@kodycodes/cli 1.3.0 → 1.4.0

package/README.md

@@ -64,10 +64,47 @@ Or run via `npx @kodycodes/cli` without a global install.
 | `kody status` | Shows CLI login state without printing secrets. |
 | `kody whoami` | Confirms the CLI MCP connection and lists tools. |
 | `kody search [query]` | Calls Kody `search` from the CLI (prefer the host MCP tool). |
-| `kody execute` | Calls Kody `execute` from the CLI (`--invoke`, `--code`, `--file`, or stdin via `--file -`). |
+| `kody execute` | Calls Kody `execute` from the CLI (`--invoke`, `--code`, `--file`, or stdin via `--file -`). Add `--local` to run the module on this machine. |
 
 `--json` prints structured MCP results.
 
+## Local execute
+
+`kody execute --local` runs the same execute module (default export called
+with `--params`) on this machine instead of in Kody's cloud sandbox. Local CPU
+is free; every `kody:runtime` call (`kody.*`, `kody.mcp.*`, `workflows`,
+`packages`) is proxied to Kody's CapabilityProxy and metered like a cloud hop.
+
+```bash
+export KODY_API_TOKEN=…   # scoped token minted through the Kody `api` tool
+npx @kodycodes/cli execute --local --file ./task.js --params '{"to":"me@example.com"}'
+```
+
+- **Auth:** a scoped API token from `--token` or `KODY_API_TOKEN` (prefer the
+  env var so the token stays out of shell history and `ps`). No `kody login`,
+  and the CLI never reads MCP OAuth tokens from other hosts. The token stays in
+  the CLI process; the sandbox only talks to a loopback bridge.
+- **Runtime:** a pinned [workerd](https://github.com/cloudflare/workerd)
+  release, downloaded once from GitHub, sha256-verified, and cached under
+  `~/.cache/kody` (Linux, or `$XDG_CACHE_HOME/kody`) or
+  `~/Library/Caches/kody` (macOS). Override with `KODY_CACHE_DIR`, or point
+  `KODY_WORKERD_PATH` at your own binary. No Docker required. Linux and macOS
+  (x64/arm64) only for now.
+- **API:** `https://api.kody.codes` by default (`--api-url` or `KODY_API_URL`
+  to override). The CLI calls `GET /v1/capability-proxy/session` before
+  starting workerd and `POST /v1/capability-proxy/call` with
+  `{ path, args, conversationId? }` for each runtime call.
+- **Errors:** an expired/revoked token or an account without the
+  `local-execute` flag fails fast with a clear message before any code runs.
+  The token is only sent over https (plain http is allowed for localhost).
+- **Lifetime:** no execution time limit locally; Ctrl-C (or SIGTERM) stops
+  workerd and removes the temporary module.
+- **Not yet:** static `kody:@scope/package/export` imports and `--invoke`
+  (use cloud execute or `packages.invoke`). `packageStorage()`,
+  `packageSecrets`, `email`, and `events` stay unbound like ad hoc cloud
+  execute. Outbound `fetch` goes straight from this machine, including to
+  local-network hosts.
+
 ## Token storage
 
 CLI credentials are stored in the OS secret store:
@@ -82,6 +119,9 @@ If the keychain is unavailable (common on headless Linux), the CLI writes a
 
 Access tokens refresh automatically on expiry or HTTP 401.
 
+`execute --local` does not use stored CLI credentials; it only reads
+`--token` / `KODY_API_TOKEN`.
+
 ## Releases
 
 This repo uses [semantic-release](https://github.com/semantic-release/semantic-release)

package/dist/capability-proxy.d.ts

@@ -0,0 +1,46 @@
+/**
+ * HTTP contract for Kody's CapabilityProxy (Open API `/v1`). Local execute
+ * runs user code in workerd and forwards every `kody:runtime` call here with
+ * a scoped API token.
+ *
+ * - `GET  /v1/capability-proxy/session` validates the token before workerd
+ *   starts. 200 → `{ scopes?: string[], expiresAt?: string }`.
+ * - `POST /v1/capability-proxy/call` with `{ path, args, conversationId? }`
+ *   where `path` is the runtime property path (`['kody', 'emailSend']`,
+ *   `['kody', 'mcp', server, tool]`, `['workflows', 'create']`) and `args`
+ *   is the positional argument list. 200 → `{ result }`.
+ *
+ * Errors use `{ error: { code, message } }` (a bare string is accepted too).
+ * 401 means the token is expired/revoked; 403 `feature_disabled` means the
+ * `local-execute` flag is off for the account.
+ */
+export declare const capabilityProxySessionPath = "v1/capability-proxy/session";
+export declare const capabilityProxyCallPath = "v1/capability-proxy/call";
+export type CapabilityProxySession = {
+    scopes: Array<string>;
+    expiresAt: string | null;
+};
+export type CapabilityProxyCall = {
+    path: Array<string>;
+    args: Array<unknown>;
+    conversationId?: string;
+};
+export type CapabilityProxyClientInput = {
+    apiUrl: string;
+    token: string;
+    fetchFn?: typeof fetch;
+    signal?: AbortSignal;
+};
+export declare class CapabilityProxyError extends Error {
+    readonly status: number | null;
+    readonly code: string | null;
+    constructor(message: string, options?: {
+        status?: number | null;
+        code?: string | null;
+    });
+}
+/** The bearer token must not cross the network in cleartext. */
+export declare function assertTokenSafeApiUrl(apiUrl: string): void;
+export declare function capabilityProxyUrl(apiUrl: string, path: string): URL;
+export declare function openCapabilityProxySession(input: CapabilityProxyClientInput): Promise<CapabilityProxySession>;
+export declare function callCapabilityProxy(input: CapabilityProxyClientInput & CapabilityProxyCall): Promise<unknown>;

package/dist/capability-proxy.js

@@ -0,0 +1,151 @@
+import { apiTokenEnvVar, cliName } from './defaults.js';
+import { describeNetworkError } from './network-error.js';
+import { readPackageVersion } from './package-info.js';
+/**
+ * HTTP contract for Kody's CapabilityProxy (Open API `/v1`). Local execute
+ * runs user code in workerd and forwards every `kody:runtime` call here with
+ * a scoped API token.
+ *
+ * - `GET  /v1/capability-proxy/session` validates the token before workerd
+ *   starts. 200 → `{ scopes?: string[], expiresAt?: string }`.
+ * - `POST /v1/capability-proxy/call` with `{ path, args, conversationId? }`
+ *   where `path` is the runtime property path (`['kody', 'emailSend']`,
+ *   `['kody', 'mcp', server, tool]`, `['workflows', 'create']`) and `args`
+ *   is the positional argument list. 200 → `{ result }`.
+ *
+ * Errors use `{ error: { code, message } }` (a bare string is accepted too).
+ * 401 means the token is expired/revoked; 403 `feature_disabled` means the
+ * `local-execute` flag is off for the account.
+ */
+export const capabilityProxySessionPath = 'v1/capability-proxy/session';
+export const capabilityProxyCallPath = 'v1/capability-proxy/call';
+export class CapabilityProxyError extends Error {
+    status;
+    code;
+    constructor(message, options = {}) {
+        super(message);
+        this.name = 'CapabilityProxyError';
+        this.status = options.status ?? null;
+        this.code = options.code ?? null;
+    }
+}
+const loopbackHosts = new Set(['localhost', '127.0.0.1', '[::1]']);
+/** The bearer token must not cross the network in cleartext. */
+export function assertTokenSafeApiUrl(apiUrl) {
+    let url;
+    try {
+        url = new URL(apiUrl);
+    }
+    catch {
+        throw new Error(`Invalid Kody API URL: ${apiUrl}`);
+    }
+    if (url.protocol === 'https:')
+        return;
+    if (url.protocol === 'http:' && loopbackHosts.has(url.hostname))
+        return;
+    throw new Error(`Refusing to send the API token to ${url.origin}: use https (plain http is only allowed for localhost).`);
+}
+export function capabilityProxyUrl(apiUrl, path) {
+    const base = apiUrl.endsWith('/') ? apiUrl : `${apiUrl}/`;
+    return new URL(path, base);
+}
+export async function openCapabilityProxySession(input) {
+    const url = capabilityProxyUrl(input.apiUrl, capabilityProxySessionPath);
+    const response = await send(input, url, { method: 'GET' });
+    const body = await readJson(response);
+    if (!response.ok) {
+        throw describeFailure(response.status, body, url, 'session');
+    }
+    const record = isRecord(body) ? body : {};
+    return {
+        scopes: Array.isArray(record.scopes)
+            ? record.scopes.filter((scope) => typeof scope === 'string')
+            : [],
+        expiresAt: typeof record.expiresAt === 'string' ? record.expiresAt : null,
+    };
+}
+export async function callCapabilityProxy(input) {
+    const url = capabilityProxyUrl(input.apiUrl, capabilityProxyCallPath);
+    const payload = { path: input.path, args: input.args };
+    if (input.conversationId !== undefined)
+        payload.conversationId = input.conversationId;
+    const response = await send(input, url, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify(payload),
+    });
+    const body = await readJson(response);
+    if (!response.ok) {
+        throw describeFailure(response.status, body, url, 'call');
+    }
+    const failure = readErrorBody(body);
+    if (failure) {
+        throw new CapabilityProxyError(failure.message, { status: response.status, code: failure.code });
+    }
+    return isRecord(body) ? body.result : undefined;
+}
+async function send(input, url, init) {
+    const fetchFn = input.fetchFn ?? fetch;
+    try {
+        return await fetchFn(url, {
+            ...init,
+            signal: input.signal,
+            headers: {
+                ...init.headers,
+                accept: 'application/json',
+                authorization: `Bearer ${input.token}`,
+                'user-agent': `${cliName}/${readPackageVersion()}`,
+            },
+        });
+    }
+    catch (error) {
+        const reason = describeNetworkError(error);
+        throw new CapabilityProxyError(`Could not reach the Kody API at ${url.origin} (${reason}). Check --api-url / KODY_API_URL and your network.`);
+    }
+}
+async function readJson(response) {
+    const text = await response.text();
+    if (!text)
+        return null;
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return text;
+    }
+}
+function readErrorBody(body) {
+    if (!isRecord(body) || body.error == null)
+        return null;
+    const { error } = body;
+    if (typeof error === 'string')
+        return { code: null, message: error };
+    if (isRecord(error)) {
+        const code = typeof error.code === 'string' ? error.code : null;
+        const message = typeof error.message === 'string' ? error.message : code ?? JSON.stringify(error);
+        return { code, message };
+    }
+    return { code: null, message: String(error) };
+}
+function describeFailure(status, body, url, stage) {
+    const failure = readErrorBody(body);
+    const code = failure?.code ?? null;
+    const detail = failure?.message ? ` Server said: ${failure.message}` : '';
+    if (status === 401) {
+        return new CapabilityProxyError(`Kody rejected the API token (expired, revoked, or malformed). Mint a fresh scoped token and pass it with --token or ${apiTokenEnvVar}.${detail}`, { status, code });
+    }
+    if (code === 'feature_disabled') {
+        return new CapabilityProxyError('Local execute is not enabled for this Kody account (feature flag `local-execute`). Run execute without --local, or ask the Kody team for access.', { status, code });
+    }
+    if (status === 403 && stage === 'session') {
+        return new CapabilityProxyError(`The API token is not allowed to use local execute${code ? ` (${code})` : ''}. Mint a token with the local execute scope.${detail}`, { status, code });
+    }
+    if (status === 404 && stage === 'session') {
+        return new CapabilityProxyError(`CapabilityProxy was not found at ${url.href}. Local execute may not be deployed on this Kody API yet; check --api-url / KODY_API_URL.`, { status, code });
+    }
+    return new CapabilityProxyError(failure?.message ?? `Kody API request failed with HTTP ${status} (${url.pathname}).`, { status, code });
+}
+function isRecord(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+//# sourceMappingURL=capability-proxy.js.map

