@kody-ade/kody-engine 0.4.550 → 0.4.552

package/dist/bin/kody.js

@@ -15,7 +15,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "@kody-ade/kody-engine",
-      version: "0.4.550",
+      version: "0.4.552",
       description: "kody \u2014 autonomous development engine. Single-session Claude Code agent behind a generic executor + declarative implementation profiles.",
       license: "MIT",
       type: "module",
@@ -989,7 +989,7 @@ function buildVerifyEnv(source = process.env) {
   return env;
 }
 function runCommand(command, cwd) {
-  return new Promise((resolve19) => {
+  return new Promise((resolve20) => {
     const start = Date.now();
     const child = spawn(command, {
       cwd,
@@ -1018,11 +1018,11 @@ function runCommand(command, cwd) {
     child.on("exit", (code) => {
       clearTimeout(timer);
       const tail = Buffer.concat(buffers).toString("utf-8").slice(-TAIL_CHARS);
-      resolve19({ exitCode: code ?? -1, durationMs: Date.now() - start, tail });
+      resolve20({ exitCode: code ?? -1, durationMs: Date.now() - start, tail });
     });
     child.on("error", (err) => {
       clearTimeout(timer);
-      resolve19({ exitCode: -1, durationMs: Date.now() - start, tail: err.message });
+      resolve20({ exitCode: -1, durationMs: Date.now() - start, tail: err.message });
     });
   });
 }
@@ -1331,7 +1331,7 @@ function cmsHeaders(opts) {
     }
   };
 }
-async function callDashboardCms(opts, path53, init = {}) {
+async function callDashboardCms(opts, path54, init = {}) {
   const baseUrl = dashboardBaseUrl(opts);
   if (!baseUrl) {
     return {
@@ -1343,7 +1343,7 @@ async function callDashboardCms(opts, path53, init = {}) {
   const headerResult = cmsHeaders(opts);
   if (!headerResult.ok) return headerResult;
   try {
-    const res = await fetch(`${baseUrl}${path53}`, {
+    const res = await fetch(`${baseUrl}${path54}`, {
       ...init,
       headers: {
         ...headerResult.headers,
@@ -1415,8 +1415,8 @@ function documentArg(value) {
 function normalizeCmsDocumentIdInput(input) {
   const trimmed = stripWrappingQuotes(input.trim());
   const withoutQuery = trimmed.split(/[?#]/, 1)[0] ?? trimmed;
-  const path53 = parseDocumentPath(withoutQuery);
-  return path53 ?? parseDocumentIdSegment(withoutQuery) ?? withoutQuery;
+  const path54 = parseDocumentPath(withoutQuery);
+  return path54 ?? parseDocumentIdSegment(withoutQuery) ?? withoutQuery;
 }
 function stripWrappingQuotes(value) {
   let current = value;
@@ -1427,9 +1427,9 @@ function stripWrappingQuotes(value) {
   }
 }
 function parseDocumentPath(value) {
-  const path53 = value.startsWith("http://") || value.startsWith("https://") ? urlPathname(value) : value;
-  if (!path53?.includes("/content/entries/")) return null;
-  const parts = path53.split("/").filter(Boolean).map(decodePathPart);
+  const path54 = value.startsWith("http://") || value.startsWith("https://") ? urlPathname(value) : value;
+  if (!path54?.includes("/content/entries/")) return null;
+  const parts = path54.split("/").filter(Boolean).map(decodePathPart);
   const entriesIndex = parts.findIndex((part, index) => part === "content" && parts[index + 1] === "entries");
   const idPart = parts[entriesIndex + 3];
   if (!idPart || idPart === "new") return null;
@@ -1997,7 +1997,9 @@ function parseCapabilityContract(raw) {
 function parseCapabilityRequirements(raw) {
   if (raw === void 0) return void 0;
   if (!isPlainObject(raw)) throw new Error("contract.json requirements must be an object");
-  const unsupported = Object.keys(raw).filter((key) => key !== "browser" && key !== "qaCredentials");
+  const unsupported = Object.keys(raw).filter(
+    (key) => key !== "browser" && key !== "qaCredentials" && key !== "githubTestToken" && key !== "browserOnly"
+  );
   if (unsupported.length > 0) {
     throw new Error(`contract.json requirements contains unsupported fields: ${unsupported.join(", ")}`);
   }
@@ -2007,12 +2009,20 @@ function parseCapabilityRequirements(raw) {
   if (raw.qaCredentials !== void 0 && typeof raw.qaCredentials !== "boolean") {
     throw new Error("contract.json requirements.qaCredentials must be boolean");
   }
-  if (raw.qaCredentials === true && raw.browser !== true) {
-    throw new Error("contract.json requirements.qaCredentials requires browser");
+  if (raw.githubTestToken !== void 0 && typeof raw.githubTestToken !== "boolean") {
+    throw new Error("contract.json requirements.githubTestToken must be boolean");
+  }
+  if (raw.browserOnly !== void 0 && typeof raw.browserOnly !== "boolean") {
+    throw new Error("contract.json requirements.browserOnly must be boolean");
+  }
+  if ((raw.qaCredentials === true || raw.githubTestToken === true || raw.browserOnly === true) && raw.browser !== true) {
+    throw new Error("contract.json authentication requirements require browser");
   }
   const requirements = {
     ...raw.browser === true ? { browser: true } : {},
-    ...raw.qaCredentials === true ? { qaCredentials: true } : {}
+    ...raw.qaCredentials === true ? { qaCredentials: true } : {},
+    ...raw.githubTestToken === true ? { githubTestToken: true } : {},
+    ...raw.browserOnly === true ? { browserOnly: true } : {}
   };
   return Object.keys(requirements).length > 0 ? requirements : void 0;
 }
@@ -2027,8 +2037,8 @@ function isRegularFile(filePath) {
 function schemaPropertyPaths(schema, prefix) {
   const properties = isPlainObject(schema.properties) ? schema.properties : {};
   return Object.entries(properties).flatMap(([name, property]) => {
-    const path53 = `${prefix}.${name}`;
-    return isPlainObject(property) ? [path53, ...schemaPropertyPaths(property, path53)] : [path53];
+    const path54 = `${prefix}.${name}`;
+    return isPlainObject(property) ? [path54, ...schemaPropertyPaths(property, path54)] : [path54];
   });
 }
 function parseCapabilityBody(raw, slug) {
@@ -3620,7 +3630,7 @@ var init_repoWorkspace = __esm({
     defaultCloneRepo = (repo, token, dir) => {
       fs9.mkdirSync(path10.dirname(dir), { recursive: true });
       const clone = buildCloneProcess(repo, token);
-      return new Promise((resolve19, reject) => {
+      return new Promise((resolve20, reject) => {
         const child = spawn2("git", ["clone", "--depth=1", clone.url, dir], {
           env: clone.env,
           stdio: "inherit"
@@ -3640,7 +3650,7 @@ var init_repoWorkspace = __esm({
             }
           } catch {
           }
-          resolve19();
+          resolve20();
         });
         child.on("error", reject);
       });
@@ -3971,10 +3981,10 @@ async function runAgent(opts) {
         let timer;
         let next;
         if (turnTimeoutMs > 0) {
-          const timeoutPromise = new Promise((resolve19) => {
+          const timeoutPromise = new Promise((resolve20) => {
             timer = setTimeout(() => {
               timedOut = true;
