@kody-ade/kody-engine 0.4.496 → 0.4.498

package/README.md

@@ -107,7 +107,11 @@ fans out scheduled capabilities at runtime, so capability schedules never
 generate additional GitHub workflow files. Idempotent — pass `--force` to
 overwrite.
 
-Required repo secrets: at least one model provider key (e.g. `MINIMAX_API_KEY`, `ANTHROPIC_API_KEY`). Recommended: `KODY_TOKEN` PAT so kody's commits trigger downstream CI and can modify `.github/workflows/*`.
+Store model provider keys (for example `MINIMAX_API_KEY`) in the connected
+repository's Kody vault. GitHub Actions uses OIDC to request only the selected
+model key at runtime; user secrets are not copied into Actions. `KODY_TOKEN`
+remains an optional GitHub authentication fallback when Kody must trigger
+downstream workflows or modify `.github/workflows/*`.
 
 The consumer workflow listens on `issue_comment` for `@kody ...` dispatch and `workflow_dispatch` for manual runs, chat mode, and scheduled wakeups.
 

package/dist/bin/kody.js

@@ -15,7 +15,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "@kody-ade/kody-engine",
-      version: "0.4.496",
+      version: "0.4.498",
       description: "kody \u2014 autonomous development engine. Single-session Claude Code agent behind a generic executor + declarative implementation profiles.",
       license: "MIT",
       type: "module",
@@ -4267,56 +4267,6 @@ var init_agencyBoundaryEval = __esm({
   }
 });
 
-// src/scripts/capabilityExecutionEnvironment.ts
-function capabilityInputEnvironment(input) {
-  const environment = {
-    KODY_CAPABILITY_INPUT: JSON.stringify(input ?? null)
-  };
-  if (!input || typeof input !== "object" || Array.isArray(input)) {
-    return environment;
-  }
-  for (const [name, value] of Object.entries(input)) {
-    if (value === void 0 || value === null) continue;
-    const key = environmentKey(name);
-    environment[`KODY_ARG_${key}`] = typeof value === "string" ? value : JSON.stringify(value);
-  }
-  return environment;
-}
-function capabilityConfigEnvironment(config) {
-  if (!config || typeof config !== "object" || Array.isArray(config)) return {};
-  return Object.fromEntries(
-    flattenConfig(config).map(([key, value]) => [
-      `KODY_CFG_${key}`,
-      value
-    ])
-  );
-}
-function flattenConfig(config, prefix = "") {
-  const entries = [];
-  for (const [name, value] of Object.entries(config)) {
-    if (value === null || value === void 0) continue;
-    const key = prefix ? `${prefix}_${environmentKey(name)}` : environmentKey(name);
-    if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") {
-      entries.push([key, String(value)]);
-    } else if (Array.isArray(value)) {
-      entries.push([key, JSON.stringify(value)]);
-    } else if (typeof value === "object") {
-      entries.push(
-        ...flattenConfig(value, key)
-      );
-    }
-  }
-  return entries;
-}
-function environmentKey(name) {
-  return name.toUpperCase().replace(/[^A-Z0-9]+/g, "_");
-}
-var init_capabilityExecutionEnvironment = __esm({
-  "src/scripts/capabilityExecutionEnvironment.ts"() {
-    "use strict";
-  }
-});
-
 // src/agency/capability-contract-validation.ts
 import Ajv from "ajv";
 function validateCapabilityContractValue(boundary, schema, value) {
