npm - @kody-ade/kody-engine - Versions diffs - 0.4.409 → 0.4.411 - Mend

@kody-ade/kody-engine 0.4.409 → 0.4.411

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (3) hide show

package/dist/bin/kody.js CHANGED Viewed

@@ -15,7 +15,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "@kody-ade/kody-engine",
-      version: "0.4.409",
+      version: "0.4.411",
       description: "kody \u2014 autonomous development engine. Single-session Claude Code agent behind a generic executor + declarative implementation profiles.",
       license: "MIT",
       type: "module",
@@ -746,7 +746,7 @@ function buildVerifyEnv(source = process.env) {
   return env;
 }
 function runCommand(command, cwd) {
-  return new Promise((resolve16) => {
+  return new Promise((resolve17) => {
     const start = Date.now();
     const child = spawn(command, {
       cwd,
@@ -775,11 +775,11 @@ function runCommand(command, cwd) {
     child.on("exit", (code) => {
       clearTimeout(timer);
       const tail = Buffer.concat(buffers).toString("utf-8").slice(-TAIL_CHARS);
-      resolve16({ exitCode: code ?? -1, durationMs: Date.now() - start, tail });
+      resolve17({ exitCode: code ?? -1, durationMs: Date.now() - start, tail });
     });
     child.on("error", (err) => {
       clearTimeout(timer);
-      resolve16({ exitCode: -1, durationMs: Date.now() - start, tail: err.message });
+      resolve17({ exitCode: -1, durationMs: Date.now() - start, tail: err.message });
     });
   });
 }
@@ -1088,7 +1088,7 @@ function cmsHeaders(opts) {
     }
   };
 }
-async function callDashboardCms(opts, path51, init = {}) {
+async function callDashboardCms(opts, path52, init = {}) {
   const baseUrl = dashboardBaseUrl(opts);
   if (!baseUrl) {
     return {
@@ -1100,7 +1100,7 @@ async function callDashboardCms(opts, path51, init = {}) {
   const headerResult = cmsHeaders(opts);
   if (!headerResult.ok) return headerResult;
   try {
-    const res = await fetch(`${baseUrl}${path51}`, {
+    const res = await fetch(`${baseUrl}${path52}`, {
       ...init,
       headers: {
         ...headerResult.headers,
@@ -1172,8 +1172,8 @@ function documentArg(value) {
 function normalizeCmsDocumentIdInput(input) {
   const trimmed = stripWrappingQuotes(input.trim());
   const withoutQuery = trimmed.split(/[?#]/, 1)[0] ?? trimmed;
-  const path51 = parseDocumentPath(withoutQuery);
-  return path51 ?? parseDocumentIdSegment(withoutQuery) ?? withoutQuery;
+  const path52 = parseDocumentPath(withoutQuery);
+  return path52 ?? parseDocumentIdSegment(withoutQuery) ?? withoutQuery;
 }
 function stripWrappingQuotes(value) {
   let current = value;
@@ -1184,9 +1184,9 @@ function stripWrappingQuotes(value) {
   }
 }
 function parseDocumentPath(value) {
-  const path51 = value.startsWith("http://") || value.startsWith("https://") ? urlPathname(value) : value;
-  if (!path51?.includes("/content/entries/")) return null;
-  const parts = path51.split("/").filter(Boolean).map(decodePathPart);
+  const path52 = value.startsWith("http://") || value.startsWith("https://") ? urlPathname(value) : value;
+  if (!path52?.includes("/content/entries/")) return null;
+  const parts = path52.split("/").filter(Boolean).map(decodePathPart);
   const entriesIndex = parts.findIndex((part, index) => part === "content" && parts[index + 1] === "entries");
   const idPart = parts[entriesIndex + 3];
   if (!idPart || idPart === "new") return null;
@@ -2219,6 +2219,108 @@ var init_convex_client = __esm({
   }
 });
+// src/kody-api-client.ts
+import { getFunctionName } from "convex/server";
+function apiUrl(env) {
+  return (env.KODY_API_URL?.trim() || DEFAULT_KODY_API_URL).replace(/\/$/, "");
+}
+function oidcRequestUrl(env) {
+  const raw = env.ACTIONS_ID_TOKEN_REQUEST_URL?.trim();
+  if (!raw) throw new Error("GitHub Actions OIDC request URL is unavailable");
+  const url = new URL(raw);
+  if (url.protocol !== "https:") throw new Error("GitHub Actions OIDC request URL must use HTTPS");
+  url.searchParams.set("audience", OIDC_AUDIENCE);
+  return url;
+}
+function tokenExpiry(token) {
+  try {
+    const payload = JSON.parse(Buffer.from(token.split(".")[1] ?? "", "base64url").toString("utf8"));
+    return typeof payload.exp === "number" ? payload.exp * 1e3 : Date.now() + 4 * 6e4;
+  } catch {
+    return Date.now() + 4 * 6e4;
+  }
+}
+async function githubOidcToken(env, force = false) {
+  if (!force && cachedToken && cachedToken.expiresAt - 6e4 > Date.now()) return cachedToken.value;
+  const requestToken = env.ACTIONS_ID_TOKEN_REQUEST_TOKEN?.trim();
+  if (!requestToken) throw new Error("GitHub Actions OIDC request token is unavailable");
+  const response = await fetch(oidcRequestUrl(env), {
+    headers: { Authorization: `Bearer ${requestToken}` },
+    signal: AbortSignal.timeout(15e3)
+  });
+  if (!response.ok) throw new Error(`GitHub Actions identity request failed (${response.status})`);
+  const body = await response.json();
+  if (typeof body.value !== "string" || !body.value) throw new Error("GitHub Actions identity response was invalid");
+  cachedToken = { value: body.value, expiresAt: tokenExpiry(body.value) };
+  return body.value;
+}
+function operationName(fn) {
+  return getFunctionName(fn).replace(":", ".");
+}
+async function callKodyApi(kind, fn, args, env) {
+  const call = async (forceToken) => {
+    const token = await githubOidcToken(env, forceToken);
+    return fetch(`${apiUrl(env)}/api/kody/engine/backend`, {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${token}`,
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify({ kind, operation: operationName(fn), args }),
+      signal: AbortSignal.timeout(3e4)
+    });
+  };
+  let response = await call(false);
+  if (response.status === 401) response = await call(true);
+  if (!response.ok) throw new Error(`Kody backend request failed (${response.status})`);
+  const body = await response.json();
+  return body.result;
+}
+function hasGitHubActionsIdentity(env = process.env) {
+  return Boolean(
+    env.GITHUB_ACTIONS === "true" && env.ACTIONS_ID_TOKEN_REQUEST_URL?.trim() && env.ACTIONS_ID_TOKEN_REQUEST_TOKEN?.trim()
+  );
+}
+function createKodyApiBackendClient(env = process.env) {
+  if (!hasGitHubActionsIdentity(env)) throw new Error("GitHub Actions workflow identity is unavailable");
+  return {
+    query: (fn, args) => callKodyApi("query", fn, args, env),
+    mutation: (fn, args) => callKodyApi("mutation", fn, args, env)
+  };
+}
+async function readRuntimeSecretFromKody(name, env = process.env) {
+  const token = await githubOidcToken(env);
+  const response = await fetch(`${apiUrl(env)}/api/kody/engine/secret`, {
+    method: "POST",
+    headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json" },
+    body: JSON.stringify({ name }),
+    signal: AbortSignal.timeout(3e4)
+  });
+  if (response.status === 404) return null;
+  if (!response.ok) throw new Error(`Kody secret request failed (${response.status})`);
+  const body = await response.json();
+  return typeof body.value === "string" ? body.value : null;
+}
+async function readPreviewContextFromKody(env = process.env) {
+  const token = await githubOidcToken(env);
+  const response = await fetch(`${apiUrl(env)}/api/kody/engine/preview-context`, {
+    method: "POST",
+    headers: { Authorization: `Bearer ${token}` },
+    signal: AbortSignal.timeout(3e4)
+  });
+  if (!response.ok) throw new Error(`Kody preview context request failed (${response.status})`);
+  return await response.json();
+}
+var DEFAULT_KODY_API_URL, OIDC_AUDIENCE, cachedToken;
+var init_kody_api_client = __esm({
+  "src/kody-api-client.ts"() {
+    "use strict";
+    DEFAULT_KODY_API_URL = "https://kody-dashboard-khaki.vercel.app";
+    OIDC_AUDIENCE = "kody-api";
+    cachedToken = null;
+  }
+});
 // src/state-backend.ts
 import { anyApi } from "convex/server";
 function requireTenant(tenantId2) {
@@ -2236,10 +2338,16 @@ function requireNonEmpty(value, name) {
   return normalized;
 }
 function createStateBackendFromEnv(env = process.env, client) {
-  const url = env.CONVEX_URL?.trim();
-  const serviceKey = env.KODY_SERVICE_KEY?.trim();
-  if (!url || !serviceKey) throw new Error("CONVEX_URL and KODY_SERVICE_KEY are required");
-  const transport = client ?? createConvexClientFromEnv(env);
+  let transport = client;
+  if (!transport && hasGitHubActionsIdentity(env)) transport = createKodyApiBackendClient(env);
+  if (!transport) {
+    const url = env.CONVEX_URL?.trim();
+    const serviceKey = env.KODY_SERVICE_KEY?.trim();
+    if (!url || !serviceKey) {
+      throw new Error("GitHub Actions identity or direct Kody backend credentials are required");
+    }
+    transport = createConvexClientFromEnv(env);
+  }
   return {
     async get(tenantId2, taskKey, kind) {
       const result = await transport.query(anyApi.taskState.get, {
@@ -2412,10 +2520,14 @@ function createStateBackendFromEnv(env = process.env, client) {
     }
   };
 }
+function hasStateBackendConfig(env = process.env) {
+  return hasGitHubActionsIdentity(env) || Boolean(env.CONVEX_URL?.trim() && env.KODY_SERVICE_KEY?.trim());
+}
 var init_state_backend = __esm({
   "src/state-backend.ts"() {
     "use strict";
     init_convex_client();
+    init_kody_api_client();
   }
 });
@@ -3041,7 +3153,7 @@ var init_repoWorkspace = __esm({
     defaultCloneRepo = (repo, token, dir) => {
       fs7.mkdirSync(path8.dirname(dir), { recursive: true });
       const clone = buildCloneProcess(repo, token);
-      return new Promise((resolve16, reject) => {
+      return new Promise((resolve17, reject) => {
         const child = spawn2("git", ["clone", "--depth=1", clone.url, dir], {
           env: clone.env,
           stdio: "inherit"
@@ -3061,7 +3173,7 @@ var init_repoWorkspace = __esm({
             }
           } catch {
           }
-          resolve16();
+          resolve17();
         });
         child.on("error", reject);
       });
@@ -3372,10 +3484,10 @@ async function runAgent(opts) {
         let timer;
         let next;
         if (turnTimeoutMs > 0) {
-          const timeoutPromise = new Promise((resolve16) => {
+          const timeoutPromise = new Promise((resolve17) => {
             timer = setTimeout(() => {
               timedOut = true;
-              resolve16({ done: true, value: void 0 });
+              resolve17({ done: true, value: void 0 });
             }, turnTimeoutMs);
           });
           next = await Promise.race([nextPromise, timeoutPromise]);
@@ -3391,7 +3503,7 @@ async function runAgent(opts) {
             try {
               await Promise.race([
                 iterator.return(void 0).catch(() => void 0),
-                new Promise((resolve16) => setTimeout(resolve16, 1e4).unref())
+                new Promise((resolve17) => setTimeout(resolve17, 1e4).unref())
               ]);
             } catch {
             }
@@ -3657,7 +3769,7 @@ function prepareTaskArtifactsDir(cwd, taskId) {
 function initializeTaskArtifacts(artifacts, metadata = { taskType: "job" }) {
   const startedAt = (/* @__PURE__ */ new Date()).toISOString();
   const defaults = {
-    "context.json": JSON.stringify(
+    "context.json": `${JSON.stringify(
       {
         taskId: artifacts.taskId,
         taskType: metadata.taskType,
@@ -3674,7 +3786,8 @@ function initializeTaskArtifacts(artifacts, metadata = { taskType: "job" }) {
       },
       null,
       2
-    ) + "\n",
+    )}
+`,
     "memory-recs.json": "[]\n",
     "followups.json": "[]\n",
     "handoff-notes.md": "Baseline handoff: the agent did not provide additional notes.\n"
@@ -3699,12 +3812,10 @@ function verifyTaskArtifacts(absDir) {
 }
 async function persistTaskArtifactsToState(config, _cwd, artifacts) {
   const tenantId2 = config.github?.owner && config.github.repo ? `${config.github.owner}/${config.github.repo}` : process.env.GITHUB_REPOSITORY?.trim();
-  if (process.env.GITHUB_ACTIONS === "true" && (!process.env.CONVEX_URL || !process.env.KODY_SERVICE_KEY || !tenantId2)) {
-    throw new Error(
-      "Convex artifact backend is required in GitHub Actions (CONVEX_URL, KODY_SERVICE_KEY, and repository identity)"
-    );
+  if (process.env.GITHUB_ACTIONS === "true" && (!hasStateBackendConfig() || !tenantId2)) {