-              resolve19({ done: true, value: void 0 });
+              resolve20({ done: true, value: void 0 });
             }, turnTimeoutMs);
           });
           next = await Promise.race([nextPromise, timeoutPromise]);
@@ -3990,7 +4000,7 @@ async function runAgent(opts) {
             try {
               await Promise.race([
                 iterator.return(void 0).catch(() => void 0),
-                new Promise((resolve19) => setTimeout(resolve19, 1e4).unref())
+                new Promise((resolve20) => setTimeout(resolve20, 1e4).unref())
               ]);
             } catch {
             }
@@ -4614,15 +4624,15 @@ function validateWorkflow(value, options = {}) {
   }
   return issues;
 }
-function validateInputBindings(value, path53, issues, declaredInputs) {
+function validateInputBindings(value, path54, issues, declaredInputs) {
   if (value === void 0) return;
   const bindings = asRecord(value);
   if (!bindings || Object.keys(bindings).length === 0) {
-    issue(issues, "invalid_inputs", path53, "workflow step inputs must contain at least one named mapping");
+    issue(issues, "invalid_inputs", path54, "workflow step inputs must contain at least one named mapping");
     return;
   }
   for (const [name, value2] of Object.entries(bindings)) {
-    const bindingPath = `${path53}.${name}`;
+    const bindingPath = `${path54}.${name}`;
     if (!/^[A-Za-z_][A-Za-z0-9_-]*$/.test(name)) {
       issue(issues, "invalid_input_name", bindingPath, `workflow input name ${name} is invalid`);
     }
@@ -4641,7 +4651,7 @@ function validateInputBindings(value, path53, issues, declaredInputs) {
     }
   }
 }
-function validateInputBindingSources(value, path53, issues, capabilitiesByStep, capabilityOutputs) {
+function validateInputBindingSources(value, path54, issues, capabilitiesByStep, capabilityOutputs) {
   const bindings = asRecord(value);
   if (!bindings) return;
   for (const [name, rawBinding] of Object.entries(bindings)) {
@@ -4654,7 +4664,7 @@ function validateInputBindingSources(value, path53, issues, capabilitiesByStep,
       issue(
         issues,
         "missing_input_step",
-        `${path53}.${name}.from`,
+        `${path54}.${name}.from`,
         `workflow input mapping references missing step ${sourceStep ?? "<none>"}`
       );
       continue;
@@ -4665,7 +4675,7 @@ function validateInputBindingSources(value, path53, issues, capabilitiesByStep,
       issue(
         issues,
         "undeclared_step_output",
-        `${path53}.${name}.from`,
+        `${path54}.${name}.from`,
         `workflow input mapping reads ${outputPath}, but step ${sourceStep} does not declare it`
       );
     }
@@ -4674,11 +4684,11 @@ function validateInputBindingSources(value, path53, issues, capabilitiesByStep,
 function formatWorkflowValidationIssues(issues) {
   return issues.map((entry) => `${entry.path}: ${entry.message}`);
 }
-function validateDataMatch(value, path53, issues, capabilityOutputs) {
+function validateDataMatch(value, path54, issues, capabilityOutputs) {
   if (value === void 0) return;
   const match = asRecord(value);
   if (!match || Object.keys(match).length === 0) {
-    issue(issues, "invalid_condition", path53, "workflow condition must contain at least one match");
+    issue(issues, "invalid_condition", path54, "workflow condition must contain at least one match");
     return;
   }
   for (const [field, expected] of Object.entries(match)) {
@@ -4686,7 +4696,7 @@ function validateDataMatch(value, path53, issues, capabilityOutputs) {
       issue(
         issues,
         "invalid_data_path",
-        `${path53}.${field}`,
+        `${path54}.${field}`,
         `workflow condition must read from facts, evidence, artifacts, result, workflow, or lastOutcome`
       );
     }
@@ -4694,12 +4704,12 @@ function validateDataMatch(value, path53, issues, capabilityOutputs) {
       issue(
         issues,
         "undeclared_result_path",
-        `${path53}.${field}`,
+        `${path54}.${field}`,
         `workflow condition reads ${field}, but the source capability does not declare it`
       );
     }
     if (!isComparable(expected)) {
-      issue(issues, "invalid_condition_value", `${path53}.${field}`, "workflow condition value must be a JSON scalar");
+      issue(issues, "invalid_condition_value", `${path54}.${field}`, "workflow condition value must be a JSON scalar");
     }
   }
 }
@@ -4723,8 +4733,8 @@ function isJsonValue(value) {
   if (!value || typeof value !== "object") return false;
   return Object.values(value).every(isJsonValue);
 }
-function issue(issues, code, path53, message) {
-  issues.push({ code, path: path53, message });
+function issue(issues, code, path54, message) {
+  issues.push({ code, path: path54, message });
 }
 var SAFE_NAME, SAFE_STEP_ID, SAFE_DATA_PATH, SAFE_INPUT_SOURCE, SUPPORTED_STEP_FIELDS, SUPPORTED_TRANSITION_FIELDS;
 var init_workflowValidation = __esm({
@@ -7600,11 +7610,11 @@ async function nextAvailableLitellmUrl(url) {
   throw new Error(`no free LiteLLM port found after ${startPort}`);
 }
 function canListen(port, host) {
-  return new Promise((resolve19) => {
+  return new Promise((resolve20) => {
     const server = net.createServer();
-    server.once("error", () => resolve19(false));
+    server.once("error", () => resolve20(false));
     server.once("listening", () => {
-      server.close(() => resolve19(true));
+      server.close(() => resolve20(true));
     });
     server.listen(port, host);
   });
@@ -9027,9 +9037,9 @@ import * as fs28 from "fs";
 function stageGoalRunLogEvent(data, goalId, event, at = nowIso()) {
   const logs = goalRunLogs(data);
   const existing = logs[goalId];
-  const path53 = existing?.path ?? goalRunLogPath(goalId, data);
+  const path54 = existing?.path ?? goalRunLogPath(goalId, data);
   logs[goalId] = {
-    path: path53,
+    path: path54,
     events: [...existing?.events ?? [], buildGoalRunLogEvent(data, goalId, event, at)]
   };
 }
@@ -9906,15 +9916,15 @@ var init_backendStateBackend = __esm({
         this.jobsDir = opts.jobsDir.replace(/\/+$/, "");
       }
       async load(slug) {
-        const path53 = stateFilePath(this.jobsDir, slug);
+        const path54 = stateFilePath(this.jobsDir, slug);
         const loaded = await createStateBackendFromEnv().get(this.tenantId, `capabilities/${slug}`, "job-state");
         if (!loaded) {
-          return { path: path53, handle: null, state: initialStateEnvelope("seed"), created: true };
+          return { path: path54, handle: null, state: initialStateEnvelope("seed"), created: true };
         }
         if (!isStateEnvelope(loaded.doc)) {
           throw new Error(`BackendStateBackend: capabilities/${slug} is not a StateEnvelope`);
         }
-        return { path: path53, handle: loaded.updatedAt, state: loaded.doc, created: false };
