@kodycodes/cli 1.28.2 → 1.28.4

package/README.md

@@ -86,12 +86,14 @@ multi-org store as the active org (no re-login).
 | `kody whoami`                                     | Confirms the CLI MCP connection and lists tools. With a scoped API token (and no login), shows token identity via the Open API.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
 | `kody search [query]`                             | Calls Kody `search` from the CLI (prefer the host MCP tool). Token-only auth uses Open API `GET /v1/search`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
 | `kody api <operationId>`                          | Thin Open API wrapper matching the MCP `api` tool: `operationId` + flat `--params` JSON. Auth: `--token` / `KODY_API_TOKEN` / stored `auth bootstrap` token. The parsed `/openapi.json` route map is cached under the Kody cache dir keyed by the document's `ETag` and revalidated with `If-None-Match` on each run.                                                                                                                                                                                                                                                                                                                                                                                                                           |
-| `kody package publish`                            | Thin wrapper for `packagePublishExternalPush`. Optional positional `@owner/leaf`, bare leaf name, or package UUID (names are resolved to the package UUID via `packageList`); extra fields via `--params`. Same auth as `kody api`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
+| `kody package publish`                            | Thin wrapper for `packagePublishExternalPush`. Optional positional `@owner/leaf`, bare leaf name, or package UUID (names are resolved to the package UUID via `packageList`); extra fields via `--params`. Same auth as `kody api`. Prints the API JSON and exits **0 on HTTP 2xx**, including refusal statuses (`checks_failed`, `locked`, `approval_required`, `not_fast_forward`) — read `status` in the body. Network failures exit 1; `--json` adds `{ error, message, sent }` on stdout (`sent: false` = not sent; `sent: "unknown"` = maybe sent — prefer `kody api workflowRunList` before retry). Re-publishing the same commit is safe (durable dedupe / `already_published`).                                                        |
 | `kody package collaborators` / `grant` / `revoke` | Who can use one package, and add or remove teams and members of the org (`--org`). `<package>` is `@owner/leaf`, the kody id, or the package id. `grant <package> --team <slug>\|--user <username> [--preset use\|contribute\|manage]` (default `use`) adds or changes a collaborator via `packageCollaboratorSet`; people outside the org are refused. `revoke <package> --team\|--user\|--grant <grant_id>` removes one via `packageCollaboratorRemove`. Needs Manage on the package and a token with `package:manage_access` (`auth bootstrap --scopes …,package:manage_access`). Prints a summary, or JSON with `--json`.                                                                                                                   |
 | `kody execute`                                    | Calls Kody `execute` from the CLI (`--invoke`, `--code`, `--file`, or stdin via `--file -`). With a scoped API token and no login (or with `--token`), cloud execute goes through CapabilityProxy → `kody.execute` — no `kody login`. Add `--local` to run the module (and static `kody:@…` package modules) on this machine instead. `--credential key=name` (repeatable; `org:name` / `personal:name` / empty `=` for none) picks ADR 0068 credentials for `--local` or a `kody login` MCP session. `--allow-private-network` opts local execution into private and local network access. `--target prod\|mock` (default `prod`) sends CapabilityProxy / search hops to prod or the built-in CLI mock; `--target mock` implies local workerd. |
 | `kody dev`                                        | Local testing for unpublished packages. Serves `kody.app.entry` on localhost via workerd with hot reload. Subcommands: `fetch`, `job`, `webhook`, `emit`, `check`. Default `--target mock` (scratch storage, fake credentials). Covers exports, webhooks, schedules (run-once), and subscriptions. See [Local package testing](#local-package-testing-kody-dev).                                                                                                                                                                                                                                                                                                                                                                                |
 
-`--json` prints structured MCP results.
+`--json` prints structured MCP results. On command failures it also prints a
+JSON error object on stdout (`error`, `message`, and when a network hop failed
+before an HTTP response, additive `sent: false | "unknown"`).
 