package/dist/capability-proxy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"capability-proxy.js","sourceRoot":"","sources":["../src/capability-proxy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAA;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AAEtD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,6BAA6B,CAAA;AACvE,MAAM,CAAC,MAAM,uBAAuB,GAAG,0BAA0B,CAAA;AAoBjE,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IACrC,MAAM,CAAe;IACrB,IAAI,CAAe;IAE5B,YACC,OAAe,EACf,UAA4D,EAAE;QAE9D,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAA;QAClC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,IAAI,CAAA;QACpC,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,IAAI,CAAA;IACjC,CAAC;CACD;AAED,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAA;AAElE,gEAAgE;AAChE,MAAM,UAAU,qBAAqB,CAAC,MAAc;IACnD,IAAI,GAAQ,CAAA;IACZ,IAAI,CAAC;QACJ,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAA;IACtB,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,KAAK,CAAC,yBAAyB,MAAM,EAAE,CAAC,CAAA;IACnD,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAM;IACrC,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAM;IACvE,MAAM,IAAI,KAAK,CACd,qCAAqC,GAAG,CAAC,MAAM,yDAAyD,CACxG,CAAA;AACF,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,MAAc,EAAE,IAAY;IAC9D,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,GAAG,CAAA;IACzD,OAAO,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;AAC3B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC/C,KAAiC;IAEjC,MAAM,GAAG,GAAG,kBAAkB,CAAC,KAAK,CAAC,MAAM,EAAE,0BAA0B,CAAC,CAAA;IACxE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAA;IAC1D,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAA;IACrC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QAClB,MAAM,eAAe,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,SAAS,CAAC,CAAA;IAC7D,CAAC;IACD,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAA;IACzC,OAAO;QACN,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;YACnC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;YAC7E,CAAC,CAAC,EAAE;QACL,SAAS,EAAE,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;KACzE,CAAA;AACF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACxC,KAAuD;IAEvD,MAAM,GAAG,GAAG,kBAAkB,CAAC,KAAK,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAA;IACrE,MAAM,OAAO,GAAwB,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAA;IAC3E,IAAI,KAAK,CAAC,cAAc,KAAK,SAAS;QAAE,OAAO,CAAC,cAAc,GAAG,KAAK,CAAC,cAAc,CAAA;IACrF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE;QACvC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;KAC7B,CAAC,CAAA;IACF,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAA;IACrC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QAClB,MAAM,eAAe,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,CAAA;IAC1D,CAAC;IACD,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,CAAA;IACnC,IAAI,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,oBAAoB,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAA;IACjG,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAA;AAChD,CAAC;AAED,KAAK,UAAU,IAAI,CAClB,KAAiC,EACjC,GAAQ,EACR,IAAiB;IAEjB,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,KAAK,CAAA;IACtC,IAAI,CAAC;QACJ,OAAO,MAAM,OAAO,CAAC,GAAG,EAAE;YACzB,GAAG,IAAI;YACP,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,OAAO,EAAE;gBACR,GAAI,IAAI,CAAC,OAA8C;gBACvD,MAAM,EAAE,kBAAkB;gBAC1B,aAAa,EAAE,UAAU,KAAK,CAAC,KAAK,EAAE;gBACtC,YAAY,EAAE,GAAG,OAAO,IAAI,kBAAkB,EAAE,EAAE;aAClD;SACD,CAAC,CAAA;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAA;QAC1C,MAAM,IAAI,oBAAoB,CAC7B,mCAAmC,GAAG,CAAC,MAAM,KAAK,MAAM,qDAAqD,CAC7G,CAAA;IACF,CAAC;AACF,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,QAAkB;IACzC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;IAClC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAA;IACtB,IAAI,CAAC;QACJ,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACxB,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA;IACZ,CAAC;AACF,CAAC;AAED,SAAS,aAAa,CAAC,IAAa;IACnC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI;QAAE,OAAO,IAAI,CAAA;IACtD,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAA;IACtB,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAA;IACpE,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,GAAG,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAA;QAC/D,MAAM,OAAO,GACZ,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;QAClF,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;IACzB,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAA;AAC9C,CAAC;AAED,SAAS,eAAe,CACvB,MAAc,EACd,IAAa,EACb,GAAQ,EACR,KAAyB;IAEzB,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,CAAA;IACnC,MAAM,IAAI,GAAG,OAAO,EAAE,IAAI,IAAI,IAAI,CAAA;IAClC,MAAM,MAAM,GAAG,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,iBAAiB,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IACzE,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACpB,OAAO,IAAI,oBAAoB,CAC9B,uHAAuH,cAAc,IAAI,MAAM,EAAE,EACjJ,EAAE,MAAM,EAAE,IAAI,EAAE,CAChB,CAAA;IACF,CAAC;IACD,IAAI,IAAI,KAAK,kBAAkB,EAAE,CAAC;QACjC,OAAO,IAAI,oBAAoB,CAC9B,kJAAkJ,EAClJ,EAAE,MAAM,EAAE,IAAI,EAAE,CAChB,CAAA;IACF,CAAC;IACD,IAAI,MAAM,KAAK,GAAG,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QAC3C,OAAO,IAAI,oBAAoB,CAC9B,oDAAoD,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,+CAA+C,MAAM,EAAE,EACnI,EAAE,MAAM,EAAE,IAAI,EAAE,CAChB,CAAA;IACF,CAAC;IACD,IAAI,MAAM,KAAK,GAAG,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QAC3C,OAAO,IAAI,oBAAoB,CAC9B,oCAAoC,GAAG,CAAC,IAAI,2FAA2F,EACvI,EAAE,MAAM,EAAE,IAAI,EAAE,CAChB,CAAA;IACF,CAAC;IACD,OAAO,IAAI,oBAAoB,CAC9B,OAAO,EAAE,OAAO,IAAI,qCAAqC,MAAM,KAAK,GAAG,CAAC,QAAQ,IAAI,EACpF,EAAE,MAAM,EAAE,IAAI,EAAE,CAChB,CAAA;AACF,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;AAC5E,CAAC"}

package/dist/cli.d.ts

@@ -1,4 +1,11 @@
 export type CommandName = 'login' | 'logout' | 'status' | 'whoami' | 'search' | 'execute' | 'install' | 'skill' | 'help' | 'version';
+export declare function apiUrlFrom(values: {
+    apiUrl?: string;
+}, env?: NodeJS.ProcessEnv): string;
+/** `execute --local` authenticates only with a scoped API token, never stored CLI OAuth. */
+export declare function resolveApiToken(values: {
+    token?: string;
+}, env?: NodeJS.ProcessEnv): string;
 declare function parseKnown(args: Array<string>): {
     values: {
         [longOption: string]: string | boolean | undefined;
@@ -15,6 +22,9 @@ declare function parseKnown(args: Array<string>): {
         invoke?: string | boolean | undefined;
         params?: string | boolean | undefined;
         'conversation-id'?: string | boolean | undefined;
+        local?: string | boolean | undefined;
+        token?: string | boolean | undefined;
+        'api-url'?: string | boolean | undefined;
         project?: string | boolean | undefined;
         'no-browser'?: string | boolean | undefined;
         clients?: string | boolean | undefined;

package/dist/cli.js

@@ -1,17 +1,29 @@
 import { parseArgs } from 'node:util';
 import { readFile } from 'node:fs/promises';
-import { defaultMcpUrl, modernMcpProtocolVersion } from './defaults.js';
+import { apiTokenEnvVar, defaultApiUrl, defaultMcpUrl, modernMcpProtocolVersion, } from './defaults.js';
 import { usage } from './help.js';
 import { ensureFreshCredentials, login } from './auth.js';
 import { deleteCredentials, loadCredentials } from './store.js';
 import { callKodyTool, formatToolResult, listKodyTools } from './mcp.js';
 import { runInstall } from './install.js';
+import { runLocalExecute } from './local-execute.js';
 import { installSkill } from './skill.js';
 import { readPackageVersion } from './package-info.js';
 import { redactError } from './redact.js';
 function mcpUrlFrom(values) {
     return values.mcpUrl || process.env.KODY_MCP_URL || defaultMcpUrl;
 }
+export function apiUrlFrom(values, env = process.env) {
+    return values.apiUrl || env.KODY_API_URL || defaultApiUrl;
+}
+/** `execute --local` authenticates only with a scoped API token, never stored CLI OAuth. */
+export function resolveApiToken(values, env = process.env) {
+    const token = (values.token ?? env[apiTokenEnvVar] ?? '').trim();
+    if (!token) {
+        throw new Error(`execute --local needs a scoped Kody API token: pass --token or set ${apiTokenEnvVar}. Mint one with the Kody \`api\` tool (tokens) or the Kody API.`);
+    }
+    return token;
+}
 function parseKnown(args) {
     return parseArgs({
         args,
@@ -30,6 +42,9 @@ function parseKnown(args) {
             invoke: { type: 'string' },
             params: { type: 'string' },
             'conversation-id': { type: 'string' },
+            local: { type: 'boolean' },
+            token: { type: 'string' },
+            'api-url': { type: 'string' },
             project: { type: 'boolean' },
             'no-browser': { type: 'boolean' },
             clients: { type: 'string' },
@@ -73,14 +88,14 @@ export async function runCli(argv = process.argv.slice(2), io = {}) {
             write(usage);
             return 0;
         }
-        return await dispatch(parsed, write);
+        return await dispatch(parsed, write, writeErr);
     }
     catch (error) {
         writeErr(`${redactError(error).message}\n`);
         return 1;
     }
 }
-async function dispatch(parsed, write) {
+async function dispatch(parsed, write, writeErr) {
     const mcpUrl = mcpUrlFrom({
         mcpUrl: typeof parsed.values['mcp-url'] === 'string' ? parsed.values['mcp-url'] : undefined,
     });
@@ -169,6 +184,13 @@ async function dispatch(parsed, write) {
             const hasCodeFlag = typeof parsed.values.code === 'string';
             const hasFileFlag = typeof parsed.values.file === 'string';
             const positionalModule = parsed.positionals.join('\n').trim();
+            const local = parsed.values.local === true;
+            if (!local && typeof parsed.values.token === 'string') {
+                throw new Error('--token is only used with execute --local; cloud execute uses `kody login`.');
+            }
+            if (local && invoke !== undefined) {
+                throw new Error('--invoke runs a saved package export in Kody; --local runs a module you provide (--code, --file, or a module string).');
+            }
             if (executeSourcesConflict({ invoke, hasCodeFlag, hasFileFlag, positionalModule })) {
                 throw new Error('--invoke cannot be combined with --code, --file, or a module string.');
             }
@@ -189,7 +211,22 @@ async function dispatch(parsed, write) {
                     ? parsed.values['conversation-id']
                     : undefined,
             });
-            const result = await callKodyTool({ name: 'execute', args, mcpUrl });
+            const result = local
+                ? await runLocalExecute({
+                    code: args.code,
+                    params: args.params,
+                    conversationId: args.conversationId,
+                    token: resolveApiToken({
+                        token: typeof parsed.values.token === 'string' ? parsed.values.token : undefined,
+                    }),
+                    apiUrl: apiUrlFrom({
+                        apiUrl: typeof parsed.values['api-url'] === 'string'
+                            ? parsed.values['api-url']
+                            : undefined,
+                    }),
+                    onStatus: (message) => writeErr(`${message}\n`),
+                })
+                : await callKodyTool({ name: 'execute', args, mcpUrl });
             write(formatToolResult(result, json));
             return result.isError ? 1 : 0;
         }

