@kody-ade/kody-engine 0.4.621 → 0.4.623

package/README.md

@@ -57,7 +57,9 @@ key. It's built to keep that blast radius small:
   downstream CI.
 - **Write allowlist.** The agent commits through `commitAndPush`, which blocks
   writes to engine runtime or configuration paths — it can't touch your
-  runtime state.
+  runtime state. See [Delivery boundary](docs/delivery-boundary.md) for what is
+  silently discarded, what fails visibly, and how an approved workflow file is
+  delivered.
 - **Locked-toolbox mode.** A job can declare `tools: [...]` to drop `Bash` and
   shell entirely, running only a fixed set of high-level intents.
 - **Review like any contributor.** kody opens PRs; you merge them.
@@ -107,6 +109,12 @@ fans out scheduled capabilities at runtime, so capability schedules never
 generate additional GitHub workflow files. Idempotent — pass `--force` to
 overwrite.
 
+Kody also discovers conventional package scripts (`typecheck`, `lint`,
+`test:unit` or `test`, and non-mutating format-check scripts). This means a
+repository that adds its application after Kody onboarding still receives a
+real verification gate. Explicit `quality` commands in `kody.config.json`
+always override discovery. See [Repository quality gates](docs/quality-gates.md).
+
 Store model provider keys (for example `MINIMAX_API_KEY`) in the connected
 repository's Kody vault. GitHub Actions uses OIDC to request only the selected
 model key at runtime; user secrets are not copied into Actions. `KODY_TOKEN`