+    throw new Error("Kody backend access and repository identity are required in GitHub Actions");
   }
-  if (process.env.CONVEX_URL && process.env.KODY_SERVICE_KEY && tenantId2) {
+  if (hasStateBackendConfig() && tenantId2) {
     const backend = createStateBackendFromEnv();
     for (const file of TASK_ARTIFACT_FILES) {
       const full = path11.join(artifacts.absDir, file);
@@ -5834,7 +5945,7 @@ var init_loadMemoryContext = __esm({
     loadMemoryContext = async (ctx) => {
       if (typeof ctx.data.memoryContext === "string") return;
       const tenantId2 = ctx.config.github?.owner && ctx.config.github.repo ? `${ctx.config.github.owner}/${ctx.config.github.repo}` : process.env.GITHUB_REPOSITORY?.trim();
-      if (process.env.CONVEX_URL && process.env.KODY_SERVICE_KEY && tenantId2) {
+      if (hasStateBackendConfig() && tenantId2) {
         try {
           const backend = createStateBackendFromEnv();
           const docs = await backend.listRepoDocs(tenantId2, "memory:");
@@ -6559,11 +6670,11 @@ async function nextAvailableLitellmUrl(url) {
   throw new Error(`no free LiteLLM port found after ${startPort}`);
 }
 function canListen(port, host) {
-  return new Promise((resolve16) => {
+  return new Promise((resolve17) => {
     const server = net.createServer();
-    server.once("error", () => resolve16(false));
+    server.once("error", () => resolve17(false));
     server.once("listening", () => {
-      server.close(() => resolve16(true));
+      server.close(() => resolve17(true));
     });
     server.listen(port, host);
   });
@@ -7724,9 +7835,9 @@ import * as fs26 from "fs";
 function stageGoalRunLogEvent(data, goalId, event, at = nowIso()) {
   const logs = goalRunLogs(data);
   const existing = logs[goalId];
-  const path51 = existing?.path ?? goalRunLogPath(goalId, data);
+  const path52 = existing?.path ?? goalRunLogPath(goalId, data);
   logs[goalId] = {
-    path: path51,
+    path: path52,
     events: [...existing?.events ?? [], buildGoalRunLogEvent(data, goalId, event, at)]
   };
 }
@@ -7851,7 +7962,7 @@ function buildGoalRunLogEvent(data, goalId, event, at) {
   if (context !== void 0) base.dispatchContext = context;
   return base;
 }
-function enrichGoalRunLogEvent(config, data, logPath, event) {
+function enrichGoalRunLogEvent(config, data, _logPath, event) {
   const trigger = event.trigger ?? triggerContext();
   const job = event.job ?? jobContext(data);
   const run = event.run ?? runContext(data);
@@ -8142,7 +8253,7 @@ function backendTenant(config) {
   return owner && repo ? `${owner}/${repo}` : null;
 }
 function decodeGoal(doc) {
-  if (!doc || !doc.state || typeof doc.state !== "object" || Array.isArray(doc.state)) return null;
+  if (!doc?.state || typeof doc.state !== "object" || Array.isArray(doc.state)) return null;
   const state = doc.state;
   if (typeof state.state !== "string" || !state.extra || typeof state.extra !== "object") return null;
   return state;
@@ -8699,11 +8810,11 @@ function validateWorkflow(value, options = {}) {
 function formatWorkflowValidationIssues(issues) {
   return issues.map((entry) => `${entry.path}: ${entry.message}`);
 }
-function validateDataMatch(value, path51, issues, capabilityOutputs) {
+function validateDataMatch(value, path52, issues, capabilityOutputs) {
   if (value === void 0) return;
   const match = asRecord2(value);
   if (!match || Object.keys(match).length === 0) {
-    issue(issues, "invalid_condition", path51, "workflow condition must contain at least one match");
+    issue(issues, "invalid_condition", path52, "workflow condition must contain at least one match");
     return;
   }
   for (const [field, expected] of Object.entries(match)) {
@@ -8711,7 +8822,7 @@ function validateDataMatch(value, path51, issues, capabilityOutputs) {
       issue(
         issues,
         "invalid_data_path",
-        `${path51}.${field}`,
+        `${path52}.${field}`,
         `workflow condition must read from facts, evidence, artifacts, result, workflow, or lastOutcome`
       );
     }
@@ -8719,12 +8830,12 @@ function validateDataMatch(value, path51, issues, capabilityOutputs) {
       issue(
         issues,
         "undeclared_result_path",
-        `${path51}.${field}`,
+        `${path52}.${field}`,
         `workflow condition reads ${field}, but the source capability does not declare it`
       );
     }
     if (!isComparable(expected)) {
-      issue(issues, "invalid_condition_value", `${path51}.${field}`, "workflow condition value must be a JSON scalar");
+      issue(issues, "invalid_condition_value", `${path52}.${field}`, "workflow condition value must be a JSON scalar");
     }
   }
 }
@@ -8742,8 +8853,8 @@ function isComparable(value) {
   if (value === null || ["string", "number", "boolean"].includes(typeof value)) return true;
   return Array.isArray(value) && value.length > 0 && value.every((item) => isComparable(item) && !Array.isArray(item));
 }
-function issue(issues, code, path51, message) {
-  issues.push({ code, path: path51, message });
+function issue(issues, code, path52, message) {
+  issues.push({ code, path: path52, message });
 }
 var SAFE_NAME, SAFE_STEP_ID, SAFE_DATA_PATH, SUPPORTED_STEP_FIELDS, SUPPORTED_TRANSITION_FIELDS;
 var init_workflowValidation = __esm({
@@ -9001,15 +9112,15 @@ var init_backendStateBackend = __esm({
         this.jobsDir = opts.jobsDir.replace(/\/+$/, "");
       }
       async load(slug) {
-        const path51 = stateFilePath(this.jobsDir, slug);
+        const path52 = stateFilePath(this.jobsDir, slug);
         const loaded = await createStateBackendFromEnv().get(this.tenantId, `capabilities/${slug}`, "job-state");
         if (!loaded) {
-          return { path: path51, handle: null, state: initialStateEnvelope("seed"), created: true };
+          return { path: path52, handle: null, state: initialStateEnvelope("seed"), created: true };
         }
         if (!isStateEnvelope(loaded.doc)) {
           throw new Error(`BackendStateBackend: capabilities/${slug} is not a StateEnvelope`);
         }
-        return { path: path51, handle: loaded.updatedAt, state: loaded.doc, created: false };
+        return { path: path52, handle: loaded.updatedAt, state: loaded.doc, created: false };
       }
       async save(loaded, next) {
         if (!loaded.created && isStateUnchanged(loaded.state, next)) return false;
@@ -9535,7 +9646,7 @@ function subjectCandidates(kind, id, state) {
   return [...ids].map((candidate) => ({ kind, id: candidate }));
 }
 async function firstTrustOverride(ctx, subjects) {
-  const backendConfigured = Boolean(process.env.CONVEX_URL?.trim() && process.env.KODY_SERVICE_KEY?.trim());
+  const backendConfigured = hasStateBackendConfig();
   if (!backendConfigured) return null;
   const repoSlug = ctx.config.github?.owner && ctx.config.github?.repo ? `${ctx.config.github.owner}/${ctx.config.github.repo}` : "";
   for (const subject of subjects) {
@@ -9751,6 +9862,7 @@ var init_advanceManagedGoal = __esm({
     init_typeDefinitions();
     init_issue();
     init_registry();
+    init_state_backend();
     init_trustPolicy();
     init_workflowDefinitions();
     init_goalCapabilityScheduling();
@@ -10048,12 +10160,12 @@ function resolveTrigger(force) {
 }
 async function appendActivity(ctx, record2) {
   const tenantId2 = ctx.config.github?.owner && ctx.config.github.repo ? `${ctx.config.github.owner}/${ctx.config.github.repo}` : process.env.GITHUB_REPOSITORY;
-  if (process.env.CONVEX_URL?.trim() && process.env.KODY_SERVICE_KEY?.trim() && tenantId2) {
+  if (hasStateBackendConfig() && tenantId2) {
     await createStateBackendFromEnv().appendDailyLog(tenantId2, "activity", record2.ts.slice(0, 10), record2);
     return;
   }
   if (process.env.GITHUB_ACTIONS === "true") {
-    throw new Error("Convex backend is required for company activity in GitHub Actions");
+    throw new Error("Kody backend access is required for company activity in GitHub Actions");
   }
 }
 var appendCompanyActivity;
@@ -13804,14 +13916,33 @@ var init_fixFlow = __esm({
   }
 });
-// src/scripts/initFlow.ts
-import { execFileSync as execFileSync14 } from "child_process";
+// src/workflow-template.ts
 import * as fs35 from "fs";
 import * as path33 from "path";
+import { fileURLToPath } from "url";
+function loadKodyWorkflowTemplate() {
+  const here = path33.dirname(fileURLToPath(import.meta.url));
+  const candidates = [path33.resolve(here, "../templates/kody.yml"), path33.resolve(here, "../../templates/kody.yml")];
+  const source = candidates.find((candidate) => fs35.existsSync(candidate));
+  if (!source) throw new Error(`Kody workflow template is missing: ${KODY_WORKFLOW_TEMPLATE_PATH}`);
+  return fs35.readFileSync(source, "utf8");
+}
+var KODY_WORKFLOW_TEMPLATE_PATH;
+var init_workflow_template = __esm({
+  "src/workflow-template.ts"() {
+    "use strict";
+    KODY_WORKFLOW_TEMPLATE_PATH = "templates/kody.yml";
+  }
+});
+// src/scripts/initFlow.ts
+import { execFileSync as execFileSync14 } from "child_process";
+import * as fs36 from "fs";
+import * as path34 from "path";
 function detectPackageManager(cwd) {
-  if (fs35.existsSync(path33.join(cwd, "pnpm-lock.yaml"))) return "pnpm";
-  if (fs35.existsSync(path33.join(cwd, "yarn.lock"))) return "yarn";
-  if (fs35.existsSync(path33.join(cwd, "bun.lockb"))) return "bun";
+  if (fs36.existsSync(path34.join(cwd, "pnpm-lock.yaml"))) return "pnpm";
+  if (fs36.existsSync(path34.join(cwd, "yarn.lock"))) return "yarn";
+  if (fs36.existsSync(path34.join(cwd, "bun.lockb"))) return "bun";
   return "npm";
 }
 function qualityCommandsFor(pm) {
@@ -13883,22 +14014,22 @@ function performInit(cwd, force) {
   const pm = detectPackageManager(cwd);
   const ownerRepo = detectOwnerRepo(cwd);
   const defaultBranch = defaultBranchFromGit(cwd);
-  const configPath = path33.join(cwd, "kody.config.json");
-  if (fs35.existsSync(configPath) && !force) {
+  const configPath = path34.join(cwd, "kody.config.json");
+  if (fs36.existsSync(configPath) && !force) {
     skipped.push("kody.config.json");
   } else {
     const cfg = makeConfig(pm, ownerRepo, defaultBranch);
-    fs35.writeFileSync(configPath, `${JSON.stringify(cfg, null, 2)}
+    fs36.writeFileSync(configPath, `${JSON.stringify(cfg, null, 2)}
 `);
     wrote.push("kody.config.json");
   }
-  const workflowDir = path33.join(cwd, ".github", "workflows");
-  const workflowPath = path33.join(workflowDir, "kody.yml");
-  if (fs35.existsSync(workflowPath) && !force) {
+  const workflowDir = path34.join(cwd, ".github", "workflows");
+  const workflowPath = path34.join(workflowDir, "kody.yml");
+  if (fs36.existsSync(workflowPath) && !force) {
     skipped.push(".github/workflows/kody.yml");
   } else {
-    fs35.mkdirSync(workflowDir, { recursive: true });
-    fs35.writeFileSync(workflowPath, WORKFLOW_TEMPLATE);
+    fs36.mkdirSync(workflowDir, { recursive: true });
+    fs36.writeFileSync(workflowPath, loadKodyWorkflowTemplate());
     wrote.push(".github/workflows/kody.yml");
   }
   for (const exe of listImplementations()) {
@@ -13909,12 +14040,12 @@ function performInit(cwd, force) {
       continue;
     }
     if (profile.kind !== "scheduled" || !profile.schedule) continue;
-    const target = path33.join(workflowDir, `kody-${exe.name}.yml`);
-    if (fs35.existsSync(target) && !force) {
+    const target = path34.join(workflowDir, `kody-${exe.name}.yml`);
+    if (fs36.existsSync(target) && !force) {
       skipped.push(`.github/workflows/kody-${exe.name}.yml`);
       continue;
     }
-    fs35.writeFileSync(target, renderScheduledWorkflow(exe.name, profile.schedule));
+    fs36.writeFileSync(target, renderScheduledWorkflow(exe.name, profile.schedule));
     wrote.push(`.github/workflows/kody-${exe.name}.yml`);
   }
   let labels;
@@ -13960,7 +14091,7 @@ jobs:
         run: npx -y -p @kody-ade/kody-engine@latest kody-engine implementation ${name}
 `;
 }
-var WORKFLOW_TEMPLATE, initFlow;
+var initFlow;
 var init_initFlow = __esm({
   "src/scripts/initFlow.ts"() {
     "use strict";
@@ -13968,67 +14099,7 @@ var init_initFlow = __esm({
     init_lifecycleLabels();
     init_profile();
     init_registry();
-    WORKFLOW_TEMPLATE = `# Drop this file at .github/workflows/kody.yml in your repo.