+        return { path: path54, handle: loaded.updatedAt, state: loaded.doc, created: false };
       }
       async save(loaded, next) {
         if (!loaded.created && isStateUnchanged(loaded.state, next)) return false;
@@ -15343,13 +15353,13 @@ var init_loadCapabilityState = __esm({
 function isCompanyIntentId(value) {
   return SLUG_RE2.test(value);
 }
-function normalizeCompanyIntent(path53, raw) {
+function normalizeCompanyIntent(path54, raw) {
   if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
-    throw new Error(`${path53}: intent must be JSON object`);
+    throw new Error(`${path54}: intent must be JSON object`);
   }
   const input = raw;
   const id = stringField4(input.id);
-  if (!id || !isCompanyIntentId(id)) throw new Error(`${path53}: invalid intent id`);
+  if (!id || !isCompanyIntentId(id)) throw new Error(`${path54}: invalid intent id`);
   const createdAt = stringField4(input.createdAt) || nowIso();
   const updatedAt = stringField4(input.updatedAt) || createdAt;
   const description = stringField4(input.description);
@@ -15511,7 +15521,7 @@ function retryDelaysMs() {
 }
 function sleep(ms) {
   if (ms <= 0) return Promise.resolve();
-  return new Promise((resolve19) => setTimeout(resolve19, ms));
+  return new Promise((resolve20) => setTimeout(resolve20, ms));
 }
 async function fetchGoalStateWithRetry(config, goalId, cwd) {
   let state = await fetchGoalStateAsync(config, goalId, cwd);
@@ -16528,19 +16538,19 @@ function parseAgencyModelProposal(raw) {
 function normalizeBundleFiles(bundle) {
   const seen = /* @__PURE__ */ new Set();
   return bundle.files.map((file, index) => {
-    const path53 = file.path.replace(/^\/+/, "");
-    const parts = path53.split("/");
-    if (!path53 || file.path.startsWith("/") || file.path.includes("\\") || parts.some((part) => !part || part === "." || part === "..")) {
+    const path54 = file.path.replace(/^\/+/, "");
+    const parts = path54.split("/");
+    if (!path54 || file.path.startsWith("/") || file.path.includes("\\") || parts.some((part) => !part || part === "." || part === "..")) {
       throw new Error(`openAgencyModelReviewPr: files[${index}].path is unsafe`);
     }
     if (!/^(agents\/[^/]+\.md|capabilities\/[^/]+\/.+|goals\/(?:templates\/)?[^/]+\/.+|workflows\/[^/]+\.json)$/.test(
-      path53
+      path54
     )) {
       throw new Error(`openAgencyModelReviewPr: files[${index}].path is not a supported definition path`);
     }
-    if (seen.has(path53)) throw new Error(`openAgencyModelReviewPr: duplicate generated file path: ${path53}`);
-    seen.add(path53);
-    return { path: path53, content: file.content.replace(/\r\n?/g, "\n") };
+    if (seen.has(path54)) throw new Error(`openAgencyModelReviewPr: duplicate generated file path: ${path54}`);
+    seen.add(path54);
+    return { path: path54, content: file.content.replace(/\r\n?/g, "\n") };
   });
 }
 function buildProposalId(issueNumber, bundle, sourceLabel) {
@@ -17951,16 +17961,67 @@ var init_prepareCapabilityDelivery = __esm({
 });
 
 // src/scripts/prepareSimpleCapabilityRuntime.ts
+import { isIP } from "net";
+import * as path43 from "path";
 function requirementsFrom(ctx) {
   const raw = ctx.data.capabilityRequirements;
   return raw && typeof raw === "object" && !Array.isArray(raw) ? raw : {};
 }
-function configureBrowser(profile) {
+function isPrivateTargetHost(hostname) {
+  const host = hostname.toLowerCase();
+  if (host === "localhost" || host.endsWith(".localhost") || host.endsWith(".local")) return true;
+  if (isIP(host) === 4) {
+    const [a, b] = host.split(".").map(Number);
+    return a === 10 || a === 127 || a === 169 && b === 254 || a === 172 && b >= 16 && b <= 31 || a === 192 && b === 168;
+  }
+  if (isIP(host) === 6) {
+    return host === "::1" || host.startsWith("fc") || host.startsWith("fd") || host.startsWith("fe8");
+  }
+  return false;
+}
+function browserRuntime(ctx, requirements) {
+  if (!requirements.browserOnly) return PLAYWRIGHT_SERVER;
+  const input = ctx.data.capabilityInput;
+  if (!input || typeof input !== "object" || Array.isArray(input)) {
+    throw new Error("Restricted browser capability requires object input");
+  }
+  const targetUrl = input.targetUrl;
+  const qualityRunId = input.qualityRunId;
+  let origin = "";
+  try {
+    const parsed = new URL(typeof targetUrl === "string" ? targetUrl : "");
+    if (parsed.protocol === "https:" && !parsed.username && !parsed.password && !isPrivateTargetHost(parsed.hostname)) {
+      origin = parsed.origin;
+    }
+  } catch {
+  }
+  if (!origin) throw new Error("Restricted browser capability requires a public HTTPS targetUrl");
+  if (typeof qualityRunId !== "string" || !/^[A-Za-z0-9_-]{1,200}$/.test(qualityRunId)) {
+    throw new Error("Restricted browser capability requires a valid qualityRunId");
+  }
+  return {
+    ...PLAYWRIGHT_SERVER,
+    args: [
+      ...PLAYWRIGHT_SERVER.args,
+      "--allowed-origins",
+      origin,
+      "--output-dir",
+      path43.resolve(ctx.cwd, "test-results", "quality-runs", qualityRunId)
+    ]
+  };
+}
+function configureBrowser(ctx, profile, requirements) {
+  const server = browserRuntime(ctx, requirements);
+  if (requirements.browserOnly) {
+    profile.claudeCode.tools = ["Write"];
+    profile.claudeCode.permissionMode = "default";
+    profile.claudeCode.maxTurns = Math.min(profile.claudeCode.maxTurns ?? 50, 50);
+  }
   if (!profile.claudeCode.tools.includes("mcp__playwright")) {
     profile.claudeCode.tools = [...profile.claudeCode.tools, "mcp__playwright"];
   }
   if (!profile.claudeCode.mcpServers.some(({ name }) => name === PLAYWRIGHT_SERVER.name)) {
-    profile.claudeCode.mcpServers = [...profile.claudeCode.mcpServers, PLAYWRIGHT_SERVER];
+    profile.claudeCode.mcpServers = [...profile.claudeCode.mcpServers, server];
   }
 }
 function appendPrompt(ctx, section) {
@@ -17972,6 +18033,7 @@ var init_prepareSimpleCapabilityRuntime = __esm({
   "src/scripts/prepareSimpleCapabilityRuntime.ts"() {
     "use strict";
     init_loadQaContext();
+    init_runtimeSecrets();
     PLAYWRIGHT_SERVER = {
       name: "playwright",
       command: "npx",
@@ -17980,19 +18042,36 @@ var init_prepareSimpleCapabilityRuntime = __esm({
     prepareSimpleCapabilityRuntime = async (ctx, profile) => {
       const requirements = requirementsFrom(ctx);
       if (!requirements.browser) return;
-      configureBrowser(profile);
-      if (!requirements.qaCredentials) return;
-      await loadQaContext(ctx, profile);
-      appendPrompt(
-        ctx,
-        [
-          "## QA authentication",
-          "",
-          String(ctx.data.qaAuthBlock ?? ""),
-          "",
-          "If the changed surface requires authentication and the credentials are missing or the login is rejected, return a blocked result with a safe explanation. Do not include usernames, passwords, tokens, or other credential values in the result."