@@ -6949,12 +6899,16 @@ function resolveLitellmCommand() {
     throw new Error("litellm is importable but its console script was not found next to python3");
   }
 }
-async function startLitellmIfNeeded(model, projectDir, url = LITELLM_DEFAULT_URL) {
+async function startLitellmIfNeeded(model, projectDir, url = LITELLM_DEFAULT_URL, runtimeEnvironment = {}) {
   if (!needsLitellmProxy(model)) return null;
   const cmd = resolveLitellmCommand();
   let activeUrl = url.replace(/\/+$/, "");
   const modelGroups = litellmModelGroups(model);
-  const childEnv = stripBlockingEnv({ ...process.env, ...readDotenvApiKeys(projectDir) });
+  const childEnv = stripBlockingEnv({
+    ...process.env,
+    ...readDotenvApiKeys(projectDir),
+    ...runtimeEnvironment
+  });
   let child;
   let logPath;
   const spawnProxy = () => {
@@ -7332,6 +7286,256 @@ var init_runtimeCleanup = __esm({
   }
 });
 
+// src/backendVault.ts
+import { createDecipheriv, createHash as createHash4 } from "crypto";
+function cacheKey(owner, repo, masterKey) {
+  const keyHash = createHash4("sha256").update(masterKey).digest("hex").slice(0, 16);
+  return `${owner}/${repo}:${keyHash}`.toLowerCase();
+}
+function decryptVault(payload, masterKey) {
+  const parts = payload.split(":");
+  if (parts.length !== 4 || parts[0] !== "v1") {
+    throw new Error("invalid vault payload format");
+  }
+  const [, ivB64, ctB64, tagB64] = parts;
+  const iv = Buffer.from(ivB64, "base64");
+  const ct = Buffer.from(ctB64, "base64");
+  const tag = Buffer.from(tagB64, "base64");
+  const decipher = createDecipheriv("aes-256-gcm", masterKey, iv);
+  decipher.setAuthTag(tag);
+  return Buffer.concat([decipher.update(ct), decipher.final()]).toString("utf8");
+}
+async function readVaultSecrets(opts) {
+  const key = cacheKey(opts.owner, opts.repo, opts.masterKey);
+  const hit = cache.get(key);
+  if (hit && hit.expiresAt > Date.now()) return hit.secrets;
+  const record2 = await createStateBackendFromEnv().getRepoDoc(`${opts.owner}/${opts.repo}`, VAULT_PATH);
+  const raw = record2?.doc;
+  const ciphertext = raw && typeof raw === "object" && !Array.isArray(raw) && typeof raw.ciphertext === "string" ? raw.ciphertext.trim() : "";
+  if (!ciphertext) {
+    cache.set(key, { secrets: {}, expiresAt: Date.now() + CACHE_TTL_MS });
+    return {};
+  }
+  const doc = JSON.parse(decryptVault(ciphertext, opts.masterKey));
+  const flat = {};
+  for (const [name, entry] of Object.entries(doc.secrets ?? {})) {
+    if (entry && typeof entry.value === "string") flat[name] = entry.value;
+  }
+  cache.set(key, { secrets: flat, expiresAt: Date.now() + CACHE_TTL_MS });
+  return flat;
+}
+async function readRepoSecret(opts) {
+  const secrets = await readVaultSecrets(opts);
+  const v = secrets[opts.name];
+  return v?.trim() ? v : null;
+}
+async function readRepoSecrets(opts) {
+  return readVaultSecrets(opts);
+}
+var VAULT_PATH, CACHE_TTL_MS, cache;
+var init_backendVault = __esm({
+  "src/backendVault.ts"() {
+    "use strict";
+    init_state_backend();
+    VAULT_PATH = "secrets.enc";
+    CACHE_TTL_MS = 6e4;
+    cache = /* @__PURE__ */ new Map();
+  }
+});
+
+// src/pool/keys.ts
+import { hkdfSync } from "crypto";
