@kody-ade/kody-engine 0.4.485 → 0.4.488

package/dist/bin/kody.js

@@ -15,7 +15,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "@kody-ade/kody-engine",
-      version: "0.4.485",
+      version: "0.4.487",
       description: "kody \u2014 autonomous development engine. Single-session Claude Code agent behind a generic executor + declarative implementation profiles.",
       license: "MIT",
       type: "module",
@@ -15475,6 +15475,18 @@ async function resolveRuntimeSecret(name, ctx, opts = {}) {
   }
   return envSecret(name, env);
 }
+async function resolveRuntimeSecrets(names, ctx, opts = {}) {
+  const declared = Array.isArray(names) ? [...new Set(names.filter((name) => typeof name === "string" && /^[A-Z][A-Z0-9_]*$/.test(name)))] : [];
+  const resolved = await Promise.all(
+    declared.map(async (name) => ({ name, result: await resolveRuntimeSecret(name, ctx, opts) }))
+  );
+  return {
+    environment: Object.fromEntries(
+      resolved.flatMap(({ name, result }) => result.value ? [[name, result.value]] : [])
+    ),
+    warnings: resolved.flatMap(({ result }) => result.warning ? [result.warning] : [])
+  };
+}
 var init_runtimeSecrets = __esm({
   "src/scripts/runtimeSecrets.ts"() {
     "use strict";
@@ -19150,16 +19162,6 @@ import * as fs47 from "fs";
 function formatDuration2(timeoutMs) {
   return timeoutMs % 6e4 === 0 ? `${timeoutMs / 6e4} minutes` : `${timeoutMs}ms`;
 }
-function declaredSecrets(names, parent) {
-  if (!Array.isArray(names)) return {};
-  const secrets = {};
-  for (const name of names) {
-    if (typeof name !== "string" || !/^[A-Z][A-Z0-9_]*$/.test(name)) continue;
-    const value = parent[name];
-    if (value !== void 0) secrets[name] = value;
-  }
-  return secrets;
-}
 function isRegularFile2(filePath) {
   try {
     const stat = fs47.lstatSync(filePath);
@@ -19176,6 +19178,7 @@ var init_runSimpleCapabilityScript = __esm({
   "src/scripts/runSimpleCapabilityScript.ts"() {
     "use strict";
     init_capabilityResult();
+    init_runtimeSecrets();
     init_tickShellRunner();
     DEFAULT_SCRIPT_TIMEOUT_MS = 5 * 60 * 1e3;
     SCRIPT_MAX_OUTPUT_BYTES = 1024 * 1024;
@@ -19188,13 +19191,17 @@ var init_runSimpleCapabilityScript = __esm({
         return;
       }
       const capabilityEnvironment = isStringRecord(ctx.data.capabilityEnvironment) ? ctx.data.capabilityEnvironment : {};
-      const capabilitySecrets = declaredSecrets(ctx.data.capabilitySecretNames, process.env);
+      const capabilitySecrets = await resolveRuntimeSecrets(ctx.data.capabilitySecretNames, ctx);
+      for (const warning of capabilitySecrets.warnings) {
+        process.stderr.write(`\u2192 kody: WARNING ${warning}
+`);
+      }
       const timeoutMs = typeof ctx.data.capabilityScriptTimeoutMs === "number" ? ctx.data.capabilityScriptTimeoutMs : DEFAULT_SCRIPT_TIMEOUT_MS;
       const result = spawnSync3("bash", [scriptPath], {
         cwd: ctx.cwd,
         env: {
           ...buildTickChildEnv(process.env, false),
-          ...capabilitySecrets,
+          ...capabilitySecrets.environment,
           ...capabilityEnvironment
         },
         stdio: ["ignore", "pipe", "pipe"],
@@ -24233,14 +24240,14 @@ function primaryNumericInputName(implementation) {
   const intInput = inputs.find((i) => i.type === "int" && i.required);
   return intInput?.name ?? null;
 }
-function resolveOperatorAction(action) {
-  return resolveCapabilityAction(action);
+function resolveOperatorAction(action, projectCapabilitiesRoot) {
+  return resolveCapabilityAction(action, projectCapabilitiesRoot);
 }
-function resolveConfiguredAction(action) {
-  return resolveCapabilityAction(action);
+function resolveConfiguredAction(action, projectCapabilitiesRoot) {
+  return resolveCapabilityAction(action, projectCapabilitiesRoot);
 }
-function requiredRoute(action) {
-  const route = resolveConfiguredAction(action);
+function requiredRoute(action, projectCapabilitiesRoot) {
+  const route = resolveConfiguredAction(action, projectCapabilitiesRoot);
   if (!route) throw new Error(`required capability action not found: ${action}`);
   return route;
 }
@@ -24256,9 +24263,14 @@ function routeResult(route, cliArgs, target, why) {
   return result;
 }
 function autoDispatch(opts) {
