@kody-ade/kody-engine 0.4.585 → 0.4.587

package/dist/bin/kody.js

@@ -15,7 +15,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "@kody-ade/kody-engine",
-      version: "0.4.585",
+      version: "0.4.587",
       description: "kody \u2014 autonomous development engine. Single-session Claude Code agent behind a generic executor + declarative implementation profiles.",
       license: "MIT",
       type: "module",
@@ -2189,6 +2189,7 @@ function readCapabilityFolder(root, slug) {
         ...contract.execution ? { execution: contract.execution } : {},
         ...contract.deliveryPolicy ? { deliveryPolicy: contract.deliveryPolicy } : {},
         ...contract.deliveryPathAllowlist ? { deliveryPathAllowlist: contract.deliveryPathAllowlist } : {},
+        ...contract.deliveryConfigAllowlist ? { deliveryConfigAllowlist: contract.deliveryConfigAllowlist } : {},
         input: contract.input,
         output: contract.output
       } : {},
@@ -2229,11 +2230,18 @@ function parseCapabilityContract(raw) {
     throw new Error('contract.json requiredSubagents are supported only when execution is "agent"');
   }
   const deliveryPathAllowlist = parseDeliveryPathAllowlist(parsed.deliveryPathAllowlist);
+  const deliveryConfigAllowlist = parseDeliveryConfigAllowlist(parsed.deliveryConfigAllowlist);
   if (deliveryPathAllowlist && parsed.execution !== "agent") {
     throw new Error('contract.json deliveryPathAllowlist is supported only when execution is "agent"');
   }
+  if (deliveryConfigAllowlist && parsed.execution !== "agent") {
+    throw new Error('contract.json deliveryConfigAllowlist is supported only when execution is "agent"');
+  }
+  if (deliveryConfigAllowlist && Object.keys(deliveryConfigAllowlist).some((filePath) => !deliveryPathAllowlist?.includes(filePath))) {
+    throw new Error("contract.json deliveryConfigAllowlist files must also be deliveryPathAllowlist entries");
+  }
   const unsupported = Object.keys(parsed).filter(
-    (key) => key !== "execution" && key !== "deliveryPolicy" && key !== "deliveryPathAllowlist" && key !== "requirements" && key !== "secrets" && key !== "timeoutMs" && key !== "requiredSubagents" && key !== "input" && key !== "output"
+    (key) => key !== "execution" && key !== "deliveryPolicy" && key !== "deliveryPathAllowlist" && key !== "deliveryConfigAllowlist" && key !== "requirements" && key !== "secrets" && key !== "timeoutMs" && key !== "requiredSubagents" && key !== "input" && key !== "output"
   );
   if (unsupported.length > 0) {
     throw new Error(`contract.json contains unsupported fields: ${unsupported.join(", ")}`);
@@ -2248,6 +2256,7 @@ function parseCapabilityContract(raw) {
     ...parsed.execution ? { execution: parsed.execution } : {},
     ...parsed.deliveryPolicy === "checkpoint" ? { deliveryPolicy: "checkpoint" } : {},
     ...deliveryPathAllowlist ? { deliveryPathAllowlist } : {},
+    ...deliveryConfigAllowlist ? { deliveryConfigAllowlist } : {},
     ...requirements ? { requirements } : {},
     ...secrets ? { secrets } : {},
     ...timeoutMs !== void 0 ? { timeoutMs } : {},
@@ -2256,6 +2265,23 @@ function parseCapabilityContract(raw) {
     output: parsed.output
   };
 }
+function parseDeliveryConfigAllowlist(raw) {
+  if (raw === void 0) return void 0;
+  if (!isPlainObject(raw) || Object.keys(raw).length === 0) {
+    throw new Error("contract.json deliveryConfigAllowlist must be a non-empty object");
+  }
+  const parsed = {};
+  for (const [filePath, paths] of Object.entries(raw)) {
+    if (filePath !== "kody.config.json" || !Array.isArray(paths) || paths.length === 0 || paths.length > 32) {
+      throw new Error("contract.json deliveryConfigAllowlist contains an unsupported config file or path list");
+    }
+    if (!paths.every((value) => typeof value === "string" && /^[A-Za-z][A-Za-z0-9]*(?:\.[A-Za-z][A-Za-z0-9]*)*$/.test(value))) {
+      throw new Error("contract.json deliveryConfigAllowlist must contain safe dotted config paths");
+    }
+    parsed[filePath] = [...new Set(paths)];
+  }
+  return parsed;
+}
 function parseDeliveryPathAllowlist(raw) {
   if (raw === void 0) return void 0;
   if (!Array.isArray(raw) || raw.length === 0 || raw.length > 64) {
@@ -8734,12 +8760,32 @@ function isSafeConfigActivationChange(before, after) {
   }
   return isDeepStrictEqual(beforeCompanyRest, afterCompanyRest);