+function masterKeyBytes(raw) {
+  const v = raw.trim();
+  if (!v) throw new Error("KODY_MASTER_KEY is empty");
+  if (/^[0-9a-fA-F]+$/.test(v) && v.length === 64) {
+    return Buffer.from(v, "hex");
+  }
+  return Buffer.from(v.replace(/-/g, "+").replace(/_/g, "/"), "base64");
+}
+function deriveKey(master, info, length = 32) {
+  return Buffer.from(hkdfSync("sha256", master, Buffer.alloc(0), info, length)).toString("hex");
+}
+function derivePoolApiKey(master) {
+  return deriveKey(master, POOL_API_KEY_INFO);
+}
+function deriveRunnerApiKey(master) {
+  return deriveKey(master, RUNNER_API_KEY_INFO);
+}
+function bearerOk(headerAuth, xApiKey, expected) {
+  const x = (xApiKey ?? "").trim();
+  if (x && timingEqual(x, expected)) return true;
+  const a = (headerAuth ?? "").trim();
+  if (a.toLowerCase().startsWith("bearer ")) {
+    return timingEqual(a.slice(7).trim(), expected);
+  }
+  return false;
+}
+function timingEqual(a, b) {
+  if (a.length !== b.length) return false;
+  let diff = 0;
+  for (let i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  return diff === 0;
+}
+var POOL_API_KEY_INFO, RUNNER_API_KEY_INFO;
+var init_keys = __esm({
+  "src/pool/keys.ts"() {
+    "use strict";
+    POOL_API_KEY_INFO = "kody-pool-api:v1";
+    RUNNER_API_KEY_INFO = "kody-runner-api:v1";
+  }
+});
+
+// src/scripts/runtimeSecrets.ts
+function envSecret(name, env) {
+  const value = env[name]?.trim() ? env[name] : "";
+  return value ? { value, source: "env" } : { value: "", source: "missing" };
+}
+async function resolveRuntimeSecret(name, ctx, opts = {}) {
+  const env = opts.env ?? process.env;
+  if (hasGitHubActionsIdentity(env)) {
+    try {
+      const value = await readRuntimeSecretFromKody(name, env);
+      if (value) return { value, source: "vault" };
+      return envSecret(name, env);
+    } catch (err) {
+      const fallback = envSecret(name, env);
+      return {
+        ...fallback,
+        warning: `Kody secret read failed for ${name}: ${err instanceof Error ? err.message : String(err)}`
+      };
+    }
+  }
+  const masterRaw = env.KODY_MASTER_KEY?.trim() ?? "";
+  if (!masterRaw || !env.CONVEX_URL?.trim() || !env.KODY_SERVICE_KEY?.trim()) return envSecret(name, env);
+  try {
+    const masterKey = masterKeyBytes(masterRaw);
+    if (masterKey.length !== 32) {
+      throw new Error("KODY_MASTER_KEY must decode to 32 bytes");
+    }
+    const value = await readRepoSecret({
+      owner: ctx.config.github.owner,
+      repo: ctx.config.github.repo,
+      name,
+      masterKey
+    });
+    if (value) return { value, source: "vault" };
+  } catch (err) {
+    const fallback = envSecret(name, env);
+    return {
+      ...fallback,
+      warning: `vault read failed for ${name}: ${err instanceof Error ? err.message : String(err)}`
+    };
+  }
+  return envSecret(name, env);
+}
+async function resolveRuntimeSecrets(names, ctx, opts = {}) {
+  const declared = Array.isArray(names) ? [...new Set(names.filter((name) => typeof name === "string" && /^[A-Z][A-Z0-9_]*$/.test(name)))] : [];
+  const resolved = [];
+  for (const name of declared) {
+    resolved.push({ name, result: await resolveRuntimeSecret(name, ctx, opts) });
+  }