package/dist/bin/kody.js

@@ -15,7 +15,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "@kody-ade/kody-engine",
-      version: "0.4.621",
+      version: "0.4.623",
       description: "kody \u2014 autonomous development engine. Single-session Claude Code agent behind a generic executor + declarative implementation profiles.",
       license: "MIT",
       repository: {
@@ -29,6 +29,7 @@ var init_package = __esm({
       files: [
         "dist",
         "templates",
+        "docs/delivery-boundary.md",
         "kody.config.schema.json"
       ],
       scripts: {
@@ -182,6 +183,32 @@ var init_completionGuard = __esm({
 // src/config.ts
 import * as fs2 from "fs";
 import * as path3 from "path";
+function packageManagerFor(projectDir) {
+  if (fs2.existsSync(path3.join(projectDir, "pnpm-lock.yaml"))) return "pnpm";
+  if (fs2.existsSync(path3.join(projectDir, "yarn.lock"))) return "yarn";
+  if (fs2.existsSync(path3.join(projectDir, "bun.lockb")) || fs2.existsSync(path3.join(projectDir, "bun.lock"))) return "bun";
+  return "npm";
+}
+function inferQualityCommands(projectDir) {
+  const empty = { typecheck: "", lint: "", format: "", testUnit: "" };
+  try {
+    const pkg = JSON.parse(fs2.readFileSync(path3.join(projectDir, "package.json"), "utf-8"));
+    const scripts = pkg.scripts ?? {};
+    const pm = packageManagerFor(projectDir);
+    const command = (names) => {
+      const name = names.find((candidate) => typeof scripts[candidate] === "string");
+      return name ? `${pm} run ${name}` : "";
+    };
+    return {
+      typecheck: command(["typecheck", "type-check", "check:types"]),
+      lint: command(["lint"]),
+      format: command(["format:check", "format-check", "prettier:check"]),
+      testUnit: command(["test:unit", "test"])
+    };
+  } catch {
+    return empty;
+  }
+}
 function parseReasoningEffort(raw) {
   if (!raw) return null;
   const v = raw.trim().toLowerCase();
@@ -284,6 +311,7 @@ function loadConfig(projectDir = process.cwd()) {
     throw new Error(`kody.config.json is invalid JSON: ${msg}`);
   }
   const quality = recordValue(raw.quality) ?? {};
+  const inferredQuality = inferQualityCommands(projectDir);
   const git5 = recordValue(raw.git) ?? {};
   const github = recordValue(raw.github) ?? {};
   const agent = recordValue(raw.agent) ?? {};
@@ -299,10 +327,10 @@ function loadConfig(projectDir = process.cwd()) {
   }
   return {
     quality: {
-      typecheck: typeof quality.typecheck === "string" ? quality.typecheck : "",
-      lint: typeof quality.lint === "string" ? quality.lint : "",
-      format: typeof quality.format === "string" ? quality.format : "",
-      testUnit: typeof quality.testUnit === "string" ? quality.testUnit : "",
+      typecheck: typeof quality.typecheck === "string" ? quality.typecheck : inferredQuality.typecheck,
+      lint: typeof quality.lint === "string" ? quality.lint : inferredQuality.lint,
+      format: typeof quality.format === "string" ? quality.format : inferredQuality.format,
+      testUnit: typeof quality.testUnit === "string" ? quality.testUnit : inferredQuality.testUnit,
       coverage: typeof quality.coverage === "string" ? quality.coverage : ""
     },
     git: {
@@ -15809,19 +15837,6 @@ var init_workflow_template = __esm({
 import { execFileSync as execFileSync14 } from "child_process";
 import * as fs40 from "fs";
 import * as path39 from "path";
-function detectPackageManager(cwd) {
-  if (fs40.existsSync(path39.join(cwd, "pnpm-lock.yaml"))) return "pnpm";
-  if (fs40.existsSync(path39.join(cwd, "yarn.lock"))) return "yarn";
-  if (fs40.existsSync(path39.join(cwd, "bun.lockb"))) return "bun";
-  return "npm";
-}
-function qualityCommandsFor(pm) {
-  return {
-    typecheck: `${pm} tsc --noEmit`,
-    lint: "",
-    testUnit: `${pm} test`
-  };
-}
 function schemaUrlFromPkg() {
   const fallback = "https://raw.githubusercontent.com/aharonyaircohen/kody-engine/main/kody.config.schema.json";
   const repoUrl = package_default.repository?.url;
@@ -15844,10 +15859,10 @@ function detectOwnerRepo(cwd) {
   if (!m) return null;
   return { owner: m[1], repo: m[2] };
 }
-function makeConfig(pm, ownerRepo, defaultBranch) {
+function makeConfig(cwd, ownerRepo, defaultBranch) {
   return {
     $schema: schemaUrlFromPkg(),
-    quality: qualityCommandsFor(pm),
+    quality: inferQualityCommands(cwd),
     git: { defaultBranch },
     github: {
       owner: ownerRepo?.owner ?? "OWNER",
@@ -15881,14 +15896,13 @@ function defaultBranchFromGit(cwd) {
 function performInit(cwd, force) {
   const wrote = [];
   const skipped = [];
-  const pm = detectPackageManager(cwd);
   const ownerRepo = detectOwnerRepo(cwd);
   const defaultBranch = defaultBranchFromGit(cwd);
   const configPath = path39.join(cwd, "kody.config.json");
   if (fs40.existsSync(configPath) && !force) {
     skipped.push("kody.config.json");
   } else {
-    const cfg = makeConfig(pm, ownerRepo, defaultBranch);
+    const cfg = makeConfig(cwd, ownerRepo, defaultBranch);
     fs40.writeFileSync(configPath, `${JSON.stringify(cfg, null, 2)}
 `);
     wrote.push("kody.config.json");
@@ -15915,6 +15929,7 @@ var init_initFlow = __esm({
   "src/scripts/initFlow.ts"() {
     "use strict";
     init_package();
+    init_config();
     init_lifecycleLabels();
     init_workflow_template();
     initFlow = async (ctx) => {
@@ -27171,7 +27186,7 @@ async function resolveAuthToken(env = process.env) {
   );
   return void 0;
 }
-function detectPackageManager2(cwd) {
+function detectPackageManager(cwd) {
   if (fs56.existsSync(path53.join(cwd, "pnpm-lock.yaml"))) return "pnpm";
   if (fs56.existsSync(path53.join(cwd, "yarn.lock"))) return "yarn";
   if (fs56.existsSync(path53.join(cwd, "bun.lockb"))) return "bun";
@@ -27471,7 +27486,7 @@ async function runCi(argv) {
       if (n > 0) process.stdout.write(`\u2192 kody: unpacked ${n} secret(s)
 `);
       await resolveAuthToken();
-      const pm = args.packageManager ?? detectPackageManager2(cwd);
+      const pm = args.packageManager ?? detectPackageManager(cwd);
       if (!args.skipInstall) {
         const code = installDeps(pm, cwd);
         if (code !== 0) {
@@ -27632,7 +27647,7 @@ ${CI_HELP}`);
 `);
     await resolveAuthToken();
     reactToTriggerComment(cwd);
-    const pm = args.packageManager ?? detectPackageManager2(cwd);
+    const pm = args.packageManager ?? detectPackageManager(cwd);
     process.stdout.write(`\u2192 kody: package manager = ${pm}
 `);
     const buildOnly = dispatch2.implementation === "preview-build";
@@ -27713,7 +27728,7 @@ async function runScheduledFanOut(cwd, args, opts) {
     if (n > 0) process.stdout.write(`\u2192 kody: unpacked ${n} secret(s) from ALL_SECRETS
 `);
     await resolveAuthToken();
-    const pm = args.packageManager ?? detectPackageManager2(cwd);
+    const pm = args.packageManager ?? detectPackageManager(cwd);
     process.stdout.write(`\u2192 kody: package manager = ${pm}
 `);
     if (!args.skipInstall) {

