@kody-ade/kody-engine 0.4.579 → 0.4.581

package/dist/bin/kody.js

@@ -15,7 +15,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "@kody-ade/kody-engine",
-      version: "0.4.579",
+      version: "0.4.581",
       description: "kody \u2014 autonomous development engine. Single-session Claude Code agent behind a generic executor + declarative implementation profiles.",
       license: "MIT",
       type: "module",
@@ -8620,6 +8620,7 @@ var init_pushWithRetry = __esm({
 
 // src/commit.ts
 import { execFileSync as execFileSync6 } from "child_process";
+import { isDeepStrictEqual } from "util";
 import * as fs29 from "fs";
 import * as path28 from "path";
 function isGitHubYamlPath(filePath) {
@@ -8694,13 +8695,46 @@ function isExplicitlyAllowed(p, allowlist) {
 }
 function isForbiddenPath(p, deliveryPathAllowlist = []) {
   if (FORBIDDEN_PATH_EXACT.has(p)) return true;
-  for (const pre of FORBIDDEN_PATH_PREFIXES) if (p.startsWith(pre)) return true;
   for (const suf of FORBIDDEN_PATH_SUFFIXES) if (p.endsWith(suf)) return true;
-  if (isExplicitlyAllowed(p, deliveryPathAllowlist)) return false;
+  if (isExplicitlyAllowed(p, deliveryPathAllowlist) && (p.startsWith(".kody-engine/definitions/loops/") || isGitHubYamlPath(p))) {
+    return false;
+  }
+  for (const pre of FORBIDDEN_PATH_PREFIXES) if (p.startsWith(pre)) return true;
   if (isGitHubYamlPath(p)) return true;
   for (const pre of ALLOWED_PATH_PREFIXES) if (p.startsWith(pre)) return false;
   return false;
 }
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isSafeConfigActivationChange(before, after) {
+  if (!isRecord(before) || !isRecord(after)) return false;
+  const beforeRest = { ...before };
+  const afterRest = { ...after };
+  for (const field of ACTIVATION_FIELDS) {
+    const previous = before[field];
+    const next = after[field];
+    delete beforeRest[field];
+    delete afterRest[field];
+    if (previous === void 0 && next === void 0) continue;
+    if (!Array.isArray(previous ?? []) || !Array.isArray(next)) return false;
+    if (!next.every((value) => typeof value === "string")) return false;
+    if (!previous.every((value) => typeof value === "string")) return false;
+    const nextValues = new Set(next);
+    if (!previous.every((value) => nextValues.has(value))) return false;
+  }
+  return isDeepStrictEqual(beforeRest, afterRest);
+}
+function isTrustedConfigActivationChange(filePath, deliveryPathAllowlist, cwd) {
+  if (filePath !== "kody.config.json" || !deliveryPathAllowlist.includes(filePath)) return false;
+  try {
+    const before = JSON.parse(git(["show", "HEAD:kody.config.json"], cwd));
+    const after = JSON.parse(fs29.readFileSync(path28.join(cwd ?? process.cwd(), filePath), "utf-8"));
+    return isSafeConfigActivationChange(before, after);
+  } catch {
+    return false;
+  }
+}
 function listChangedFiles(cwd) {
   const raw = execFileSync6("git", ["status", "--porcelain=v1", "-z", "--untracked-files=all"], {
     encoding: "utf-8",
@@ -8736,12 +8770,16 @@ function normalizeCommitMessage(raw) {
 }
 function commitAndPush(branch, agentMessage, cwd, deliveryPathAllowlist = []) {
   const allChanged = listChangedFiles(cwd);
-  const allowedFiles = allChanged.filter((f) => !isForbiddenPath(f, deliveryPathAllowlist));
+  const allowedFiles = allChanged.filter(
+    (f) => !isForbiddenPath(f, deliveryPathAllowlist) || isTrustedConfigActivationChange(f, deliveryPathAllowlist, cwd)
+  );
   const mergeHeadExists = fs29.existsSync(path28.join(cwd ?? process.cwd(), ".git", "MERGE_HEAD"));
   if (allowedFiles.length === 0 && !mergeHeadExists) {
     return { committed: false, pushed: false, sha: "", message: "" };
   }
-  const forbiddenFiles = allChanged.filter((f) => isForbiddenPath(f, deliveryPathAllowlist));
+  const forbiddenFiles = allChanged.filter(
+    (f) => isForbiddenPath(f, deliveryPathAllowlist) && !isTrustedConfigActivationChange(f, deliveryPathAllowlist, cwd)
+  );
   for (const f of forbiddenFiles) {
     try {
       git(["reset", "-q", "--", f], cwd);
@@ -8785,7 +8823,7 @@ function hasCommitsAhead(branch, defaultBranch, cwd) {
     }
   }
 }
-var FORBIDDEN_PATH_PREFIXES, ALLOWED_PATH_PREFIXES, FORBIDDEN_PATH_EXACT, FORBIDDEN_PATH_SUFFIXES, CONVENTIONAL_PREFIXES;
+var FORBIDDEN_PATH_PREFIXES, ALLOWED_PATH_PREFIXES, FORBIDDEN_PATH_EXACT, FORBIDDEN_PATH_SUFFIXES, ACTIVATION_FIELDS, CONVENTIONAL_PREFIXES;
 var init_commit = __esm({
   "src/commit.ts"() {
     "use strict";
@@ -8808,6 +8846,14 @@ var init_commit = __esm({
     ALLOWED_PATH_PREFIXES = [];
     FORBIDDEN_PATH_EXACT = /* @__PURE__ */ new Set([".env", ".kody-pip-requirements.txt", "kody.config.json"]);
     FORBIDDEN_PATH_SUFFIXES = [".log"];
+    ACTIVATION_FIELDS = [
+      "activeAgents",
+      "activeCapabilities",
+      "activeWorkflows",
+      "activePipelines",
+      "activeCommands",
+      "activeFeatures"
+    ];
     CONVENTIONAL_PREFIXES = [
       "feat:",
       "fix:",
@@ -8842,7 +8888,7 @@ var init_abortUnfinishedGitOps = __esm({
 });
 
 // src/scripts/deliveryOutcome.ts
-function isRecord(input) {
+function isRecord2(input) {
   return !!input && typeof input === "object" && !Array.isArray(input);
 }
 function setDeliveryNotRequired(data, reason) {
@@ -8850,7 +8896,7 @@ function setDeliveryNotRequired(data, reason) {
 }
 function readDeliveryOutcome(data) {
   const raw = data.deliveryOutcome;
-  if (!isRecord(raw)) return null;
+  if (!isRecord2(raw)) return null;
   if (raw.kind !== "not_required" || typeof raw.reason !== "string" || raw.reason.length === 0) return null;
   return { kind: "not_required", reason: raw.reason };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kody-ade/kody-engine",
-  "version": "0.4.579",
+  "version": "0.4.581",
   "description": "kody — autonomous development engine. Single-session Claude Code agent behind a generic executor + declarative implementation profiles.",
   "license": "MIT",
   "type": "module",