+  const projectCapabilitiesRoot = opts?.projectCapabilitiesRoot;
   const explicit = opts?.explicit;
   if (explicit?.issueNumber && explicit.issueNumber > 0) {
-    return routeResult(requiredRoute("run"), { issue: explicit.issueNumber }, explicit.issueNumber);
+    return routeResult(
+      requiredRoute("run", projectCapabilitiesRoot),
+      { issue: explicit.issueNumber },
+      explicit.issueNumber
+    );
   }
   const eventName = process.env.GITHUB_EVENT_NAME;
   const eventPath = process.env.GITHUB_EVENT_PATH;
@@ -24274,7 +24286,7 @@ function autoDispatch(opts) {
     const n = parseInt(String(inputs2?.issue_number ?? ""), 10);
     if (!Number.isNaN(n) && n > 0) {
       const actionName = String(inputs2?.capability ?? "").trim() || "run";
-      const route2 = resolveConfiguredAction(actionName);
+      const route2 = resolveConfiguredAction(actionName, projectCapabilitiesRoot);
       if (!route2) return null;
       const base = String(inputs2?.base ?? "").trim();
       const profileInputs = getProfileInputs(route2.implementation);
@@ -24296,7 +24308,7 @@ function autoDispatch(opts) {
     if (actionName && (action === "opened" || action === "synchronize" || action === "reopened")) {
       const pullRequest = objectValue(event.pull_request);
       if (isReleasePullRequest(pullRequest, opts?.config)) return null;
-      const route2 = resolveConfiguredAction(actionName);
+      const route2 = resolveConfiguredAction(actionName, projectCapabilitiesRoot);
       if (!route2) return null;
       const prNum = Number(pullRequest?.number ?? event.number ?? 0);
       if (prNum > 0) {
@@ -24335,7 +24347,7 @@ function autoDispatch(opts) {
   let route = null;
   let consumedFirstToken = false;
   if (aliased) {
-    route = resolveOperatorAction(aliased);
+    route = resolveOperatorAction(aliased, projectCapabilitiesRoot);
     if (route) {
       consumedFirstToken = true;
     } else if (firstToken && aliases[firstToken] && aliases[firstToken] === aliased) {
@@ -24347,7 +24359,7 @@ function autoDispatch(opts) {
   }
   if (!route && !firstToken) {
     const defaultAction = isPr ? opts?.config?.defaultPrImplementation ?? null : opts?.config?.defaultImplementation ?? null;
-    route = defaultAction ? resolveConfiguredAction(defaultAction) : null;
+    route = defaultAction ? resolveConfiguredAction(defaultAction, projectCapabilitiesRoot) : null;
   }
   if (isBotAuthor && !consumedFirstToken) {
     process.stderr.write(
@@ -24358,14 +24370,14 @@ function autoDispatch(opts) {
   }
   if (!route) {
     if (!firstToken) return null;
-    const profileMissing = aliased ? resolveOperatorAction(aliased) === null : true;
+    const profileMissing = aliased ? resolveOperatorAction(aliased, projectCapabilitiesRoot) === null : true;
     process.stderr.write(
       `[kody] dispatch: no capability action resolved for issue_comment (firstToken=${firstToken ?? "<none>"}, aliased=${aliased ?? "<none>"}, actionFound=${!profileMissing}, defaultImplementation=${opts?.config?.defaultImplementation ?? "<unset>"}, defaultPrImplementation=${opts?.config?.defaultPrImplementation ?? "<unset>"})
 `
     );
     return null;
   }
-  const inputs = getProfileInputs(route.implementation);
+  const inputs = getCapabilityActionInputs(route.action, projectCapabilitiesRoot);
   const effectiveInputs = inputs ?? [];
   const unknownProfile = inputs === null;
   const rest = extractCommentRest(afterTag, consumedFirstToken ? firstToken : null);
@@ -24440,7 +24452,7 @@ function autoDispatchTyped(opts) {
       reason: tokenRaw ? `polite-word lead-in '${tokenRaw}', no default capability action configured` : "no subcommand token, no default capability action configured"
     };
   }
-  const available = listCapabilityActions().map((e) => e.action).filter((n) => !n.startsWith("goal-") && !n.startsWith("job-")).sort();
+  const available = listCapabilityActions(opts?.projectCapabilitiesRoot).map((e) => e.action).filter((n) => !n.startsWith("goal-") && !n.startsWith("job-")).sort();
   return { kind: "unrecognized", token: tokenRaw, target: targetNum, isPr, available };
 }
 function dispatchScheduledWatches(opts) {
@@ -24651,7 +24663,7 @@ Options:
   --package-manager    Override package-manager auto-detect
 