-#
-# Triggers: @kody comment on an issue or PR, or manual workflow_dispatch.
-# Everything else (install deps, set up LiteLLM, run the agent, open the PR)
-# is handled inside the @kody-ade/kody-engine package.
-#
-# Required repo secrets: at least one model provider key (e.g. MINIMAX_API_KEY,
-# ANTHROPIC_API_KEY). kody reads any *_API_KEY secret automatically via
-# toJSON(secrets) \u2014 no need to list them here.
-#
-# Recommended: KODY_TOKEN secret \u2014 a PAT or GitHub App token with repo
-# scope so kody's pushes trigger downstream CI and PR-body edits succeed.
-name: kody
-on:
-  workflow_dispatch:
-    inputs:
-      issue_number:
-        description: "GitHub issue number"
-        required: true
-        type: string
-      capability:
-        description: "Capability action to run (default: run)"
-        required: false
-        type: string
-        default: ""
-  issue_comment:
-    types: [created]
-jobs:
-  run:
-    if: >-
-      \${{ github.event_name == 'workflow_dispatch' ||
-          (github.event_name == 'issue_comment' &&
-            contains(github.event.comment.body, '@kody')) }}
-    runs-on: ubuntu-latest
-    timeout-minutes: 60
-    permissions:
-      issues: write
-      pull-requests: write
-      contents: write
-      actions: read
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-          token: \${{ secrets.KODY_TOKEN || github.token }}
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 22
-      - uses: actions/setup-python@v5
-        with:
-          python-version: "3.12"
-      - env:
-          ALL_SECRETS: \${{ toJSON(secrets) }}
-        run: npx -y -p @kody-ade/kody-engine@latest kody-engine ci
-`;
+    init_workflow_template();
     initFlow = async (ctx) => {
       const force = ctx.args.force === true;
       const cwd = ctx.cwd;
@@ -14062,7 +14133,7 @@ Nothing to do. All files already present. (Use --force to overwrite.)
 });
 // src/scripts/loadAgentAdhoc.ts
-import * as fs36 from "fs";
+import * as fs37 from "fs";
 function resolveMessage(messageArg) {
   const fromComment = readCommentBody();
   if (fromComment) return stripDirective(fromComment);
@@ -14070,9 +14141,9 @@ function resolveMessage(messageArg) {
 }
 function readCommentBody() {
   const eventPath = process.env.GITHUB_EVENT_PATH;
-  if (!eventPath || !fs36.existsSync(eventPath)) return "";
+  if (!eventPath || !fs37.existsSync(eventPath)) return "";
   try {
-    const event = JSON.parse(fs36.readFileSync(eventPath, "utf-8"));
+    const event = JSON.parse(fs37.readFileSync(eventPath, "utf-8"));
     return String(event.comment?.body ?? "");
   } catch {
     return "";
@@ -14126,10 +14197,10 @@ var init_loadAgentAdhoc = __esm({
         throw new Error("loadAgentAdhoc: ctx.args.agent must be a non-empty slug");
       }
       const agentPath = resolveAgentFile(ctx.cwd, agentSlug, agentsDir);
-      if (!fs36.existsSync(agentPath)) {
+      if (!fs37.existsSync(agentPath)) {
         throw new Error(`loadAgentAdhoc: agent identity not found: ${agentPath}`);
       }
-      const { title, body } = parseAgentFile(fs36.readFileSync(agentPath, "utf-8"), agentSlug);
+      const { title, body } = parseAgentFile(fs37.readFileSync(agentPath, "utf-8"), agentSlug);
       const message = resolveMessage(ctx.args.message);
       if (!message) {
         throw new Error(
@@ -14201,13 +14272,13 @@ var init_loadCapabilityState = __esm({
 function isCompanyIntentId(value) {
   return SLUG_RE.test(value);
 }
-function normalizeCompanyIntent(path51, raw) {
+function normalizeCompanyIntent(path52, raw) {
   if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
-    throw new Error(`${path51}: intent must be JSON object`);
+    throw new Error(`${path52}: intent must be JSON object`);
   }
   const input = raw;
   const id = stringField4(input.id);
-  if (!id || !isCompanyIntentId(id)) throw new Error(`${path51}: invalid intent id`);
+  if (!id || !isCompanyIntentId(id)) throw new Error(`${path52}: invalid intent id`);
   const createdAt = stringField4(input.createdAt) || nowIso();
   const updatedAt = stringField4(input.updatedAt) || createdAt;
   const description = stringField4(input.description);
@@ -14369,7 +14440,7 @@ function retryDelaysMs() {
 }
 function sleep(ms) {
   if (ms <= 0) return Promise.resolve();
-  return new Promise((resolve16) => setTimeout(resolve16, ms));
+  return new Promise((resolve17) => setTimeout(resolve17, ms));
 }
 async function fetchGoalStateWithRetry(config, goalId, cwd) {
   let state = await fetchGoalStateAsync(config, goalId, cwd);
@@ -14498,8 +14569,8 @@ var init_loadIssueStateComment = __esm({
 });
 // src/scripts/loadJobFromFile.ts
-import * as fs37 from "fs";
-import * as path34 from "path";
+import * as fs38 from "fs";
+import * as path35 from "path";
 function parseJobFile(raw, slug) {
   let stripped = raw;
   if (stripped.startsWith("---\n")) {
@@ -14538,10 +14609,10 @@ var init_loadJobFromFile = __esm({
       if (!slug) {
         throw new Error(`loadJobFromFile: ctx.args.${slugArg} must be a non-empty slug`);
       }
-      const capability = resolveCapabilityFolder(slug, path34.resolve(ctx.cwd, jobsDir));
+      const capability = resolveCapabilityFolder(slug, path35.resolve(ctx.cwd, jobsDir));
       if (!capability) {
         throw new Error(
-          `loadJobFromFile: capability folder not found or incomplete: ${path34.resolve(ctx.cwd, jobsDir, slug)}`
+          `loadJobFromFile: capability folder not found or incomplete: ${path35.resolve(ctx.cwd, jobsDir, slug)}`
         );
       }
       const { title, body, config } = capability;
@@ -14551,12 +14622,12 @@ var init_loadJobFromFile = __esm({
       let agentIdentity = "";
       if (agentSlug) {
         const agentPath = resolveAgentFile(ctx.cwd, agentSlug, agentsDir);
-        if (!fs37.existsSync(agentPath)) {
+        if (!fs38.existsSync(agentPath)) {
           throw new Error(
             `loadJobFromFile: capability '${slug}' declares agent '${agentSlug}' but ${agentPath} does not exist`
           );
         }
-        const agentRaw = fs37.readFileSync(agentPath, "utf-8");
+        const agentRaw = fs38.readFileSync(agentPath, "utf-8");
         const parsed = parseJobFile(agentRaw, agentSlug);
         agentTitle = parsed.title;
         agentIdentity = parsed.body;
@@ -14636,13 +14707,13 @@ ${truncate2(issue2.body, FINDING_BODY_MAX_BYTES)}`;
 });
 // src/scripts/kodyVariables.ts
-import * as fs38 from "fs";
-import * as path35 from "path";
+import * as fs39 from "fs";
+import * as path36 from "path";
 function readKodyVariables(cwd) {
-  const full = path35.join(cwd, KODY_VARIABLES_REL_PATH);
+  const full = path36.join(cwd, KODY_VARIABLES_REL_PATH);
   let raw;
   try {
-    raw = fs38.readFileSync(full, "utf-8");
+    raw = fs39.readFileSync(full, "utf-8");
   } catch {
     return {};
   }
@@ -14773,6 +14844,18 @@ function envSecret(name, env) {
 }
 async function resolveRuntimeSecret(name, ctx, opts = {}) {
   const env = opts.env ?? process.env;
+  if (hasGitHubActionsIdentity(env)) {
+    try {
+      const value = await readRuntimeSecretFromKody(name, env);
+      return value ? { value, source: "vault" } : envSecret(name, env);
+    } catch (err) {
+      const fallback = envSecret(name, env);
+      return {
+        ...fallback,
+        warning: `Kody secret read failed for ${name}: ${err instanceof Error ? err.message : String(err)}`
+      };
+    }
+  }
   const masterRaw = env.KODY_MASTER_KEY?.trim() ?? "";
   if (!masterRaw || !env.CONVEX_URL?.trim() || !env.KODY_SERVICE_KEY?.trim()) return envSecret(name, env);
   try {
@@ -14800,13 +14883,14 @@ var init_runtimeSecrets = __esm({
   "src/scripts/runtimeSecrets.ts"() {
     "use strict";
     init_backendVault();
+    init_kody_api_client();
     init_keys();
   }
 });
 // src/scripts/loadQaContext.ts
-import * as fs39 from "fs";
-import * as path36 from "path";
+import * as fs40 from "fs";
+import * as path37 from "path";
 function parseSlugList(value) {
   const inner = value.startsWith("[") && value.endsWith("]") ? value.slice(1, -1) : value;
   return inner.split(",").map(
@@ -14835,18 +14919,18 @@ function readProfileAgents(raw) {
   return { agent: agent ?? legacy ?? ["kody"], body };
 }
 function readProfile(cwd) {
-  const dir = path36.join(cwd, CONTEXT_DIR_REL_PATH);
-  if (!fs39.existsSync(dir)) return "";
+  const dir = path37.join(cwd, CONTEXT_DIR_REL_PATH);
+  if (!fs40.existsSync(dir)) return "";
   let entries;
   try {
-    entries = fs39.readdirSync(dir).filter((f) => f.endsWith(".md")).sort();
+    entries = fs40.readdirSync(dir).filter((f) => f.endsWith(".md")).sort();
   } catch {
     return "";
   }
   const blocks = [];
   for (const file of entries) {
     try {
-      const raw = fs39.readFileSync(path36.join(dir, file), "utf-8");
+      const raw = fs40.readFileSync(path37.join(dir, file), "utf-8");
