@kody-ade/kody-engine 0.4.484 → 0.4.487

package/dist/bin/kody.js

@@ -15,7 +15,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "@kody-ade/kody-engine",
-      version: "0.4.484",
+      version: "0.4.487",
       description: "kody \u2014 autonomous development engine. Single-session Claude Code agent behind a generic executor + declarative implementation profiles.",
       license: "MIT",
       type: "module",
@@ -4315,6 +4315,17 @@ function validateCapabilityContractValue(boundary, schema, value) {
     throw new CapabilityContractValidationError(boundary, validate.errors ?? []);
   }
 }
+function capabilityContractInput(inputs, args) {
+  const isGenericRunnerInput = inputs.some((input) => input.name === "capability") && inputs.some((input) => input.name === "input");
+  if (!isGenericRunnerInput) return args;
+  const value = args.input;
+  if (typeof value !== "string") return value;
+  try {
+    return JSON.parse(value);
+  } catch {
+    return value;
+  }
+}
 var validator, CapabilityContractValidationError;
 var init_capability_contract_validation = __esm({
   "src/agency/capability-contract-validation.ts"() {
@@ -15464,6 +15475,18 @@ async function resolveRuntimeSecret(name, ctx, opts = {}) {
   }
   return envSecret(name, env);
 }
+async function resolveRuntimeSecrets(names, ctx, opts = {}) {
+  const declared = Array.isArray(names) ? [...new Set(names.filter((name) => typeof name === "string" && /^[A-Z][A-Z0-9_]*$/.test(name)))] : [];
+  const resolved = await Promise.all(
+    declared.map(async (name) => ({ name, result: await resolveRuntimeSecret(name, ctx, opts) }))
+  );
+  return {
+    environment: Object.fromEntries(
+      resolved.flatMap(({ name, result }) => result.value ? [[name, result.value]] : [])
+    ),
+    warnings: resolved.flatMap(({ result }) => result.warning ? [result.warning] : [])
+  };
+}
 var init_runtimeSecrets = __esm({
   "src/scripts/runtimeSecrets.ts"() {
     "use strict";
@@ -19139,16 +19162,6 @@ import * as fs47 from "fs";
 function formatDuration2(timeoutMs) {
   return timeoutMs % 6e4 === 0 ? `${timeoutMs / 6e4} minutes` : `${timeoutMs}ms`;
 }
-function declaredSecrets(names, parent) {
-  if (!Array.isArray(names)) return {};
-  const secrets = {};
-  for (const name of names) {
-    if (typeof name !== "string" || !/^[A-Z][A-Z0-9_]*$/.test(name)) continue;
-    const value = parent[name];
-    if (value !== void 0) secrets[name] = value;
-  }
-  return secrets;
-}
 function isRegularFile2(filePath) {
   try {
     const stat = fs47.lstatSync(filePath);
@@ -19165,6 +19178,7 @@ var init_runSimpleCapabilityScript = __esm({
   "src/scripts/runSimpleCapabilityScript.ts"() {
     "use strict";
     init_capabilityResult();
+    init_runtimeSecrets();
     init_tickShellRunner();
     DEFAULT_SCRIPT_TIMEOUT_MS = 5 * 60 * 1e3;
     SCRIPT_MAX_OUTPUT_BYTES = 1024 * 1024;
@@ -19177,13 +19191,17 @@ var init_runSimpleCapabilityScript = __esm({
         return;
       }
       const capabilityEnvironment = isStringRecord(ctx.data.capabilityEnvironment) ? ctx.data.capabilityEnvironment : {};
-      const capabilitySecrets = declaredSecrets(ctx.data.capabilitySecretNames, process.env);
+      const capabilitySecrets = await resolveRuntimeSecrets(ctx.data.capabilitySecretNames, ctx);
+      for (const warning of capabilitySecrets.warnings) {
+        process.stderr.write(`\u2192 kody: WARNING ${warning}
+`);
+      }
       const timeoutMs = typeof ctx.data.capabilityScriptTimeoutMs === "number" ? ctx.data.capabilityScriptTimeoutMs : DEFAULT_SCRIPT_TIMEOUT_MS;
       const result = spawnSync3("bash", [scriptPath], {
         cwd: ctx.cwd,
         env: {
           ...buildTickChildEnv(process.env, false),
-          ...capabilitySecrets,
+          ...capabilitySecrets.environment,
           ...capabilityEnvironment
         },
         stdio: ["ignore", "pipe", "pipe"],
@@ -20943,7 +20961,11 @@ async function runImplementation(profileName, input) {
   try {
     args = validateInputs(profile.inputs, input.cliArgs);
     if (profile.canonicalContract) {
-      validateCapabilityContractValue("input", profile.canonicalContract.inputSchema, args);
+      validateCapabilityContractValue(
+        "input",
+        profile.canonicalContract.inputSchema,
+        capabilityContractInput(profile.inputs, args)
+      );
     }
   } catch (err) {
     return finishAndEnd({ exitCode: 64, reason: err instanceof Error ? err.message : String(err) });
@@ -24218,14 +24240,14 @@ function primaryNumericInputName(implementation) {
   const intInput = inputs.find((i) => i.type === "int" && i.required);
   return intInput?.name ?? null;
 }
-function resolveOperatorAction(action) {
-  return resolveCapabilityAction(action);
+function resolveOperatorAction(action, projectCapabilitiesRoot) {
+  return resolveCapabilityAction(action, projectCapabilitiesRoot);
 }
-function resolveConfiguredAction(action) {