package/dist/cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AACrC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAC3C,OAAO,EAAE,aAAa,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAA;AACvE,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAA;AACjC,OAAO,EAAE,sBAAsB,EAAE,KAAK,EAAE,MAAM,WAAW,CAAA;AACzD,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAC/D,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AACxE,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAA;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AACzC,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAczC,SAAS,UAAU,CAAC,MAA2B;IAC9C,OAAO,MAAM,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,aAAa,CAAA;AAClE,CAAC;AAED,SAAS,UAAU,CAAC,IAAmB;IACtC,OAAO,SAAS,CAAC;QAChB,IAAI;QACJ,gBAAgB,EAAE,IAAI;QACtB,MAAM,EAAE,KAAK;QACb,OAAO,EAAE;YACR,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE;YACrC,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE;YACxC,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;YACzB,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC7B,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC1B,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC1B,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACzB,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACxB,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACxB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC1B,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC1B,iBAAiB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACrC,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;YAC5B,YAAY,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;YACjC,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC3B,GAAG,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE;SACpC;KACD,CAAC,CAAA;AACH,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAmB;IAKjD,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC,IAAI,CAAC,CAAA;IAChD,IAAI,MAAM,CAAC,IAAI,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7C,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,CAAA;IAChD,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,CAAA;IACnD,CAAC;IACD,MAAM,GAAG,GAAG,WAAW,CAAC,CAAC,CAAC,CAAA;IAC1B,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,CAAA;IACzD,QAAQ,GAAG,EAAE,CAAC;QACb,KAAK,OAAO,CAAC;QACb,KAAK,QAAQ,CAAC;QACd,KAAK,QAAQ,CAAC;QACd,KAAK,QAAQ,CAAC;QACd,KAAK,QAAQ,CAAC;QACd,KAAK,SAAS,CAAC;QACf,KAAK,SAAS,CAAC;QACf,KAAK,OAAO,CAAC;QACb,KAAK,MAAM,CAAC;QACZ,KAAK,SAAS;YACb,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,WAAW,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAA;QACnE;YACC,MAAM,IAAI,KAAK,CAAC,oBAAoB,GAAG,SAAS,KAAK,EAAE,CAAC,CAAA;IAC1D,CAAC;AACF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,MAAM,CAC3B,OAAsB,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAC3C,KAA2E,EAAE;IAE7E,MAAM,KAAK,GAAG,EAAE,CAAC,MAAM,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAA;IACzE,MAAM,QAAQ,GAAG,EAAE,CAAC,MAAM,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAA;IAC5E,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,CAAA;QACnC,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;YACrD,KAAK,CAAC,KAAK,CAAC,CAAA;YACZ,OAAO,CAAC,CAAA;QACT,CAAC;QACD,OAAO,MAAM,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;IACrC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,QAAQ,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,OAAO,IAAI,CAAC,CAAA;QAC3C,OAAO,CAAC,CAAA;IACT,CAAC;AACF,CAAC;AAED,KAAK,UAAU,QAAQ,CACtB,MAAyC,EACzC,KAA6B;IAE7B,MAAM,MAAM,GAAG,UAAU,CAAC;QACzB,MAAM,EAAE,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS;KAC3F,CAAC,CAAA;IACF,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,IAAI,CAAA;IAExC,QAAQ,MAAM,CAAC,OAAO,EAAE,CAAC;QACxB,KAAK,MAAM;YACV,KAAK,CAAC,KAAK,CAAC,CAAA;YACZ,OAAO,CAAC,CAAA;QACT,KAAK,SAAS;YACb,KAAK,CAAC,GAAG,kBAAkB,EAAE,IAAI,CAAC,CAAA;YAClC,OAAO,CAAC,CAAA;QACT,KAAK,OAAO,CAAC,CAAC,CAAC;YACd,KAAK,CAAC,gDAAgD,CAAC,CAAA;YACvD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC;gBAC1B,MAAM;gBACN,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,IAAI;gBACjD,kBAAkB,EAAE,CAAC,GAAG,EAAE,EAAE;oBAC3B,KAAK,CAAC,yCAAyC,GAAG,CAAC,IAAI,IAAI,CAAC,CAAA;gBAC7D,CAAC;aACD,CAAC,CAAA;YACF,KAAK,CAAC,gBAAgB,MAAM,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,CAAA;YACrD,IAAI,MAAM,CAAC,WAAW,KAAK,MAAM,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;gBACzD,KAAK,CACJ,qDAAqD,MAAM,CAAC,WAAW,iBAAiB,CACxF,CAAA;YACF,CAAC;iBAAM,CAAC;gBACP,KAAK,CAAC,0CAA0C,CAAC,CAAA;YAClD,CAAC;YACD,OAAO,CAAC,CAAA;QACT,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACf,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAA;YACxC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAA;YACpE,OAAO,CAAC,CAAA;QACT,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACf,MAAM,WAAW,GAAG,eAAe,CAAC,MAAM,CAAC,CAAA;YAC3C,IAAI,CAAC,WAAW,EAAE,CAAC;gBAClB,KAAK,CAAC,kBAAkB,CAAC,CAAA;gBACzB,OAAO,CAAC,CAAA;YACT,CAAC;YACD,MAAM,OAAO,GAAG,WAAW,CAAC,SAAS;gBACpC,CAAC,CAAC,IAAI,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;gBAC/C,CAAC,CAAC,SAAS,CAAA;YACZ,KAAK,CACJ;gBACC,QAAQ,WAAW,CAAC,MAAM,EAAE;gBAC5B,gBAAgB;gBAChB,yBAAyB,OAAO,EAAE;gBAClC,kBAAkB,WAAW,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE;gBAC3D,UAAU,WAAW,CAAC,KAAK,IAAI,SAAS,EAAE;gBAC1C,EAAE;aACF,CAAC,IAAI,CAAC,IAAI,CAAC,CACZ,CAAA;YACD,OAAO,CAAC,CAAA;QACT,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACf,MAAM,WAAW,GAAG,MAAM,sBAAsB,CAAC,EAAE,MAAM,EAAE,CAAC,CAAA;YAC5D,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC,CAAA;YAC7C,IAAI,IAAI,EAAE,CAAC;gBACV,KAAK,CACJ,GAAG,IAAI,CAAC,SAAS,CAChB;oBACC,MAAM,EAAE,WAAW,CAAC,MAAM;oBAC1B,QAAQ,EAAE,wBAAwB;oBAClC,KAAK,EAAE,WAAW,CAAC,KAAK,IAAI,IAAI;oBAChC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;iBACrC,EACD,IAAI,EACJ,CAAC,CACD,IAAI,CACL,CAAA;gBACD,OAAO,CAAC,CAAA;YACT,CAAC;YACD,KAAK,CACJ,gBAAgB,WAAW,CAAC,MAAM,KAAK,wBAAwB,aAAa,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,IAAI,CACrI,CAAA;YACD,OAAO,CAAC,CAAA;QACT,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACf,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAA;YACjD,MAAM,IAAI,GAA4B,EAAE,CAAA;YACxC,IAAI,KAAK;gBAAE,IAAI,CAAC,KAAK,GAAG,KAAK,CAAA;YAC7B,IAAI,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,QAAQ;gBAAE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAA;YAChF,IAAI,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,QAAQ;gBAAE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAA;YAChF,IAAI,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,KAAK,QAAQ;gBAAE,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;YACrF,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAA;YACnE,KAAK,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAA;YACrC,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QAC9B,CAAC;QACD,KAAK,SAAS,CAAC,CAAC,CAAC;YAChB,MAAM,MAAM,GACX,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAA;YAC5E,MAAM,WAAW,GAAG,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAA;YAC1D,MAAM,WAAW,GAAG,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAA;YAC1D,MAAM,gBAAgB,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAA;YAC7D,IAAI,sBAAsB,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,gBAAgB,EAAE,CAAC,EAAE,CAAC;gBACpF,MAAM,IAAI,KAAK,CACd,sEAAsE,CACtE,CAAA;YACF,CAAC;YACD,MAAM,IAAI,GACT,MAAM,KAAK,SAAS;gBACnB,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,WAAW;oBACZ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI;oBACpB,CAAC,CAAC,WAAW;wBACZ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,GAAG;4BAC3B,CAAC,CAAC,MAAM,SAAS,EAAE;4BACnB,CAAC,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAc,EAAE,MAAM,CAAC;wBACvD,CAAC,CAAC,gBAAgB,IAAI,SAAS,CAAA;YACnC,MAAM,IAAI,GAAG,oBAAoB,CAAC;gBACjC,MAAM;gBACN,IAAI,EAAE,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;gBACjD,UAAU,EACT,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;gBAC5E,cAAc,EACb,OAAO,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,KAAK,QAAQ;oBACnD,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC;oBAClC,CAAC,CAAC,SAAS;aACb,CAAC,CAAA;YACF,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAA;YACpE,KAAK,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAA;YACrC,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QAC9B,CAAC;QACD,KAAK,SAAS,CAAC,CAAC,CAAC;YAChB,MAAM,MAAM,GAAG,MAAM,UAAU,CAC9B;gBACC,MAAM;gBACN,OAAO,EACN,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;gBAC9E,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,KAAK,IAAI;gBAC/B,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,KAAK,IAAI;gBACvC,IAAI;aACJ,EACD,EAAE,MAAM,EAAE,KAAK,EAAE,CACjB,CAAA;YACD,OAAO,MAAM,CAAC,IAAI,CAAA;QACnB,CAAC;QACD,KAAK,OAAO,CAAC,CAAC,CAAC;YACd,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,SAAS,CAAA;YACjD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC1B,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAA;YACzD,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC,CAAA;YAC/E,KAAK,CACJ,iCAAiC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAC3G,CAAA;YACD,OAAO,CAAC,CAAA;QACT,CAAC;QACD,OAAO,CAAC,CAAC,CAAC;YACT,MAAM,UAAU,GAAU,MAAM,CAAC,OAAO,CAAA;YACxC,MAAM,IAAI,KAAK,CAAC,sBAAsB,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAA;QAC5D,CAAC;IACF,CAAC;AACF,CAAC;AAED,KAAK,UAAU,SAAS;IACvB,MAAM,MAAM,GAAkB,EAAE,CAAA;IAChC,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QACzC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;IACjE,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;AAC9C,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,sBAAsB,CAAC,KAKtC;IACA,OAAO,CACN,KAAK,CAAC,MAAM,KAAK,SAAS;QAC1B,CAAC,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,CAAC,CAC7E,CAAA;AACF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAKpC;IACA,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAA;IAC3B,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAA;IACvB,IAAI,MAAM,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAA;IACxF,CAAC;IACD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QAC1B,IAAI,CAAC,MAAM,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAA;QACvD,CAAC;QACD,OAAO,uBAAuB,CAAC,EAAE,MAAM,EAAE,EAAE,KAAK,CAAC,CAAA;IAClD,CAAC;IACD,IAAI,IAAI,EAAE,CAAC;QACV,OAAO,uBAAuB,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,CAAC,CAAA;IAChD,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAA;AACzE,CAAC;AAED,SAAS,uBAAuB,CAC/B,IAA6B,EAC7B,KAAuD;IAEvD,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACpC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;IAC3C,CAAC;IACD,IAAI,KAAK,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QACxC,IAAI,CAAC,cAAc,GAAG,KAAK,CAAC,cAAc,CAAA;IAC3C,CAAC;IACD,OAAO,IAAI,CAAA;AACZ,CAAC"}