+  const warnings = resolved.flatMap(({ result }) => result.warning ? [result.warning] : []);
+  const fallbackSecrets = Object.fromEntries(
+    resolved.flatMap(({ name, result }) => result.source === "env" && result.value ? [[name, result.value]] : [])
+  );
+  if (hasGitHubActionsIdentity(opts.env ?? process.env) && Object.keys(fallbackSecrets).length > 0) {
+    try {
+      await writeRuntimeSecretsToKody(fallbackSecrets, opts.env ?? process.env);
+    } catch (err) {
+      warnings.push(`Kody secret migration failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+  return {
+    environment: Object.fromEntries(
+      resolved.flatMap(({ name, result }) => result.value ? [[name, result.value]] : [])
+    ),
+    warnings
+  };
+}
+var init_runtimeSecrets = __esm({
+  "src/scripts/runtimeSecrets.ts"() {
+    "use strict";
+    init_backendVault();
+    init_kody_api_client();
+    init_keys();
+  }
+});
+
+// src/runtimeModelEnvironment.ts
+async function resolveRuntimeModelEnvironment(model, ctx) {
+  const name = model.apiKeyEnvVar ?? providerApiKeyEnvVar(model.provider);
+  const result = await resolveRuntimeSecret(name, ctx);
+  const warnings = result.warning ? [result.warning] : [];
+  if (!result.value) {
+    return {
+      environment: {},
+      warnings: [...warnings, `Model credential ${name} is missing from the Kody vault.`]
+    };
+  }
+  return {
+    environment: { [name]: result.value },
+    warnings
+  };
+}
+var init_runtimeModelEnvironment = __esm({
+  "src/runtimeModelEnvironment.ts"() {
+    "use strict";
+    init_config();
+    init_runtimeSecrets();
+  }
+});
+
+// src/scripts/capabilityExecutionEnvironment.ts
+function capabilityInputEnvironment(input) {
+  const environment = {
+    KODY_CAPABILITY_INPUT: JSON.stringify(input ?? null)
+  };
+  if (!input || typeof input !== "object" || Array.isArray(input)) {
+    return environment;
+  }
+  for (const [name, value] of Object.entries(input)) {
+    if (value === void 0 || value === null) continue;
+    const key = environmentKey(name);
+    environment[`KODY_ARG_${key}`] = typeof value === "string" ? value : JSON.stringify(value);
+  }
+  return environment;
+}
+function capabilityConfigEnvironment(config) {
+  if (!config || typeof config !== "object" || Array.isArray(config)) return {};
+  return Object.fromEntries(
+    flattenConfig(config).map(([key, value]) => [
+      `KODY_CFG_${key}`,
+      value
+    ])
+  );
+}
+function flattenConfig(config, prefix = "") {
+  const entries = [];
+  for (const [name, value] of Object.entries(config)) {
+    if (value === null || value === void 0) continue;
+    const key = prefix ? `${prefix}_${environmentKey(name)}` : environmentKey(name);
+    if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") {
+      entries.push([key, String(value)]);
+    } else if (Array.isArray(value)) {
+      entries.push([key, JSON.stringify(value)]);
+    } else if (typeof value === "object") {
+      entries.push(
+        ...flattenConfig(value, key)
+      );
+    }
+  }
+  return entries;
+}
+function environmentKey(name) {
+  return name.toUpperCase().replace(/[^A-Z0-9]+/g, "_");
+}
+var init_capabilityExecutionEnvironment = __esm({
+  "src/scripts/capabilityExecutionEnvironment.ts"() {