-        ].join("\n")
-      );
+      configureBrowser(ctx, profile, requirements);
+      if (requirements.qaCredentials) {
+        await loadQaContext(ctx, profile);
+        appendPrompt(
+          ctx,
+          [
+            "## QA authentication",
+            "",
+            String(ctx.data.qaAuthBlock ?? ""),
+            "",
+            "If the changed surface requires authentication and the credentials are missing or the login is rejected, return a blocked result with a safe explanation. Do not include usernames, passwords, tokens, or other credential values in the result."
+          ].join("\n")
+        );
+      }
+      if (requirements.githubTestToken) {
+        const token = await resolveRuntimeSecret("E2E_GITHUB_TOKEN", ctx);
+        appendPrompt(
+          ctx,
+          token.value ? [
+            "## Protected GitHub test login",
+            "",
+            `A protected GitHub test token is available: \`${token.value}\``,
+            "Use it only if the target application asks for a GitHub personal access token; never include the token in screenshots, output, logs, files, or messages."
+          ].join("\n") : [
+            "## Protected GitHub test login",
+            "",
+            "E2E_GITHUB_TOKEN is not configured. If this Quality Scenario requires GitHub token authentication, return a blocked result."
+          ].join("\n")
+        );
+      }
     };
   }
 });
@@ -18279,9 +18358,9 @@ function latestResult(raw, agentResult) {
 function recordField4(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : null;
 }
-function resolveDotted(root, path53) {
-  if (!path53) return void 0;
-  return path53.split(".").reduce((value, key) => recordField4(value)?.[key], root);
+function resolveDotted(root, path54) {
+  if (!path54) return void 0;
+  return path54.split(".").reduce((value, key) => recordField4(value)?.[key], root);
 }
 function stringValue5(value) {
   return typeof value === "string" && value.trim() ? value.trim() : null;
@@ -19123,7 +19202,7 @@ var init_previewBuildHelpers = __esm({
 // src/scripts/previewBuildRun.ts
 import { spawn as spawn5 } from "child_process";
 async function runCmd(cmd, args, opts = {}) {
-  await new Promise((resolve19, reject) => {
+  await new Promise((resolve20, reject) => {
     const child = spawn5(cmd, args, {
       cwd: opts.cwd,
       env: { ...process.env, ...opts.env ?? {} },
@@ -19135,7 +19214,7 @@ async function runCmd(cmd, args, opts = {}) {
     }
     child.on("error", reject);
     child.on("close", (code) => {
-      if (code === 0) resolve19();
+      if (code === 0) resolve20();
       else reject(new Error(`${cmd} ${args.join(" ")} exited ${code}`));
     });
   });
@@ -19207,12 +19286,12 @@ fi
 
 // src/scripts/runPreviewBuild.ts
 import { copyFile, writeFile } from "fs/promises";
-import * as path43 from "path";
+import * as path44 from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 function bundledDockerfilePath(mode) {
-  const here = path43.dirname(fileURLToPath2(import.meta.url));
+  const here = path44.dirname(fileURLToPath2(import.meta.url));
   const file = mode === "dev" ? "default-Dockerfile.preview.dev" : "default-Dockerfile.preview.prod";
-  return path43.join(here, "preview-build-templates", file);
+  return path44.join(here, "preview-build-templates", file);
 }
 function required(name) {
   const v = (process.env[name] ?? "").trim();
@@ -19447,10 +19526,10 @@ var init_runPreviewBuild = __esm({
         console.log(`[preview-build] vault: ${Object.keys(buildEnv).length} secrets, mode=${buildMode}`);
         if (Object.keys(buildEnv).length > 0) {
           const lines = Object.entries(buildEnv).map(([k, v]) => `${k}=${JSON.stringify(v)}`);
-          await writeFile(path43.join(ctx.cwd, ".env.production.local"), `${lines.join("\n")}
+          await writeFile(path44.join(ctx.cwd, ".env.production.local"), `${lines.join("\n")}
 `, "utf8");
         }
-        const consumerDockerfile = path43.join(ctx.cwd, "Dockerfile.preview");
+        const consumerDockerfile = path44.join(ctx.cwd, "Dockerfile.preview");
         const { stat } = await import("fs/promises");
         let hasConsumerDockerfile = false;
         try {
@@ -19635,7 +19714,7 @@ var init_tickShellRunner = __esm({
 
 // src/scripts/runScheduledImplementationTick.ts
 import * as fs47 from "fs";
-import * as path44 from "path";
+import * as path45 from "path";
 var runScheduledImplementationTick;
 var init_runScheduledImplementationTick = __esm({
   "src/scripts/runScheduledImplementationTick.ts"() {
@@ -19656,13 +19735,13 @@ var init_runScheduledImplementationTick = __esm({
         ctx.output.reason = `runScheduledImplementationTick: args.slug or ctx.args.${slugArg} must be non-empty capability slug`;
         return;
       }
-      const capability = resolveCapabilityFolder(slug, path44.resolve(ctx.cwd, jobsDir));
+      const capability = resolveCapabilityFolder(slug, path45.resolve(ctx.cwd, jobsDir));
       if (!capability) {
         ctx.output.exitCode = 99;
         ctx.output.reason = `runScheduledImplementationTick: capability folder not found or incomplete: ${slug} (searched ${jobsDir} and company store)`;
         return;
       }
-      const shellPath = path44.join(profile.dir, shell);
+      const shellPath = path45.join(profile.dir, shell);
       if (!fs47.existsSync(shellPath)) {
         ctx.output.exitCode = 99;
         ctx.output.reason = `runScheduledImplementationTick: shell not found: ${shell} (looked in ${profile.dir})`;
@@ -19781,7 +19860,7 @@ var init_runSimpleCapabilityScript = __esm({
 
 // src/scripts/runTickScript.ts
 import * as fs49 from "fs";
-import * as path45 from "path";
+import * as path46 from "path";
 var runTickScript;
 var init_runTickScript = __esm({
   "src/scripts/runTickScript.ts"() {
@@ -19801,10 +19880,10 @@ var init_runTickScript = __esm({
         ctx.output.reason = `runTickScript: ctx.args.${slugArg} must be a non-empty slug`;
         return;
       }
-      const capability = readCapabilityFolder(path45.resolve(ctx.cwd, jobsDir), slug);
+      const capability = readCapabilityFolder(path46.resolve(ctx.cwd, jobsDir), slug);
       if (!capability) {
         ctx.output.exitCode = 99;
-        ctx.output.reason = `runTickScript: capability folder not found or incomplete: ${path45.resolve(ctx.cwd, jobsDir, slug)}`;