 }
-function isTrustedConfigActivationChange(filePath, deliveryPathAllowlist, cwd) {
+function isSafeConfigChange(before, after, allowedPaths = []) {
+  if (!isRecord(before) || !isRecord(after)) return false;
+  const beforeCopy = structuredClone(before);
+  const afterCopy = structuredClone(after);
+  for (const dottedPath of allowedPaths) {
+    deleteConfigPath(beforeCopy, dottedPath);
+    deleteConfigPath(afterCopy, dottedPath);
+  }
+  return isSafeConfigActivationChange(beforeCopy, afterCopy);
+}
+function deleteConfigPath(value, dottedPath) {
+  const segments = dottedPath.split(".");
+  let cursor = value;
+  for (const segment of segments.slice(0, -1)) {
+    const next = cursor[segment];
+    if (!isRecord(next)) return;
+    cursor = next;
+  }
+  delete cursor[segments.at(-1)];
+}
+function isTrustedConfigActivationChange(filePath, deliveryPathAllowlist, deliveryConfigAllowlist, cwd) {
   if (filePath !== "kody.config.json" || !deliveryPathAllowlist.includes(filePath)) return false;
   try {
     const before = JSON.parse(git(["show", "HEAD:kody.config.json"], cwd));
     const after = JSON.parse(fs29.readFileSync(path28.join(cwd ?? process.cwd(), filePath), "utf-8"));
-    return isSafeConfigActivationChange(before, after);
+    return isSafeConfigChange(before, after, deliveryConfigAllowlist[filePath] ?? []);
   } catch {
     return false;
   }
@@ -8790,19 +8836,19 @@ function normalizeCommitMessage(raw) {
   }
   return `chore: ${trimmed}`;
 }
-function commitAndPush(branch, agentMessage, cwd, deliveryPathAllowlist = []) {
+function commitAndPush(branch, agentMessage, cwd, deliveryPathAllowlist = [], deliveryConfigAllowlist = {}) {
   const ignoredAllowedFiles = listAllowlistedIgnoredFiles(deliveryPathAllowlist, cwd);
   const ignoredAllowedSet = new Set(ignoredAllowedFiles);
   const allChanged = [.../* @__PURE__ */ new Set([...listChangedFiles(cwd), ...ignoredAllowedFiles])];
   const allowedFiles = allChanged.filter(
-    (f) => !isForbiddenPath(f, deliveryPathAllowlist) || isTrustedConfigActivationChange(f, deliveryPathAllowlist, cwd)
+    (f) => !isForbiddenPath(f, deliveryPathAllowlist) || isTrustedConfigActivationChange(f, deliveryPathAllowlist, deliveryConfigAllowlist, cwd)
   );
   const mergeHeadExists = fs29.existsSync(path28.join(cwd ?? process.cwd(), ".git", "MERGE_HEAD"));
   if (allowedFiles.length === 0 && !mergeHeadExists) {
     return { committed: false, pushed: false, sha: "", message: "" };
   }
   const forbiddenFiles = allChanged.filter(
-    (f) => isForbiddenPath(f, deliveryPathAllowlist) && !isTrustedConfigActivationChange(f, deliveryPathAllowlist, cwd)
+    (f) => isForbiddenPath(f, deliveryPathAllowlist) && !isTrustedConfigActivationChange(f, deliveryPathAllowlist, deliveryConfigAllowlist, cwd)
   );
   for (const f of forbiddenFiles) {
     try {
@@ -12472,8 +12518,15 @@ var init_commitAndPush = __esm({
       }
       const message = ctx.data.commitMessage || DEFAULT_COMMIT_MESSAGE;
       const deliveryPathAllowlist = Array.isArray(ctx.data.deliveryPathAllowlist) ? ctx.data.deliveryPathAllowlist : [];
+      const deliveryConfigAllowlist = ctx.data.deliveryConfigAllowlist && typeof ctx.data.deliveryConfigAllowlist === "object" ? ctx.data.deliveryConfigAllowlist : {};
       try {
-        const result2 = commitAndPush(branch, message, ctx.cwd, deliveryPathAllowlist);
+        const result2 = commitAndPush(
+          branch,
+          message,
+          ctx.cwd,
+          deliveryPathAllowlist,
+          deliveryConfigAllowlist
+        );
         ctx.data.commitResult = result2;
         const postCommitFiles = result2.committed ? listFilesInCommit("HEAD", ctx.cwd) : listChangedFiles(ctx.cwd);
         ctx.data.changedFiles = postCommitFiles.filter(
@@ -16456,6 +16509,9 @@ var init_loadSimpleCapability = __esm({
       if (capability.contract?.deliveryPathAllowlist) {
         ctx.data.deliveryPathAllowlist = capability.contract.deliveryPathAllowlist;
       }
+      if (capability.contract?.deliveryConfigAllowlist) {
+        ctx.data.deliveryConfigAllowlist = capability.contract.deliveryConfigAllowlist;
+      }
       if (capability.contract?.requirements) {
         ctx.data.capabilityRequirements = capability.contract.requirements;
       }
@@ -17481,7 +17537,7 @@ var init_parseReproOutput = __esm({
 