+    "use strict";
+  }
+});
+
 // src/scripts/evaluateAgencyBoundaries.ts
 function shouldEvaluateAgencyBoundaries(data, profile) {
   return Boolean(agencyBoundaryCapabilityKind(data, profile));
@@ -11572,12 +11776,12 @@ var init_classifyByLabel = __esm({
 });
 
 // src/scripts/commitAndPush.ts
-import { createHash as createHash4 } from "crypto";
+import { createHash as createHash5 } from "crypto";
 import * as fs31 from "fs";
 import * as path29 from "path";
 function sentinelPathForStage(cwd, profileName, workflowExecutionKey) {
   const runId = resolveRunId();
-  const executionSuffix = typeof workflowExecutionKey === "string" && workflowExecutionKey.length > 0 ? `-${createHash4("sha256").update(workflowExecutionKey).digest("hex").slice(0, 16)}` : "";
+  const executionSuffix = typeof workflowExecutionKey === "string" && workflowExecutionKey.length > 0 ? `-${createHash5("sha256").update(workflowExecutionKey).digest("hex").slice(0, 16)}` : "";
   return runtimeStatePath(cwd, "agent-runs", runId, `commit-${profileName}${executionSuffix}.lock`);
 }
 var DEFAULT_COMMIT_MESSAGE, commitAndPush2;
@@ -15351,182 +15555,6 @@ var init_kodyVariables = __esm({
   }
 });
 
-// src/backendVault.ts
-import { createDecipheriv, createHash as createHash5 } from "crypto";
-function cacheKey(owner, repo, masterKey) {
-  const keyHash = createHash5("sha256").update(masterKey).digest("hex").slice(0, 16);
-  return `${owner}/${repo}:${keyHash}`.toLowerCase();
-}
-function decryptVault(payload, masterKey) {
-  const parts = payload.split(":");
-  if (parts.length !== 4 || parts[0] !== "v1") {
-    throw new Error("invalid vault payload format");
-  }
-  const [, ivB64, ctB64, tagB64] = parts;
-  const iv = Buffer.from(ivB64, "base64");
-  const ct = Buffer.from(ctB64, "base64");
-  const tag = Buffer.from(tagB64, "base64");
-  const decipher = createDecipheriv("aes-256-gcm", masterKey, iv);
-  decipher.setAuthTag(tag);
-  return Buffer.concat([decipher.update(ct), decipher.final()]).toString("utf8");
-}
-async function readVaultSecrets(opts) {
-  const key = cacheKey(opts.owner, opts.repo, opts.masterKey);
-  const hit = cache.get(key);
-  if (hit && hit.expiresAt > Date.now()) return hit.secrets;
-  const record2 = await createStateBackendFromEnv().getRepoDoc(`${opts.owner}/${opts.repo}`, VAULT_PATH);
-  const raw = record2?.doc;
-  const ciphertext = raw && typeof raw === "object" && !Array.isArray(raw) && typeof raw.ciphertext === "string" ? raw.ciphertext.trim() : "";
-  if (!ciphertext) {
-    cache.set(key, { secrets: {}, expiresAt: Date.now() + CACHE_TTL_MS });
-    return {};
-  }
-  const doc = JSON.parse(decryptVault(ciphertext, opts.masterKey));
-  const flat = {};
-  for (const [name, entry] of Object.entries(doc.secrets ?? {})) {
-    if (entry && typeof entry.value === "string") flat[name] = entry.value;
-  }
-  cache.set(key, { secrets: flat, expiresAt: Date.now() + CACHE_TTL_MS });
-  return flat;
-}
-async function readRepoSecret(opts) {
-  const secrets = await readVaultSecrets(opts);
-  const v = secrets[opts.name];
-  return v?.trim() ? v : null;
-}
-async function readRepoSecrets(opts) {
-  return readVaultSecrets(opts);
-}
-var VAULT_PATH, CACHE_TTL_MS, cache;