 Environment:
-  ALL_SECRETS          JSON blob of all GitHub secrets (auto-populated in CI)
+  ALL_SECRETS          Legacy JSON secret blob (supported, never generated by current templates)
   KODY_TOKEN|GH_TOKEN|GITHUB_TOKEN|GH_PAT   auth token for gh/git operations
 
 Exit codes (inherited from kody run):
@@ -24968,7 +24980,8 @@ async function runCi(argv) {
   } catch (err) {
     earlyConfigError = err instanceof Error ? err : new Error(String(err));
   }
-  const autoFallback = !args.issueNumber ? autoDispatch({ config: earlyConfig }) : null;
+  const dispatchCapabilitiesRoot = capabilitiesRoot(cwd);
+  const autoFallback = !args.issueNumber ? autoDispatch({ config: earlyConfig, projectCapabilitiesRoot: dispatchCapabilitiesRoot }) : null;
   const eventName = process.env.GITHUB_EVENT_NAME;
   const scheduledActionsWake = isScheduledActionsWake();
   const dispatchEventPath = process.env.GITHUB_EVENT_PATH;
@@ -25150,7 +25163,10 @@ async function runCi(argv) {
     return runScheduledFanOut(cwd, args, { force: manualWorkflowDispatch });
   }
   if (!args.issueNumber && !autoFallback && process.env.GITHUB_EVENT_NAME) {
-    const outcome = autoDispatchTyped({ config: earlyConfig });
+    const outcome = autoDispatchTyped({
+      config: earlyConfig,
+      projectCapabilitiesRoot: dispatchCapabilitiesRoot
+    });
     if (outcome.kind === "rejected") {
       try {
         unpackAllSecrets();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kody-ade/kody-engine",
-  "version": "0.4.485",
+  "version": "0.4.488",
   "description": "kody — autonomous development engine. Single-session Claude Code agent behind a generic executor + declarative implementation profiles.",
   "license": "MIT",
   "type": "module",
@@ -12,6 +12,29 @@
     "templates",
     "kody.config.schema.json"
   ],
+  "scripts": {
+    "kody:run": "tsx bin/kody.ts",
+    "serve": "tsx bin/kody.ts serve",
+    "serve:vscode": "tsx bin/kody.ts serve vscode",
+    "serve:claude": "tsx bin/kody.ts serve claude",
+    "clean:dist": "node scripts/clean-dist.cjs",
+    "build": "pnpm clean:dist && tsup && node scripts/copy-assets.cjs",
+    "check:modularity": "tsx scripts/check-script-modularity.ts",
+    "pretest": "pnpm check:modularity",
+    "test": "vitest run tests/unit tests/int --coverage",
+    "posttest": "tsx scripts/check-coverage-floor.ts",
+    "test:smoke": "vitest run tests/smoke --no-coverage",
+    "test:e2e": "vitest run tests/e2e --no-coverage",
+    "test:runtime-services": "node --test \"tests/runtime-services/*.test.mjs\"",
+    "test:all": "vitest run tests --no-coverage",
+    "typecheck": "tsc --noEmit",
+    "lint": "biome check",
