@kody-ade/kody-engine 0.4.580 → 0.4.582

package/dist/bin/kody.js

@@ -15,7 +15,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "@kody-ade/kody-engine",
-      version: "0.4.580",
+      version: "0.4.582",
       description: "kody \u2014 autonomous development engine. Single-session Claude Code agent behind a generic executor + declarative implementation profiles.",
       license: "MIT",
       type: "module",
@@ -8620,6 +8620,7 @@ var init_pushWithRetry = __esm({
 
 // src/commit.ts
 import { execFileSync as execFileSync6 } from "child_process";
+import { isDeepStrictEqual } from "util";
 import * as fs29 from "fs";
 import * as path28 from "path";
 function isGitHubYamlPath(filePath) {
@@ -8703,6 +8704,37 @@ function isForbiddenPath(p, deliveryPathAllowlist = []) {
   for (const pre of ALLOWED_PATH_PREFIXES) if (p.startsWith(pre)) return false;
   return false;
 }
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isSafeConfigActivationChange(before, after) {
+  if (!isRecord(before) || !isRecord(after)) return false;
+  const beforeRest = { ...before };
+  const afterRest = { ...after };
+  for (const field of ACTIVATION_FIELDS) {
+    const previous = before[field];
+    const next = after[field];
+    delete beforeRest[field];
+    delete afterRest[field];
+    if (previous === void 0 && next === void 0) continue;
+    if (!Array.isArray(previous ?? []) || !Array.isArray(next)) return false;
+    if (!next.every((value) => typeof value === "string")) return false;
+    if (!previous.every((value) => typeof value === "string")) return false;
+    const nextValues = new Set(next);
+    if (!previous.every((value) => nextValues.has(value))) return false;
+  }
+  return isDeepStrictEqual(beforeRest, afterRest);
+}
+function isTrustedConfigActivationChange(filePath, deliveryPathAllowlist, cwd) {
+  if (filePath !== "kody.config.json" || !deliveryPathAllowlist.includes(filePath)) return false;
+  try {
+    const before = JSON.parse(git(["show", "HEAD:kody.config.json"], cwd));
+    const after = JSON.parse(fs29.readFileSync(path28.join(cwd ?? process.cwd(), filePath), "utf-8"));
+    return isSafeConfigActivationChange(before, after);
+  } catch {
+    return false;
+  }
+}
 function listChangedFiles(cwd) {
   const raw = execFileSync6("git", ["status", "--porcelain=v1", "-z", "--untracked-files=all"], {
     encoding: "utf-8",
@@ -8738,12 +8770,16 @@ function normalizeCommitMessage(raw) {
 }
 function commitAndPush(branch, agentMessage, cwd, deliveryPathAllowlist = []) {
   const allChanged = listChangedFiles(cwd);
-  const allowedFiles = allChanged.filter((f) => !isForbiddenPath(f, deliveryPathAllowlist));
+  const allowedFiles = allChanged.filter(
+    (f) => !isForbiddenPath(f, deliveryPathAllowlist) || isTrustedConfigActivationChange(f, deliveryPathAllowlist, cwd)
+  );
   const mergeHeadExists = fs29.existsSync(path28.join(cwd ?? process.cwd(), ".git", "MERGE_HEAD"));
   if (allowedFiles.length === 0 && !mergeHeadExists) {
     return { committed: false, pushed: false, sha: "", message: "" };
   }
-  const forbiddenFiles = allChanged.filter((f) => isForbiddenPath(f, deliveryPathAllowlist));
+  const forbiddenFiles = allChanged.filter(
+    (f) => isForbiddenPath(f, deliveryPathAllowlist) && !isTrustedConfigActivationChange(f, deliveryPathAllowlist, cwd)
+  );
   for (const f of forbiddenFiles) {
     try {
       git(["reset", "-q", "--", f], cwd);
@@ -8787,7 +8823,7 @@ function hasCommitsAhead(branch, defaultBranch, cwd) {
     }
   }
 }
-var FORBIDDEN_PATH_PREFIXES, ALLOWED_PATH_PREFIXES, FORBIDDEN_PATH_EXACT, FORBIDDEN_PATH_SUFFIXES, CONVENTIONAL_PREFIXES;
+var FORBIDDEN_PATH_PREFIXES, ALLOWED_PATH_PREFIXES, FORBIDDEN_PATH_EXACT, FORBIDDEN_PATH_SUFFIXES, ACTIVATION_FIELDS, CONVENTIONAL_PREFIXES;
 var init_commit = __esm({
   "src/commit.ts"() {
     "use strict";
@@ -8810,6 +8846,14 @@ var init_commit = __esm({
     ALLOWED_PATH_PREFIXES = [];
     FORBIDDEN_PATH_EXACT = /* @__PURE__ */ new Set([".env", ".kody-pip-requirements.txt", "kody.config.json"]);
     FORBIDDEN_PATH_SUFFIXES = [".log"];
+    ACTIVATION_FIELDS = [
+      "activeAgents",
+      "activeCapabilities",
+      "activeWorkflows",
+      "activePipelines",
+      "activeCommands",
+      "activeFeatures"
+    ];
     CONVENTIONAL_PREFIXES = [
       "feat:",
       "fix:",
@@ -8844,7 +8888,7 @@ var init_abortUnfinishedGitOps = __esm({
 });
 