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AACrC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAC3C,OAAO,EACN,cAAc,EACd,aAAa,EACb,aAAa,EACb,wBAAwB,GACxB,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAA;AACjC,OAAO,EAAE,sBAAsB,EAAE,KAAK,EAAE,MAAM,WAAW,CAAA;AACzD,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAC/D,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AACxE,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAA;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AACzC,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAczC,SAAS,UAAU,CAAC,MAA2B;IAC9C,OAAO,MAAM,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,aAAa,CAAA;AAClE,CAAC;AAED,MAAM,UAAU,UAAU,CACzB,MAA2B,EAC3B,MAAyB,OAAO,CAAC,GAAG;IAEpC,OAAO,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,YAAY,IAAI,aAAa,CAAA;AAC1D,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,eAAe,CAC9B,MAA0B,EAC1B,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;IAChE,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACd,sEAAsE,cAAc,iEAAiE,CACrJ,CAAA;IACF,CAAC;IACD,OAAO,KAAK,CAAA;AACb,CAAC;AAED,SAAS,UAAU,CAAC,IAAmB;IACtC,OAAO,SAAS,CAAC;QAChB,IAAI;QACJ,gBAAgB,EAAE,IAAI;QACtB,MAAM,EAAE,KAAK;QACb,OAAO,EAAE;YACR,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE;YACrC,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE;YACxC,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;YACzB,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC7B,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC1B,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC1B,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACzB,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACxB,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACxB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC1B,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC1B,iBAAiB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACrC,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;YAC1B,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACzB,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC7B,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;YAC5B,YAAY,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;YACjC,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC3B,GAAG,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE;SACpC;KACD,CAAC,CAAA;AACH,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAmB;IAKjD,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC,IAAI,CAAC,CAAA;IAChD,IAAI,MAAM,CAAC,IAAI,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7C,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,CAAA;IAChD,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,CAAA;IACnD,CAAC;IACD,MAAM,GAAG,GAAG,WAAW,CAAC,CAAC,CAAC,CAAA;IAC1B,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,CAAA;IACzD,QAAQ,GAAG,EAAE,CAAC;QACb,KAAK,OAAO,CAAC;QACb,KAAK,QAAQ,CAAC;QACd,KAAK,QAAQ,CAAC;QACd,KAAK,QAAQ,CAAC;QACd,KAAK,QAAQ,CAAC;QACd,KAAK,SAAS,CAAC;QACf,KAAK,SAAS,CAAC;QACf,KAAK,OAAO,CAAC;QACb,KAAK,MAAM,CAAC;QACZ,KAAK,SAAS;YACb,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,WAAW,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAA;QACnE;YACC,MAAM,IAAI,KAAK,CAAC,oBAAoB,GAAG,SAAS,KAAK,EAAE,CAAC,CAAA;IAC1D,CAAC;AACF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,MAAM,CAC3B,OAAsB,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAC3C,KAA2E,EAAE;IAE7E,MAAM,KAAK,GAAG,EAAE,CAAC,MAAM,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAA;IACzE,MAAM,QAAQ,GAAG,EAAE,CAAC,MAAM,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAA;IAC5E,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,CAAA;QACnC,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;YACrD,KAAK,CAAC,KAAK,CAAC,CAAA;YACZ,OAAO,CAAC,CAAA;QACT,CAAC;QACD,OAAO,MAAM,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAA;IAC/C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,QAAQ,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,OAAO,IAAI,CAAC,CAAA;QAC3C,OAAO,CAAC,CAAA;IACT,CAAC;AACF,CAAC;AAED,KAAK,UAAU,QAAQ,CACtB,MAAyC,EACzC,KAA6B,EAC7B,QAAgC;IAEhC,MAAM,MAAM,GAAG,UAAU,CAAC;QACzB,MAAM,EAAE,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS;KAC3F,CAAC,CAAA;IACF,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,IAAI,CAAA;IAExC,QAAQ,MAAM,CAAC,OAAO,EAAE,CAAC;QACxB,KAAK,MAAM;YACV,KAAK,CAAC,KAAK,CAAC,CAAA;YACZ,OAAO,CAAC,CAAA;QACT,KAAK,SAAS;YACb,KAAK,CAAC,GAAG,kBAAkB,EAAE,IAAI,CAAC,CAAA;YAClC,OAAO,CAAC,CAAA;QACT,KAAK,OAAO,CAAC,CAAC,CAAC;YACd,KAAK,CAAC,gDAAgD,CAAC,CAAA;YACvD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC;gBAC1B,MAAM;gBACN,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,IAAI;gBACjD,kBAAkB,EAAE,CAAC,GAAG,EAAE,EAAE;oBAC3B,KAAK,CAAC,yCAAyC,GAAG,CAAC,IAAI,IAAI,CAAC,CAAA;gBAC7D,CAAC;aACD,CAAC,CAAA;YACF,KAAK,CAAC,gBAAgB,MAAM,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,CAAA;YACrD,IAAI,MAAM,CAAC,WAAW,KAAK,MAAM,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;gBACzD,KAAK,CACJ,qDAAqD,MAAM,CAAC,WAAW,iBAAiB,CACxF,CAAA;YACF,CAAC;iBAAM,CAAC;gBACP,KAAK,CAAC,0CAA0C,CAAC,CAAA;YAClD,CAAC;YACD,OAAO,CAAC,CAAA;QACT,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACf,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAA;YACxC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAA;YACpE,OAAO,CAAC,CAAA;QACT,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACf,MAAM,WAAW,GAAG,eAAe,CAAC,MAAM,CAAC,CAAA;YAC3C,IAAI,CAAC,WAAW,EAAE,CAAC;gBAClB,KAAK,CAAC,kBAAkB,CAAC,CAAA;gBACzB,OAAO,CAAC,CAAA;YACT,CAAC;YACD,MAAM,OAAO,GAAG,WAAW,CAAC,SAAS;gBACpC,CAAC,CAAC,IAAI,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;gBAC/C,CAAC,CAAC,SAAS,CAAA;YACZ,KAAK,CACJ;gBACC,QAAQ,WAAW,CAAC,MAAM,EAAE;gBAC5B,gBAAgB;gBAChB,yBAAyB,OAAO,EAAE;gBAClC,kBAAkB,WAAW,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE;gBAC3D,UAAU,WAAW,CAAC,KAAK,IAAI,SAAS,EAAE;gBAC1C,EAAE;aACF,CAAC,IAAI,CAAC,IAAI,CAAC,CACZ,CAAA;YACD,OAAO,CAAC,CAAA;QACT,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACf,MAAM,WAAW,GAAG,MAAM,sBAAsB,CAAC,EAAE,MAAM,EAAE,CAAC,CAAA;YAC5D,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC,CAAA;YAC7C,IAAI,IAAI,EAAE,CAAC;gBACV,KAAK,CACJ,GAAG,IAAI,CAAC,SAAS,CAChB;oBACC,MAAM,EAAE,WAAW,CAAC,MAAM;oBAC1B,QAAQ,EAAE,wBAAwB;oBAClC,KAAK,EAAE,WAAW,CAAC,KAAK,IAAI,IAAI;oBAChC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;iBACrC,EACD,IAAI,EACJ,CAAC,CACD,IAAI,CACL,CAAA;gBACD,OAAO,CAAC,CAAA;YACT,CAAC;YACD,KAAK,CACJ,gBAAgB,WAAW,CAAC,MAAM,KAAK,wBAAwB,aAAa,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,IAAI,CACrI,CAAA;YACD,OAAO,CAAC,CAAA;QACT,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACf,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAA;YACjD,MAAM,IAAI,GAA4B,EAAE,CAAA;YACxC,IAAI,KAAK;gBAAE,IAAI,CAAC,KAAK,GAAG,KAAK,CAAA;YAC7B,IAAI,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,QAAQ;gBAAE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAA;YAChF,IAAI,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,QAAQ;gBAAE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAA;YAChF,IAAI,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,KAAK,QAAQ;gBAAE,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;YACrF,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAA;YACnE,KAAK,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAA;YACrC,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QAC9B,CAAC;QACD,KAAK,SAAS,CAAC,CAAC,CAAC;YAChB,MAAM,MAAM,GACX,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAA;YAC5E,MAAM,WAAW,GAAG,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAA;YAC1D,MAAM,WAAW,GAAG,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAA;YAC1D,MAAM,gBAAgB,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAA;YAC7D,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,KAAK,IAAI,CAAA;YAC1C,IAAI,CAAC,KAAK,IAAI,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;gBACvD,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC,CAAA;YAC/F,CAAC;YACD,IAAI,KAAK,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACnC,MAAM,IAAI,KAAK,CACd,uHAAuH,CACvH,CAAA;YACF,CAAC;YACD,IAAI,sBAAsB,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,gBAAgB,EAAE,CAAC,EAAE,CAAC;gBACpF,MAAM,IAAI,KAAK,CACd,sEAAsE,CACtE,CAAA;YACF,CAAC;YACD,MAAM,IAAI,GACT,MAAM,KAAK,SAAS;gBACnB,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,WAAW;oBACZ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI;oBACpB,CAAC,CAAC,WAAW;wBACZ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,GAAG;4BAC3B,CAAC,CAAC,MAAM,SAAS,EAAE;4BACnB,CAAC,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAc,EAAE,MAAM,CAAC;wBACvD,CAAC,CAAC,gBAAgB,IAAI,SAAS,CAAA;YACnC,MAAM,IAAI,GAAG,oBAAoB,CAAC;gBACjC,MAAM;gBACN,IAAI,EAAE,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;gBACjD,UAAU,EACT,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;gBAC5E,cAAc,EACb,OAAO,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,KAAK,QAAQ;oBACnD,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC;oBAClC,CAAC,CAAC,SAAS;aACb,CAAC,CAAA;YACF,MAAM,MAAM,GAAG,KAAK;gBACnB,CAAC,CAAC,MAAM,eAAe,CAAC;oBACtB,IAAI,EAAE,IAAI,CAAC,IAAc;oBACzB,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,cAAc,EAAE,IAAI,CAAC,cAAoC;oBACzD,KAAK,EAAE,eAAe,CAAC;wBACtB,KAAK,EAAE,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;qBAChF,CAAC;oBACF,MAAM,EAAE,UAAU,CAAC;wBAClB,MAAM,EACL,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,QAAQ;4BAC3C,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC;4BAC1B,CAAC,CAAC,SAAS;qBACb,CAAC;oBACF,QAAQ,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,OAAO,IAAI,CAAC;iBAC/C,CAAC;gBACH,CAAC,CAAC,MAAM,YAAY,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAA;YACxD,KAAK,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAA;YACrC,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QAC9B,CAAC;QACD,KAAK,SAAS,CAAC,CAAC,CAAC;YAChB,MAAM,MAAM,GAAG,MAAM,UAAU,CAC9B;gBACC,MAAM;gBACN,OAAO,EACN,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;gBAC9E,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,KAAK,IAAI;gBAC/B,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,KAAK,IAAI;gBACvC,IAAI;aACJ,EACD,EAAE,MAAM,EAAE,KAAK,EAAE,CACjB,CAAA;YACD,OAAO,MAAM,CAAC,IAAI,CAAA;QACnB,CAAC;QACD,KAAK,OAAO,CAAC,CAAC,CAAC;YACd,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,SAAS,CAAA;YACjD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC1B,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAA;YACzD,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC,CAAA;YAC/E,KAAK,CACJ,iCAAiC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAC3G,CAAA;YACD,OAAO,CAAC,CAAA;QACT,CAAC;QACD,OAAO,CAAC,CAAC,CAAC;YACT,MAAM,UAAU,GAAU,MAAM,CAAC,OAAO,CAAA;YACxC,MAAM,IAAI,KAAK,CAAC,sBAAsB,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAA;QAC5D,CAAC;IACF,CAAC;AACF,CAAC;AAED,KAAK,UAAU,SAAS;IACvB,MAAM,MAAM,GAAkB,EAAE,CAAA;IAChC,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QACzC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;IACjE,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;AAC9C,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,sBAAsB,CAAC,KAKtC;IACA,OAAO,CACN,KAAK,CAAC,MAAM,KAAK,SAAS;QAC1B,CAAC,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,CAAC,CAC7E,CAAA;AACF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAKpC;IACA,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAA;IAC3B,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAA;IACvB,IAAI,MAAM,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAA;IACxF,CAAC;IACD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QAC1B,IAAI,CAAC,MAAM,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAA;QACvD,CAAC;QACD,OAAO,uBAAuB,CAAC,EAAE,MAAM,EAAE,EAAE,KAAK,CAAC,CAAA;IAClD,CAAC;IACD,IAAI,IAAI,EAAE,CAAC;QACV,OAAO,uBAAuB,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,CAAC,CAAA;IAChD,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAA;AACzE,CAAC;AAED,SAAS,uBAAuB,CAC/B,IAA6B,EAC7B,KAAuD;IAEvD,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACpC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;IAC3C,CAAC;IACD,IAAI,KAAK,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QACxC,IAAI,CAAC,cAAc,GAAG,KAAK,CAAC,cAAc,CAAA;IAC3C,CAAC;IACD,OAAO,IAAI,CAAA;AACZ,CAAC"}