-var init_backendVault = __esm({
-  "src/backendVault.ts"() {
-    "use strict";
-    init_state_backend();
-    VAULT_PATH = "secrets.enc";
-    CACHE_TTL_MS = 6e4;
-    cache = /* @__PURE__ */ new Map();
-  }
-});
-
-// src/pool/keys.ts
-import { hkdfSync } from "crypto";
-function masterKeyBytes(raw) {
-  const v = raw.trim();
-  if (!v) throw new Error("KODY_MASTER_KEY is empty");
-  if (/^[0-9a-fA-F]+$/.test(v) && v.length === 64) {
-    return Buffer.from(v, "hex");
-  }
-  return Buffer.from(v.replace(/-/g, "+").replace(/_/g, "/"), "base64");
-}
-function deriveKey(master, info, length = 32) {
-  return Buffer.from(hkdfSync("sha256", master, Buffer.alloc(0), info, length)).toString("hex");
-}
-function derivePoolApiKey(master) {
-  return deriveKey(master, POOL_API_KEY_INFO);
-}
-function deriveRunnerApiKey(master) {
-  return deriveKey(master, RUNNER_API_KEY_INFO);
-}
-function bearerOk(headerAuth, xApiKey, expected) {
-  const x = (xApiKey ?? "").trim();
-  if (x && timingEqual(x, expected)) return true;
-  const a = (headerAuth ?? "").trim();
-  if (a.toLowerCase().startsWith("bearer ")) {
-    return timingEqual(a.slice(7).trim(), expected);
-  }
-  return false;
-}
-function timingEqual(a, b) {
-  if (a.length !== b.length) return false;
-  let diff = 0;
-  for (let i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
-  return diff === 0;
-}
-var POOL_API_KEY_INFO, RUNNER_API_KEY_INFO;
-var init_keys = __esm({
-  "src/pool/keys.ts"() {
-    "use strict";
-    POOL_API_KEY_INFO = "kody-pool-api:v1";
-    RUNNER_API_KEY_INFO = "kody-runner-api:v1";
-  }
-});
-
-// src/scripts/runtimeSecrets.ts
-function envSecret(name, env) {
-  const value = env[name]?.trim() ? env[name] : "";
-  return value ? { value, source: "env" } : { value: "", source: "missing" };
-}
-async function resolveRuntimeSecret(name, ctx, opts = {}) {
-  const env = opts.env ?? process.env;
-  if (hasGitHubActionsIdentity(env)) {
-    try {
-      const value = await readRuntimeSecretFromKody(name, env);
-      if (value) return { value, source: "vault" };
-      return envSecret(name, env);
-    } catch (err) {
-      const fallback = envSecret(name, env);
-      return {
-        ...fallback,
-        warning: `Kody secret read failed for ${name}: ${err instanceof Error ? err.message : String(err)}`
-      };
-    }
-  }
-  const masterRaw = env.KODY_MASTER_KEY?.trim() ?? "";
-  if (!masterRaw || !env.CONVEX_URL?.trim() || !env.KODY_SERVICE_KEY?.trim()) return envSecret(name, env);
-  try {
-    const masterKey = masterKeyBytes(masterRaw);
-    if (masterKey.length !== 32) {
-      throw new Error("KODY_MASTER_KEY must decode to 32 bytes");
-    }
-    const value = await readRepoSecret({
-      owner: ctx.config.github.owner,
-      repo: ctx.config.github.repo,
-      name,
-      masterKey
-    });
-    if (value) return { value, source: "vault" };
-  } catch (err) {
-    const fallback = envSecret(name, env);
-    return {
-      ...fallback,
-      warning: `vault read failed for ${name}: ${err instanceof Error ? err.message : String(err)}`
-    };
-  }
-  return envSecret(name, env);
-}
-async function resolveRuntimeSecrets(names, ctx, opts = {}) {