       const { agent, body } = readProfileAgents(raw);
       if (!agent.includes(QA_AGENT) && !agent.includes(ALL_AGENTS)) continue;
       blocks.push(`## ${file}
@@ -14895,8 +14979,8 @@ var init_loadQaContext = __esm({
 });
 // src/taskContext.ts
-import * as fs40 from "fs";
-import * as path37 from "path";
+import * as fs41 from "fs";
+import * as path38 from "path";
 function buildTaskContext(args) {
   return {
     schemaVersion: TASK_CONTEXT_SCHEMA_VERSION,
@@ -14912,9 +14996,9 @@ function buildTaskContext(args) {
 function persistTaskContext(cwd, ctx) {
   try {
     const dir = runtimeStatePath(cwd, "agent-runs", ctx.runId);
-    fs40.mkdirSync(dir, { recursive: true });
-    const file = path37.join(dir, "task-context.json");
-    fs40.writeFileSync(file, `${JSON.stringify(ctx, null, 2)}
+    fs41.mkdirSync(dir, { recursive: true });
+    const file = path38.join(dir, "task-context.json");
+    fs41.writeFileSync(file, `${JSON.stringify(ctx, null, 2)}
 `);
     return file;
   } catch (err) {
@@ -15341,19 +15425,19 @@ function parseAgencyModelProposal(raw) {
 function normalizeBundleFiles(bundle) {
   const seen = /* @__PURE__ */ new Set();
   return bundle.files.map((file, index) => {
-    const path51 = file.path.replace(/^\/+/, "");
-    const parts = path51.split("/");
-    if (!path51 || file.path.startsWith("/") || file.path.includes("\\") || parts.some((part) => !part || part === "." || part === "..")) {
+    const path52 = file.path.replace(/^\/+/, "");
+    const parts = path52.split("/");
+    if (!path52 || file.path.startsWith("/") || file.path.includes("\\") || parts.some((part) => !part || part === "." || part === "..")) {
       throw new Error(`openAgencyModelReviewPr: files[${index}].path is unsafe`);
     }
     if (!/^(agents\/[^/]+\.md|capabilities\/[^/]+\/.+|goals\/(?:templates\/)?[^/]+\/.+|workflows\/[^/]+\.json)$/.test(
-      path51
+      path52
     )) {
       throw new Error(`openAgencyModelReviewPr: files[${index}].path is not a supported definition path`);
     }
-    if (seen.has(path51)) throw new Error(`openAgencyModelReviewPr: duplicate generated file path: ${path51}`);
-    seen.add(path51);
-    return { path: path51, content: file.content.replace(/\r\n?/g, "\n") };
+    if (seen.has(path52)) throw new Error(`openAgencyModelReviewPr: duplicate generated file path: ${path52}`);
+    seen.add(path52);
+    return { path: path52, content: file.content.replace(/\r\n?/g, "\n") };
   });
 }
 function buildProposalId(issueNumber, bundle, sourceLabel) {
@@ -16297,9 +16381,9 @@ var init_postResearchComment = __esm({
 });
 // src/scripts/prepareBrowserAuth.ts
-import * as fs41 from "fs";
+import * as fs42 from "fs";
 import * as os6 from "os";
-import * as path38 from "path";
+import * as path39 from "path";
 function appendAuthMessage(ctx, message) {
   const current = typeof ctx.data.qaAuthBlock === "string" ? ctx.data.qaAuthBlock.trim() : "";
   ctx.data.qaAuthBlock = current ? `${current}
@@ -16338,9 +16422,9 @@ async function githubJson(url, token) {
   return await response.json();
 }
 function writeKodyStorageState(input) {
-  const directory = fs41.mkdtempSync(path38.join(os6.tmpdir(), "kody-browser-auth-"));
-  fs41.chmodSync(directory, 448);
-  const file = path38.join(directory, "storage-state.json");
+  const directory = fs42.mkdtempSync(path39.join(os6.tmpdir(), "kody-browser-auth-"));
+  fs42.chmodSync(directory, 448);
+  const file = path39.join(directory, "storage-state.json");
   const now = Date.now();
   const repoEntry = {
     repoUrl: input.repoUrl,
@@ -16370,7 +16454,7 @@ function writeKodyStorageState(input) {
       }
     ]
   };
-  fs41.writeFileSync(file, JSON.stringify(storageState), { mode: 384 });
+  fs42.writeFileSync(file, JSON.stringify(storageState), { mode: 384 });
   return { directory, file };
 }
 function configurePlaywright(profile, storageStatePath) {
@@ -16452,7 +16536,7 @@ async function prepareMethod(ctx, profile, method) {
     configurePlaywright(profile, state.file);
     const authDirectory = state.directory;
     registerRuntimeCleanup(ctx, () => {
-      fs41.rmSync(authDirectory, { recursive: true, force: true });
+      fs42.rmSync(authDirectory, { recursive: true, force: true });
     });
     appendAuthMessage(
       ctx,
@@ -16460,7 +16544,7 @@ async function prepareMethod(ctx, profile, method) {
     );
     return true;
   } catch (error) {
-    if (state) fs41.rmSync(state.directory, { recursive: true, force: true });
+    if (state) fs42.rmSync(state.directory, { recursive: true, force: true });
     const reason = error instanceof Error ? error.message : String(error);
     appendAuthMessage(
       ctx,
@@ -16573,9 +16657,9 @@ function latestResult(raw, agentResult) {
 function recordField4(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : null;
 }
-function resolveDotted(root, path51) {
-  if (!path51) return void 0;
-  return path51.split(".").reduce((value, key) => recordField4(value)?.[key], root);
+function resolveDotted(root, path52) {
+  if (!path52) return void 0;
+  return path52.split(".").reduce((value, key) => recordField4(value)?.[key], root);
 }
 function stringValue4(value) {
   return typeof value === "string" && value.trim() ? value.trim() : null;
@@ -16618,7 +16702,7 @@ var init_publishReport = __esm({
       });
       const runId = generatedAt.replace(/\.\d{3}Z$/, "Z").replace(/:/g, "-");
       const tenantId2 = ctx.config.github?.owner && ctx.config.github.repo ? `${ctx.config.github.owner}/${ctx.config.github.repo}` : process.env.GITHUB_REPOSITORY;
-      if (process.env.CONVEX_URL?.trim() && process.env.KODY_SERVICE_KEY?.trim() && tenantId2) {
+      if (hasStateBackendConfig() && tenantId2) {
         await createStateBackendFromEnv().saveReport(
           tenantId2,
           slug,
@@ -16634,7 +16718,7 @@ var init_publishReport = __esm({
           generatedAt
         );
       } else if (process.env.GITHUB_ACTIONS === "true") {
-        throw new Error("Convex backend is required for reports in GitHub Actions");
+        throw new Error("Kody backend access is required for reports in GitHub Actions");
       }
     };
   }
@@ -17447,53 +17531,14 @@ function basePreviewAppName(repo) {
   }
   return `kp-${shortHash(owner)}-${shortHash(name)}-base`;
 }
-function decryptVaultPayload(payload, keyRaw) {
-  const parts = payload.split(":");
-  if (parts.length !== 4 || parts[0] !== "v1") {
-    throw new Error("invalid vault payload format");
-  }
-  const [, ivB64, ctB64, tagB64] = parts;
-  const key = decodeMasterKey(keyRaw);
-  if (key.length !== 32) {
-    throw new Error("KODY_MASTER_KEY must decode to 32 bytes");
-  }
-  const iv = Buffer.from(ivB64, "base64");
-  const ct = Buffer.from(ctB64, "base64");
-  const tag = Buffer.from(tagB64, "base64");
-  const decipher = createDecipheriv2("aes-256-gcm", key, iv);
-  decipher.setAuthTag(tag);
-  return Buffer.concat([decipher.update(ct), decipher.final()]).toString("utf8");
-}
-function decodeMasterKey(keyRaw) {
-  if (/^[0-9a-fA-F]{64}$/.test(keyRaw)) return Buffer.from(keyRaw, "hex");
-  return Buffer.from(keyRaw.replace(/-/g, "+").replace(/_/g, "/"), "base64");
-}
-function derivePreviewVerifyKey(masterKeyRaw) {
-  const masterKey = decodeMasterKey(masterKeyRaw);
-  if (masterKey.length !== 32) {
-    throw new Error("KODY_MASTER_KEY must decode to 32 bytes");
-  }
-  return Buffer.from(hkdfSync2("sha256", masterKey, Buffer.alloc(0), PREVIEW_KEY_INFO, 32)).toString("hex");
-}
 function previewRuntimeEnv(args) {
   return {
     ...args.buildEnv,
-    KODY_PREVIEW_VERIFY_KEY: derivePreviewVerifyKey(args.masterKey),
+    KODY_PREVIEW_VERIFY_KEY: args.previewVerifyKey,
     KODY_REPO_CONTEXT: args.repo,
     KODY_PR: String(args.pr)
   };
 }
-function buildEnvFromVault(doc) {
-  const buildEnv = {};
-  for (const [name, entry] of Object.entries(doc.secrets ?? {})) {
-    if (!entry?.value) continue;
-    if (NEVER_PASS_TO_BUILD.has(name)) continue;
-    buildEnv[name] = entry.value;
-  }
-  const raw = doc.secrets?.KODY_PREVIEW_BUILD_MODE?.value;
-  const buildMode = raw?.toLowerCase().trim() === "dev" ? "dev" : "prod";
-  return { buildEnv, buildMode };
-}
 function formatPreviewComment(args) {
   return [
     "<!-- kody-fly-preview -->",
@@ -17505,30 +17550,16 @@ function formatPreviewComment(args) {
 function defaultImageTag(repo, ref) {
   return createHash4("sha256").update(`${repo}@${ref}`).digest("hex").slice(0, 12);
 }
-var NEVER_PASS_TO_BUILD, PREVIEW_KEY_INFO;
 var init_previewBuildHelpers = __esm({
   "src/scripts/previewBuildHelpers.ts"() {
     "use strict";
-    NEVER_PASS_TO_BUILD = /* @__PURE__ */ new Set([
-      "FLY_API_TOKEN",
-      "FLY_ORG_SLUG",
-      "FLY_DEFAULT_REGION",
-      "KODY_MASTER_KEY",
-      // Preview-config knob; consumed by the dispatcher before spawn.