+        ctx.output.reason = `runTickScript: capability folder not found or incomplete: ${path46.resolve(ctx.cwd, jobsDir, slug)}`;
         return;
       }
       const tickScript = capability.config.tickScript;
@@ -19813,7 +19892,7 @@ var init_runTickScript = __esm({
         ctx.output.reason = `runTickScript: capability ${slug} has no \`tickScript\` in profile.json \u2014 route via capability-tick instead`;
         return;
       }
-      const scriptPath = path45.isAbsolute(tickScript) ? tickScript : path45.join(ctx.cwd, tickScript);
+      const scriptPath = path46.isAbsolute(tickScript) ? tickScript : path46.join(ctx.cwd, tickScript);
       if (!fs49.existsSync(scriptPath)) {
         ctx.output.exitCode = 99;
         ctx.output.reason = `runTickScript: tickScript not found: ${scriptPath}`;
@@ -20096,7 +20175,7 @@ var init_syncFlow = __esm({
 });
 
 // src/scripts/validateAgencyModelProposal.ts
-import * as path46 from "path";
+import * as path47 from "path";
 function validateModelBundle(bundle, expectedKind, options = {}) {
   const failures = [];
   validateOneModel(bundle.model, bundle.files, "model", true, failures, expectedKind, options);
@@ -20414,7 +20493,7 @@ var init_validateAgencyModelProposal = __esm({
       const bundle = parseAgencyModelProposal(raw);
       const expectedKind = readExpectedModelKind(args);
       const failures = validateModelBundle(bundle, expectedKind, {
-        capabilityRoot: path46.join(ctx.cwd, ".kody", "capabilities")
+        capabilityRoot: path47.join(ctx.cwd, ".kody", "capabilities")
       });
       if (failures.length > 0) {
         throw new Error(`validateAgencyModelProposal: ${failures.join("; ")}`);
@@ -20477,7 +20556,7 @@ function stripAnsi2(s) {
   return s.replace(ANSI_RE2, "");
 }
 function runCommand2(command, cwd) {
-  return new Promise((resolve19) => {
+  return new Promise((resolve20) => {
     const child = spawn6(command, {
       cwd,
       shell: true,
@@ -20504,11 +20583,11 @@ function runCommand2(command, cwd) {
     }, TEST_TIMEOUT_MS);
     child.on("exit", (code) => {
       clearTimeout(timer);
-      resolve19({ exitCode: code ?? -1, output: Buffer.concat(buffers).toString("utf-8") });
+      resolve20({ exitCode: code ?? -1, output: Buffer.concat(buffers).toString("utf-8") });
     });
     child.on("error", (err) => {
       clearTimeout(timer);
-      resolve19({ exitCode: -1, output: err.message });
+      resolve20({ exitCode: -1, output: err.message });
     });
   });
 }
@@ -20914,21 +20993,21 @@ function lineStream(stream) {
     tryDeliver();
   });
   return {
-    next: (timeoutMs) => new Promise((resolve19) => {
+    next: (timeoutMs) => new Promise((resolve20) => {
       if (queue.length > 0) {
-        resolve19(queue.shift());
+        resolve20(queue.shift());
         return;
       }
       if (ended) {
-        resolve19(null);
+        resolve20(null);
         return;
       }
-      waiter = resolve19;
+      waiter = resolve20;
       const t = setTimeout(
         () => {
-          if (waiter === resolve19) {
+          if (waiter === resolve20) {
             waiter = null;
-            resolve19(null);
+            resolve20(null);
           }
         },
         Math.max(0, timeoutMs)
@@ -21330,15 +21409,15 @@ var init_scripts = __esm({
 
 // src/stateWorkspace.ts
 import * as fs51 from "fs";
-import * as path47 from "path";
+import * as path48 from "path";
 function tenantId(config) {
   const owner = config.github?.owner?.trim() || process.env.GITHUB_REPOSITORY?.split("/")[0]?.trim();
   const repo = config.github?.repo?.trim() || process.env.GITHUB_REPOSITORY?.split("/")[1]?.trim();
   return owner && repo ? `${owner}/${repo}` : null;
 }
 function writeRuntimeFile(cwd, relativePath, content) {
-  const target = path47.join(cwd, RUNTIME_ROOT, relativePath);
-  fs51.mkdirSync(path47.dirname(target), { recursive: true });
+  const target = path48.join(cwd, RUNTIME_ROOT, relativePath);
+  fs51.mkdirSync(path48.dirname(target), { recursive: true });
   fs51.writeFileSync(target, content, "utf8");
 }
 function record(value) {
@@ -21404,10 +21483,10 @@ async function hydrateStateWorkspace(config, cwd, backendOverride) {
       throw new Error("Kody backend access is required for runtime workspace documents");
     return;
   }
-  const key = `${path47.resolve(cwd)}|${tenant}`;
+  const key = `${path48.resolve(cwd)}|${tenant}`;
   if (hydratedWorkspaces.has(key)) return;
   const backend = backendOverride ?? createStateBackendFromEnv();
-  const root = path47.join(cwd, RUNTIME_ROOT);
+  const root = path48.join(cwd, RUNTIME_ROOT);
   fs51.rmSync(root, { recursive: true, force: true });
   await Promise.all([
     hydratePrefix(backend, tenant, cwd, "context:"),
@@ -21424,7 +21503,7 @@ var init_stateWorkspace = __esm({
   "src/stateWorkspace.ts"() {
     "use strict";
     init_state_backend();
-    RUNTIME_ROOT = path47.join(".kody-engine", "runtime");
+    RUNTIME_ROOT = path48.join(".kody-engine", "runtime");
     hydratedWorkspaces = /* @__PURE__ */ new Set();
   }
 });
@@ -21497,7 +21576,7 @@ var init_tools = __esm({
 import { spawn as spawn8 } from "child_process";
 import * as fs52 from "fs";
 import * as os8 from "os";
-import * as path48 from "path";
+import * as path49 from "path";
 function isMutatingPostflight(scriptName) {
   return MUTATING_POSTFLIGHTS.has(scriptName ?? "");
 }
@@ -21749,7 +21828,7 @@ async function runImplementation(profileName, input) {
   const jobWhyBlock = typeof ctx.data.jobWhy === "string" ? operatorRequestBlock(ctx.data.jobWhy) : null;
   const jobRefBlock = jobReferenceBlock(profileName, profile, ctx.data);
   const invokeAgent = async (prompt) => {
-    const externalPlugins = (profile.claudeCode.plugins ?? []).map((p) => path48.isAbsolute(p) ? p : path48.resolve(profile.dir, p)).filter((p) => p.length > 0);
+    const externalPlugins = (profile.claudeCode.plugins ?? []).map((p) => path49.isAbsolute(p) ? p : path49.resolve(profile.dir, p)).filter((p) => p.length > 0);
     const syntheticPath = ctx.data.syntheticPluginPath;
     const pluginPaths = [...externalPlugins, ...syntheticPath ? [syntheticPath] : []];
     const agents = loadSubagents(profile);
@@ -22225,13 +22304,13 @@ function clearStampedLifecycleLabels(profile, ctx) {
