@kody-ade/kody-engine 0.4.578 → 0.4.580

package/dist/bin/kody.js

@@ -15,7 +15,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "@kody-ade/kody-engine",
-      version: "0.4.578",
+      version: "0.4.580",
       description: "kody \u2014 autonomous development engine. Single-session Claude Code agent behind a generic executor + declarative implementation profiles.",
       license: "MIT",
       type: "module",
@@ -2269,7 +2269,8 @@ function parseDeliveryPathAllowlist(raw) {
     const subtree = value.endsWith("/**");
     const base = subtree ? value.slice(0, -3) : value;
     const segments = base.split("/");
-    if (!base || base.startsWith("/") || base.startsWith(".") && !base.startsWith(".github/") || base.includes("\\") || base.includes("..") || base.includes("*") || segments.some((segment) => !segment) || subtree && segments.length < 2 || value === ".github/**") {
+    const trustedRepositoryDefinitions = base === ".kody-engine/definitions/loops";
+    if (!base || base.startsWith("/") || base.startsWith(".") && !base.startsWith(".github/") && !trustedRepositoryDefinitions || base.includes("\\") || base.includes("..") || base.includes("*") || segments.some((segment) => !segment) || subtree && segments.length < 2 || value === ".github/**") {
       throw new Error(`contract.json deliveryPathAllowlist contains an unsafe path: ${value}`);
     }
   }
@@ -8693,9 +8694,11 @@ function isExplicitlyAllowed(p, allowlist) {
 }
 function isForbiddenPath(p, deliveryPathAllowlist = []) {
   if (FORBIDDEN_PATH_EXACT.has(p)) return true;
-  for (const pre of FORBIDDEN_PATH_PREFIXES) if (p.startsWith(pre)) return true;
   for (const suf of FORBIDDEN_PATH_SUFFIXES) if (p.endsWith(suf)) return true;
-  if (isExplicitlyAllowed(p, deliveryPathAllowlist)) return false;
+  if (isExplicitlyAllowed(p, deliveryPathAllowlist) && (p.startsWith(".kody-engine/definitions/loops/") || isGitHubYamlPath(p))) {
+    return false;
+  }
+  for (const pre of FORBIDDEN_PATH_PREFIXES) if (p.startsWith(pre)) return true;
   if (isGitHubYamlPath(p)) return true;
   for (const pre of ALLOWED_PATH_PREFIXES) if (p.startsWith(pre)) return false;
   return false;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kody-ade/kody-engine",
-  "version": "0.4.578",
+  "version": "0.4.580",
   "description": "kody — autonomous development engine. Single-session Claude Code agent behind a generic executor + declarative implementation profiles.",
   "license": "MIT",
   "type": "module",
@@ -12,6 +12,30 @@
     "templates",
     "kody.config.schema.json"
   ],
+  "scripts": {
+    "kody:run": "tsx bin/kody.ts",
+    "serve": "tsx bin/kody.ts serve",
+    "serve:vscode": "tsx bin/kody.ts serve vscode",
+    "serve:claude": "tsx bin/kody.ts serve claude",
+    "clean:dist": "node scripts/clean-dist.cjs",
+    "build": "pnpm clean:dist && tsup && node scripts/copy-assets.cjs",
+    "check:modularity": "tsx scripts/check-script-modularity.ts",
+    "pretest": "pnpm check:modularity",
+    "test": "vitest run tests/unit tests/int --coverage",
+    "posttest": "tsx scripts/check-coverage-floor.ts",
+    "test:smoke": "vitest run tests/smoke --no-coverage",
+    "test:e2e": "vitest run tests/e2e --no-coverage",
+    "verify:live-release": "tsx scripts/live-release-gate.ts",
+    "test:runtime-services": "node --test \"tests/runtime-services/*.test.mjs\"",
+    "test:all": "vitest run tests --no-coverage",
+    "typecheck": "tsc --noEmit",
+    "lint": "biome check",
+    "lint:fix": "biome check --write",
+    "format": "biome format --write",
+    "verify:package": "node scripts/verify-package-tarball.cjs",
+    "brain:publish": "docker buildx build --platform linux/amd64 -f runner/Dockerfile.brain --build-arg KODY_ENGINE_REF=$(git rev-parse HEAD) -t ghcr.io/${KODY_BRAIN_GHCR_OWNER:-aharonyaircohen}/kody-brain:latest --push runner",
+    "prepublishOnly": "pnpm typecheck && pnpm test:runtime-services && pnpm build && pnpm verify:package"
+  },
   "dependencies": {
     "@actions/cache": "^6.0.0",
     "@anthropic-ai/claude-agent-sdk": "0.2.119",
@@ -38,28 +62,5 @@
     "url": "git+https://github.com/aharonyaircohen/kody-engine.git"
   },
   "homepage": "https://github.com/aharonyaircohen/kody-engine",
-  "bugs": "https://github.com/aharonyaircohen/kody-engine/issues",
-  "scripts": {
-    "kody:run": "tsx bin/kody.ts",
-    "serve": "tsx bin/kody.ts serve",
-    "serve:vscode": "tsx bin/kody.ts serve vscode",
-    "serve:claude": "tsx bin/kody.ts serve claude",
-    "clean:dist": "node scripts/clean-dist.cjs",
-    "build": "pnpm clean:dist && tsup && node scripts/copy-assets.cjs",
-    "check:modularity": "tsx scripts/check-script-modularity.ts",
-    "pretest": "pnpm check:modularity",
-    "test": "vitest run tests/unit tests/int --coverage",
-    "posttest": "tsx scripts/check-coverage-floor.ts",
-    "test:smoke": "vitest run tests/smoke --no-coverage",
-    "test:e2e": "vitest run tests/e2e --no-coverage",
-    "verify:live-release": "tsx scripts/live-release-gate.ts",
-    "test:runtime-services": "node --test \"tests/runtime-services/*.test.mjs\"",
-    "test:all": "vitest run tests --no-coverage",
-    "typecheck": "tsc --noEmit",
-    "lint": "biome check",
-    "lint:fix": "biome check --write",
-    "format": "biome format --write",
-    "verify:package": "node scripts/verify-package-tarball.cjs",
-    "brain:publish": "docker buildx build --platform linux/amd64 -f runner/Dockerfile.brain --build-arg KODY_ENGINE_REF=$(git rev-parse HEAD) -t ghcr.io/${KODY_BRAIN_GHCR_OWNER:-aharonyaircohen}/kody-brain:latest --push runner"
-  }
-}
+  "bugs": "https://github.com/aharonyaircohen/kody-engine/issues"
+}