-      "KODY_PREVIEW_BUILD_MODE",
-      "KODY_PREVIEW_VERIFY_KEY",
-      "KODY_REPO_CONTEXT",
-      "KODY_PR",
-      "KODY_BRANCH"
-    ]);
-    PREVIEW_KEY_INFO = "kody-preview:v1";
   }
 });
 // src/scripts/previewBuildRun.ts
 import { spawn as spawn5 } from "child_process";
 async function runCmd(cmd, args, opts = {}) {
-  await new Promise((resolve16, reject) => {
+  await new Promise((resolve17, reject) => {
     const child = spawn5(cmd, args, {
       cwd: opts.cwd,
       env: { ...process.env, ...opts.env ?? {} },
@@ -17540,7 +17571,7 @@ async function runCmd(cmd, args, opts = {}) {
     }
     child.on("error", reject);
     child.on("close", (code) => {
-      if (code === 0) resolve16();
+      if (code === 0) resolve17();
       else reject(new Error(`${cmd} ${args.join(" ")} exited ${code}`));
     });
   });
@@ -17612,12 +17643,12 @@ fi
 // src/scripts/runPreviewBuild.ts
 import { copyFile, writeFile } from "fs/promises";
-import * as path39 from "path";
-import { fileURLToPath } from "url";
+import * as path40 from "path";
+import { fileURLToPath as fileURLToPath2 } from "url";
 function bundledDockerfilePath(mode) {
-  const here = path39.dirname(fileURLToPath(import.meta.url));
+  const here = path40.dirname(fileURLToPath2(import.meta.url));
   const file = mode === "dev" ? "default-Dockerfile.preview.dev" : "default-Dockerfile.preview.prod";
-  return path39.join(here, "preview-build-templates", file);
+  return path40.join(here, "preview-build-templates", file);
 }
 function required(name) {
   const v = (process.env[name] ?? "").trim();
@@ -17630,16 +17661,6 @@ function flyHeaders(token) {
     "Content-Type": "application/json"
   };
 }
-async function fetchVaultDoc(repo, masterKey) {
-  const [owner, name] = repo.split("/", 2);
-  if (!owner || !name) throw new Error(`invalid GITHUB_REPOSITORY "${repo}"`);
-  const record2 = await createStateBackendFromEnv().getRepoDoc(`${owner}/${name}`, "secrets.enc");
-  const raw = record2?.doc;
-  const payload = raw && typeof raw === "object" && !Array.isArray(raw) && typeof raw.ciphertext === "string" ? raw.ciphertext : "";
-  if (!payload) throw new Error("backend vault is empty \u2014 save secrets from the dashboard first");
-  const plaintext = decryptVaultPayload(payload, masterKey);
-  return JSON.parse(plaintext);
-}
 async function flyAppExists(name, token) {
   const res = await fetch(`${FLY_MACHINES}/apps/${encodeURIComponent(name)}`, {
     headers: flyHeaders(token),
@@ -17814,7 +17835,7 @@ var FLY_MACHINES, FLY_GRAPHQL, REQ_TIMEOUT_MS2, runPreviewBuild;
 var init_runPreviewBuild = __esm({
   "src/scripts/runPreviewBuild.ts"() {
     "use strict";
-    init_state_backend();
+    init_kody_api_client();
     init_previewBuildHelpers();
     init_previewBuildNamespace();
     init_previewBuildRun();
@@ -17831,12 +17852,10 @@ var init_runPreviewBuild = __esm({
       }
       let repo;
       let ref;
-      let masterKey;
       let ghToken3;
       try {
         repo = required("GITHUB_REPOSITORY");
         ref = required("GITHUB_SHA");
-        masterKey = required("KODY_MASTER_KEY");
         ghToken3 = (process.env.KODY_TOKEN ?? process.env.GH_TOKEN ?? process.env.GITHUB_TOKEN ?? process.env.GH_PAT ?? "").trim();
         if (!ghToken3) {
           throw new Error("GitHub auth token missing (KODY_TOKEN / GH_TOKEN / GITHUB_TOKEN / GH_PAT all empty)");
@@ -17850,24 +17869,24 @@ var init_runPreviewBuild = __esm({
       const appName = previewAppName(repo, pr);
       const tag = defaultImageTag(repo, ref);
       try {
-        const doc = await fetchVaultDoc(repo, masterKey);
-        const { buildEnv, buildMode } = buildEnvFromVault(doc);
-        const flyToken = doc.secrets?.FLY_API_TOKEN?.value?.trim();
+        const previewContext = await readPreviewContextFromKody();
+        const { buildEnv, buildMode } = previewContext;
+        const flyToken = previewContext.flyApiToken?.trim();
         if (!flyToken) {
           ctx.output.exitCode = 99;
           ctx.output.reason = "runPreviewBuild: vault has no FLY_API_TOKEN \u2014 add it via the dashboard's /secrets page";
           return;
         }
-        const orgSlug = doc.secrets?.FLY_ORG_SLUG?.value?.trim() || (process.env.FLY_ORG_SLUG ?? "personal").trim();
-        const region = doc.secrets?.FLY_DEFAULT_REGION?.value?.trim() || (process.env.FLY_REGION ?? "fra").trim();
-        const nscTenantId = doc.secrets?.NSC_TENANT_ID?.value?.trim() || "";
+        const orgSlug = previewContext.flyOrgSlug?.trim() || (process.env.FLY_ORG_SLUG ?? "personal").trim();
+        const region = previewContext.flyRegion?.trim() || (process.env.FLY_REGION ?? "fra").trim();
+        const nscTenantId = previewContext.namespaceTenantId?.trim() || "";
         console.log(`[preview-build] vault: ${Object.keys(buildEnv).length} secrets, mode=${buildMode}`);
         if (Object.keys(buildEnv).length > 0) {
           const lines = Object.entries(buildEnv).map(([k, v]) => `${k}=${JSON.stringify(v)}`);
-          await writeFile(path39.join(ctx.cwd, ".env.production.local"), `${lines.join("\n")}
+          await writeFile(path40.join(ctx.cwd, ".env.production.local"), `${lines.join("\n")}
 `, "utf8");
         }
-        const consumerDockerfile = path39.join(ctx.cwd, "Dockerfile.preview");
+        const consumerDockerfile = path40.join(ctx.cwd, "Dockerfile.preview");
         const { stat } = await import("fs/promises");
         let hasConsumerDockerfile = false;
         try {
@@ -17942,7 +17961,7 @@ var init_runPreviewBuild = __esm({
             appName,
             region,
             image: `registry.fly.io/${appName}:${tag}`,
-            env: previewRuntimeEnv({ buildEnv, masterKey, pr, repo })
+            env: previewRuntimeEnv({ buildEnv, previewVerifyKey: previewContext.previewVerifyKey, pr, repo })
           },
           flyToken
         );
@@ -18051,8 +18070,8 @@ var init_tickShellRunner = __esm({
 });
 // src/scripts/runScheduledImplementationTick.ts
-import * as fs42 from "fs";
-import * as path40 from "path";
+import * as fs43 from "fs";
+import * as path41 from "path";
 var runScheduledImplementationTick;
 var init_runScheduledImplementationTick = __esm({
   "src/scripts/runScheduledImplementationTick.ts"() {
@@ -18073,14 +18092,14 @@ var init_runScheduledImplementationTick = __esm({
         ctx.output.reason = `runScheduledImplementationTick: args.slug or ctx.args.${slugArg} must be non-empty capability slug`;
         return;
       }
-      const capability = resolveCapabilityFolder(slug, path40.resolve(ctx.cwd, jobsDir));
+      const capability = resolveCapabilityFolder(slug, path41.resolve(ctx.cwd, jobsDir));
       if (!capability) {
         ctx.output.exitCode = 99;
         ctx.output.reason = `runScheduledImplementationTick: capability folder not found or incomplete: ${slug} (searched ${jobsDir} and company store)`;
         return;
       }
-      const shellPath = path40.join(profile.dir, shell);
-      if (!fs42.existsSync(shellPath)) {
+      const shellPath = path41.join(profile.dir, shell);
+      if (!fs43.existsSync(shellPath)) {
         ctx.output.exitCode = 99;
         ctx.output.reason = `runScheduledImplementationTick: shell not found: ${shell} (looked in ${profile.dir})`;
         return;
@@ -18111,8 +18130,8 @@ var init_runScheduledImplementationTick = __esm({
 });
 // src/scripts/runTickScript.ts
-import * as fs43 from "fs";
-import * as path41 from "path";
+import * as fs44 from "fs";
+import * as path42 from "path";
 var runTickScript;
 var init_runTickScript = __esm({
   "src/scripts/runTickScript.ts"() {
@@ -18132,10 +18151,10 @@ var init_runTickScript = __esm({
         ctx.output.reason = `runTickScript: ctx.args.${slugArg} must be a non-empty slug`;
         return;
       }
-      const capability = readCapabilityFolder(path41.resolve(ctx.cwd, jobsDir), slug);
+      const capability = readCapabilityFolder(path42.resolve(ctx.cwd, jobsDir), slug);
       if (!capability) {
         ctx.output.exitCode = 99;
-        ctx.output.reason = `runTickScript: capability folder not found or incomplete: ${path41.resolve(ctx.cwd, jobsDir, slug)}`;
+        ctx.output.reason = `runTickScript: capability folder not found or incomplete: ${path42.resolve(ctx.cwd, jobsDir, slug)}`;
         return;
       }
       const tickScript = capability.config.tickScript;
@@ -18144,8 +18163,8 @@ var init_runTickScript = __esm({
         ctx.output.reason = `runTickScript: capability ${slug} has no \`tickScript\` in profile.json \u2014 route via capability-tick instead`;
         return;
       }
-      const scriptPath = path41.isAbsolute(tickScript) ? tickScript : path41.join(ctx.cwd, tickScript);
-      if (!fs43.existsSync(scriptPath)) {
+      const scriptPath = path42.isAbsolute(tickScript) ? tickScript : path42.join(ctx.cwd, tickScript);
+      if (!fs44.existsSync(scriptPath)) {
         ctx.output.exitCode = 99;
         ctx.output.reason = `runTickScript: tickScript not found: ${scriptPath}`;
         return;
@@ -18427,7 +18446,7 @@ var init_syncFlow = __esm({
 });
 // src/scripts/validateAgencyModelProposal.ts
-import * as path42 from "path";
+import * as path43 from "path";
 function validateModelBundle(bundle, expectedKind, options = {}) {
   const failures = [];
   validateOneModel(bundle.model, bundle.files, "model", true, failures, expectedKind, options);
@@ -18753,7 +18772,7 @@ var init_validateAgencyModelProposal = __esm({
       const bundle = parseAgencyModelProposal(raw);
       const expectedKind = readExpectedModelKind(args);
       const failures = validateModelBundle(bundle, expectedKind, {
-        capabilityRoot: path42.join(ctx.cwd, ".kody", "capabilities")