-  return resolveCapabilityAction(action);
+function resolveConfiguredAction(action, projectCapabilitiesRoot) {
+  return resolveCapabilityAction(action, projectCapabilitiesRoot);
 }
-function requiredRoute(action) {
-  const route = resolveConfiguredAction(action);
+function requiredRoute(action, projectCapabilitiesRoot) {
+  const route = resolveConfiguredAction(action, projectCapabilitiesRoot);
   if (!route) throw new Error(`required capability action not found: ${action}`);
   return route;
 }
@@ -24241,9 +24263,14 @@ function routeResult(route, cliArgs, target, why) {
   return result;
 }
 function autoDispatch(opts) {
+  const projectCapabilitiesRoot = opts?.projectCapabilitiesRoot;
   const explicit = opts?.explicit;
   if (explicit?.issueNumber && explicit.issueNumber > 0) {
-    return routeResult(requiredRoute("run"), { issue: explicit.issueNumber }, explicit.issueNumber);
+    return routeResult(
+      requiredRoute("run", projectCapabilitiesRoot),
+      { issue: explicit.issueNumber },
+      explicit.issueNumber
+    );
   }
   const eventName = process.env.GITHUB_EVENT_NAME;
   const eventPath = process.env.GITHUB_EVENT_PATH;
@@ -24259,7 +24286,7 @@ function autoDispatch(opts) {
     const n = parseInt(String(inputs2?.issue_number ?? ""), 10);
     if (!Number.isNaN(n) && n > 0) {
       const actionName = String(inputs2?.capability ?? "").trim() || "run";
-      const route2 = resolveConfiguredAction(actionName);
+      const route2 = resolveConfiguredAction(actionName, projectCapabilitiesRoot);
       if (!route2) return null;
       const base = String(inputs2?.base ?? "").trim();
       const profileInputs = getProfileInputs(route2.implementation);
@@ -24281,7 +24308,7 @@ function autoDispatch(opts) {
     if (actionName && (action === "opened" || action === "synchronize" || action === "reopened")) {
       const pullRequest = objectValue(event.pull_request);
       if (isReleasePullRequest(pullRequest, opts?.config)) return null;
-      const route2 = resolveConfiguredAction(actionName);
+      const route2 = resolveConfiguredAction(actionName, projectCapabilitiesRoot);
       if (!route2) return null;
       const prNum = Number(pullRequest?.number ?? event.number ?? 0);
       if (prNum > 0) {
@@ -24320,7 +24347,7 @@ function autoDispatch(opts) {
   let route = null;
   let consumedFirstToken = false;
   if (aliased) {
-    route = resolveOperatorAction(aliased);
+    route = resolveOperatorAction(aliased, projectCapabilitiesRoot);
     if (route) {
       consumedFirstToken = true;
     } else if (firstToken && aliases[firstToken] && aliases[firstToken] === aliased) {
@@ -24332,7 +24359,7 @@ function autoDispatch(opts) {
   }
   if (!route && !firstToken) {
     const defaultAction = isPr ? opts?.config?.defaultPrImplementation ?? null : opts?.config?.defaultImplementation ?? null;
-    route = defaultAction ? resolveConfiguredAction(defaultAction) : null;
+    route = defaultAction ? resolveConfiguredAction(defaultAction, projectCapabilitiesRoot) : null;
   }
   if (isBotAuthor && !consumedFirstToken) {
     process.stderr.write(
@@ -24343,14 +24370,14 @@ function autoDispatch(opts) {
   }
   if (!route) {
     if (!firstToken) return null;
-    const profileMissing = aliased ? resolveOperatorAction(aliased) === null : true;
+    const profileMissing = aliased ? resolveOperatorAction(aliased, projectCapabilitiesRoot) === null : true;
     process.stderr.write(
       `[kody] dispatch: no capability action resolved for issue_comment (firstToken=${firstToken ?? "<none>"}, aliased=${aliased ?? "<none>"}, actionFound=${!profileMissing}, defaultImplementation=${opts?.config?.defaultImplementation ?? "<unset>"}, defaultPrImplementation=${opts?.config?.defaultPrImplementation ?? "<unset>"})
 `
     );
     return null;
   }
-  const inputs = getProfileInputs(route.implementation);
+  const inputs = getCapabilityActionInputs(route.action, projectCapabilitiesRoot);
   const effectiveInputs = inputs ?? [];
   const unknownProfile = inputs === null;
   const rest = extractCommentRest(afterTag, consumedFirstToken ? firstToken : null);
@@ -24425,7 +24452,7 @@ function autoDispatchTyped(opts) {
       reason: tokenRaw ? `polite-word lead-in '${tokenRaw}', no default capability action configured` : "no subcommand token, no default capability action configured"
     };
   }
-  const available = listCapabilityActions().map((e) => e.action).filter((n) => !n.startsWith("goal-") && !n.startsWith("job-")).sort();
+  const available = listCapabilityActions(opts?.projectCapabilitiesRoot).map((e) => e.action).filter((n) => !n.startsWith("goal-") && !n.startsWith("job-")).sort();
   return { kind: "unrecognized", token: tokenRaw, target: targetNum, isPr, available };
 }
 function dispatchScheduledWatches(opts) {
@@ -24636,7 +24663,7 @@ Options:
   --package-manager    Override package-manager auto-detect
 