 // src/scripts/deliveryOutcome.ts
-function isRecord(input) {
+function isRecord2(input) {
   return !!input && typeof input === "object" && !Array.isArray(input);
 }
 function setDeliveryNotRequired(data, reason) {
@@ -8852,7 +8896,7 @@ function setDeliveryNotRequired(data, reason) {
 }
 function readDeliveryOutcome(data) {
   const raw = data.deliveryOutcome;
-  if (!isRecord(raw)) return null;
+  if (!isRecord2(raw)) return null;
   if (raw.kind !== "not_required" || typeof raw.reason !== "string" || raw.reason.length === 0) return null;
   return { kind: "not_required", reason: raw.reason };
 }

package/dist/plugins/hooks/block-git.json

@@ -7,7 +7,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "node -e 'let s=\"\";process.stdin.on(\"data\",c=>s+=c).on(\"end\",()=>{try{const d=JSON.parse(s);const cmd=(d.tool_input&&d.tool_input.command)||\"\";const wrap=new Set([\"command\",\"exec\",\"xargs\",\"env\",\"nohup\",\"time\",\"nice\",\"sudo\",\"doas\"]);const readGit=new Set([\"status\",\"log\",\"diff\",\"show\",\"rev-parse\",\"ls-files\"]);const blocked=cmd.split(/[;&|\\n]+/).some(p=>{const t=p.trim().split(/\\s+/).filter(Boolean);let i=0;while(i<t.length&&(wrap.has(t[i])||/^[A-Za-z_][A-Za-z0-9_]*=/.test(t[i])))i++;const tool=(t[i]||\"\").split(\"/\").pop();if(tool===\"gh\")return true;if(tool!==\"git\")return false;return !readGit.has(t[i+1])});const shc=/\\b(?:ba|z|da|k)?sh\\s+[^;|&]*-c\\s*[\"\\x27`]+\\s*(?:\\S*\\/)?(?:git|gh)\\b/.test(cmd);const sub=/[$`]\\(?\\s*(?:\\S*\\/)?(?:git|gh)\\s/.test(cmd);if(blocked||shc||sub){process.stderr.write(\"kody blocks Git and GitHub writes — the delivery wrapper owns VCS mutations\\n\");process.exit(2)}}catch{}})'"
+            "command": "node -e 'let s=\"\";process.stdin.on(\"data\",c=>s+=c).on(\"end\",()=>{try{const d=JSON.parse(s);const cmd=(d.tool_input&&d.tool_input.command)||\"\";const wrap=new Set([\"command\",\"exec\",\"xargs\",\"env\",\"nohup\",\"time\",\"nice\",\"sudo\",\"doas\"]);const readGit=new Set([\"status\",\"log\",\"diff\",\"show\",\"rev-parse\",\"ls-files\"]);const blocked=cmd.split(/[;&|\\n]+/).some(p=>{const t=p.trim().split(/\\s+/).filter(Boolean);let i=0;while(i<t.length&&(wrap.has(t[i])||/^[A-Za-z_][A-Za-z0-9_]*=/.test(t[i])))i++;const tool=(t[i]||\"\").split(\"/\").pop();if(tool===\"gh\")return true;if(tool!==\"git\")return false;return !readGit.has(t[i+1])});const shc=/\\b(?:ba|z|da|k)?sh\\s+[^;|&]*-c\\s*[\"\\x27`]+\\s*(?:\\S*\\/)?(?:git|gh)\\b/.test(cmd);const sub=/[$`]\\(?\\s*(?:\\S*\\/)?(?:git|gh)\\s/.test(cmd);if(blocked||shc||sub){process.stderr.write(\"kody blocks Git and GitHub writes — the delivery wrapper owns VCS mutations. Do not treat this expected block as a task failure; the delivery wrapper will commit and create the pull request. Continue verification and finish your result normally.\\n\");process.exit(2)}}catch{}})'"
           }
         ]
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kody-ade/kody-engine",
-  "version": "0.4.580",
+  "version": "0.4.582",
   "description": "kody — autonomous development engine. Single-session Claude Code agent behind a generic executor + declarative implementation profiles.",
   "license": "MIT",