+        capabilityRoot: path43.join(ctx.cwd, ".kody", "capabilities")
       });
       if (failures.length > 0) {
         throw new Error(`validateAgencyModelProposal: ${failures.join("; ")}`);
@@ -18816,7 +18835,7 @@ function stripAnsi2(s) {
   return s.replace(ANSI_RE2, "");
 }
 function runCommand2(command, cwd) {
-  return new Promise((resolve16) => {
+  return new Promise((resolve17) => {
     const child = spawn6(command, {
       cwd,
       shell: true,
@@ -18843,11 +18862,11 @@ function runCommand2(command, cwd) {
     }, TEST_TIMEOUT_MS);
     child.on("exit", (code) => {
       clearTimeout(timer);
-      resolve16({ exitCode: code ?? -1, output: Buffer.concat(buffers).toString("utf-8") });
+      resolve17({ exitCode: code ?? -1, output: Buffer.concat(buffers).toString("utf-8") });
     });
     child.on("error", (err) => {
       clearTimeout(timer);
-      resolve16({ exitCode: -1, output: err.message });
+      resolve17({ exitCode: -1, output: err.message });
     });
   });
 }
@@ -19253,21 +19272,21 @@ function lineStream(stream) {
     tryDeliver();
   });
   return {
-    next: (timeoutMs) => new Promise((resolve16) => {
+    next: (timeoutMs) => new Promise((resolve17) => {
       if (queue.length > 0) {
-        resolve16(queue.shift());
+        resolve17(queue.shift());
         return;
       }
       if (ended) {
-        resolve16(null);
+        resolve17(null);
         return;
       }
-      waiter = resolve16;
+      waiter = resolve17;
       const t = setTimeout(
         () => {
-          if (waiter === resolve16) {
+          if (waiter === resolve17) {
             waiter = null;
-            resolve16(null);
+            resolve17(null);
           }
         },
         Math.max(0, timeoutMs)
@@ -19304,7 +19323,7 @@ var init_warmupMcp = __esm({
 });
 // src/scripts/writeAgentRunSummary.ts
-import * as fs44 from "fs";
+import * as fs45 from "fs";
 var writeAgentRunSummary;
 var init_writeAgentRunSummary = __esm({
   "src/scripts/writeAgentRunSummary.ts"() {
@@ -19330,7 +19349,7 @@ var init_writeAgentRunSummary = __esm({
       if (reason) lines.push(`- **Reason:** ${reason}`);
       lines.push("");
       try {
-        fs44.appendFileSync(summaryPath, `${lines.join("\n")}
+        fs45.appendFileSync(summaryPath, `${lines.join("\n")}
 `);
       } catch {
       }
@@ -19656,17 +19675,17 @@ var init_scripts = __esm({
 });
 // src/stateWorkspace.ts
-import * as fs45 from "fs";
-import * as path43 from "path";
+import * as fs46 from "fs";
+import * as path44 from "path";
 function tenantId(config) {
   const owner = config.github?.owner?.trim() || process.env.GITHUB_REPOSITORY?.split("/")[0]?.trim();
   const repo = config.github?.repo?.trim() || process.env.GITHUB_REPOSITORY?.split("/")[1]?.trim();
   return owner && repo ? `${owner}/${repo}` : null;
 }
 function writeRuntimeFile(cwd, relativePath, content) {
-  const target = path43.join(cwd, RUNTIME_ROOT, relativePath);
-  fs45.mkdirSync(path43.dirname(target), { recursive: true });
-  fs45.writeFileSync(target, content, "utf8");
+  const target = path44.join(cwd, RUNTIME_ROOT, relativePath);
+  fs46.mkdirSync(path44.dirname(target), { recursive: true });
+  fs46.writeFileSync(target, content, "utf8");
 }
 function record(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : null;
@@ -19725,17 +19744,17 @@ async function hydrateWorkflows(backend, tenant, cwd) {
 }
 async function hydrateStateWorkspace(config, cwd, backendOverride) {
   const tenant = tenantId(config);
-  const configured = Boolean(process.env.CONVEX_URL?.trim()) && Boolean(process.env.KODY_SERVICE_KEY?.trim());
+  const configured = hasStateBackendConfig();
   if (!tenant || !configured) {
     if (process.env.GITHUB_ACTIONS === "true")
-      throw new Error("Convex backend is required for runtime workspace documents");
+      throw new Error("Kody backend access is required for runtime workspace documents");
     return;
   }
-  const key = `${path43.resolve(cwd)}|${tenant}`;
+  const key = `${path44.resolve(cwd)}|${tenant}`;
   if (hydratedWorkspaces.has(key)) return;
   const backend = backendOverride ?? createStateBackendFromEnv();
-  const root = path43.join(cwd, RUNTIME_ROOT);
-  fs45.rmSync(root, { recursive: true, force: true });
+  const root = path44.join(cwd, RUNTIME_ROOT);
+  fs46.rmSync(root, { recursive: true, force: true });
   await Promise.all([
     hydratePrefix(backend, tenant, cwd, "context:"),
     hydratePrefix(backend, tenant, cwd, "memory:"),
@@ -19751,7 +19770,7 @@ var init_stateWorkspace = __esm({
   "src/stateWorkspace.ts"() {
     "use strict";
     init_state_backend();
-    RUNTIME_ROOT = path43.join(".kody-engine", "runtime");
+    RUNTIME_ROOT = path44.join(".kody-engine", "runtime");
     hydratedWorkspaces = /* @__PURE__ */ new Set();
   }
 });
@@ -19822,9 +19841,9 @@ var init_tools = __esm({
 // src/executor.ts
 import { spawn as spawn8 } from "child_process";
-import * as fs46 from "fs";
+import * as fs47 from "fs";
 import * as os7 from "os";
-import * as path44 from "path";
+import * as path45 from "path";
 function isMutatingPostflight(scriptName) {
   return MUTATING_POSTFLIGHTS.has(scriptName ?? "");
 }
@@ -20056,7 +20075,7 @@ async function runImplementation(profileName, input) {
   const jobWhyBlock = typeof ctx.data.jobWhy === "string" ? operatorRequestBlock(ctx.data.jobWhy) : null;
   const jobRefBlock = jobReferenceBlock(profileName, profile, ctx.data);
   const invokeAgent = async (prompt) => {
-    const externalPlugins = (profile.claudeCode.plugins ?? []).map((p) => path44.isAbsolute(p) ? p : path44.resolve(profile.dir, p)).filter((p) => p.length > 0);
+    const externalPlugins = (profile.claudeCode.plugins ?? []).map((p) => path45.isAbsolute(p) ? p : path45.resolve(profile.dir, p)).filter((p) => p.length > 0);
     const syntheticPath = ctx.data.syntheticPluginPath;
     const pluginPaths = [...externalPlugins, ...syntheticPath ? [syntheticPath] : []];
     const agents = loadSubagents(profile);
@@ -20494,17 +20513,17 @@ function clearStampedLifecycleLabels(profile, ctx) {
 function resolveProfilePath(profileName) {
   const found = resolveImplementation(profileName);
   if (found) return found;
-  const here = path44.dirname(new URL(import.meta.url).pathname);
+  const here = path45.dirname(new URL(import.meta.url).pathname);
   const candidates = [
-    path44.join(here, "implementations", profileName, "profile.json"),
+    path45.join(here, "implementations", profileName, "profile.json"),
     // same-dir sibling (dev)
-    path44.join(here, "..", "implementations", profileName, "profile.json"),
+    path45.join(here, "..", "implementations", profileName, "profile.json"),
     // up one (prod: dist/bin → dist/implementations)
-    path44.join(here, "..", "src", "implementations", profileName, "profile.json")
+    path45.join(here, "..", "src", "implementations", profileName, "profile.json")
     // fallback
   ];
   for (const c of candidates) {
-    if (fs46.existsSync(c)) return c;
+    if (fs47.existsSync(c)) return c;
   }
   return candidates[0];
 }
@@ -20619,15 +20638,15 @@ function resolveShellTimeoutMs(entry) {
 }
 async function runShellEntry(entry, ctx, profile) {
   const shellName = entry.shell;
-  const shellPath = path44.join(profile.dir, shellName);
-  if (!fs46.existsSync(shellPath)) {
+  const shellPath = path45.join(profile.dir, shellName);
+  if (!fs47.existsSync(shellPath)) {
     ctx.skipAgent = true;
     ctx.output.exitCode = 99;
     ctx.output.reason = `shell script not found: ${shellName} (looked in ${profile.dir})`;
     return;
   }
   const positional = entry.with ? Object.values(entry.with).map((v) => String(v)) : [];
-  const outputFile = path44.join(
+  const outputFile = path45.join(
     os7.tmpdir(),
     `kody-shell-output-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`
   );
@@ -20662,14 +20681,14 @@ async function runShellEntry(entry, ctx, profile) {
   let killTimer;
   let escalateTimer;
   const result = await new Promise(
-    (resolve16) => {
+    (resolve17) => {
       let settled = false;
       const settle = (code, signal, spawnErr) => {
         if (settled) return;
         settled = true;
         if (killTimer) clearTimeout(killTimer);
         if (escalateTimer) clearTimeout(escalateTimer);
-        resolve16({ code, signal, spawnErr });
+        resolve17({ code, signal, spawnErr });
       };
       child.on("error", (err) => settle(null, null, err));
       child.on("close", (code, signal) => settle(code, signal));
@@ -20699,9 +20718,9 @@ async function runShellEntry(entry, ctx, profile) {
   }
   let sideChannelText = "";
   try {
-    if (fs46.existsSync(outputFile)) {
-      sideChannelText = fs46.readFileSync(outputFile, "utf-8");
-      fs46.rmSync(outputFile, { force: true });
+    if (fs47.existsSync(outputFile)) {
+      sideChannelText = fs47.readFileSync(outputFile, "utf-8");
+      fs47.rmSync(outputFile, { force: true });
     }
   } catch {
   }
@@ -20872,7 +20891,7 @@ __export(job_exports, {
   stableJobKey: () => stableJobKey,
   validateJob: () => validateJob
 });
-import * as path45 from "path";
+import * as path46 from "path";
 function newJobId(flavor) {
   localJobSeq += 1;
   const runId = process.env.GITHUB_RUN_ID;
@@ -21335,11 +21354,11 @@ function selectWorkflowTransition(step, data, counts) {
 }
 function workflowResultConditionPaths(transitions) {
   return transitions.flatMap(
-    (transition) => Object.keys(transition.when ?? {}).filter((path51) => path51.startsWith("result."))
+    (transition) => Object.keys(transition.when ?? {}).filter((path52) => path52.startsWith("result."))