-  const declared = Array.isArray(names) ? [...new Set(names.filter((name) => typeof name === "string" && /^[A-Z][A-Z0-9_]*$/.test(name)))] : [];
-  const resolved = [];
-  for (const name of declared) {
-    resolved.push({ name, result: await resolveRuntimeSecret(name, ctx, opts) });
-  }
-  const warnings = resolved.flatMap(({ result }) => result.warning ? [result.warning] : []);
-  const fallbackSecrets = Object.fromEntries(
-    resolved.flatMap(({ name, result }) => result.source === "env" && result.value ? [[name, result.value]] : [])
-  );
-  if (hasGitHubActionsIdentity(opts.env ?? process.env) && Object.keys(fallbackSecrets).length > 0) {
-    try {
-      await writeRuntimeSecretsToKody(fallbackSecrets, opts.env ?? process.env);
-    } catch (err) {
-      warnings.push(`Kody secret migration failed: ${err instanceof Error ? err.message : String(err)}`);
-    }
-  }
-  return {
-    environment: Object.fromEntries(
-      resolved.flatMap(({ name, result }) => result.value ? [[name, result.value]] : [])
-    ),
-    warnings
-  };
-}
-var init_runtimeSecrets = __esm({
-  "src/scripts/runtimeSecrets.ts"() {
-    "use strict";
-    init_backendVault();
-    init_kody_api_client();
-    init_keys();
-  }
-});
-
 // src/scripts/loadQaContext.ts
 import * as fs42 from "fs";
 import * as path39 from "path";
@@ -21052,6 +21080,7 @@ async function runImplementation(profileName, input) {
     });
   }
   let litellm;
+  let runtimeModelEnvironment;
   const ctx = {
     args,
     cwd: input.cwd,
@@ -21143,9 +21172,18 @@ async function runImplementation(profileName, input) {
     const syntheticPath = ctx.data.syntheticPluginPath;
     const pluginPaths = [...externalPlugins, ...syntheticPath ? [syntheticPath] : []];
     const agents = loadSubagents(profile);
+    if (runtimeModelEnvironment === void 0) {
+      runtimeModelEnvironment = {};
+      if (needsLitellmProxy(model)) {
+        const resolved2 = await resolveRuntimeModelEnvironment(model, ctx);
+        runtimeModelEnvironment = resolved2.environment;
+        for (const warning of resolved2.warnings) process.stderr.write(`\u26A0 ${warning}
+`);
+      }
+    }
     if (litellm === void 0) {
       try {
-        litellm = await startLitellmIfNeeded(model, input.cwd);
+        litellm = await startLitellmIfNeeded(model, input.cwd, void 0, runtimeModelEnvironment);
       } catch (err) {
         throw new Error(`litellm startup failed: ${err instanceof Error ? err.message : String(err)}`);
       }
@@ -21155,7 +21193,10 @@ async function runImplementation(profileName, input) {
       prompt,
       model,
       cwd: input.cwd,
-      environment: ctx.data.capabilityEnvironment && typeof ctx.data.capabilityEnvironment === "object" && !Array.isArray(ctx.data.capabilityEnvironment) ? ctx.data.capabilityEnvironment : void 0,
+      environment: {
+        ...ctx.data.capabilityEnvironment && typeof ctx.data.capabilityEnvironment === "object" && !Array.isArray(ctx.data.capabilityEnvironment) ? ctx.data.capabilityEnvironment : {},
+        ...runtimeModelEnvironment
+      },
       litellmUrl: lm?.url ?? null,
       // On a connection drop mid-run, restart the (possibly crashed) proxy
       // before the agent retries. No-op for direct-Anthropic runs (lm null).