package/dist/defaults.d.ts

@@ -1,4 +1,7 @@
 export declare const defaultMcpUrl = "https://kody.codes/mcp";
+/** Kody Open API origin; hosts CapabilityProxy for `execute --local`. */
+export declare const defaultApiUrl = "https://api.kody.codes";
+export declare const apiTokenEnvVar = "KODY_API_TOKEN";
 /** Pin to Kody's stateless `/mcp` lane. */
 export declare const modernMcpProtocolVersion = "2026-07-28";
 export declare const defaultScopes: readonly ["profile", "email"];

package/dist/defaults.js

@@ -1,4 +1,7 @@
 export const defaultMcpUrl = 'https://kody.codes/mcp';
+/** Kody Open API origin; hosts CapabilityProxy for `execute --local`. */
+export const defaultApiUrl = 'https://api.kody.codes';
+export const apiTokenEnvVar = 'KODY_API_TOKEN';
 /** Pin to Kody's stateless `/mcp` lane. */
 export const modernMcpProtocolVersion = '2026-07-28';
 export const defaultScopes = ['profile', 'email'];

package/dist/defaults.js.map

@@ -1 +1 @@
-{"version":3,"file":"defaults.js","sourceRoot":"","sources":["../src/defaults.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,aAAa,GAAG,wBAAwB,CAAA;AACrD,2CAA2C;AAC3C,MAAM,CAAC,MAAM,wBAAwB,GAAG,YAAY,CAAA;AACpD,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,SAAS,EAAE,OAAO,CAAU,CAAA;AAC1D,MAAM,CAAC,MAAM,cAAc,GAAG,YAAY,CAAA;AAC1C,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAA;AAC3C,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAA;AACvC,MAAM,CAAC,MAAM,OAAO,GAAG,gBAAgB,CAAA;AACvC,MAAM,CAAC,MAAM,YAAY,GAAG,iCAAiC,CAAA;AAC7D,kEAAkE;AAClE,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,CAAA;AACtC,MAAM,CAAC,MAAM,uBAAuB,GAAG,iCAAiC,CAAA;AAExE,MAAM,UAAU,oBAAoB,CAAC,MAAc;IAClD,OAAO,IAAI,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC,IAAI,CAAA;AACrD,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,OAAe,iBAAiB;IAC9D,OAAO,IAAI,GAAG,CAAC,oBAAoB,IAAI,WAAW,CAAC,CAAA;AACpD,CAAC;AAED,MAAM,CAAC,MAAM,cAAc,GAAG,aAAa,CAAA;AAE3C,MAAM,UAAU,aAAa,CAAC,MAAc;IAC3C,OAAO,IAAI,GAAG,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,IAAI,CAAA;AAC5C,CAAC"}
+{"version":3,"file":"defaults.js","sourceRoot":"","sources":["../src/defaults.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,aAAa,GAAG,wBAAwB,CAAA;AACrD,yEAAyE;AACzE,MAAM,CAAC,MAAM,aAAa,GAAG,wBAAwB,CAAA;AACrD,MAAM,CAAC,MAAM,cAAc,GAAG,gBAAgB,CAAA;AAC9C,2CAA2C;AAC3C,MAAM,CAAC,MAAM,wBAAwB,GAAG,YAAY,CAAA;AACpD,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,SAAS,EAAE,OAAO,CAAU,CAAA;AAC1D,MAAM,CAAC,MAAM,cAAc,GAAG,YAAY,CAAA;AAC1C,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAA;AAC3C,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAA;AACvC,MAAM,CAAC,MAAM,OAAO,GAAG,gBAAgB,CAAA;AACvC,MAAM,CAAC,MAAM,YAAY,GAAG,iCAAiC,CAAA;AAC7D,kEAAkE;AAClE,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,CAAA;AACtC,MAAM,CAAC,MAAM,uBAAuB,GAAG,iCAAiC,CAAA;AAExE,MAAM,UAAU,oBAAoB,CAAC,MAAc;IAClD,OAAO,IAAI,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC,IAAI,CAAA;AACrD,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,OAAe,iBAAiB;IAC9D,OAAO,IAAI,GAAG,CAAC,oBAAoB,IAAI,WAAW,CAAC,CAAA;AACpD,CAAC;AAED,MAAM,CAAC,MAAM,cAAc,GAAG,aAAa,CAAA;AAE3C,MAAM,UAAU,aAAa,CAAC,MAAc;IAC3C,OAAO,IAAI,GAAG,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,IAAI,CAAA;AAC5C,CAAC"}

package/dist/help.js

@@ -1,4 +1,4 @@
-import { defaultMcpUrl, onboardingUrl } from './defaults.js';
+import { apiTokenEnvVar, defaultApiUrl, defaultMcpUrl, onboardingUrl } from './defaults.js';
 import { hostIds } from './host-catalog.js';
 import { readPackageVersion } from './package-info.js';
 export const usage = `Kody CLI ${readPackageVersion()}
@@ -12,6 +12,7 @@ Usage:
   kody whoami [--mcp-url <url>] [--json]
   kody search [query] [--entity <ref>] [--domain <id>] [--limit <n>] [--json]
   kody execute [--invoke <ref> | --code <esm> | --file <path>] [--params <json>] [--conversation-id <id>] [--json]
+               [--local [--token <token>] [--api-url <url>]]
   kody install [--mcp-url <url>] [--clients <ids>] [--yes] [--project] [--json]
   kody skill install [--project]
 
@@ -21,7 +22,15 @@ Usage:
 
   --clients  Comma-separated ids: ${hostIds.join(', ')}
 
+  --local    Run the execute module on this machine (workerd, Linux/macOS).
+             kody:runtime calls go to Kody with a scoped API token from
+             ${apiTokenEnvVar} (preferred) or --token; no kody login needed.
+
 Environment:
-  KODY_MCP_URL   Override the default MCP URL (${defaultMcpUrl})
+  KODY_MCP_URL        Override the default MCP URL (${defaultMcpUrl})
+  ${apiTokenEnvVar}      Scoped API token for execute --local
+  KODY_API_URL        Override the Kody API URL for execute --local (${defaultApiUrl})
+  KODY_CACHE_DIR      Where execute --local caches workerd (default: user cache dir)
+  KODY_WORKERD_PATH   Use this workerd binary instead of the pinned download
 `;
 //# sourceMappingURL=help.js.map

package/dist/help.js.map

@@ -1 +1 @@
-{"version":3,"file":"help.js","sourceRoot":"","sources":["../src/help.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAC5D,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAA;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AAEtD,MAAM,CAAC,MAAM,KAAK,GAAG,YAAY,kBAAkB,EAAE;;;;;;;;;;;;;;;;QAgB7C,aAAa,CAAC,aAAa,CAAC;;oCAEA,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;;;iDAGL,aAAa;CAC7D,CAAA"}
+{"version":3,"file":"help.js","sourceRoot":"","sources":["../src/help.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAC3F,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAA;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AAEtD,MAAM,CAAC,MAAM,KAAK,GAAG,YAAY,kBAAkB,EAAE;;;;;;;;;;;;;;;;;QAiB7C,aAAa,CAAC,aAAa,CAAC;;oCAEA,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;;;;eAIvC,cAAc;;;sDAGyB,aAAa;IAC/D,cAAc;uEACqD,aAAa;;;CAGnF,CAAA"}

package/dist/local-execute.d.ts

@@ -0,0 +1,28 @@
+import type { ToolCallResult } from './mcp.js';
+export type LocalExecuteInput = {
+    code: string;
+    params?: unknown;
+    conversationId?: string;
+    token: string;
+    apiUrl: string;
+    /** Used for CapabilityProxy requests (session + proxied calls). */
+    fetchFn?: typeof fetch;
+    /** Skip the pinned download and run this workerd binary. */
+    workerdPath?: string;
+    onStatus?: (message: string) => void;
+};
+type SandboxResponse = {
+    result?: unknown;
+    error?: string;
+    logs?: Array<string>;
+};
+export declare function assertNoStaticPackageImports(code: string): void;
+export declare function runLocalExecute(input: LocalExecuteInput): Promise<ToolCallResult>;
+/** Same envelope as cloud execute so `formatToolResult` and `--json` behave identically. */
+export declare function buildLocalExecuteResult(input: {
+    sandbox: SandboxResponse;
+    startedAt: Date;
+    endedAt: Date;
+    conversationId?: string;
+}): ToolCallResult;
+export {};