 function resolveProfilePath(profileName, cwd = process.cwd()) {
   const found = resolveImplementation(profileName, getRuntimeProfileRootsForCwd(cwd));
   if (found) return found;
-  const here = path48.dirname(new URL(import.meta.url).pathname);
+  const here = path49.dirname(new URL(import.meta.url).pathname);
   const candidates = [
-    path48.join(here, "implementations", profileName, "profile.json"),
+    path49.join(here, "implementations", profileName, "profile.json"),
     // same-dir sibling (dev)
-    path48.join(here, "..", "implementations", profileName, "profile.json"),
+    path49.join(here, "..", "implementations", profileName, "profile.json"),
     // up one (prod: dist/bin → dist/implementations)
-    path48.join(here, "..", "src", "implementations", profileName, "profile.json")
+    path49.join(here, "..", "src", "implementations", profileName, "profile.json")
     // fallback
   ];
   for (const c of candidates) {
@@ -22350,7 +22429,7 @@ function resolveShellTimeoutMs(entry) {
 }
 async function runShellEntry(entry, ctx, profile) {
   const shellName = entry.shell;
-  const shellPath = path48.join(profile.dir, shellName);
+  const shellPath = path49.join(profile.dir, shellName);
   if (!fs52.existsSync(shellPath)) {
     ctx.skipAgent = true;
     ctx.output.exitCode = 99;
@@ -22358,7 +22437,7 @@ async function runShellEntry(entry, ctx, profile) {
     return;
   }
   const positional = entry.with ? Object.values(entry.with).map((v) => String(v)) : [];
-  const outputFile = path48.join(
+  const outputFile = path49.join(
     os8.tmpdir(),
     `kody-shell-output-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`
   );
@@ -22388,14 +22467,14 @@ async function runShellEntry(entry, ctx, profile) {
   let killTimer;
   let escalateTimer;
   const result = await new Promise(
-    (resolve19) => {
+    (resolve20) => {
       let settled = false;
       const settle = (code, signal, spawnErr) => {
         if (settled) return;
         settled = true;
         if (killTimer) clearTimeout(killTimer);
         if (escalateTimer) clearTimeout(escalateTimer);
-        resolve19({ code, signal, spawnErr });
+        resolve20({ code, signal, spawnErr });
       };
       child.on("error", (err) => settle(null, null, err));
       child.on("close", (code, signal) => settle(code, signal));
@@ -23283,11 +23362,11 @@ function exhaustedWorkflowTransitions(step, data, counts) {
 }
 function workflowResultConditionPaths(transitions) {
   return transitions.flatMap(
-    (transition) => Object.keys(transition.when ?? {}).filter((path53) => path53.startsWith("result."))
+    (transition) => Object.keys(transition.when ?? {}).filter((path54) => path54.startsWith("result."))
   );
 }
 function conditionMatches(condition, context) {
-  return Object.entries(condition).every(([path53, expected]) => valueMatches(resolveDottedPath2(context, path53), expected));
+  return Object.entries(condition).every(([path54, expected]) => valueMatches(resolveDottedPath2(context, path54), expected));
 }
 function withWorkflowBoundaryEval(capability, result) {
   const capabilityKind = capability.config.capabilityKind;
@@ -23724,7 +23803,7 @@ function translateOpenAISseToBrain(opts) {
 
 // src/servers/brain-serve.ts
 import { createServer as createServer2 } from "http";
-import * as path51 from "path";
+import * as path52 from "path";
 
 // src/chat/loop.ts
 init_agent();
@@ -23878,9 +23957,9 @@ var CodexAppServerClient = class {
     await this.request("thread/resume", { threadId });
   }
   async runTurn(args) {
-    await new Promise((resolve19, reject) => {
+    await new Promise((resolve20, reject) => {
       this.process.turnWaiters.set(args.threadId, {
-        resolve: resolve19,
+        resolve: resolve20,
         reject,
         onNotification: args.onNotification,
         queue: Promise.resolve()
@@ -23897,8 +23976,8 @@ var CodexAppServerClient = class {
   }
   request(method, params) {
     const id = this.process.nextId++;
-    return new Promise((resolve19, reject) => {
-      this.process.pending.set(id, { resolve: resolve19, reject });
+    return new Promise((resolve20, reject) => {
+      this.process.pending.set(id, { resolve: resolve20, reject });
       this.process.child.stdin.write(`${JSON.stringify({ method, id, params })}
 `);
     });
@@ -24965,7 +25044,7 @@ async function hydrateDefinitionsFromEnv(cwd = process.cwd(), env = process.env)
 // src/kody-cli.ts
 import { execFileSync as execFileSync24 } from "child_process";
 import * as fs53 from "fs";
-import * as path49 from "path";
+import * as path50 from "path";
 
 // src/app-auth.ts
 import { createSign } from "crypto";
@@ -25767,9 +25846,9 @@ async function resolveAuthToken(env = process.env) {
   return void 0;
 }
 function detectPackageManager2(cwd) {
-  if (fs53.existsSync(path49.join(cwd, "pnpm-lock.yaml"))) return "pnpm";
-  if (fs53.existsSync(path49.join(cwd, "yarn.lock"))) return "yarn";
-  if (fs53.existsSync(path49.join(cwd, "bun.lockb"))) return "bun";
+  if (fs53.existsSync(path50.join(cwd, "pnpm-lock.yaml"))) return "pnpm";
+  if (fs53.existsSync(path50.join(cwd, "yarn.lock"))) return "yarn";
+  if (fs53.existsSync(path50.join(cwd, "bun.lockb"))) return "bun";
   return "npm";
 }
 function shouldChainScheduledWatch(match) {
@@ -25902,7 +25981,7 @@ async function runCi(argv) {
     return 0;
   }
   const args = parseCiArgs(argv);
-  const cwd = args.cwd ? path49.resolve(args.cwd) : process.cwd();
+  const cwd = args.cwd ? path50.resolve(args.cwd) : process.cwd();
   try {
     const n = unpackAllSecrets();
     if (n > 0) process.stdout.write(`\u2192 kody: unpacked ${n} secret(s) from ALL_SECRETS
@@ -26386,7 +26465,7 @@ init_repoWorkspace();
 // src/scripts/brainTurnLog.ts
 init_runtimePaths();
 import * as fs54 from "fs";
-import * as path50 from "path";
+import * as path51 from "path";
 import posixPath4 from "path/posix";
 var live = /* @__PURE__ */ new Map();
 function brainEventsFilePath(dir, chatId) {
@@ -26433,7 +26512,7 @@ function beginTurn(dir, chatId) {
   };
   live.set(chatId, state);
   const p = brainEventsFilePath(dir, chatId);
-  fs54.mkdirSync(path50.dirname(p), { recursive: true });
+  fs54.mkdirSync(path51.dirname(p), { recursive: true });
   return (event) => {
     state.seq += 1;
     const rec = { seq: state.seq, turn, ts: Date.now(), event };