 ## Token-authenticated execute (no `kody login`)
 

package/dist/{auth-TSEDVC4Q.js → auth-67R45WKR.js}

@@ -7,14 +7,14 @@ import {
   login,
   refreshStoredCredentials,
   resolvePendingOrgSlug
-} from "./chunk-7AXKW7HF.js";
-import "./chunk-ZILB2HWE.js";
+} from "./chunk-K5VI6QLH.js";
 import "./chunk-CASGRYOF.js";
-import "./chunk-GZIIFSK7.js";
+import "./chunk-ZILB2HWE.js";
+import "./chunk-V62QV2YD.js";
 import "./chunk-46IJPEID.js";
-import "./chunk-DW5UTJ6T.js";
-import "./chunk-FGD6ZQWV.js";
-import "./chunk-4GIFJVGT.js";
+import "./chunk-PWWN6JI2.js";
+import "./chunk-4KZ7BGFE.js";
+import "./chunk-LSFY5BNX.js";
 import "./chunk-CWWHR4FH.js";
 import "./chunk-3H72XY5R.js";
 import "./chunk-BTL3PJ2H.js";
@@ -28,4 +28,4 @@ export {
   refreshStoredCredentials,
   resolvePendingOrgSlug
 };
-//# sourceMappingURL=auth-TSEDVC4Q.js.map
+//# sourceMappingURL=auth-67R45WKR.js.map

package/dist/bin.js

@@ -2,21 +2,21 @@
 import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
 import {
   runCli
-} from "./chunk-TMKESCDS.js";
+} from "./chunk-F3UJD24O.js";
 import "./chunk-2XPH7L2P.js";
 import "./chunk-SLNAWWQK.js";
 import "./chunk-YDWTXEKQ.js";
-import "./chunk-HZN5DD3X.js";
-import "./chunk-4IO7CCI3.js";
+import "./chunk-65UVHMB4.js";
+import "./chunk-EOUYOO3A.js";
 import "./chunk-6ZYUGXVW.js";
-import "./chunk-7AXKW7HF.js";
-import "./chunk-ZILB2HWE.js";
+import "./chunk-K5VI6QLH.js";
 import "./chunk-CASGRYOF.js";
-import "./chunk-GZIIFSK7.js";
+import "./chunk-ZILB2HWE.js";
+import "./chunk-V62QV2YD.js";
 import "./chunk-46IJPEID.js";
-import "./chunk-DW5UTJ6T.js";
-import "./chunk-FGD6ZQWV.js";
-import "./chunk-4GIFJVGT.js";
+import "./chunk-PWWN6JI2.js";
+import "./chunk-4KZ7BGFE.js";
+import "./chunk-LSFY5BNX.js";
 import "./chunk-7PRJ36I5.js";
 import "./chunk-CWWHR4FH.js";
 import "./chunk-3H72XY5R.js";

package/dist/capability-proxy.d.ts

@@ -1,6 +1,7 @@
 import { type IncomingMessage } from 'node:http';
 import { Readable } from 'node:stream';
 import { type CredentialCallMapInput } from './credential-call-map.js';
+import { type RequestSentStatus } from './network-error.js';
 /**
  * HTTP contract for Kody's CapabilityProxy (Open API `/v1`). Local execute
  * runs user code in workerd and forwards every `kody:runtime` call here with
@@ -97,9 +98,15 @@ export type CapabilityProxyClientInput = {
 export declare class CapabilityProxyError extends Error {
     readonly status: number | null;
     readonly code: string | null;
+    /**
+     * Set when the hop failed before an HTTP response. `false` = connect
+     * phase (nothing sent); `"unknown"` = body may have reached the server.
+     */
+    readonly sent?: RequestSentStatus;
     constructor(message: string, options?: {
         status?: number | null;
         code?: string | null;
+        sent?: RequestSentStatus;
     });
 }
 /** The bearer token must not cross the network in cleartext. */