   );
 }
 function conditionMatches(condition, context) {
-  return Object.entries(condition).every(([path51, expected]) => valueMatches(resolveDottedPath2(context, path51), expected));
+  return Object.entries(condition).every(([path52, expected]) => valueMatches(resolveDottedPath2(context, path52), expected));
 }
 function withWorkflowBoundaryEval(capability, result) {
   const capabilityKind = capability.config.capabilityKind;
@@ -21497,7 +21516,7 @@ function loadCapabilityContext(slug, cwd) {
   return resolveCapabilityFolder(slug, hydratedCapabilitiesRoot(cwd));
 }
 function hydratedCapabilitiesRoot(cwd) {
-  return path45.join(cwd, ".kody-engine", "definitions", "capabilities");
+  return path46.join(cwd, ".kody-engine", "definitions", "capabilities");
 }
 function loadWorkflowContext(slug, base) {
   if (!slug || !base.config || !isWorkflowDefinitionId(slug)) return null;
@@ -21660,7 +21679,7 @@ function translateOpenAISseToBrain(opts) {
 // src/servers/brain-serve.ts
 import { createServer as createServer2 } from "http";
-import * as path48 from "path";
+import * as path49 from "path";
 // src/chat/loop.ts
 init_agent();
@@ -21814,9 +21833,9 @@ var CodexAppServerClient = class {
     await this.request("thread/resume", { threadId });
   }
   async runTurn(args) {
-    await new Promise((resolve16, reject) => {
+    await new Promise((resolve17, reject) => {
       this.process.turnWaiters.set(args.threadId, {
-        resolve: resolve16,
+        resolve: resolve17,
         reject,
         onNotification: args.onNotification,
         queue: Promise.resolve()
@@ -21833,8 +21852,8 @@ var CodexAppServerClient = class {
   }
   request(method, params) {
     const id = this.process.nextId++;
-    return new Promise((resolve16, reject) => {
-      this.process.pending.set(id, { resolve: resolve16, reject });
+    return new Promise((resolve17, reject) => {
+      this.process.pending.set(id, { resolve: resolve17, reject });
       this.process.child.stdin.write(`${JSON.stringify({ method, id, params })}
 `);
     });
@@ -22702,8 +22721,8 @@ init_config();
 // src/kody-cli.ts
 import { execFileSync as execFileSync24 } from "child_process";
-import * as fs47 from "fs";
-import * as path46 from "path";
+import * as fs48 from "fs";
+import * as path47 from "path";
 // src/app-auth.ts
 import { createSign } from "crypto";
@@ -23471,6 +23490,20 @@ function recoverCheckoutToken(env = process.env, cwd = process.cwd()) {
   return token;
 }
 async function resolveAuthToken(env = process.env) {
+  const readySources = [
+    ["GH_PAT", env.GH_PAT],
+    ["KODY_TOKEN", env.KODY_TOKEN],
+    ["GH_TOKEN", env.GH_TOKEN]
+  ];
+  const ready = readySources.find(([, value]) => !!value?.trim());
+  if (ready?.[1]) {
+    const token2 = ready[1].trim();
+    env.GH_TOKEN = token2;
+    recoverCheckoutToken(env);
+    process.stdout.write(`\u2192 kody: GH_TOKEN sourced from env.${ready[0]}
+`);
+    return token2;
+  }
   const creds = readAppCreds(env);
   if (creds) {
     try {
@@ -23484,12 +23517,7 @@ async function resolveAuthToken(env = process.env) {
 `);
     }
   }
-  const sources = [
-    ["KODY_TOKEN", env.KODY_TOKEN],
-    ["GH_TOKEN", env.GH_TOKEN],
-    ["GITHUB_TOKEN", env.GITHUB_TOKEN],
-    ["GH_PAT", env.GH_PAT]
-  ];
+  const sources = [["GITHUB_TOKEN", env.GITHUB_TOKEN]];
   const picked = sources.find(([, v]) => !!v);
   const token = picked?.[1];
   if (token && !env.GH_TOKEN) env.GH_TOKEN = token;
@@ -23505,9 +23533,9 @@ async function resolveAuthToken(env = process.env) {
   return void 0;
 }
 function detectPackageManager2(cwd) {
-  if (fs47.existsSync(path46.join(cwd, "pnpm-lock.yaml"))) return "pnpm";
-  if (fs47.existsSync(path46.join(cwd, "yarn.lock"))) return "yarn";
-  if (fs47.existsSync(path46.join(cwd, "bun.lockb"))) return "bun";
+  if (fs48.existsSync(path47.join(cwd, "pnpm-lock.yaml"))) return "pnpm";
+  if (fs48.existsSync(path47.join(cwd, "yarn.lock"))) return "yarn";
+  if (fs48.existsSync(path47.join(cwd, "bun.lockb"))) return "bun";
   return "npm";
 }
 function shouldChainScheduledWatch(match) {
@@ -23600,8 +23628,8 @@ function postFailureTail(issueNumber, cwd, reason) {
   const logPath = lastRunLogPath(cwd);
   let tail = "";
   try {
-    if (fs47.existsSync(logPath)) {
-      const content = fs47.readFileSync(logPath, "utf-8");
+    if (fs48.existsSync(logPath)) {
+      const content = fs48.readFileSync(logPath, "utf-8");
       tail = content.slice(-3e3);
     }
   } catch {
@@ -23630,7 +23658,7 @@ async function runCi(argv) {
     return 0;
   }
   const args = parseCiArgs(argv);
-  const cwd = args.cwd ? path46.resolve(args.cwd) : process.cwd();
+  const cwd = args.cwd ? path47.resolve(args.cwd) : process.cwd();
   try {
     const n = unpackAllSecrets();
     if (n > 0) process.stdout.write(`\u2192 kody: unpacked ${n} secret(s) from ALL_SECRETS
@@ -23689,9 +23717,9 @@ async function runCi(argv) {
       forceRunCliArgs = { goal: envForceMessage };
     }
   }
-  if (!args.issueNumber && !autoFallback && !forceRunAction && !runRequestFanOut && eventName === "workflow_dispatch" && dispatchEventPath && fs47.existsSync(dispatchEventPath)) {
+  if (!args.issueNumber && !autoFallback && !forceRunAction && !runRequestFanOut && eventName === "workflow_dispatch" && dispatchEventPath && fs48.existsSync(dispatchEventPath)) {
     try {
-      const evt = JSON.parse(fs47.readFileSync(dispatchEventPath, "utf-8"));
+      const evt = JSON.parse(fs48.readFileSync(dispatchEventPath, "utf-8"));
       const inputs = objectValue2(evt.inputs);
       const issueInput = parseInt(String(inputs?.issue_number ?? ""), 10);
       const sessionInput = String(inputs?.sessionId ?? "");
@@ -24064,8 +24092,8 @@ init_repoWorkspace();
 // src/scripts/brainTurnLog.ts
 init_runtimePaths();
-import * as fs48 from "fs";
-import * as path47 from "path";
+import * as fs49 from "fs";
+import * as path48 from "path";
 import posixPath4 from "path/posix";
 var live = /* @__PURE__ */ new Map();
 function brainEventsFilePath(dir, chatId) {
@@ -24073,8 +24101,8 @@ function brainEventsFilePath(dir, chatId) {
 }
 function lastPersistedSeq(dir, chatId) {
   const p = brainEventsFilePath(dir, chatId);
-  if (!fs48.existsSync(p)) return 0;
-  const lines = fs48.readFileSync(p, "utf-8").split("\n").filter(Boolean);
+  if (!fs49.existsSync(p)) return 0;
+  const lines = fs49.readFileSync(p, "utf-8").split("\n").filter(Boolean);
   if (lines.length === 0) return 0;
   try {
     return JSON.parse(lines[lines.length - 1]).seq || 0;
@@ -24084,9 +24112,9 @@ function lastPersistedSeq(dir, chatId) {
 }
 function readSince(dir, chatId, since) {
   const p = brainEventsFilePath(dir, chatId);
-  if (!fs48.existsSync(p)) return [];
+  if (!fs49.existsSync(p)) return [];
   const out = [];
-  for (const line of fs48.readFileSync(p, "utf-8").split("\n")) {
+  for (const line of fs49.readFileSync(p, "utf-8").split("\n")) {
     if (!line) continue;
     try {
       const rec = JSON.parse(line);
@@ -24112,12 +24140,12 @@ function beginTurn(dir, chatId) {
   };
   live.set(chatId, state);
   const p = brainEventsFilePath(dir, chatId);
-  fs48.mkdirSync(path47.dirname(p), { recursive: true });
+  fs49.mkdirSync(path48.dirname(p), { recursive: true });
   return (event) => {
     state.seq += 1;
     const rec = { seq: state.seq, turn, ts: Date.now(), event };
     try {
-      fs48.appendFileSync(p, `${JSON.stringify(rec)}
+      fs49.appendFileSync(p, `${JSON.stringify(rec)}
 `);
     } catch (err) {
       process.stderr.write(
@@ -24156,7 +24184,7 @@ function endTurnIfUnterminated(dir, chatId, errMessage) {
     event: { type: "error", error: errMessage || "turn ended unexpectedly", chatId }
   };
   try {
-    fs48.appendFileSync(brainEventsFilePath(dir, chatId), `${JSON.stringify(rec)}
+    fs49.appendFileSync(brainEventsFilePath(dir, chatId), `${JSON.stringify(rec)}
 `);
   } catch {
   }
@@ -24250,17 +24278,17 @@ function authOk(req, expected) {
   return false;
 }
 function readJsonBody(req) {
-  return new Promise((resolve16, reject) => {
+  return new Promise((resolve17, reject) => {
     const chunks = [];
     req.on("data", (c) => chunks.push(c));
     req.on("end", () => {
       const raw = Buffer.concat(chunks).toString("utf-8");
       if (!raw.trim()) {
-        resolve16({});
+        resolve17({});
         return;
       }
       try {
-        resolve16(JSON.parse(raw));
+        resolve17(JSON.parse(raw));
       } catch (err) {
         reject(err instanceof Error ? err : new Error(String(err)));
       }
@@ -24353,12 +24381,12 @@ var BrokerSink = class {
     const be = translateChatEvent(event, this.chatId);
     if (!be) return;
     this.emitToLog(be);
-    if (this.tenantId && hasStateBackendConfig()) {
+    if (this.tenantId && hasStateBackendConfig2()) {
       await createStateBackendFromEnv().appendChatEvent(this.tenantId, this.chatId, be);
     }
   }
 };
-function hasStateBackendConfig(env = process.env) {
+function hasStateBackendConfig2(env = process.env) {
   return Boolean(env.CONVEX_URL?.trim() && env.KODY_SERVICE_KEY?.trim());
 }
 var chatQueues = /* @__PURE__ */ new Map();
@@ -24519,7 +24547,7 @@ function buildServer(opts) {
   const runTurn = opts.runTurn ?? runChatTurn;
   const createStore = opts.createStore ?? createSessionStore;
   const cloneRepo = opts.cloneRepo ?? defaultCloneRepo;
-  const reposRoot = opts.reposRoot ?? path48.join(path48.dirname(path48.resolve(opts.cwd)), "repos");
+  const reposRoot = opts.reposRoot ?? path49.join(path49.dirname(path49.resolve(opts.cwd)), "repos");
   return createServer2(async (req, res) => {
     if (!req.method || !req.url) {
       sendJson(res, 400, { error: "bad request" });
@@ -24600,11 +24628,11 @@ async function brainServe(opts) {
     litellmUrl,
     driver
   });
-  await new Promise((resolve16) => {
+  await new Promise((resolve17) => {
     server.listen(port, "0.0.0.0", () => {
       process.stdout.write(`[brain-serve] listening on 0.0.0.0:${port} (cwd=${opts.cwd})
 `);
-      resolve16();
+      resolve17();
     });
   });
   const shutdown = (signal) => {
@@ -24859,14 +24887,14 @@ async function startBrainProxy(opts) {
   const { httpServer, handler } = buildBrainProxy(opts);
   const port = opts.port ?? 0;
   const host = opts.host ?? "127.0.0.1";
-  await new Promise((resolve16) => httpServer.listen(port, host, () => resolve16()));
+  await new Promise((resolve17) => httpServer.listen(port, host, () => resolve17()));
   const addr = httpServer.address();
   return {
     httpServer,
     port: addr.port,
     url: `http://${host}:${addr.port}`,
-    stop: () => new Promise((resolve16) => {
-      httpServer.close(() => resolve16());
+    stop: () => new Promise((resolve17) => {
+      httpServer.close(() => resolve17());
     }),
     handler
   };
@@ -25016,23 +25044,23 @@ function buildMcpHttpServer(opts) {
     httpServer,
     routes,
     port,
-    stop: () => new Promise((resolve16) => {
+    stop: () => new Promise((resolve17) => {
       let pending = transports.size;
       if (pending === 0) {
-        httpServer.close(() => resolve16());
+        httpServer.close(() => resolve17());
         return;
       }
       for (const transport of transports.values()) {
         void transport.close().finally(() => {
           pending--;
-          if (pending === 0) httpServer.close(() => resolve16());
+          if (pending === 0) httpServer.close(() => resolve17());
         });
       }
     })
   };
 }
 function listenMcpHttpServer(server, host = "127.0.0.1") {
-  return new Promise((resolve16, reject) => {
+  return new Promise((resolve17, reject) => {
     server.httpServer.once("error", reject);
     server.httpServer.listen(server.port, host, () => {
       server.httpServer.off("error", reject);