@@ -26571,17 +26650,17 @@ function authOk(req, expected) {
   return false;
 }
 function readJsonBody(req) {
-  return new Promise((resolve19, reject) => {
+  return new Promise((resolve20, reject) => {
     const chunks = [];
     req.on("data", (c) => chunks.push(c));
     req.on("end", () => {
       const raw = Buffer.concat(chunks).toString("utf-8");
       if (!raw.trim()) {
-        resolve19({});
+        resolve20({});
         return;
       }
       try {
-        resolve19(JSON.parse(raw));
+        resolve20(JSON.parse(raw));
       } catch (err) {
         reject(err instanceof Error ? err : new Error(String(err)));
       }
@@ -26873,7 +26952,7 @@ function buildServer(opts) {
   const runTurn = opts.runTurn ?? runChatTurn;
   const createStore = opts.createStore ?? createSessionStore;
   const cloneRepo = opts.cloneRepo ?? defaultCloneRepo;
-  const reposRoot = opts.reposRoot ?? path51.join(path51.dirname(path51.resolve(opts.cwd)), "repos");
+  const reposRoot = opts.reposRoot ?? path52.join(path52.dirname(path52.resolve(opts.cwd)), "repos");
   return createServer2(async (req, res) => {
     if (!req.method || !req.url) {
       sendJson(res, 400, { error: "bad request" });
@@ -26954,11 +27033,11 @@ async function brainServe(opts) {
     litellmUrl,
     driver
   });
-  await new Promise((resolve19) => {
+  await new Promise((resolve20) => {
     server.listen(port, "0.0.0.0", () => {
       process.stdout.write(`[brain-serve] listening on 0.0.0.0:${port} (cwd=${opts.cwd})
 `);
-      resolve19();
+      resolve20();
     });
   });
   const shutdown = (signal) => {
@@ -27213,14 +27292,14 @@ async function startBrainProxy(opts) {
   const { httpServer, handler } = buildBrainProxy(opts);
   const port = opts.port ?? 0;
   const host = opts.host ?? "127.0.0.1";
-  await new Promise((resolve19) => httpServer.listen(port, host, () => resolve19()));
+  await new Promise((resolve20) => httpServer.listen(port, host, () => resolve20()));
   const addr = httpServer.address();
   return {
     httpServer,
     port: addr.port,
     url: `http://${host}:${addr.port}`,
-    stop: () => new Promise((resolve19) => {
-      httpServer.close(() => resolve19());
+    stop: () => new Promise((resolve20) => {
+      httpServer.close(() => resolve20());
     }),
     handler
   };
@@ -27370,23 +27449,23 @@ function buildMcpHttpServer(opts) {
     httpServer,
     routes,
     port,
-    stop: () => new Promise((resolve19) => {
+    stop: () => new Promise((resolve20) => {
       let pending = transports.size;
       if (pending === 0) {
-        httpServer.close(() => resolve19());
+        httpServer.close(() => resolve20());
         return;
       }
       for (const transport of transports.values()) {
         void transport.close().finally(() => {
           pending--;
-          if (pending === 0) httpServer.close(() => resolve19());
+          if (pending === 0) httpServer.close(() => resolve20());
         });
       }
     })
   };
 }
 function listenMcpHttpServer(server, host = "127.0.0.1") {
-  return new Promise((resolve19, reject) => {
+  return new Promise((resolve20, reject) => {
     server.httpServer.once("error", reject);
     server.httpServer.listen(server.port, host, () => {
       server.httpServer.off("error", reject);
@@ -27394,7 +27473,7 @@ function listenMcpHttpServer(server, host = "127.0.0.1") {
       if (addr && typeof addr === "object") {
         server.port = addr.port;
       }
-      resolve19();
+      resolve20();
     });
   });
 }
@@ -27477,7 +27556,7 @@ async function loadConfigSafe() {
 }
 
 // src/chat-cli.ts
-import * as path52 from "path";
+import * as path53 from "path";
 
 // src/chat/inbox.ts
 import { execFileSync as execFileSync25 } from "child_process";
@@ -27544,7 +27623,7 @@ async function waitForNextUserMessage(opts) {
   }
 }
 function sleep3(ms) {
-  return new Promise((resolve19) => setTimeout(resolve19, ms));
+  return new Promise((resolve20) => setTimeout(resolve20, ms));
 }
 function currentBranch(cwd) {
   try {
@@ -27768,7 +27847,7 @@ async function runChat(argv) {
 ${CHAT_HELP}`);
     return 64;
   }
-  const cwd = args.cwd ? path52.resolve(args.cwd) : process.cwd();
+  const cwd = args.cwd ? path53.resolve(args.cwd) : process.cwd();
   const sessionId = args.sessionId;
   const runRequest = readRunRequestFromEnv();
   if (runRequest && "request" in runRequest) {
@@ -27964,8 +28043,8 @@ var FlyClient = class {
   get fetch() {
     return this.opts.fetchImpl ?? fetch;
   }
-  async call(path53, init = {}) {
-    const res = await this.fetch(`${FLY_API_BASE}${path53}`, {
+  async call(path54, init = {}) {
+    const res = await this.fetch(`${FLY_API_BASE}${path54}`, {
       method: init.method ?? "GET",
       headers: {
         Authorization: `Bearer ${this.opts.token}`,
@@ -27976,7 +28055,7 @@ var FlyClient = class {
     if (res.status === 404 && init.allow404) return null;
     if (!res.ok) {
       const text2 = await res.text().catch(() => "");
-      throw new Error(`Fly API ${res.status} on ${path53}: ${text2.slice(0, 200) || res.statusText}`);
+      throw new Error(`Fly API ${res.status} on ${path54}: ${text2.slice(0, 200) || res.statusText}`);
     }
     if (res.status === 204) return null;
     const raw = await res.text();
@@ -28489,14 +28568,14 @@ function sendJson2(res, status, body) {
   res.end(JSON.stringify(body));
 }
 function readJsonBody2(req) {
-  return new Promise((resolve19, reject) => {
+  return new Promise((resolve20, reject) => {
     const chunks = [];
     req.on("data", (c) => chunks.push(c));
     req.on("end", () => {
       const raw = Buffer.concat(chunks).toString("utf-8");
-      if (!raw.trim()) return resolve19({});
+      if (!raw.trim()) return resolve20({});
       try {
-        resolve19(JSON.parse(raw));
+        resolve20(JSON.parse(raw));
       } catch (err) {
         reject(err instanceof Error ? err : new Error(String(err)));
       }
@@ -28650,10 +28729,10 @@ async function poolServe() {
     }
   });
   const apiHost = process.env.POOL_API_HOST ?? "::";
-  await new Promise((resolve19) => {
+  await new Promise((resolve20) => {
     server.listen(apiPort, apiHost, () => {
       log(`listening on ${apiHost}:${apiPort} (min=${min}, app=${app}, region=${region})`);
-      resolve19();
+      resolve20();
     });
   });