 Environment:
-  ALL_SECRETS          JSON blob of all GitHub secrets (auto-populated in CI)
+  ALL_SECRETS          Legacy JSON secret blob (supported, never generated by current templates)
   KODY_TOKEN|GH_TOKEN|GITHUB_TOKEN|GH_PAT   auth token for gh/git operations
 
 Exit codes (inherited from kody run):
@@ -24953,7 +24980,8 @@ async function runCi(argv) {
   } catch (err) {
     earlyConfigError = err instanceof Error ? err : new Error(String(err));
   }
-  const autoFallback = !args.issueNumber ? autoDispatch({ config: earlyConfig }) : null;
+  const dispatchCapabilitiesRoot = capabilitiesRoot(cwd);
+  const autoFallback = !args.issueNumber ? autoDispatch({ config: earlyConfig, projectCapabilitiesRoot: dispatchCapabilitiesRoot }) : null;
   const eventName = process.env.GITHUB_EVENT_NAME;
   const scheduledActionsWake = isScheduledActionsWake();
   const dispatchEventPath = process.env.GITHUB_EVENT_PATH;
@@ -25135,7 +25163,10 @@ async function runCi(argv) {
     return runScheduledFanOut(cwd, args, { force: manualWorkflowDispatch });
   }
   if (!args.issueNumber && !autoFallback && process.env.GITHUB_EVENT_NAME) {
-    const outcome = autoDispatchTyped({ config: earlyConfig });
+    const outcome = autoDispatchTyped({
+      config: earlyConfig,
+      projectCapabilitiesRoot: dispatchCapabilitiesRoot
+    });
     if (outcome.kind === "rejected") {
       try {
         unpackAllSecrets();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kody-ade/kody-engine",
-  "version": "0.4.484",
+  "version": "0.4.487",
   "description": "kody — autonomous development engine. Single-session Claude Code agent behind a generic executor + declarative implementation profiles.",
   "license": "MIT",
   "type": "module",

package/templates/kody.yml

@@ -75,7 +75,10 @@ jobs:
           node-version: 22
 
       - env:
-          ALL_SECRETS: ${{ toJSON(secrets) }}
+          GH_PAT: ${{ secrets.GH_PAT }}
+          KODY_TOKEN: ${{ secrets.KODY_TOKEN }}
+          KODY_APP_ID: ${{ secrets.KODY_APP_ID }}
+          KODY_APP_PRIVATE_KEY: ${{ secrets.KODY_APP_PRIVATE_KEY }}
           SESSION_ID: ${{ inputs.sessionId }}
           INIT_MESSAGE: ${{ inputs.message }}
           MODEL: ${{ inputs.model }}