@@ -25040,7 +25068,7 @@ function listenMcpHttpServer(server, host = "127.0.0.1") {
       if (addr && typeof addr === "object") {
         server.port = addr.port;
       }
-      resolve16();
+      resolve17();
     });
   });
 }
@@ -25123,7 +25151,7 @@ async function loadConfigSafe() {
 }
 // src/chat-cli.ts
-import * as path49 from "path";
+import * as path50 from "path";
 // src/chat/inbox.ts
 import { execFileSync as execFileSync25 } from "child_process";
@@ -25190,7 +25218,7 @@ async function waitForNextUserMessage(opts) {
   }
 }
 function sleep3(ms) {
-  return new Promise((resolve16) => setTimeout(resolve16, ms));
+  return new Promise((resolve17) => setTimeout(resolve17, ms));
 }
 function currentBranch(cwd) {
   try {
@@ -25404,7 +25432,7 @@ async function runChat(argv) {
 ${CHAT_HELP}`);
     return 64;
   }
-  const cwd = args.cwd ? path49.resolve(args.cwd) : process.cwd();
+  const cwd = args.cwd ? path50.resolve(args.cwd) : process.cwd();
   const sessionId = args.sessionId;
   const runRequest = readRunRequestFromEnv();
   if (runRequest && "request" in runRequest) {
@@ -25525,8 +25553,8 @@ init_config();
 // src/definition-hydration.ts
 init_state_backend();
 import { createHash as createHash5 } from "crypto";
-import * as fs49 from "fs";
-import * as path50 from "path";
+import * as fs50 from "fs";
+import * as path51 from "path";
 var SLUG_RE2 = /^[a-z0-9][a-z0-9_-]{0,63}$/;
 function assertSafeDefinitionPath(filePath) {
   const segments = filePath.split("/");
@@ -25560,32 +25588,32 @@ function writeDefinition(root, kind, definition) {
   if (kind === "agent") {
     const raw = bundle.files["agent.md"];
     if (typeof raw !== "string") throw new Error(`agent definition ${definition.slug} is missing agent.md`);
-    fs49.writeFileSync(path50.join(root, "agents", `${definition.slug}.md`), raw, "utf8");
+    fs50.writeFileSync(path51.join(root, "agents", `${definition.slug}.md`), raw, "utf8");
     return;
   }
   if (kind === "goal") {
-    const goalRoot = path50.join(root, "goals", definition.slug);
+    const goalRoot = path51.join(root, "goals", definition.slug);
     for (const [filePath, contents] of Object.entries(bundle.files)) {
-      const target = path50.join(goalRoot, filePath);
-      fs49.mkdirSync(path50.dirname(target), { recursive: true });
-      fs49.writeFileSync(target, contents, "utf8");
+      const target = path51.join(goalRoot, filePath);
+      fs50.mkdirSync(path51.dirname(target), { recursive: true });
+      fs50.writeFileSync(target, contents, "utf8");
     }
     return;
   }
-  const capabilityRoot = path50.join(root, "capabilities", definition.slug);
+  const capabilityRoot = path51.join(root, "capabilities", definition.slug);
   for (const [filePath, contents] of Object.entries(bundle.files)) {
-    const target = path50.join(capabilityRoot, filePath);
-    fs49.mkdirSync(path50.dirname(target), { recursive: true });
-    fs49.writeFileSync(target, contents, "utf8");
+    const target = path51.join(capabilityRoot, filePath);
+    fs50.mkdirSync(path51.dirname(target), { recursive: true });
+    fs50.writeFileSync(target, contents, "utf8");
   }
 }
 async function hydrateDefinitions(options) {
-  const root = path50.join(options.cwd, ".kody-engine", "definitions");
+  const root = path51.join(options.cwd, ".kody-engine", "definitions");
   const staging = `${root}.tmp-${process.pid}-${Date.now()}`;
-  fs49.rmSync(staging, { recursive: true, force: true });
-  fs49.mkdirSync(path50.join(staging, "agents"), { recursive: true });
-  fs49.mkdirSync(path50.join(staging, "capabilities"), { recursive: true });
-  fs49.mkdirSync(path50.join(staging, "goals"), { recursive: true });
+  fs50.rmSync(staging, { recursive: true, force: true });
+  fs50.mkdirSync(path51.join(staging, "agents"), { recursive: true });
+  fs50.mkdirSync(path51.join(staging, "capabilities"), { recursive: true });
+  fs50.mkdirSync(path51.join(staging, "goals"), { recursive: true });
   try {
     const [capabilities, agents, goals] = await Promise.all([
       options.backend.listDefinitions(options.tenantId, "capability"),
@@ -25611,22 +25639,21 @@ async function hydrateDefinitions(options) {
       hydratedAt: (/* @__PURE__ */ new Date()).toISOString(),
       versions: Object.fromEntries(Object.entries(versions).sort(([left], [right]) => left.localeCompare(right)))
     };
-    fs49.writeFileSync(path50.join(staging, "manifest.json"), `${JSON.stringify(manifest, null, 2)}
+    fs50.writeFileSync(path51.join(staging, "manifest.json"), `${JSON.stringify(manifest, null, 2)}
 `, "utf8");
-    fs49.rmSync(root, { recursive: true, force: true });
-    fs49.renameSync(staging, root);
+    fs50.rmSync(root, { recursive: true, force: true });
+    fs50.renameSync(staging, root);
     return { root, tenantId: options.tenantId, versions: manifest.versions };
   } catch (error) {
-    fs49.rmSync(staging, { recursive: true, force: true });
+    fs50.rmSync(staging, { recursive: true, force: true });
     throw error;
   }
 }
 async function hydrateDefinitionsFromEnv(cwd = process.cwd(), env = process.env) {
   const tenantId2 = env.GITHUB_REPOSITORY?.trim();
-  const hasCredentials = Boolean(env.CONVEX_URL?.trim()) && Boolean(env.KODY_SERVICE_KEY?.trim());
-  if (!hasCredentials) {
+  if (!hasStateBackendConfig(env)) {
     if (env.GITHUB_ACTIONS === "true") {
-      throw new Error("CONVEX_URL and KODY_SERVICE_KEY are required for backend definitions in GitHub Actions");
+      throw new Error("GitHub Actions workflow identity is required for backend definitions");
     }
     return null;
   }
@@ -25711,8 +25738,8 @@ var FlyClient = class {
   get fetch() {
     return this.opts.fetchImpl ?? fetch;
   }
-  async call(path51, init = {}) {
-    const res = await this.fetch(`${FLY_API_BASE}${path51}`, {
+  async call(path52, init = {}) {
+    const res = await this.fetch(`${FLY_API_BASE}${path52}`, {
       method: init.method ?? "GET",
       headers: {
         Authorization: `Bearer ${this.opts.token}`,
@@ -25723,7 +25750,7 @@ var FlyClient = class {
     if (res.status === 404 && init.allow404) return null;
     if (!res.ok) {
       const text2 = await res.text().catch(() => "");
-      throw new Error(`Fly API ${res.status} on ${path51}: ${text2.slice(0, 200) || res.statusText}`);
+      throw new Error(`Fly API ${res.status} on ${path52}: ${text2.slice(0, 200) || res.statusText}`);
     }
     if (res.status === 204) return null;
     const raw = await res.text();
@@ -26236,14 +26263,14 @@ function sendJson2(res, status, body) {
   res.end(JSON.stringify(body));
 }
 function readJsonBody2(req) {
-  return new Promise((resolve16, reject) => {
+  return new Promise((resolve17, reject) => {
     const chunks = [];
     req.on("data", (c) => chunks.push(c));
     req.on("end", () => {
       const raw = Buffer.concat(chunks).toString("utf-8");
-      if (!raw.trim()) return resolve16({});
+      if (!raw.trim()) return resolve17({});
       try {
-        resolve16(JSON.parse(raw));
+        resolve17(JSON.parse(raw));
       } catch (err) {
         reject(err instanceof Error ? err : new Error(String(err)));
       }
@@ -26454,10 +26481,10 @@ async function poolServe() {
     }
   });
   const apiHost = process.env.POOL_API_HOST ?? "::";
-  await new Promise((resolve16) => {
+  await new Promise((resolve17) => {
     server.listen(apiPort, apiHost, () => {
       log(`listening on ${apiHost}:${apiPort} (min=${min}, app=${app}, region=${region})`);
-      resolve16();
+      resolve17();
     });
   });
   if (loopTickEnabled) void runLoopTick();
@@ -26476,7 +26503,7 @@ async function poolServe() {
 // src/servers/runner-serve.ts
 import { spawn as spawn9 } from "child_process";
-import * as fs50 from "fs";
+import * as fs51 from "fs";
 import { createServer as createServer6 } from "http";
 var DEFAULT_PORT2 = 8080;
 var DEFAULT_WORKDIR = "/workspace/repo";
@@ -26497,17 +26524,17 @@ function authOk2(req, expected) {
   return false;
 }
 function readJsonBody3(req) {
-  return new Promise((resolve16, reject) => {
+  return new Promise((resolve17, reject) => {
     const chunks = [];
     req.on("data", (c) => chunks.push(c));
     req.on("end", () => {
       const raw = Buffer.concat(chunks).toString("utf-8");
       if (!raw.trim()) {
-        resolve16({});
+        resolve17({});
         return;
       }
       try {
-        resolve16(JSON.parse(raw));
+        resolve17(JSON.parse(raw));
       } catch (err) {
         reject(err instanceof Error ? err : new Error(String(err)));
       }
@@ -26611,8 +26638,8 @@ async function defaultRunJob(job) {
   const workdir = process.env.RUNNER_WORKDIR ?? DEFAULT_WORKDIR;
   const branch = job.ref ?? "main";
   const authUrl = `https://x-access-token:${job.githubToken}@github.com/${job.repo}.git`;
-  fs50.rmSync(workdir, { recursive: true, force: true });
-  fs50.mkdirSync(workdir, { recursive: true });
+  fs51.rmSync(workdir, { recursive: true, force: true });
+  fs51.mkdirSync(workdir, { recursive: true });
   const allSecrets = typeof job.allSecrets === "string" ? job.allSecrets : JSON.stringify(job.allSecrets ?? {});
   const target = job.runRequest.target;
   const interactive = target.type === "chat";
@@ -26641,13 +26668,13 @@ async function defaultRunJob(job) {
     ...interactive && job.idleExitMs ? { KODY_IDLE_EXIT_MS: String(job.idleExitMs) } : {},
     ...interactive && job.hardCapMs ? { KODY_HARD_CAP_MS: String(job.hardCapMs) } : {}
   };
-  const run = (cmd, args, cwd) => new Promise((resolve16) => {
+  const run = (cmd, args, cwd) => new Promise((resolve17) => {
     const child = spawn9(cmd, args, { stdio: "inherit", env: childEnv, cwd });
-    child.on("exit", (code) => resolve16(code ?? 0));
+    child.on("exit", (code) => resolve17(code ?? 0));
     child.on("error", (err) => {
       process.stderr.write(`[runner-serve] ${cmd} failed: ${err.message}
 `);
-      resolve16(1);
+      resolve17(1);
     });
   });
   process.stdout.write(`[runner-serve] job ${job.jobId}: cloning ${job.repo}@${branch}
@@ -26723,11 +26750,11 @@ async function runnerServe() {
   const port = Number(process.env.PORT ?? DEFAULT_PORT2);
   const server = buildServer2({ apiKey });
   const host = process.env.RUNNER_HOST ?? "::";
-  await new Promise((resolve16) => {
+  await new Promise((resolve17) => {
     server.listen(port, host, () => {
       process.stdout.write(`[runner-serve] listening on ${host}:${port} (idle, awaiting job)
 `);
-      resolve16();
+      resolve17();
     });
   });
   const shutdown = (signal) => {
@@ -26796,14 +26823,14 @@ async function serve(opts) {
 `);
     const args = ["--dangerously-skip-permissions", "--model", model.model];
     const child = spawn10("claude", args, { stdio: "inherit", env: editorEnv, cwd: opts.cwd });
-    const exitCode = await new Promise((resolve16) => {
-      child.on("exit", (code) => resolve16(code ?? 0));
+    const exitCode = await new Promise((resolve17) => {
+      child.on("exit", (code) => resolve17(code ?? 0));
       child.on("error", (err) => {
         process.stderr.write(`[kody serve] failed to launch Claude Code: ${err.message}
 `);
         process.stderr.write(`  Install: https://docs.anthropic.com/claude/docs/claude-code
 `);
-        resolve16(1);
+        resolve17(1);
       });
     });
     killProxy();
@@ -27187,7 +27214,7 @@ function parseArgs(argv) {
 }
 async function main(argv = process.argv.slice(2)) {
   unpackAllSecrets();
-  const cwdFlag = argv.findIndex((value) => value === "--cwd");
+  const cwdFlag = argv.indexOf("--cwd");
   const definitionCwd = cwdFlag >= 0 && argv[cwdFlag + 1] ? argv[cwdFlag + 1] : process.cwd();
   const shouldHydrate = Boolean(process.env.CONVEX_URL?.trim()) || process.env.GITHUB_ACTIONS === "true" && Boolean(process.env.GITHUB_EVENT_NAME);
   if (shouldHydrate) {