package/dist/local-execute.js

@@ -0,0 +1,286 @@
+import { spawn } from 'node:child_process';
+import { randomBytes } from 'node:crypto';
+import { rmSync } from 'node:fs';
+import { mkdtemp, rm, writeFile } from 'node:fs/promises';
+import { createServer, request as httpRequest, } from 'node:http';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { setTimeout as delay } from 'node:timers/promises';
+import { assertTokenSafeApiUrl, callCapabilityProxy, openCapabilityProxySession, } from './capability-proxy.js';
+import { apiTokenEnvVar } from './defaults.js';
+import { createLocalEntrySource, createLocalRuntimeModuleSource, createWorkerdConfig, runSecretEnvVar, runSecretHeader, } from './local-runtime-source.js';
+import { redact } from './redact.js';
+import { ensureWorkerdBinary } from './workerd-binary.js';
+const workerdStartTimeoutMs = 30_000;
+const workerdExitGraceMs = 1_000;
+export function assertNoStaticPackageImports(code) {
+    if (/(?:\bfrom\s*|\bimport\s*\(?\s*)["']kody:@/.test(code)) {
+        throw new Error('execute --local does not resolve saved-package imports (kody:@…) yet. Call the export with packages.invoke(specifier, options) from kody:runtime, or run execute without --local.');
+    }
+}
+export async function runLocalExecute(input) {
+    assertNoStaticPackageImports(input.code);
+    assertTokenSafeApiUrl(input.apiUrl);
+    const client = { apiUrl: input.apiUrl, token: input.token, fetchFn: input.fetchFn };
+    await openCapabilityProxySession(client);
+    const workerdPath = input.workerdPath ??
+        (await ensureWorkerdBinary({
+            onDownload: (url) => input.onStatus?.(`Downloading workerd for local execute from ${url}…`),
+        }));
+    const runSecret = randomBytes(32).toString('hex');
+    const workDir = await mkdtemp(join(tmpdir(), 'kody-local-'));
+    let child;
+    let bridge;
+    // SIGTERM makes workerd drain in-flight requests, which a hung module never finishes.
+    const stopWorkerd = () => child?.kill('SIGKILL');
+    const releaseSignals = cleanupOnSignal(() => {
+        stopWorkerd();
+        rmSync(workDir, { recursive: true, force: true });
+    });
+    const startedAt = new Date();
+    const finish = (sandbox) => buildLocalExecuteResult({
+        sandbox,
+        startedAt,
+        endedAt: new Date(),
+        conversationId: input.conversationId,
+    });
+    try {
+        bridge = await startBridge({
+            runSecret,
+            forward: (call, signal) => callCapabilityProxy({
+                ...client,
+                ...call,
+                conversationId: input.conversationId,
+                signal,
+            }),
+        });
+        const files = { entry: 'entry.js', user: 'main.js', runtime: 'runtime.js' };
+        await writeFile(join(workDir, files.entry), createLocalEntrySource());
+        await writeFile(join(workDir, files.user), input.code);
+        await writeFile(join(workDir, files.runtime), createLocalRuntimeModuleSource());
+        const configPath = join(workDir, 'config.capnp');
+        await writeFile(configPath, createWorkerdConfig({ bridgePort: bridge.port, files }));
+        const env = { ...process.env, [runSecretEnvVar]: runSecret };
+        delete env[apiTokenEnvVar];
+        child = spawn(workerdPath, ['serve', configPath, '--control-fd=3'], {
+            cwd: workDir,
+            env,
+            stdio: ['ignore', 'pipe', 'pipe', 'pipe'],
+        });
+        const workerd = watchWorkerd(child);
+        const started = await workerd.listening;
+        if ('exitDetail' in started) {
+            return finish({ error: `Local execute could not load the module${started.exitDetail}` });
+        }
+        let response;
+        try {
+            response = await postToWorkerd({
+                port: started.port,
+                runSecret,
+                body: JSON.stringify({ params: input.params ?? {} }),
+            });
+        }
+        catch (error) {
+            const exitDetail = await Promise.race([workerd.exited, delay(workerdExitGraceMs, null)]);
+            if (exitDetail !== null)
+                throw new Error(`workerd exited during the run${exitDetail}`);
+            const reason = error instanceof Error ? error.message : String(error);
+            throw new Error(`Local execute run failed (${reason}).${workerd.stderr()}`);
+        }
+        if (response.status !== 200) {
+            throw new Error(`Local execute runtime returned HTTP ${response.status}.${workerd.stderr()}`);
+        }
+        return finish(JSON.parse(response.body));
+    }
+    finally {
+        releaseSignals();
+        stopWorkerd();
+        await bridge?.close();
+        await rm(workDir, { recursive: true, force: true });
+    }
+}
+/** Same envelope as cloud execute so `formatToolResult` and `--json` behave identically. */
+export function buildLocalExecuteResult(input) {
+    const { sandbox } = input;
+    const logs = sandbox.logs ?? [];
+    const base = {
+        ...(input.conversationId !== undefined ? { conversationId: input.conversationId } : {}),
+        timing: {
+            startedAt: input.startedAt.toISOString(),
+            endedAt: input.endedAt.toISOString(),
+            durationMs: input.endedAt.getTime() - input.startedAt.getTime(),
+        },
+    };
+    if (typeof sandbox.error === 'string') {
+        return {
+            content: [{ type: 'text', text: `Error: ${sandbox.error}` }],
+            structuredContent: { ...base, returnedBytes: 0, error: sandbox.error, logs },
+            isError: true,
+        };
+    }
+    const text = typeof sandbox.result === 'string'
+        ? sandbox.result
+        : (JSON.stringify(sandbox.result, null, 2) ?? 'undefined');
+    const serialized = typeof sandbox.result === 'string'
+        ? sandbox.result
+        : (JSON.stringify(sandbox.result) ?? 'undefined');
+    return {
+        content: [{ type: 'text', text }],
+        structuredContent: {
+            ...base,
+            returnedBytes: Buffer.byteLength(serialized),
+            result: sandbox.result,
+            logs,
+        },
+        isError: false,
+    };
+}
+/**
+ * `finally` does not run when the CLI is killed by a signal; without this,
+ * workerd is orphaned and the user's module stays in the temp dir.
+ */
+function cleanupOnSignal(cleanup) {
+    const signals = ['SIGINT', 'SIGTERM', 'SIGHUP'];
+    const release = () => {
+        for (const signal of signals)
+            process.off(signal, handler);
+    };
+    const handler = (signal) => {
+        release();
+        cleanup();
+        process.kill(process.pid, signal);
+    };
+    for (const signal of signals)
+        process.once(signal, handler);
+    return release;
+}
+function watchWorkerd(child) {
+    let stderrText = '';
+    child.stderr?.on('data', (chunk) => {
+        stderrText += chunk.toString('utf8');
+    });
+    child.stdout?.resume();
+    const stderr = () => {
+        const trimmed = redact(stderrText.trim());
+        return trimmed ? `\n${trimmed}` : '';
+    };
+    const exited = new Promise((resolve) => {
+        child.once('exit', (code, signal) => {
+            resolve(` (workerd exit ${signal ?? code})${stderr()}`);
+        });
+    });
+    const listening = new Promise((resolve, reject) => {
+        const control = child.stdio[3];
+        let buffered = '';
+        const timer = setTimeout(() => {
+            reject(new Error(`workerd did not start within ${workerdStartTimeoutMs / 1000}s.${stderr()}`));
+        }, workerdStartTimeoutMs);
+        control?.on('data', (chunk) => {
+            buffered += chunk.toString('utf8');
+            for (const line of buffered.split('\n')) {
+                const port = parseListenPort(line);
+                if (port !== null) {
+                    clearTimeout(timer);
+                    resolve({ port });
+                }
+            }
+        });
+        child.once('error', (error) => {
+            clearTimeout(timer);
+            reject(new Error(`Could not start workerd: ${error.message}`));
+        });
+        void exited.then((exitDetail) => {
+            clearTimeout(timer);
+            resolve({ exitDetail });
+        });
+    });
+    return { listening, exited, stderr };
+}
+function parseListenPort(line) {
+    if (!line.trim())
+        return null;
+    try {
+        const event = JSON.parse(line);
+        return event.event === 'listen' && event.socket === 'http' && typeof event.port === 'number'
+            ? event.port
+            : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** node:http rather than fetch: local runs have no time limit, and fetch gives up after 300s. */
+function postToWorkerd(input) {
+    return new Promise((resolve, reject) => {
+        const request = httpRequest({
+            host: '127.0.0.1',
+            port: input.port,
+            method: 'POST',
+            path: '/',
+            headers: {
+                'content-type': 'application/json',
+                'content-length': Buffer.byteLength(input.body),
+                [runSecretHeader]: input.runSecret,
+            },
+        }, (response) => {
+            readBody(response).then((body) => resolve({ status: response.statusCode ?? 0, body }), reject);
+        });
+        request.on('error', reject);
+        request.end(input.body);
+    });
+}
+async function startBridge(input) {
+    const inFlight = new AbortController();
+    const server = createServer(async (request, response) => {
+        const reply = (status, body) => {
+            response.writeHead(status, { 'content-type': 'application/json' });
+            response.end(JSON.stringify(body));
+        };
+        if (request.method !== 'POST' ||
+            request.url !== '/call' ||
+            request.headers[runSecretHeader] !== input.runSecret) {
+            reply(403, { error: 'Forbidden' });
+            return;
+        }
+        try {
+            const call = parseBridgeCall(await readBody(request));
+            const result = await input.forward(call, inFlight.signal);
+            reply(200, { result });
+        }
+        catch (error) {
+            reply(200, { error: redact(error instanceof Error ? error.message : String(error)) });
+        }
+    });
+    await new Promise((resolve, reject) => {
+        server.once('error', reject);
+        server.listen(0, '127.0.0.1', () => resolve());
+    });
+    return {
+        port: server.address().port,
+        close: () => new Promise((resolve) => {
+            inFlight.abort();
+            server.closeAllConnections();
+            server.close(() => resolve());
+        }),
+    };
+}
+function parseBridgeCall(body) {
+    const parsed = JSON.parse(body);
+    if (!Array.isArray(parsed.path) ||
+        parsed.path.length === 0 ||
+        !parsed.path.every((segment) => typeof segment === 'string')) {
+        throw new Error('Invalid kody:runtime call path.');
+    }
+    return {
+        path: parsed.path,
+        args: Array.isArray(parsed.args) ? parsed.args : [],
+    };
+}
+async function readBody(stream) {
+    const chunks = [];
+    for await (const chunk of stream) {
+        chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+    }
+    return Buffer.concat(chunks).toString('utf8');
+}
+//# sourceMappingURL=local-execute.js.map