 // src/scripts/parseSimpleCapabilityOutput.ts
 import * as fs47 from "fs";
-function acceptAuthoritativeFileOutput(ctx, profile, output) {
+function acceptAuthoritativeCapabilityOutput(ctx, profile, output) {
   ctx.data.agentDone = true;
   delete ctx.data.agentFailureReason;
   const summary = isObject2(output) && typeof output.summary === "string" ? output.summary.trim() : "";
@@ -17571,7 +17627,8 @@ var init_parseSimpleCapabilityOutput = __esm({
       }
       const outputPath = typeof ctx.data.capabilityOutputPath === "string" ? ctx.data.capabilityOutputPath : void 0;
       const fileOutput = readOutputFile(outputPath);
-      const output = fileOutput.found ? fileOutput.value : Object.hasOwn(ctx.data, "capabilityScriptOutput") ? ctx.data.capabilityScriptOutput : parseOutput(agentResult?.finalText);
+      const hasScriptOutput = Object.hasOwn(ctx.data, "capabilityScriptOutput");
+      const output = fileOutput.found ? fileOutput.value : hasScriptOutput ? ctx.data.capabilityScriptOutput : parseOutput(agentResult?.finalText);
       if (output === void 0) {
         const reason2 = agentResult?.outcomeKind === "out_of_turns" ? "Capability execution limit reached" : "Capability execution ended before returning a result";
         const blocked = {
@@ -17618,7 +17675,7 @@ var init_parseSimpleCapabilityOutput = __esm({
           return;
         }
       }
-      if (fileOutput.found) acceptAuthoritativeFileOutput(ctx, profile, output);
+      if (fileOutput.found || hasScriptOutput) acceptAuthoritativeCapabilityOutput(ctx, profile, output);
       ctx.data.capabilityOutput = output;
       const structuredResult = parseCapabilityResult(output);
       if (structuredResult) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kody-ade/kody-engine",
-  "version": "0.4.585",
+  "version": "0.4.587",
   "description": "kody — autonomous development engine. Single-session Claude Code agent behind a generic executor + declarative implementation profiles.",
   "license": "MIT",
   "type": "module",

package/templates/kody.yml

@@ -14,6 +14,10 @@ on:
         description: 'GitHub issue number (agent mode)'
         type: string
         default: ''
+      requestId:
+        description: 'Unique Kody execution request ID'
+        type: string
+        default: ''
       sessionId:
         description: 'Chat session ID (chat mode, from Kody Dashboard)'
         type: string
@@ -55,7 +59,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 360
     concurrency:
-      group: kody-${{ inputs.sessionId || inputs.issue_number || github.event.issue.number || github.sha }}
+      group: kody-${{ inputs.requestId || inputs.sessionId || inputs.issue_number || github.event.issue.number || github.sha }}
       cancel-in-progress: false
     permissions:
       issues: write