   "type": "module",
@@ -12,30 +12,6 @@
     "templates",
     "kody.config.schema.json"
   ],
-  "scripts": {
-    "kody:run": "tsx bin/kody.ts",
-    "serve": "tsx bin/kody.ts serve",
-    "serve:vscode": "tsx bin/kody.ts serve vscode",
-    "serve:claude": "tsx bin/kody.ts serve claude",
-    "clean:dist": "node scripts/clean-dist.cjs",
-    "build": "pnpm clean:dist && tsup && node scripts/copy-assets.cjs",
-    "check:modularity": "tsx scripts/check-script-modularity.ts",
-    "pretest": "pnpm check:modularity",
-    "test": "vitest run tests/unit tests/int --coverage",
-    "posttest": "tsx scripts/check-coverage-floor.ts",
-    "test:smoke": "vitest run tests/smoke --no-coverage",
-    "test:e2e": "vitest run tests/e2e --no-coverage",
-    "verify:live-release": "tsx scripts/live-release-gate.ts",
-    "test:runtime-services": "node --test \"tests/runtime-services/*.test.mjs\"",
-    "test:all": "vitest run tests --no-coverage",
-    "typecheck": "tsc --noEmit",
-    "lint": "biome check",
-    "lint:fix": "biome check --write",
-    "format": "biome format --write",
-    "verify:package": "node scripts/verify-package-tarball.cjs",
-    "brain:publish": "docker buildx build --platform linux/amd64 -f runner/Dockerfile.brain --build-arg KODY_ENGINE_REF=$(git rev-parse HEAD) -t ghcr.io/${KODY_BRAIN_GHCR_OWNER:-aharonyaircohen}/kody-brain:latest --push runner",
-    "prepublishOnly": "pnpm typecheck && pnpm test:runtime-services && pnpm build && pnpm verify:package"
-  },
   "dependencies": {
     "@actions/cache": "^6.0.0",
     "@anthropic-ai/claude-agent-sdk": "0.2.119",
@@ -62,5 +38,28 @@
     "url": "git+https://github.com/aharonyaircohen/kody-engine.git"
   },
   "homepage": "https://github.com/aharonyaircohen/kody-engine",
-  "bugs": "https://github.com/aharonyaircohen/kody-engine/issues"
-}
+  "bugs": "https://github.com/aharonyaircohen/kody-engine/issues",
+  "scripts": {
+    "kody:run": "tsx bin/kody.ts",
+    "serve": "tsx bin/kody.ts serve",
+    "serve:vscode": "tsx bin/kody.ts serve vscode",
+    "serve:claude": "tsx bin/kody.ts serve claude",
+    "clean:dist": "node scripts/clean-dist.cjs",
+    "build": "pnpm clean:dist && tsup && node scripts/copy-assets.cjs",
+    "check:modularity": "tsx scripts/check-script-modularity.ts",
+    "pretest": "pnpm check:modularity",
+    "test": "vitest run tests/unit tests/int --coverage",
+    "posttest": "tsx scripts/check-coverage-floor.ts",
+    "test:smoke": "vitest run tests/smoke --no-coverage",
+    "test:e2e": "vitest run tests/e2e --no-coverage",
+    "verify:live-release": "tsx scripts/live-release-gate.ts",
+    "test:runtime-services": "node --test \"tests/runtime-services/*.test.mjs\"",
+    "test:all": "vitest run tests --no-coverage",
+    "typecheck": "tsc --noEmit",
+    "lint": "biome check",
+    "lint:fix": "biome check --write",
+    "format": "biome format --write",
+    "verify:package": "node scripts/verify-package-tarball.cjs",
+    "brain:publish": "docker buildx build --platform linux/amd64 -f runner/Dockerfile.brain --build-arg KODY_ENGINE_REF=$(git rev-parse HEAD) -t ghcr.io/${KODY_BRAIN_GHCR_OWNER:-aharonyaircohen}/kody-brain:latest --push runner"
+  }
+}