package/dist/local-execute.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-execute.js","sourceRoot":"","sources":["../src/local-execute.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAqB,MAAM,oBAAoB,CAAA;AAC7D,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACzD,OAAO,EACN,YAAY,EACZ,OAAO,IAAI,WAAW,GAGtB,MAAM,WAAW,CAAA;AAElB,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAEhC,OAAO,EAAE,UAAU,IAAI,KAAK,EAAE,MAAM,sBAAsB,CAAA;AAC1D,OAAO,EACN,qBAAqB,EACrB,mBAAmB,EACnB,0BAA0B,GAC1B,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAC9C,OAAO,EACN,sBAAsB,EACtB,8BAA8B,EAC9B,mBAAmB,EACnB,eAAe,EACf,eAAe,GACf,MAAM,2BAA2B,CAAA;AAElC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AAmBzD,MAAM,qBAAqB,GAAG,MAAM,CAAA;AACpC,MAAM,kBAAkB,GAAG,KAAK,CAAA;AAEhC,MAAM,UAAU,4BAA4B,CAAC,IAAY;IACxD,IAAI,2CAA2C,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CACd,mLAAmL,CACnL,CAAA;IACF,CAAC;AACF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAAwB;IAC7D,4BAA4B,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACxC,qBAAqB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IACnC,MAAM,MAAM,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAA;IACnF,MAAM,0BAA0B,CAAC,MAAM,CAAC,CAAA;IACxC,MAAM,WAAW,GAChB,KAAK,CAAC,WAAW;QACjB,CAAC,MAAM,mBAAmB,CAAC;YAC1B,UAAU,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,8CAA8C,GAAG,GAAG,CAAC;SAC3F,CAAC,CAAC,CAAA;IAEJ,MAAM,SAAS,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IACjD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,aAAa,CAAC,CAAC,CAAA;IAC5D,IAAI,KAA+B,CAAA;IACnC,IAAI,MAA0B,CAAA;IAC9B,sFAAsF;IACtF,MAAM,WAAW,GAAG,GAAG,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;IAChD,MAAM,cAAc,GAAG,eAAe,CAAC,GAAG,EAAE;QAC3C,WAAW,EAAE,CAAA;QACb,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IAClD,CAAC,CAAC,CAAA;IACF,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAA;IAC5B,MAAM,MAAM,GAAG,CAAC,OAAwB,EAAE,EAAE,CAC3C,uBAAuB,CAAC;QACvB,OAAO;QACP,SAAS;QACT,OAAO,EAAE,IAAI,IAAI,EAAE;QACnB,cAAc,EAAE,KAAK,CAAC,cAAc;KACpC,CAAC,CAAA;IACH,IAAI,CAAC;QACJ,MAAM,GAAG,MAAM,WAAW,CAAC;YAC1B,SAAS;YACT,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CACzB,mBAAmB,CAAC;gBACnB,GAAG,MAAM;gBACT,GAAG,IAAI;gBACP,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,MAAM;aACN,CAAC;SACH,CAAC,CAAA;QACF,MAAM,KAAK,GAAG,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,CAAA;QAC3E,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,sBAAsB,EAAE,CAAC,CAAA;QACrE,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,CAAA;QACtD,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,8BAA8B,EAAE,CAAC,CAAA;QAC/E,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAA;QAChD,MAAM,SAAS,CAAC,UAAU,EAAE,mBAAmB,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAA;QAEpF,MAAM,GAAG,GAAsB,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,EAAE,SAAS,EAAE,CAAA;QAC/E,OAAO,GAAG,CAAC,cAAc,CAAC,CAAA;QAC1B,KAAK,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC,OAAO,EAAE,UAAU,EAAE,gBAAgB,CAAC,EAAE;YACnE,GAAG,EAAE,OAAO;YACZ,GAAG;YACH,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;SACzC,CAAC,CAAA;QACF,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,CAAA;QACnC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,SAAS,CAAA;QACvC,IAAI,YAAY,IAAI,OAAO,EAAE,CAAC;YAC7B,OAAO,MAAM,CAAC,EAAE,KAAK,EAAE,0CAA0C,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAA;QACzF,CAAC;QACD,IAAI,QAA0C,CAAA;QAC9C,IAAI,CAAC;YACJ,QAAQ,GAAG,MAAM,aAAa,CAAC;gBAC9B,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,SAAS;gBACT,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;aACpD,CAAC,CAAA;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,kBAAkB,EAAE,IAAI,CAAC,CAAC,CAAC,CAAA;YACxF,IAAI,UAAU,KAAK,IAAI;gBAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,UAAU,EAAE,CAAC,CAAA;YACtF,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;YACrE,MAAM,IAAI,KAAK,CAAC,6BAA6B,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;QAC5E,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,uCAAuC,QAAQ,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;QAC9F,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAoB,CAAC,CAAA;IAC5D,CAAC;YAAS,CAAC;QACV,cAAc,EAAE,CAAA;QAChB,WAAW,EAAE,CAAA;QACb,MAAM,MAAM,EAAE,KAAK,EAAE,CAAA;QACrB,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACpD,CAAC;AACF,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,uBAAuB,CAAC,KAKvC;IACA,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAA;IACzB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,EAAE,CAAA;IAC/B,MAAM,IAAI,GAAG;QACZ,GAAG,CAAC,KAAK,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvF,MAAM,EAAE;YACP,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE;YACxC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE;YACpC,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE;SAC/D;KACD,CAAA;IACD,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,OAAO;YACN,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;YAC5D,iBAAiB,EAAE,EAAE,GAAG,IAAI,EAAE,aAAa,EAAE,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE;YAC5E,OAAO,EAAE,IAAI;SACb,CAAA;IACF,CAAC;IACD,MAAM,IAAI,GACT,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ;QACjC,CAAC,CAAC,OAAO,CAAC,MAAM;QAChB,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,WAAW,CAAC,CAAA;IAC5D,MAAM,UAAU,GACf,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ;QACjC,CAAC,CAAC,OAAO,CAAC,MAAM;QAChB,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,WAAW,CAAC,CAAA;IACnD,OAAO;QACN,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QACjC,iBAAiB,EAAE;YAClB,GAAG,IAAI;YACP,aAAa,EAAE,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC;YAC5C,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,IAAI;SACJ;QACD,OAAO,EAAE,KAAK;KACd,CAAA;AACF,CAAC;AAED;;;GAGG;AACH,SAAS,eAAe,CAAC,OAAmB;IAC3C,MAAM,OAAO,GAA0B,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAA;IACtE,MAAM,OAAO,GAAG,GAAG,EAAE;QACpB,KAAK,MAAM,MAAM,IAAI,OAAO;YAAE,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC3D,CAAC,CAAA;IACD,MAAM,OAAO,GAAG,CAAC,MAAsB,EAAE,EAAE;QAC1C,OAAO,EAAE,CAAA;QACT,OAAO,EAAE,CAAA;QACT,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;IAClC,CAAC,CAAA;IACD,KAAK,MAAM,MAAM,IAAI,OAAO;QAAE,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC3D,OAAO,OAAO,CAAA;AACf,CAAC;AAED,SAAS,YAAY,CAAC,KAAmB;IACxC,IAAI,UAAU,GAAG,EAAE,CAAA;IACnB,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;QAC1C,UAAU,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IACrC,CAAC,CAAC,CAAA;IACF,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,CAAA;IACtB,MAAM,MAAM,GAAG,GAAG,EAAE;QACnB,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAA;QACzC,OAAO,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IACrC,CAAC,CAAA;IACD,MAAM,MAAM,GAAG,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,EAAE;QAC9C,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;YACnC,OAAO,CAAC,kBAAkB,MAAM,IAAI,IAAI,IAAI,MAAM,EAAE,EAAE,CAAC,CAAA;QACxD,CAAC,CAAC,CAAA;IACH,CAAC,CAAC,CAAA;IACF,MAAM,SAAS,GAAG,IAAI,OAAO,CAA4C,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC5F,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAoB,CAAA;QACjD,IAAI,QAAQ,GAAG,EAAE,CAAA;QACjB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC7B,MAAM,CAAC,IAAI,KAAK,CAAC,gCAAgC,qBAAqB,GAAG,IAAI,KAAK,MAAM,EAAE,EAAE,CAAC,CAAC,CAAA;QAC/F,CAAC,EAAE,qBAAqB,CAAC,CAAA;QACzB,OAAO,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACrC,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;YAClC,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBACzC,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,CAAA;gBAClC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;oBACnB,YAAY,CAAC,KAAK,CAAC,CAAA;oBACnB,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;gBAClB,CAAC;YACF,CAAC;QACF,CAAC,CAAC,CAAA;QACF,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YAC7B,YAAY,CAAC,KAAK,CAAC,CAAA;YACnB,MAAM,CAAC,IAAI,KAAK,CAAC,4BAA4B,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAA;QAC/D,CAAC,CAAC,CAAA;QACF,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE;YAC/B,YAAY,CAAC,KAAK,CAAC,CAAA;YACnB,OAAO,CAAC,EAAE,UAAU,EAAE,CAAC,CAAA;QACxB,CAAC,CAAC,CAAA;IACH,CAAC,CAAC,CAAA;IACF,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,CAAA;AACrC,CAAC;AAED,SAAS,eAAe,CAAC,IAAY;IACpC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;QAAE,OAAO,IAAI,CAAA;IAC7B,IAAI,CAAC;QACJ,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAuD,CAAA;QACpF,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;YAC3F,CAAC,CAAC,KAAK,CAAC,IAAI;YACZ,CAAC,CAAC,IAAI,CAAA;IACR,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA;IACZ,CAAC;AACF,CAAC;AAED,iGAAiG;AACjG,SAAS,aAAa,CAAC,KAItB;IACA,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACtC,MAAM,OAAO,GAAG,WAAW,CAC1B;YACC,IAAI,EAAE,WAAW;YACjB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,GAAG;YACT,OAAO,EAAE;gBACR,cAAc,EAAE,kBAAkB;gBAClC,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC;gBAC/C,CAAC,eAAe,CAAC,EAAE,KAAK,CAAC,SAAS;aAClC;SACD,EACD,CAAC,QAAQ,EAAE,EAAE;YACZ,QAAQ,CAAC,QAAQ,CAAC,CAAC,IAAI,CACtB,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,UAAU,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,EAC7D,MAAM,CACN,CAAA;QACF,CAAC,CACD,CAAA;QACD,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QAC3B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACxB,CAAC,CAAC,CAAA;AACH,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,KAM1B;IACA,MAAM,QAAQ,GAAG,IAAI,eAAe,EAAE,CAAA;IACtC,MAAM,MAAM,GAAW,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE;QAC/D,MAAM,KAAK,GAAG,CAAC,MAAc,EAAE,IAAa,EAAE,EAAE;YAC/C,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAA;YAClE,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAA;QACnC,CAAC,CAAA;QACD,IACC,OAAO,CAAC,MAAM,KAAK,MAAM;YACzB,OAAO,CAAC,GAAG,KAAK,OAAO;YACvB,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,KAAK,CAAC,SAAS,EACnD,CAAC;YACF,KAAK,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAA;YAClC,OAAM;QACP,CAAC;QACD,IAAI,CAAC;YACJ,MAAM,IAAI,GAAG,eAAe,CAAC,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAA;YACrD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAA;YACzD,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;QACvB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,KAAK,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAA;QACtF,CAAC;IACF,CAAC,CAAC,CAAA;IACF,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC3C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QAC5B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAA;IAC/C,CAAC,CAAC,CAAA;IACF,OAAO;QACN,IAAI,EAAG,MAAM,CAAC,OAAO,EAAkB,CAAC,IAAI;QAC5C,KAAK,EAAE,GAAG,EAAE,CACX,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YAC7B,QAAQ,CAAC,KAAK,EAAE,CAAA;YAChB,MAAM,CAAC,mBAAmB,EAAE,CAAA;YAC5B,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAA;QAC9B,CAAC,CAAC;KACH,CAAA;AACF,CAAC;AAED,SAAS,eAAe,CAAC,IAAY;IACpC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAuC,CAAA;IACrE,IACC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC;QAC3B,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;QACxB,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,OAAO,KAAK,QAAQ,CAAC,EAC3D,CAAC;QACF,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAA;IACnD,CAAC;IACD,OAAO;QACN,IAAI,EAAE,MAAM,CAAC,IAAqB;QAClC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;KACnD,CAAA;AACF,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,MAAuB;IAC9C,MAAM,MAAM,GAAkB,EAAE,CAAA;IAChC,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAClC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;IACjE,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;AAC9C,CAAC"}

package/dist/local-runtime-source.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Sources for the workerd process behind `execute --local`. User code sees the
+ * same `kody:runtime` surface as ad hoc cloud execute; every call becomes a
+ * `{ path, args }` hop to the CLI's loopback bridge, which adds the API token
+ * and forwards it to CapabilityProxy. The token never enters workerd.
+ */
+export declare const localExecuteCompatibilityDate = "2026-04-16";
+export declare const localExecuteCompatibilityFlags: readonly ["nodejs_compat"];
+export declare const localWorkerModuleNames: {
+    readonly entry: "__kody_local_entry.js";
+    readonly user: "main.js";
+    readonly runtime: "kody:runtime";
+};
+/** Header carrying the per-run secret on workerd → bridge and CLI → workerd hops. */
+export declare const runSecretHeader = "x-kody-run-secret";
+export declare const runSecretEnvVar = "KODY_RUN_SECRET";
+export declare function createLocalRuntimeModuleSource(): string;
+export declare function createLocalEntrySource(): string;
+/**
+ * workerd text config. `files` are embedded relative to the config file.
+ * Outbound fetch reaches public and private networks: local execute runs as
+ * the user on their own machine, and reaching local services is part of why
+ * one would run locally.
+ */
+export declare function createWorkerdConfig(input: {
+    bridgePort: number;
+    files: {
+        entry: string;
+        user: string;
+        runtime: string;
+    };
+}): string;