   if (loopTickEnabled) void runLoopTick();
@@ -28693,17 +28772,17 @@ function authOk2(req, expected) {
   return false;
 }
 function readJsonBody3(req) {
-  return new Promise((resolve19, reject) => {
+  return new Promise((resolve20, reject) => {
     const chunks = [];
     req.on("data", (c) => chunks.push(c));
     req.on("end", () => {
       const raw = Buffer.concat(chunks).toString("utf-8");
       if (!raw.trim()) {
-        resolve19({});
+        resolve20({});
         return;
       }
       try {
-        resolve19(JSON.parse(raw));
+        resolve20(JSON.parse(raw));
       } catch (err) {
         reject(err instanceof Error ? err : new Error(String(err)));
       }
@@ -28778,13 +28857,13 @@ async function defaultRunJob(job) {
     ...interactive && job.idleExitMs ? { KODY_IDLE_EXIT_MS: String(job.idleExitMs) } : {},
     ...interactive && job.hardCapMs ? { KODY_HARD_CAP_MS: String(job.hardCapMs) } : {}
   };
-  const run = (cmd, args, cwd) => new Promise((resolve19) => {
+  const run = (cmd, args, cwd) => new Promise((resolve20) => {
     const child = spawn9(cmd, args, { stdio: "inherit", env: childEnv, cwd });
-    child.on("exit", (code) => resolve19(code ?? 0));
+    child.on("exit", (code) => resolve20(code ?? 0));
     child.on("error", (err) => {
       process.stderr.write(`[runner-serve] ${cmd} failed: ${err.message}
 `);
-      resolve19(1);
+      resolve20(1);
     });
   });
   process.stdout.write(`[runner-serve] job ${job.jobId}: cloning ${job.repo}@${branch}
@@ -28860,11 +28939,11 @@ async function runnerServe() {
   const port = Number(process.env.PORT ?? DEFAULT_PORT2);
   const server = buildServer2({ apiKey });
   const host = process.env.RUNNER_HOST ?? "::";
-  await new Promise((resolve19) => {
+  await new Promise((resolve20) => {
     server.listen(port, host, () => {
       process.stdout.write(`[runner-serve] listening on ${host}:${port} (idle, awaiting job)
 `);
-      resolve19();
+      resolve20();
     });
   });
   const shutdown = (signal) => {
@@ -28933,14 +29012,14 @@ async function serve(opts) {
 `);
     const args = ["--dangerously-skip-permissions", "--model", model.model];
     const child = spawn10("claude", args, { stdio: "inherit", env: editorEnv, cwd: opts.cwd });
-    const exitCode = await new Promise((resolve19) => {
-      child.on("exit", (code) => resolve19(code ?? 0));
+    const exitCode = await new Promise((resolve20) => {
+      child.on("exit", (code) => resolve20(code ?? 0));
       child.on("error", (err) => {
         process.stderr.write(`[kody serve] failed to launch Claude Code: ${err.message}
 `);
         process.stderr.write(`  Install: https://docs.anthropic.com/claude/docs/claude-code
 `);
-        resolve19(1);
+        resolve20(1);
       });
     });
     killProxy();

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@kody-ade/kody-engine",
-  "version": "0.4.550",
-  "description": "kody \u2014 autonomous development engine. Single-session Claude Code agent behind a generic executor + declarative implementation profiles.",
+  "version": "0.4.552",
+  "description": "kody — autonomous development engine. Single-session Claude Code agent behind a generic executor + declarative implementation profiles.",
   "license": "MIT",
   "type": "module",
   "bin": {
@@ -12,29 +12,6 @@
     "templates",
     "kody.config.schema.json"
   ],
-  "scripts": {
-    "kody:run": "tsx bin/kody.ts",
-    "serve": "tsx bin/kody.ts serve",
-    "serve:vscode": "tsx bin/kody.ts serve vscode",
-    "serve:claude": "tsx bin/kody.ts serve claude",
-    "clean:dist": "node scripts/clean-dist.cjs",
-    "build": "pnpm clean:dist && tsup && node scripts/copy-assets.cjs",
-    "check:modularity": "tsx scripts/check-script-modularity.ts",
-    "pretest": "pnpm check:modularity",
-    "test": "vitest run tests/unit tests/int --coverage",
-    "posttest": "tsx scripts/check-coverage-floor.ts",
-    "test:smoke": "vitest run tests/smoke --no-coverage",
-    "test:e2e": "vitest run tests/e2e --no-coverage",
-    "test:runtime-services": "node --test \"tests/runtime-services/*.test.mjs\"",
-    "test:all": "vitest run tests --no-coverage",
-    "typecheck": "tsc --noEmit",
-    "lint": "biome check",
-    "lint:fix": "biome check --write",
-    "format": "biome format --write",
-    "verify:package": "node scripts/verify-package-tarball.cjs",
-    "brain:publish": "docker buildx build --platform linux/amd64 -f runner/Dockerfile.brain --build-arg KODY_ENGINE_REF=$(git rev-parse HEAD) -t ghcr.io/${KODY_BRAIN_GHCR_OWNER:-aharonyaircohen}/kody-brain:latest --push runner",
-    "prepublishOnly": "pnpm typecheck && pnpm test:runtime-services && pnpm build && pnpm verify:package"
-  },
   "dependencies": {
     "@actions/cache": "^6.0.0",
     "@anthropic-ai/claude-agent-sdk": "0.2.119",
@@ -61,5 +38,27 @@
     "url": "git+https://github.com/aharonyaircohen/kody-engine.git"
   },
   "homepage": "https://github.com/aharonyaircohen/kody-engine",
-  "bugs": "https://github.com/aharonyaircohen/kody-engine/issues"
-}
+  "bugs": "https://github.com/aharonyaircohen/kody-engine/issues",
+  "scripts": {
+    "kody:run": "tsx bin/kody.ts",
+    "serve": "tsx bin/kody.ts serve",
+    "serve:vscode": "tsx bin/kody.ts serve vscode",
+    "serve:claude": "tsx bin/kody.ts serve claude",
+    "clean:dist": "node scripts/clean-dist.cjs",
+    "build": "pnpm clean:dist && tsup && node scripts/copy-assets.cjs",
+    "check:modularity": "tsx scripts/check-script-modularity.ts",
+    "pretest": "pnpm check:modularity",
+    "test": "vitest run tests/unit tests/int --coverage",
+    "posttest": "tsx scripts/check-coverage-floor.ts",
+    "test:smoke": "vitest run tests/smoke --no-coverage",
+    "test:e2e": "vitest run tests/e2e --no-coverage",
+    "test:runtime-services": "node --test \"tests/runtime-services/*.test.mjs\"",
+    "test:all": "vitest run tests --no-coverage",
+    "typecheck": "tsc --noEmit",
+    "lint": "biome check",
+    "lint:fix": "biome check --write",
+    "format": "biome format --write",
+    "verify:package": "node scripts/verify-package-tarball.cjs",
+    "brain:publish": "docker buildx build --platform linux/amd64 -f runner/Dockerfile.brain --build-arg KODY_ENGINE_REF=$(git rev-parse HEAD) -t ghcr.io/${KODY_BRAIN_GHCR_OWNER:-aharonyaircohen}/kody-brain:latest --push runner"
+  }
+}