package/docs/delivery-boundary.md

@@ -0,0 +1,29 @@
+# Delivery boundary
+
+Kody may inspect the whole checkout, but it does not commit every changed file.
+The postflight delivery step separates product work from runtime state and
+operator-owned configuration before creating the PR.
+
+## What happens to each kind of change
+
+| Change | Result |
+|---|---|
+| Normal source, test, or documentation file | Committed and pushed to the task branch |
+| Engine-generated cache or runtime state (`.kody-engine/`, `.kody-lean/`, `.codegraph/`, `node_modules/`, `dist/`, `build/`, logs) | Discarded from delivery without failing otherwise valid product work |
+| Protected operator or security configuration (`.github/*.yml`, `.env`, `kody.config.json`, legacy `.kody/` state) | Excluded from the commit and reported as a blocked delivery; the run fails visibly instead of claiming full completion |
+
+This distinction matters because definition hydration updates
+`.kody-engine/definitions/manifest.json` on normal runs. That file belongs to
+the Engine runtime; it is not work the agent attempted to deliver.
+
+## Delivering an approved protected file
+
+Do not weaken the global boundary. A capability that legitimately owns a
+GitHub workflow or a repository loop definition must declare the exact path in
+its delivery contract. The Engine validates that allowlist and only then stages
+the ignored file. Ordinary `run` work cannot opt itself into that permission.
+
+When a requested protected change is blocked, the issue status names the exact
+omitted path and the workflow exits nonzero. The PR can still contain the safe
+files that were successfully delivered; treat it as partial work until an
+approved owner supplies the protected file.

package/kody.config.schema.json

@@ -11,7 +11,7 @@
     },
     "quality": {
       "type": "object",
-      "description": "Quality gate commands. Empty strings disable individual gates.",
+      "description": "Quality gate commands. Missing commands are inferred from conventional package.json scripts; explicit empty strings disable individual gates.",
       "additionalProperties": false,
       "properties": {
         "typecheck": { "type": "string", "default": "" },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kody-ade/kody-engine",
-  "version": "0.4.621",
+  "version": "0.4.623",
   "description": "kody — autonomous development engine. Single-session Claude Code agent behind a generic executor + declarative implementation profiles.",
   "license": "MIT",
   "repository": {
@@ -14,6 +14,7 @@
   "files": [
     "dist",
     "templates",
+    "docs/delivery-boundary.md",
     "kody.config.schema.json"
   ],
   "scripts": {