package/dist/local-runtime-source.js

@@ -0,0 +1,199 @@
+/**
+ * Sources for the workerd process behind `execute --local`. User code sees the
+ * same `kody:runtime` surface as ad hoc cloud execute; every call becomes a
+ * `{ path, args }` hop to the CLI's loopback bridge, which adds the API token
+ * and forwards it to CapabilityProxy. The token never enters workerd.
+ */
+export const localExecuteCompatibilityDate = '2026-04-16';
+export const localExecuteCompatibilityFlags = ['nodejs_compat'];
+export const localWorkerModuleNames = {
+    entry: '__kody_local_entry.js',
+    user: 'main.js',
+    runtime: 'kody:runtime',
+};
+/** Header carrying the per-run secret on workerd → bridge and CLI → workerd hops. */
+export const runSecretHeader = 'x-kody-run-secret';
+export const runSecretEnvVar = 'KODY_RUN_SECRET';
+export function createLocalRuntimeModuleSource() {
+    return `
+let __kodyBridge = null;
+
+export function __kodyInstallLocalBridge(bridge) {
+	__kodyBridge = bridge;
+}
+
+function __kodyCall(path, args) {
+	if (__kodyBridge === null) {
+		throw new Error('kody:runtime is only available while an execute --local run is in progress.');
+	}
+	return __kodyBridge(path, args);
+}
+
+function __kodyNamespace(path) {
+	const label = '[KodyRuntime:' + path.join('.') + ']';
+	return new Proxy(function () {}, {
+		get(_target, property) {
+			if (typeof property === 'symbol' || property === 'then' || property === 'toJSON') {
+				return undefined;
+			}
+			if (property === 'toString' || property === 'inspect') return () => label;
+			return __kodyNamespace([...path, property]);
+		},
+		apply(_target, _thisArg, args) {
+			return __kodyCall(path, args);
+		},
+	});
+}
+
+export const kody = __kodyNamespace(['kody']);
+
+export const workflows = {
+	create: async (input) => await __kodyCall(['workflows', 'create'], [input ?? {}]),
+};
+
+export const packages = {
+	invoke: async (specifier, options) => {
+		if (typeof specifier !== 'string') {
+			throw new Error(
+				'Object-only packages.invoke was removed. Use a static import (import fn from "kody:@owner/package/export") when the name is known, or import(specifier) when the name is data.',
+			);
+		}
+		return await __kodyCall(['packages', 'invoke'], [specifier, options ?? {}]);
+	},
+};
+
+export function packageStorage() {
+	throw new Error(
+		'packageStorage() requires package provenance: this module was not bundled from a saved package and the run has no package context. ' +
+			'Ad hoc execute has no scratch SQLite helper. Persist durable state from a saved package with packageStorage().',
+	);
+}
+
+function __kodyPackageSecretsUnavailable() {
+	throw new Error(
+		'packageSecrets is not available in this execution context. It is bound for stamped saved-package modules and saved-package runtime contexts.',
+	);
+}
+
+export const packageSecrets = {
+	get: async () => __kodyPackageSecretsUnavailable(),
+	has: async () => __kodyPackageSecretsUnavailable(),
+};
+export const packageContext = Object.freeze({});
+export const email = null;
+export const events = null;
+export const createAuthenticatedFetch = undefined;
+export const secretHeaders = undefined;
+export const oauthClientCredentials = undefined;
+
+const __kodyRuntimeDefault = Object.freeze({
+	kody,
+	packageStorage,
+	createAuthenticatedFetch,
+	secretHeaders,
+	oauthClientCredentials,
+	packageContext,
+	packageSecrets,
+	email,
+	workflows,
+	packages,
+	events,
+});
+export default __kodyRuntimeDefault;
+export const KodyRuntime = Object.freeze({ defaultValue: __kodyRuntimeDefault });
+`.trimStart();
+}
+export function createLocalEntrySource() {
+    return `
+import { __kodyInstallLocalBridge } from ${JSON.stringify(localWorkerModuleNames.runtime)};
+
+const __kodyRunSecretHeader = ${JSON.stringify(runSecretHeader)};
+let __kodyClaimed = false;
+
+function __kodyFormatLogArgs(args) {
+	return args.map(String).join(' ');
+}
+
+export default {
+	async fetch(request, env) {
+		const secret = env.${runSecretEnvVar};
+		if (__kodyClaimed || !secret || request.headers.get(__kodyRunSecretHeader) !== secret) {
+			return new Response('Forbidden', { status: 403 });
+		}
+		__kodyClaimed = true;
+		const { params } = await request.json();
+		__kodyInstallLocalBridge(async (path, args) => {
+			const response = await env.KODY_BRIDGE.fetch('http://kody-bridge/call', {
+				method: 'POST',
+				headers: { 'content-type': 'application/json', [__kodyRunSecretHeader]: secret },
+				body: JSON.stringify({ path, args }),
+			});
+			const data = await response.json();
+			if (data.error) throw new Error(data.error);
+			return data.result;
+		});
+		const logs = [];
+		const nativeConsole = globalThis.console;
+		globalThis.console = {
+			...nativeConsole,
+			log: (...a) => { logs.push(__kodyFormatLogArgs(a)); },
+			info: (...a) => { logs.push('[info] ' + __kodyFormatLogArgs(a)); },
+			debug: (...a) => { logs.push('[debug] ' + __kodyFormatLogArgs(a)); },
+			warn: (...a) => { logs.push('[warn] ' + __kodyFormatLogArgs(a)); },
+			error: (...a) => { logs.push('[error] ' + __kodyFormatLogArgs(a)); },
+		};
+		try {
+			const module = await import(${JSON.stringify(`./${localWorkerModuleNames.user}`)});
+			if (typeof module?.default !== 'function') {
+				throw new Error('Kody execute modules must default export a function.');
+			}
+			const result = await module.default(params);
+			return new Response(JSON.stringify({ result, logs }), {
+				headers: { 'content-type': 'application/json' },
+			});
+		} catch (error) {
+			const message = error instanceof Error ? error.message : String(error);
+			return Response.json({ error: message, logs });
+		} finally {
+			globalThis.console = nativeConsole;
+		}
+	},
+};
+`.trimStart();
+}
+/**
+ * workerd text config. `files` are embedded relative to the config file.
+ * Outbound fetch reaches public and private networks: local execute runs as
+ * the user on their own machine, and reaching local services is part of why
+ * one would run locally.
+ */
+export function createWorkerdConfig(input) {
+    const flags = localExecuteCompatibilityFlags.map((flag) => JSON.stringify(flag)).join(', ');
+    return `using Workerd = import "/workerd/workerd.capnp";
+
+const config :Workerd.Config = (
+  services = [
+    (name = "main", worker = .kodyWorker),
+    (name = "kody-bridge", external = (address = "127.0.0.1:${input.bridgePort}", http = ())),
+    (name = "internet", network = (allow = ["public", "private", "local"], tlsOptions = (trustBrowserCas = true))),
+  ],
+  sockets = [ (name = "http", address = "127.0.0.1:0", http = (), service = "main") ],
+);
+
+const kodyWorker :Workerd.Worker = (
+  modules = [
+    (name = ${JSON.stringify(localWorkerModuleNames.entry)}, esModule = embed ${JSON.stringify(input.files.entry)}),
+    (name = ${JSON.stringify(localWorkerModuleNames.user)}, esModule = embed ${JSON.stringify(input.files.user)}),
+    (name = ${JSON.stringify(localWorkerModuleNames.runtime)}, esModule = embed ${JSON.stringify(input.files.runtime)}),
+  ],
+  compatibilityDate = ${JSON.stringify(localExecuteCompatibilityDate)},
+  compatibilityFlags = [${flags}],
+  globalOutbound = "internet",
+  bindings = [
+    (name = "KODY_BRIDGE", service = "kody-bridge"),
+    (name = ${JSON.stringify(runSecretEnvVar)}, fromEnvironment = ${JSON.stringify(runSecretEnvVar)}),
+  ],
+);
+`;
+}
+//# sourceMappingURL=local-runtime-source.js.map

package/dist/local-runtime-source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-runtime-source.js","sourceRoot":"","sources":["../src/local-runtime-source.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,CAAC,MAAM,6BAA6B,GAAG,YAAY,CAAA;AACzD,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,eAAe,CAAU,CAAA;AAExE,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACrC,KAAK,EAAE,uBAAuB;IAC9B,IAAI,EAAE,SAAS;IACf,OAAO,EAAE,cAAc;CACd,CAAA;AAEV,qFAAqF;AACrF,MAAM,CAAC,MAAM,eAAe,GAAG,mBAAmB,CAAA;AAClD,MAAM,CAAC,MAAM,eAAe,GAAG,iBAAiB,CAAA;AAEhD,MAAM,UAAU,8BAA8B;IAC7C,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsFP,CAAC,SAAS,EAAE,CAAA;AACb,CAAC;AAED,MAAM,UAAU,sBAAsB;IACrC,OAAO;2CACmC,IAAI,CAAC,SAAS,CAAC,sBAAsB,CAAC,OAAO,CAAC;;gCAEzD,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC;;;;;;;;;uBASxC,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;iCA2BL,IAAI,CAAC,SAAS,CAAC,KAAK,sBAAsB,CAAC,IAAI,EAAE,CAAC;;;;;;;;;;;;;;;;CAgBlF,CAAC,SAAS,EAAE,CAAA;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAGnC;IACA,MAAM,KAAK,GAAG,8BAA8B,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC3F,OAAO;;;;;8DAKsD,KAAK,CAAC,UAAU;;;;;;;;cAQhE,IAAI,CAAC,SAAS,CAAC,sBAAsB,CAAC,KAAK,CAAC,sBAAsB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC;cACnG,IAAI,CAAC,SAAS,CAAC,sBAAsB,CAAC,IAAI,CAAC,sBAAsB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC;cACjG,IAAI,CAAC,SAAS,CAAC,sBAAsB,CAAC,OAAO,CAAC,sBAAsB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC;;wBAE7F,IAAI,CAAC,SAAS,CAAC,6BAA6B,CAAC;0BAC3C,KAAK;;;;cAIjB,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,uBAAuB,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC;;;CAGlG,CAAA;AACD,CAAC"}

package/dist/network-error.d.ts

@@ -0,0 +1,2 @@
+/** `fetch failed` alone hides why; undici puts ECONNREFUSED / ENOTFOUND on `cause.code`. */
+export declare function describeNetworkError(error: unknown): string;

package/dist/network-error.js

@@ -0,0 +1,11 @@
+/** `fetch failed` alone hides why; undici puts ECONNREFUSED / ENOTFOUND on `cause.code`. */
+export function describeNetworkError(error) {
+    if (!(error instanceof Error))
+        return String(error);
+    const cause = error.cause;
+    const causeCode = cause && typeof cause === 'object' && 'code' in cause && typeof cause.code === 'string'
+        ? cause.code
+        : null;
+    return causeCode ? `${error.message}: ${causeCode}` : error.message;
+}
+//# sourceMappingURL=network-error.js.map

package/dist/network-error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"network-error.js","sourceRoot":"","sources":["../src/network-error.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,MAAM,UAAU,oBAAoB,CAAC,KAAc;IAClD,IAAI,CAAC,CAAC,KAAK,YAAY,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAA;IACnD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAA;IACzB,MAAM,SAAS,GACd,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,IAAI,KAAK,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;QACtF,CAAC,CAAC,KAAK,CAAC,IAAI;QACZ,CAAC,CAAC,IAAI,CAAA;IACR,OAAO,SAAS,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAA;AACpE,CAAC"}

package/dist/workerd-binary.d.ts

@@ -0,0 +1,31 @@
+/** