@kodycodes/cli 1.26.2 → 1.27.0

package/dist/remote-execute-JN6DRFEU.js

@@ -0,0 +1,129 @@
+import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
+import {
+  resolveExecuteInvokeCode
+} from "./chunk-SLNAWWQK.js";
+import {
+  openApiRequest
+} from "./chunk-W2SAFAT4.js";
+import "./chunk-46IJPEID.js";
+import "./chunk-DW5UTJ6T.js";
+import {
+  assertTokenSafeApiUrl
+} from "./chunk-5JIRHJQP.js";
+import "./chunk-4GIFJVGT.js";
+import "./chunk-3H72XY5R.js";
+import "./chunk-BTL3PJ2H.js";
+import "./chunk-UW6AWLXX.js";
+
+// src/remote-execute.ts
+var credentialFlagRequiresLocalOrMcpMessage = "--credential picks a credential for this run. Cloud execute sends it on POST /v1/execute. Use `execute --local --credential \u2026` when the module must run on this machine.";
+async function runRemoteExecuteWithToken(input) {
+  assertTokenSafeApiUrl(input.apiUrl);
+  const invoke = input.invoke?.trim();
+  const body = {};
+  if (invoke) {
+    if (input.code?.trim()) {
+      throw new Error(
+        "--invoke cannot be combined with --code, --file, or a module string."
+      );
+    }
+    body.invoke = invoke;
+  } else {
+    body.code = resolveRemoteExecuteCode(input);
+  }
+  if (input.params !== void 0) body.params = input.params;
+  if (input.conversationId !== void 0)
+    body.conversationId = input.conversationId;
+  if (input.credentials !== void 0) body.credentials = input.credentials;
+  const payload = await openApiRequest({
+    token: input.token,
+    apiUrl: input.apiUrl,
+    fetchFn: input.fetchFn,
+    ...input.org ? { org: input.org } : {},
+    method: "POST",
+    path: "v1/execute",
+    body
+  });
+  return toolResultFromExecuteBody(payload);
+}
+function toolResultFromExecuteBody(payload) {
+  if (payload && typeof payload === "object" && !Array.isArray(payload) && "content" in payload && Array.isArray(payload.content)) {
+    const record = payload;
+    return {
+      content: record.content,
+      structuredContent: record.structuredContent,
+      isError: record.isError === true
+    };
+  }
+  return formatExecuteCapabilityResult(payload);
+}
+function resolveRemoteExecuteCode(input) {
+  const code = input.code?.trim() ? input.code : void 0;
+  const invoke = input.invoke?.trim() ? input.invoke : void 0;
+  if (code && invoke) {
+    throw new Error(
+      "--invoke cannot be combined with --code, --file, or a module string."
+    );
+  }
+  if (invoke) return resolveExecuteInvokeCode(invoke);
+  if (code) return code;
+  throw new Error("Provide --invoke, --code, --file, or a module string.");
+}
+function formatExecuteCapabilityResult(payload) {
+  const record = isRecord(payload) ? payload : null;
+  if (!record) {
+    const text2 = typeof payload === "string" ? payload : JSON.stringify(payload, null, 2) ?? "undefined";
+    return {
+      content: [{ type: "text", text: text2 }],
+      structuredContent: { result: payload },
+      isError: false
+    };
+  }
+  const ok = record.ok !== false && typeof record.error !== "string";
+  const conversationId = typeof record.conversationId === "string" ? record.conversationId : void 0;
+  const logs = Array.isArray(record.logs) ? record.logs : [];
+  const base = {
+    ...conversationId !== void 0 ? { conversationId } : {},
+    logs
+  };
+  for (const key of [
+    "timing",
+    "runId",
+    "replayed",
+    "inProgress",
+    "status",
+    "returnedBytes",
+    "truncated",
+    "note",
+    "errorDetails",
+    "entitlement",
+    "serverTiming"
+  ]) {
+    if (record[key] !== void 0) base[key] = record[key];
+  }
+  if (!ok) {
+    const error = typeof record.error === "string" ? record.error : "Execute failed without an error message.";
+    return {
+      content: [{ type: "text", text: `Error: ${error}` }],
+      structuredContent: { ...base, error, result: record.result },
+      isError: true
+    };
+  }
+  const result = record.result;
+  const text = typeof result === "string" ? result : JSON.stringify(result, null, 2) ?? "undefined";
+  return {
+    content: [{ type: "text", text }],
+    structuredContent: { ...base, result },
+    isError: false
+  };
+}
+function isRecord(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+export {
+  credentialFlagRequiresLocalOrMcpMessage,
+  formatExecuteCapabilityResult,
+  resolveRemoteExecuteCode,
+  runRemoteExecuteWithToken
+};
+//# sourceMappingURL=remote-execute-JN6DRFEU.js.map

package/dist/remote-execute-JN6DRFEU.js.map

@@ -0,0 +1,6 @@
+{
+  "version": 3,
+  "sources": ["../src/remote-execute.ts"],
+  "mappings": ";;;;;;;;;;;;;;;;;;AAuBO,IAAM,0CACZ;AAUD,eAAsB,0BACrB,OAC0B;AAC1B,wBAAsB,MAAM,MAAM;AAClC,QAAM,SAAS,MAAM,QAAQ,KAAK;AAClC,QAAM,OAAgC,CAAC;AACvC,MAAI,QAAQ;AACX,QAAI,MAAM,MAAM,KAAK,GAAG;AACvB,YAAM,IAAI;AAAA,QACT;AAAA,MACD;AAAA,IACD;AAGA,SAAK,SAAS;AAAA,EACf,OAAO;AACN,SAAK,OAAO,yBAAyB,KAAK;AAAA,EAC3C;AACA,MAAI,MAAM,WAAW,OAAW,MAAK,SAAS,MAAM;AACpD,MAAI,MAAM,mBAAmB;AAC5B,SAAK,iBAAiB,MAAM;AAC7B,MAAI,MAAM,gBAAgB,OAAW,MAAK,cAAc,MAAM;AAC9D,QAAM,UAAU,MAAM,eAAe;AAAA,IACpC,OAAO,MAAM;AAAA,IACb,QAAQ,MAAM;AAAA,IACd,SAAS,MAAM;AAAA,IACf,GAAI,MAAM,MAAM,EAAE,KAAK,MAAM,IAAI,IAAI,CAAC;AAAA,IACtC,QAAQ;AAAA,IACR,MAAM;AAAA,IACN;AAAA,EACD,CAAC;AACD,SAAO,0BAA0B,OAAO;AACzC;AAEA,SAAS,0BAA0B,SAAkC;AACpE,MACC,WACA,OAAO,YAAY,YACnB,CAAC,MAAM,QAAQ,OAAO,KACtB,aAAa,WACb,MAAM,QAAS,QAAiC,OAAO,GACtD;AACD,UAAM,SAAS;AAKf,WAAO;AAAA,MACN,SAAS,OAAO;AAAA,MAChB,mBAAmB,OAAO;AAAA,MAC1B,SAAS,OAAO,YAAY;AAAA,IAC7B;AAAA,EACD;AACA,SAAO,8BAA8B,OAAO;AAC7C;AAEO,SAAS,yBAAyB,OAG9B;AACV,QAAM,OAAO,MAAM,MAAM,KAAK,IAAI,MAAM,OAAO;AAC/C,QAAM,SAAS,MAAM,QAAQ,KAAK,IAAI,MAAM,SAAS;AACrD,MAAI,QAAQ,QAAQ;AACnB,UAAM,IAAI;AAAA,MACT;AAAA,IACD;AAAA,EACD;AACA,MAAI,OAAQ,QAAO,yBAAyB,MAAM;AAClD,MAAI,KAAM,QAAO;AACjB,QAAM,IAAI,MAAM,uDAAuD;AACxE;AAMO,SAAS,8BACf,SACiB;AACjB,QAAM,SAAS,SAAS,OAAO,IAAI,UAAU;AAC7C,MAAI,CAAC,QAAQ;AACZ,UAAMA,QACL,OAAO,YAAY,WAChB,UACC,KAAK,UAAU,SAAS,MAAM,CAAC,KAAK;AACzC,WAAO;AAAA,MACN,SAAS,CAAC,EAAE,MAAM,QAAQ,MAAAA,MAAK,CAAC;AAAA,MAChC,mBAAmB,EAAE,QAAQ,QAAQ;AAAA,MACrC,SAAS;AAAA,IACV;AAAA,EACD;AAEA,QAAM,KAAK,OAAO,OAAO,SAAS,OAAO,OAAO,UAAU;AAC1D,QAAM,iBACL,OAAO,OAAO,mBAAmB,WAC9B,OAAO,iBACP;AACJ,QAAM,OAAO,MAAM,QAAQ,OAAO,IAAI,IAAI,OAAO,OAAO,CAAC;AACzD,QAAM,OAAgC;AAAA,IACrC,GAAI,mBAAmB,SAAY,EAAE,eAAe,IAAI,CAAC;AAAA,IACzD;AAAA,EACD;AACA,aAAW,OAAO;AAAA,IACjB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACD,GAAY;AACX,QAAI,OAAO,GAAG,MAAM,OAAW,MAAK,GAAG,IAAI,OAAO,GAAG;AAAA,EACtD;AAEA,MAAI,CAAC,IAAI;AACR,UAAM,QACL,OAAO,OAAO,UAAU,WACrB,OAAO,QACP;AACJ,WAAO;AAAA,MACN,SAAS,CAAC,EAAE,MAAM,QAAQ,MAAM,UAAU,KAAK,GAAG,CAAC;AAAA,MACnD,mBAAmB,EAAE,GAAG,MAAM,OAAO,QAAQ,OAAO,OAAO;AAAA,MAC3D,SAAS;AAAA,IACV;AAAA,EACD;AAEA,QAAM,SAAS,OAAO;AACtB,QAAM,OACL,OAAO,WAAW,WACf,SACC,KAAK,UAAU,QAAQ,MAAM,CAAC,KAAK;AACxC,SAAO;AAAA,IACN,SAAS,CAAC,EAAE,MAAM,QAAQ,KAAK,CAAC;AAAA,IAChC,mBAAmB,EAAE,GAAG,MAAM,OAAO;AAAA,IACrC,SAAS;AAAA,EACV;AACD;AAEA,SAAS,SAAS,OAAkD;AACnE,SAAO,UAAU,QAAQ,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK;AAC3E;",
+  "names": ["text"]
+}

package/dist/remote-execute.d.ts

@@ -1,5 +1,5 @@
-import type { CredentialCallMapInput } from './credential-call-map.js';
-import type { ToolCallResult } from './tool-result.js';
+import { type CredentialCallMapInput } from './credential-call-map.js';
+import { type ToolCallResult } from './tool-result.js';
 export type RemoteExecuteInput = {
     code?: string;
     invoke?: string;
@@ -16,7 +16,7 @@ export type RemoteExecuteInput = {
     /** User-owned token org selection (`?org=`). */
     org?: string;
 };
-export declare const credentialFlagRequiresLocalOrMcpMessage = "--credential picks a credential for this run, but token-auth cloud execute goes through CapabilityProxy \u2192 kody.execute, which does not take a call map (package code must not pick by name). Use `execute --local --credential \u2026`, or omit --token / KODY_API_TOKEN and use a `kody login` MCP session so execute receives credentials.";
+export declare const credentialFlagRequiresLocalOrMcpMessage = "--credential picks a credential for this run. Cloud execute sends it on POST /v1/execute. Use `execute --local --credential \u2026` when the module must run on this machine.";
 /**
  * Cloud (non-`--local`) execute authenticated only with a scoped API token:
  * CapabilityProxy session + `kody.execute`. The module runs in Kody's cloud

package/dist/setup-git-MHK563LB.js

@@ -0,0 +1,87 @@
+import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
+import {
+  apiTokenNeedsRefresh,
+  assertUserOwnedTokensLive,
+  authRemoveGit,
+  authSetupGit,
+  cliExactVersionForNpx,
+  cliMajorVersionForNpx,
+  cliTokenLifetimeAliases,
+  cliVersionGt,
+  cliVersionGte,
+  cliVersionSupportsGitCredential,
+  compareCliSemver,
+  decideSetupGitToken,
+  defaultGitConfigGetRunner,
+  defaultGitConfigRunner,
+  ensureSetupGitScopes,
+  exactNpxHelperVersion,
+  fetchTokenCurrentMetadata,
+  formatAuthRemoveGitReport,
+  gitApiTokenRefreshSkewMs,
+  gitCredentialHelperCommand,
+  gitCredentialHelperNeedsRepair,
+  gitCredentialHelperPinFallbackVersion,
+  gitCredentialHostFromMcpUrl,
+  gitCredentialMinCliVersion,
+  installGitCredentialConfig,
+  isEphemeralNpxEntryPath,
+  isKodyGitCredentialHelperValue,
+  isMajorOnlyNpxHelper,
+  parseCliSemver,
+  readCliPackageVersion,
+  readVersionFromKodyBinary,
+  refreshGitCredentialHelperPinIfNeeded,
+  scopesIncludeRequired,
+  setupGitConfigScopes,
+  setupGitDefaultScopes,
+  setupGitRequiredScopes
+} from "./chunk-OZDWOZLV.js";
+import "./chunk-6ZYUGXVW.js";
+import "./chunk-W2SAFAT4.js";
+import "./chunk-46IJPEID.js";
+import "./chunk-DW5UTJ6T.js";
+import "./chunk-5JIRHJQP.js";
+import "./chunk-4GIFJVGT.js";
+import "./chunk-3H72XY5R.js";
+import "./chunk-BTL3PJ2H.js";
+import "./chunk-UW6AWLXX.js";
+export {
+  apiTokenNeedsRefresh,
+  assertUserOwnedTokensLive,
+  authRemoveGit,
+  authSetupGit,
+  cliExactVersionForNpx,
+  cliMajorVersionForNpx,
+  cliTokenLifetimeAliases,
+  cliVersionGt,
+  cliVersionGte,
+  cliVersionSupportsGitCredential,
+  compareCliSemver,
+  decideSetupGitToken,
+  defaultGitConfigGetRunner,
+  defaultGitConfigRunner,
+  ensureSetupGitScopes,
+  exactNpxHelperVersion,
+  fetchTokenCurrentMetadata,
+  formatAuthRemoveGitReport,
+  gitApiTokenRefreshSkewMs,
+  gitCredentialHelperCommand,
+  gitCredentialHelperNeedsRepair,
+  gitCredentialHelperPinFallbackVersion,
+  gitCredentialHostFromMcpUrl,
+  gitCredentialMinCliVersion,
+  installGitCredentialConfig,
+  isEphemeralNpxEntryPath,
+  isKodyGitCredentialHelperValue,
+  isMajorOnlyNpxHelper,
+  parseCliSemver,
+  readCliPackageVersion,
+  readVersionFromKodyBinary,
+  refreshGitCredentialHelperPinIfNeeded,
+  scopesIncludeRequired,
+  setupGitConfigScopes,
+  setupGitDefaultScopes,
+  setupGitRequiredScopes
+};
+//# sourceMappingURL=setup-git-MHK563LB.js.map

package/dist/setup-git-MHK563LB.js.map

@@ -0,0 +1,6 @@
+{
+  "version": 3,
+  "sources": [],
+  "mappings": "",
+  "names": []
+}

package/dist/setup-git.d.ts

@@ -1,6 +1,6 @@
 import { cliTokenLifetimeAliases, type ResolvedCliTokenLifetime } from './auth-bootstrap.js';
 import { type StoredApiToken } from './api-token-store.js';
-import type { SecretBackend, StoreResolution } from './store.js';
+import { type SecretBackend, type StoreResolution } from './store.js';
 import { which as whichOnPath } from './which.js';
 /** Scopes setup-git always requires for clone/fetch (+ push). */
 export declare const setupGitRequiredScopes: readonly ["package:read", "package:write"];

package/dist/skill-D74XVI6T.js

@@ -0,0 +1,61 @@
+import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
+import "./chunk-UW6AWLXX.js";
+
+// src/skill.ts
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { homedir } from "node:os";
+var skillRelativePath = "skills/kody/SKILL.md";
+function bundledSkillPath() {
+  return join(fileURLToPath(new URL("../", import.meta.url)), skillRelativePath);
+}
+function userSkillTargets(home = homedir()) {
+  return [
+    {
+      host: "Claude Code",
+      path: join(home, ".claude", "skills", "kody", "SKILL.md")
+    },
+    {
+      host: "Cursor",
+      path: join(home, ".cursor", "skills", "kody", "SKILL.md")
+    },
+    {
+      host: "Agents",
+      path: join(home, ".agents", "skills", "kody", "SKILL.md")
+    }
+  ];
+}
+function projectSkillTargets(cwd = process.cwd()) {
+  return [
+    {
+      host: "Agents",
+      path: join(cwd, ".agents", "skills", "kody", "SKILL.md")
+    },
+    {
+      host: "Cursor",
+      path: join(cwd, ".cursor", "skills", "kody", "SKILL.md")
+    },
+    {
+      host: "Claude Code",
+      path: join(cwd, ".claude", "skills", "kody", "SKILL.md")
+    }
+  ];
+}
+async function installSkill(input) {
+  const source = input.sourcePath ?? bundledSkillPath();
+  const body = await readFile(source, "utf8");
+  const targets = input.project ? projectSkillTargets(input.cwd) : userSkillTargets(input.home);
+  for (const target of targets) {
+    await mkdir(dirname(target.path), { recursive: true });
+    await writeFile(target.path, body, "utf8");
+  }
+  return targets;
+}
+export {
+  bundledSkillPath,
+  installSkill,
+  projectSkillTargets,
+  userSkillTargets
+};
+//# sourceMappingURL=skill-D74XVI6T.js.map

package/dist/skill-D74XVI6T.js.map

@@ -0,0 +1,6 @@
+{
+  "version": 3,
+  "sources": ["../src/skill.ts"],
+  "mappings": ";;;;AAAA,SAAS,OAAO,UAAU,iBAAiB;AAC3C,SAAS,SAAS,YAAY;AAC9B,SAAS,qBAAqB;AAC9B,SAAS,eAAe;AAExB,IAAM,oBAAoB;AAEnB,SAAS,mBAA2B;AAC1C,SAAO,KAAK,cAAc,IAAI,IAAI,OAAO,YAAY,GAAG,CAAC,GAAG,iBAAiB;AAC9E;AAEO,SAAS,iBAAiB,OAAe,QAAQ,GAGrD;AACF,SAAO;AAAA,IACN;AAAA,MACC,MAAM;AAAA,MACN,MAAM,KAAK,MAAM,WAAW,UAAU,QAAQ,UAAU;AAAA,IACzD;AAAA,IACA;AAAA,MACC,MAAM;AAAA,MACN,MAAM,KAAK,MAAM,WAAW,UAAU,QAAQ,UAAU;AAAA,IACzD;AAAA,IACA;AAAA,MACC,MAAM;AAAA,MACN,MAAM,KAAK,MAAM,WAAW,UAAU,QAAQ,UAAU;AAAA,IACzD;AAAA,EACD;AACD;AAEO,SAAS,oBAAoB,MAAc,QAAQ,IAAI,GAG3D;AACF,SAAO;AAAA,IACN;AAAA,MACC,MAAM;AAAA,MACN,MAAM,KAAK,KAAK,WAAW,UAAU,QAAQ,UAAU;AAAA,IACxD;AAAA,IACA;AAAA,MACC,MAAM;AAAA,MACN,MAAM,KAAK,KAAK,WAAW,UAAU,QAAQ,UAAU;AAAA,IACxD;AAAA,IACA;AAAA,MACC,MAAM;AAAA,MACN,MAAM,KAAK,KAAK,WAAW,UAAU,QAAQ,UAAU;AAAA,IACxD;AAAA,EACD;AACD;AAEA,eAAsB,aAAa,OAKgB;AAClD,QAAM,SAAS,MAAM,cAAc,iBAAiB;AACpD,QAAM,OAAO,MAAM,SAAS,QAAQ,MAAM;AAC1C,QAAM,UAAU,MAAM,UACnB,oBAAoB,MAAM,GAAG,IAC7B,iBAAiB,MAAM,IAAI;AAC9B,aAAW,UAAU,SAAS;AAC7B,UAAM,MAAM,QAAQ,OAAO,IAAI,GAAG,EAAE,WAAW,KAAK,CAAC;AACrD,UAAM,UAAU,OAAO,MAAM,MAAM,MAAM;AAAA,EAC1C;AACA,SAAO;AACR;",
+  "names": []
+}

package/dist/store-27J4CQZ2.js

@@ -0,0 +1,48 @@
+import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
+import {
+  accountForMcpUrl,
+  createFileBackend,
+  createKeyringBackend,
+  deleteCredentials,
+  fileStorePath,
+  listOrgSlugs,
+  listStoredOrgs,
+  loadCredentialStore,
+  loadCredentials,
+  loadPendingCredentials,
+  migrateV1ToMultiOrg,
+  parseCredentialStore,
+  parseCredentials,
+  pickCredentialsFromStore,
+  promotePendingOrg,
+  resolveBackend,
+  saveCredentialStore,
+  saveCredentials,
+  secretServiceKeyringOptions,
+  setActiveOrg
+} from "./chunk-3H72XY5R.js";
+import "./chunk-BTL3PJ2H.js";
+import "./chunk-UW6AWLXX.js";
+export {
+  accountForMcpUrl,
+  createFileBackend,
+  createKeyringBackend,
+  deleteCredentials,
+  fileStorePath,
+  listOrgSlugs,
+  listStoredOrgs,
+  loadCredentialStore,
+  loadCredentials,
+  loadPendingCredentials,
+  migrateV1ToMultiOrg,
+  parseCredentialStore,
+  parseCredentials,
+  pickCredentialsFromStore,
+  promotePendingOrg,
+  resolveBackend,
+  saveCredentialStore,
+  saveCredentials,
+  secretServiceKeyringOptions,
+  setActiveOrg
+};
+//# sourceMappingURL=store-27J4CQZ2.js.map

package/dist/store-27J4CQZ2.js.map

@@ -0,0 +1,6 @@
+{
+  "version": 3,
+  "sources": [],
+  "mappings": "",
+  "names": []
+}

package/dist/structured-error-5MLWXYR3.js

@@ -0,0 +1,14 @@
+import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
+import {
+  StructuredCliError,
+  formatStructuredErrorMessage,
+  notImplementedInMock
+} from "./chunk-XV6D6HSG.js";
+import "./chunk-EJXEVGWF.js";
+import "./chunk-UW6AWLXX.js";
+export {
+  StructuredCliError,
+  formatStructuredErrorMessage,
+  notImplementedInMock
+};
+//# sourceMappingURL=structured-error-5MLWXYR3.js.map

package/dist/structured-error-5MLWXYR3.js.map

@@ -0,0 +1,6 @@
+{
+  "version": 3,
+  "sources": [],
+  "mappings": "",
+  "names": []
+}

package/dist/structured-error.d.ts

@@ -2,7 +2,7 @@
  * Agent-facing structured errors for local testing (design 2026-10-13).
  * Stable `code`, optional `where` / `fix`, and which `target` produced it.
  */
-import type { KodyTarget } from './target.js';
+import { type KodyTarget } from './target.js';
 export type StructuredErrorCode = 'not_implemented_in_mock' | 'unmocked_request' | 'unresolved_import' | 'missing_secret' | 'bundle_failed' | 'package_manifest_invalid' | 'dev_handler_missing' | 'dev_surface_missing' | 'invalid_target' | 'invalid_port' | 'dev_port_in_use' | 'dev_already_running';
 export type StructuredErrorBody = {
     code: StructuredErrorCode | string;

package/dist/target-33ATHDUF.js

@@ -0,0 +1,17 @@
+import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
+import {
+  commandAcceptsTarget,
+  defaultTargetFor,
+  parseTargetFlag,
+  resolveTarget,
+  targetEnvVar
+} from "./chunk-EJXEVGWF.js";
+import "./chunk-UW6AWLXX.js";
+export {
+  commandAcceptsTarget,
+  defaultTargetFor,
+  parseTargetFlag,
+  resolveTarget,
+  targetEnvVar
+};
+//# sourceMappingURL=target-33ATHDUF.js.map

package/dist/target-33ATHDUF.js.map

@@ -0,0 +1,6 @@
+{
+  "version": 3,
+  "sources": [],
+  "mappings": "",
+  "names": []
+}

package/package.json

@@ -1,7 +1,7 @@
 {
 	"name": "@kodycodes/cli",
-	"version": "1.26.2",
-	"description": "Official Kody MCP client CLI: login, secure token storage, search, and execute.",
+	"version": "1.27.0",
+	"description": "Official Kody CLI: login, secure token storage, search, and execute over the OpenAPI.",
 	"type": "module",
 	"bin": {
 		"kody": "dist/bin.js"
@@ -19,7 +19,7 @@
 		"skills"
 	],
 	"scripts": {
-		"build": "tsc -p tsconfig.build.json",
+		"build": "node scripts/build.mjs && tsc -p tsconfig.build.json",
 		"bench": "node scripts/bench.mjs",
 		"typecheck": "tsc --noEmit",
 		"test": "tsx --test test/*.test.ts",
@@ -38,28 +38,29 @@
 	"license": "MIT",
 	"repository": {
 		"type": "git",
-		"url": "git+https://github.com/kody-bot/cli.git"
+		"url": "git+https://github.com/kentcdodds/kody.git",
+		"directory": "packages/cli"
 	},
 	"bugs": {
-		"url": "https://github.com/kody-bot/cli/issues"
+		"url": "https://github.com/kentcdodds/kody/issues"
 	},
 	"homepage": "https://kody.codes",
 	"publishConfig": {
 		"access": "public"
 	},
 	"dependencies": {
-		"@inquirer/checkbox": "^5.2.2",
-		"@jridgewell/trace-mapping": "^0.3.31",
-		"@modelcontextprotocol/client": "2.0.0",
 		"@napi-rs/keyring": "^2.1.0",
-		"add-mcp": "^2.4.0",
-		"chokidar": "^4.0.3",
-		"es-module-lexer": "^3.0.3",
 		"esbuild": "^0.25.12",
 		"ps-list": "^9.0.0"
 	},
 	"devDependencies": {
+		"@inquirer/checkbox": "^5.2.2",
+		"@jridgewell/trace-mapping": "^0.3.31",
 		"@types/node": "^24.5.2",
+		"oauth4webapi": "^3.8.6",
+		"add-mcp": "^2.4.0",
+		"chokidar": "^4.0.3",
+		"es-module-lexer": "^3.0.3",
 		"msw": "3.0.3",
 		"tsx": "^4.20.5",
 		"typescript": "^5.9.2"

package/skills/kody/SKILL.md

@@ -1,16 +1,18 @@
 ---
 name: kody
 description: >
-  Install Kody as a remote MCP server, then use `search` / MCP tools and
-  prefer `kody execute --local` when the CLI and Node are available. Use
-  when the user mentions Kody, kody.codes, durable agent tasks, or wants
-  to search/execute via Kody.
+  Install Kody as a remote MCP server, then use `search` / MCP tools and prefer
+  `kody execute --local` when the CLI and Node are available. Use when the user
+  mentions Kody, kody.codes, durable agent tasks, or wants to search/execute via
+  Kody.
 ---
 
 # Kody
 
 Kody is a remote MCP personal assistant. Install it as an MCP server in this
-agent for `search`, `api`, and discovery. Prefer local CLI execute when Node ≥22 and `@kodycodes/cli` are available. Use MCP / hosted paths when the CLI or Node cannot run.
+agent for `search`, `api`, and discovery. Prefer local CLI execute when Node ≥22
+and `@kodycodes/cli` are available. Use MCP / hosted paths when the CLI or Node
+cannot run.
 
 `@kodycodes/cli` installs host MCP config and runs local execute against real
 secrets while keeping `kody:runtime` hops on CapabilityProxy.
@@ -21,9 +23,9 @@ secrets while keeping `kody:runtime` hops on CapabilityProxy.
 npx @kodycodes/cli install
 ```
 
-That command lists **running local** agents and writes each host's remote
-MCP entry for `https://kody.codes/mcp`. Host OAuth stays in that client —
-do not run `kody login` for the host connection.
+That command lists **running local** agents and writes each host's remote MCP
+entry for `https://kody.codes/mcp`. Host OAuth stays in that client — do not run
+`kody login` for the host connection.
 
 After install, use the Kody MCP tools in this agent for discovery and Open API:
 
@@ -31,11 +33,11 @@ After install, use the Kody MCP tools in this agent for discovery and Open API:
 - `api` — call one Open API operation directly (no sandbox)
 - Prefer `search` before composing work
 
-For one-off modules, smoke tests, and composition: when Node ≥22 and the CLI
-are available, prefer `npx @kodycodes/cli execute --local` (see
-[Local CLI execute](https://kody.codes/docs/local-execute)). If `--local`
-cannot run, use Open API / MCP `api`, or fix the environment — do **not** use
-hosted MCP `execute` for agent work when a local or Open API path exists.
+For one-off modules, smoke tests, and composition: when Node ≥22 and the CLI are
+available, prefer `npx @kodycodes/cli execute --local` (see
+[Local CLI execute](https://kody.codes/docs/local-execute)). If `--local` cannot
+run, use Open API / MCP `api`, or fix the environment — do **not** use hosted
+MCP `execute` for agent work when a local or Open API path exists.
 
 For web-based clients (ChatGPT, Claude.ai, Grok), point the user at
 https://kody.codes/onboarding.
@@ -61,12 +63,11 @@ kody whoami
 kody logout
 ```
 
-The CLI opens a browser for Kody OAuth (PKCE + Client ID Metadata Documents).
-If a browser cannot open, it prints the URL. Tokens (access + refresh) are
-stored in the OS keychain on macOS, Windows, and Linux (Secret Service).
-Linux without Secret Service — including headless machines that only have an
-in-memory kernel keyring — falls back to a `0600` file under
-`$XDG_CONFIG_HOME/kody`.
+The CLI opens a browser for Kody OAuth (PKCE + Client ID Metadata Documents). If
+a browser cannot open, it prints the URL. Tokens (access + refresh) are stored
+in the OS keychain on macOS, Windows, and Linux (Secret Service). Linux without
+Secret Service — including headless machines that only have an in-memory kernel
+keyring — falls back to a `0600` file under `$XDG_CONFIG_HOME/kody`.
 
 Never ask the user to paste tokens into chat.
 
@@ -80,45 +81,47 @@ machine instead (Node.js 22 or newer; older Node fails before workerd starts).
 Modules with static `kody:@…` imports keep `--local`: the CLI fetches stamped
 package modules via `POST /v1/local-execute/package-graph` and embeds them in
 local workerd (CapabilityProxy only for per-call `kody:runtime` hops — not a
-whole-module cloud defer). If that package-graph API is missing, `--local`
-fails clearly rather than silently billing a remote execute. `--file`
-entries are bundled (relative imports and npm packages; `kody:*` external)
-before workerd loads them, matching hosted execute / publish.
-`--code` and stdin are not rewritten.
+whole-module cloud defer). If that package-graph API is missing, `--local` fails
+clearly rather than silently billing a remote execute. `--file` entries are
+bundled (relative imports and npm packages; `kody:*` external) before workerd
+loads them, matching hosted execute / publish. `--code` and stdin are not
+rewritten.
 
 For `execute --local` auth: `--token` / `KODY_API_TOKEN` wins when set;
 otherwise a stored token from `kody auth bootstrap --code` (after MCP
-`cliCredentialBootstrap`); otherwise a valid `kody login` session (OAuth
-access token as Bearer only when the API and MCP URLs are paired — never print
-it, never mint via `tokenCreate` under the hood). The default pair is
-`https://api.kody.codes` and `https://kody.codes/mcp`; preview workers pair
-when the API worker name adds `-api`, and loopback hosts pair at any port.
-For another API origin, use `auth bootstrap --api-url <origin>` or set
+`cliCredentialBootstrap`); otherwise a valid `kody login` session (OAuth access
+token as Bearer only when the API and MCP URLs are paired — never print it,
+never mint via `tokenCreate` under the hood). The default pair is
+`https://api.kody.codes` and `https://kody.codes/mcp`; preview workers pair when
+the API worker name adds `-api`, and loopback hosts pair at any port. For
+another API origin, use `auth bootstrap --api-url <origin>` or set
 `KODY_API_TOKEN`. A PR preview's API host is
 `https://kody-pr-<n>-api.<subdomain>.workers.dev`, not the app origin
-`kody-pr-<n>` (which 404s `/v1/*` with HTML). Prefer bootstrap over `tokenCreate` for agents already on
-MCP so `kody_at_…` never appears in chat. Until the Open API accepts MCP OAuth on
-CapabilityProxy / package-graph
-(https://github.com/kentcdodds/kody/issues/2812), use bootstrap or mint a
-scoped token with the MCP `api` tool `tokenCreate` — include `local-execute`
-plus the capability scopes the module calls — and pass `--token` or
-`KODY_API_TOKEN`. If none of those are available, the CLI error says that
-(bootstrap → login → tokenCreate for CI). `insufficient_scope` names the
-missing scope and prints the exact command to mint a token that adds it:
+`kody-pr-<n>` (which 404s `/v1/*` with HTML). Prefer bootstrap over
+`tokenCreate` for agents already on MCP so `kody_at_…` never appears in chat.
+Until the Open API accepts MCP OAuth on CapabilityProxy / package-graph
+(https://github.com/kentcdodds/kody/issues/2812), use bootstrap or mint a scoped
+token with the MCP `api` tool `tokenCreate` — include `local-execute` plus the
+capability scopes the module calls — and pass `--token` or `KODY_API_TOKEN`. If
+none of those are available, the CLI error says that (bootstrap → login →
+tokenCreate for CI). `insufficient_scope` names the missing scope and prints the
+exact command to mint a token that adds it:
 `npx @kodycodes/cli auth bootstrap --lifetime short|long --scopes <list>` after
-`kody login`, or `cliCredentialBootstrap({ lifetime: "short"|"long", scopes: [...] })`
-from MCP (hints preserve the current token's lifetime class when known).
-Default bootstrap scopes stay least-privilege (no `package:write`),
-and `--scopes` replaces them, so list every scope you need.
-Publish a package after `packageGetGitRemote` clone/push with
+`kody login`, or
+`cliCredentialBootstrap({ lifetime: "short"|"long", scopes: [...] })` from MCP
+(hints preserve the current token's lifetime class when known). Default
+bootstrap scopes stay least-privilege (no `package:write`), and `--scopes`
+replaces them, so list every scope you need. Publish a package after
+`packageGetGitRemote` clone/push with
 `kody package publish <@owner/leaf|package_id>` (thin
-`packagePublishExternalPush` wrapper; same auth as `kody api`).
-See and change who can use a package (teams and org members of the `--org`
-org) with `kody package collaborators <package>`,
+`packagePublishExternalPush` wrapper; same auth as `kody api`). See and change
+who can use a package (teams and org members of the `--org` org) with
+`kody package collaborators <package>`,
 `kody package grant <package> --team <slug>|--user <username> --preset use|contribute|manage`,
-and `kody package revoke <package> --team <slug>|--user <username>|--grant <id>`.
-These need a token with `package:manage_access`.
-`feature_disabled` means the account `local-execute` flag is off. Never read MCP OAuth tokens from the host.
+and
+`kody package revoke <package> --team <slug>|--user <username>|--grant <id>`.
+These need a token with `package:manage_access`. `feature_disabled` means the
+account `local-execute` flag is off. Never read MCP OAuth tokens from the host.
 
 ```bash
 # Agents on MCP: