backend access is required for runtime workspace documents");
     return;
   }
   const key = `${path43.resolve(cwd)}|${tenant}`;
@@ -24353,12 +24412,12 @@ var BrokerSink = class {
     const be = translateChatEvent(event, this.chatId);
     if (!be) return;
     this.emitToLog(be);
-    if (this.tenantId && hasStateBackendConfig()) {
+    if (this.tenantId && hasStateBackendConfig2()) {
       await createStateBackendFromEnv().appendChatEvent(this.tenantId, this.chatId, be);
     }
   }
 };
-function hasStateBackendConfig(env = process.env) {
+function hasStateBackendConfig2(env = process.env) {
   return Boolean(env.CONVEX_URL?.trim() && env.KODY_SERVICE_KEY?.trim());
 }
 var chatQueues = /* @__PURE__ */ new Map();
@@ -25623,10 +25682,9 @@ async function hydrateDefinitions(options) {
 }
 async function hydrateDefinitionsFromEnv(cwd = process.cwd(), env = process.env) {
   const tenantId2 = env.GITHUB_REPOSITORY?.trim();
-  const hasCredentials = Boolean(env.CONVEX_URL?.trim()) && Boolean(env.KODY_SERVICE_KEY?.trim());
-  if (!hasCredentials) {
+  if (!hasStateBackendConfig(env)) {
     if (env.GITHUB_ACTIONS === "true") {
-      throw new Error("CONVEX_URL and KODY_SERVICE_KEY are required for backend definitions in GitHub Actions");
+      throw new Error("GitHub Actions workflow identity is required for backend definitions");
     }
     return null;
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kody-ade/kody-engine",
-  "version": "0.4.409",
+  "version": "0.4.410",
   "description": "kody — autonomous development engine. Single-session Claude Code agent behind a generic executor + declarative implementation profiles.",
   "license": "MIT",
   "type": "module",