+    "lint:fix": "biome check --write",
+    "format": "biome format --write",
+    "verify:package": "node scripts/verify-package-tarball.cjs",
+    "brain:publish": "docker buildx build --platform linux/amd64 -f runner/Dockerfile.brain --build-arg KODY_ENGINE_REF=$(git rev-parse HEAD) -t ghcr.io/${KODY_BRAIN_GHCR_OWNER:-aharonyaircohen}/kody-brain:latest --push runner",
+    "prepublishOnly": "pnpm typecheck && vitest run tests/unit tests/int --no-coverage && pnpm test:runtime-services && pnpm build && pnpm verify:package"
+  },
   "dependencies": {
     "@actions/cache": "^6.0.0",
     "@anthropic-ai/claude-agent-sdk": "0.2.119",
@@ -38,27 +61,5 @@
     "url": "git+https://github.com/aharonyaircohen/kody-engine.git"
   },
   "homepage": "https://github.com/aharonyaircohen/kody-engine",
-  "bugs": "https://github.com/aharonyaircohen/kody-engine/issues",
-  "scripts": {
-    "kody:run": "tsx bin/kody.ts",
-    "serve": "tsx bin/kody.ts serve",
-    "serve:vscode": "tsx bin/kody.ts serve vscode",
-    "serve:claude": "tsx bin/kody.ts serve claude",
-    "clean:dist": "node scripts/clean-dist.cjs",
-    "build": "pnpm clean:dist && tsup && node scripts/copy-assets.cjs",
-    "check:modularity": "tsx scripts/check-script-modularity.ts",
-    "pretest": "pnpm check:modularity",
-    "test": "vitest run tests/unit tests/int --coverage",
-    "posttest": "tsx scripts/check-coverage-floor.ts",
-    "test:smoke": "vitest run tests/smoke --no-coverage",
-    "test:e2e": "vitest run tests/e2e --no-coverage",
-    "test:runtime-services": "node --test \"tests/runtime-services/*.test.mjs\"",
-    "test:all": "vitest run tests --no-coverage",
-    "typecheck": "tsc --noEmit",
-    "lint": "biome check",
-    "lint:fix": "biome check --write",
-    "format": "biome format --write",
-    "verify:package": "node scripts/verify-package-tarball.cjs",
-    "brain:publish": "docker buildx build --platform linux/amd64 -f runner/Dockerfile.brain --build-arg KODY_ENGINE_REF=$(git rev-parse HEAD) -t ghcr.io/${KODY_BRAIN_GHCR_OWNER:-aharonyaircohen}/kody-brain:latest --push runner"
-  }
-}
+  "bugs": "https://github.com/aharonyaircohen/kody-engine/issues"
+}

package/templates/kody.yml

@@ -75,7 +75,10 @@ jobs:
           node-version: 22
 
       - env:
-          ALL_SECRETS: ${{ toJSON(secrets) }}
+          GH_PAT: ${{ secrets.GH_PAT }}
+          KODY_TOKEN: ${{ secrets.KODY_TOKEN }}
+          KODY_APP_ID: ${{ secrets.KODY_APP_ID }}
+          KODY_APP_PRIVATE_KEY: ${{ secrets.KODY_APP_PRIVATE_KEY }}
           SESSION_ID: ${{ inputs.sessionId }}
           INIT_MESSAGE: ${{ inputs.message }}
           MODEL: ${{ inputs.model }}