@@ -21847,7 +21888,6 @@ var MUTATING_POSTFLIGHTS, SHELL_MARKER_RE, TASK_ARTIFACT_WRITE_TOOLS, MAX_CHAIN_
 var init_executor = __esm({
   "src/executor.ts"() {
     "use strict";
-    init_capabilityExecutionEnvironment();
     init_capability_contract_validation();
     init_agent();
     init_agents();
@@ -21863,7 +21903,9 @@ var init_executor = __esm({
     init_registry();
     init_runIndex();
     init_runtimeCleanup();
+    init_runtimeModelEnvironment();
     init_runtimePaths();
+    init_capabilityExecutionEnvironment();
     init_evaluateAgencyBoundaries();
     init_scripts();
     init_stateWorkspace();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kody-ade/kody-engine",
-  "version": "0.4.496",
+  "version": "0.4.498",
   "description": "kody — autonomous development engine. Single-session Claude Code agent behind a generic executor + declarative implementation profiles.",
   "license": "MIT",
   "type": "module",
@@ -12,29 +12,6 @@
     "templates",
     "kody.config.schema.json"
   ],
-  "scripts": {
-    "kody:run": "tsx bin/kody.ts",
-    "serve": "tsx bin/kody.ts serve",
-    "serve:vscode": "tsx bin/kody.ts serve vscode",
-    "serve:claude": "tsx bin/kody.ts serve claude",
-    "clean:dist": "node scripts/clean-dist.cjs",
-    "build": "pnpm clean:dist && tsup && node scripts/copy-assets.cjs",
-    "check:modularity": "tsx scripts/check-script-modularity.ts",
-    "pretest": "pnpm check:modularity",
-    "test": "vitest run tests/unit tests/int --coverage",
-    "posttest": "tsx scripts/check-coverage-floor.ts",
-    "test:smoke": "vitest run tests/smoke --no-coverage",
-    "test:e2e": "vitest run tests/e2e --no-coverage",
-    "test:runtime-services": "node --test \"tests/runtime-services/*.test.mjs\"",
-    "test:all": "vitest run tests --no-coverage",
-    "typecheck": "tsc --noEmit",
-    "lint": "biome check",
-    "lint:fix": "biome check --write",
-    "format": "biome format --write",
-    "verify:package": "node scripts/verify-package-tarball.cjs",
-    "brain:publish": "docker buildx build --platform linux/amd64 -f runner/Dockerfile.brain --build-arg KODY_ENGINE_REF=$(git rev-parse HEAD) -t ghcr.io/${KODY_BRAIN_GHCR_OWNER:-aharonyaircohen}/kody-brain:latest --push runner",
-    "prepublishOnly": "pnpm typecheck && vitest run tests/unit tests/int --no-coverage && pnpm test:runtime-services && pnpm build && pnpm verify:package"
-  },
   "dependencies": {
     "@actions/cache": "^6.0.0",
     "@anthropic-ai/claude-agent-sdk": "0.2.119",
@@ -61,5 +38,27 @@
     "url": "git+https://github.com/aharonyaircohen/kody-engine.git"
   },
   "homepage": "https://github.com/aharonyaircohen/kody-engine",
-  "bugs": "https://github.com/aharonyaircohen/kody-engine/issues"
-}
+  "bugs": "https://github.com/aharonyaircohen/kody-engine/issues",
+  "scripts": {
+    "kody:run": "tsx bin/kody.ts",
+    "serve": "tsx bin/kody.ts serve",
+    "serve:vscode": "tsx bin/kody.ts serve vscode",
+    "serve:claude": "tsx bin/kody.ts serve claude",
+    "clean:dist": "node scripts/clean-dist.cjs",
+    "build": "pnpm clean:dist && tsup && node scripts/copy-assets.cjs",
+    "check:modularity": "tsx scripts/check-script-modularity.ts",
+    "pretest": "pnpm check:modularity",
+    "test": "vitest run tests/unit tests/int --coverage",
+    "posttest": "tsx scripts/check-coverage-floor.ts",
+    "test:smoke": "vitest run tests/smoke --no-coverage",
+    "test:e2e": "vitest run tests/e2e --no-coverage",
+    "test:runtime-services": "node --test \"tests/runtime-services/*.test.mjs\"",
+    "test:all": "vitest run tests --no-coverage",
+    "typecheck": "tsc --noEmit",
+    "lint": "biome check",
+    "lint:fix": "biome check --write",
+    "format": "biome format --write",
+    "verify:package": "node scripts/verify-package-tarball.cjs",
+    "brain:publish": "docker buildx build --platform linux/amd64 -f runner/Dockerfile.brain --build-arg KODY_ENGINE_REF=$(git rev-parse HEAD) -t ghcr.io/${KODY_BRAIN_GHCR_OWNER:-aharonyaircohen}/kody-brain:latest --push runner"
+  }
+}