@kody-ade/kody-engine 0.4.492 → 0.4.494

package/dist/bin/kody.js

@@ -15,7 +15,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "@kody-ade/kody-engine",
-      version: "0.4.492",
+      version: "0.4.494",
       description: "kody \u2014 autonomous development engine. Single-session Claude Code agent behind a generic executor + declarative implementation profiles.",
       license: "MIT",
       type: "module",
@@ -2448,12 +2448,12 @@ async function readRuntimeSecretFromKody(name, env = process.env) {
   const body = await response.json();
   return typeof body.value === "string" ? body.value : null;
 }
-async function writeRuntimeSecretToKody(name, value, env = process.env) {
+async function writeRuntimeSecretsToKody(secrets, env = process.env) {
   const token = await githubOidcToken(env);
   const response = await fetch(`${resolveKodyApiUrl(env)}/api/kody/engine/secret`, {
     method: "PUT",
     headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json" },
-    body: JSON.stringify({ name, value }),
+    body: JSON.stringify({ secrets }),
     signal: AbortSignal.timeout(3e4)
   });
   if (!response.ok) throw new Error(`Kody secret upsert failed (${response.status})`);
@@ -4325,9 +4325,12 @@ function validateCapabilityContractValue(boundary, schema, value) {
     throw new CapabilityContractValidationError(boundary, validate.errors ?? []);
   }
 }
-function capabilityContractInput(inputs, args) {
+function capabilityContractInput(inputs, args, capabilityId) {
   const isGenericRunnerInput = inputs.some((input) => input.name === "input") && Object.hasOwn(args, "input");
-  if (!isGenericRunnerInput) return args;
+  if (!isGenericRunnerInput) {
+    const isParameterlessGenericRunner = (inputs.some((input) => input.name === "capability") || args.capability === capabilityId) && Object.hasOwn(args, "capability");
+    return isParameterlessGenericRunner ? {} : args;
+  }
   const value = args.input;
   if (typeof value !== "string") return value;
   try {
@@ -15457,9 +15460,7 @@ async function resolveRuntimeSecret(name, ctx, opts = {}) {
     try {
       const value = await readRuntimeSecretFromKody(name, env);
       if (value) return { value, source: "vault" };
-      const fallback = envSecret(name, env);
-      if (fallback.value) await writeRuntimeSecretToKody(name, fallback.value, env);
-      return fallback;
+      return envSecret(name, env);
     } catch (err) {
       const fallback = envSecret(name, env);
       return {
@@ -15493,14 +15494,26 @@ async function resolveRuntimeSecret(name, ctx, opts = {}) {
 }
 async function resolveRuntimeSecrets(names, ctx, opts = {}) {
   const declared = Array.isArray(names) ? [...new Set(names.filter((name) => typeof name === "string" && /^[A-Z][A-Z0-9_]*$/.test(name)))] : [];
-  const resolved = await Promise.all(
-    declared.map(async (name) => ({ name, result: await resolveRuntimeSecret(name, ctx, opts) }))
+  const resolved = [];
+  for (const name of declared) {
+    resolved.push({ name, result: await resolveRuntimeSecret(name, ctx, opts) });
+  }
+  const warnings = resolved.flatMap(({ result }) => result.warning ? [result.warning] : []);
+  const fallbackSecrets = Object.fromEntries(
+    resolved.flatMap(({ name, result }) => result.source === "env" && result.value ? [[name, result.value]] : [])
   );
+  if (hasGitHubActionsIdentity(opts.env ?? process.env) && Object.keys(fallbackSecrets).length > 0) {
+    try {
+      await writeRuntimeSecretsToKody(fallbackSecrets, opts.env ?? process.env);
+    } catch (err) {
+      warnings.push(`Kody secret migration failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
   return {
     environment: Object.fromEntries(
       resolved.flatMap(({ name, result }) => result.value ? [[name, result.value]] : [])
     ),
-    warnings: resolved.flatMap(({ result }) => result.warning ? [result.warning] : [])
+    warnings
   };
 }
 var init_runtimeSecrets = __esm({
@@ -20984,7 +20997,11 @@ async function runImplementation(profileName, input) {
       validateCapabilityContractValue(
         "input",
         profile.canonicalContract.inputSchema,
-        capabilityContractInput(profile.inputs, args)
+        capabilityContractInput(
+          profile.inputs,
+          args,
+          profile.canonicalContract.capabilityId
+        )
       );
     }
   } catch (err) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kody-ade/kody-engine",
-  "version": "0.4.492",
+  "version": "0.4.494",
   "description": "kody — autonomous development engine. Single-session Claude Code agent behind a generic executor + declarative implementation profiles.",
   "license": "MIT",
   "type": "module",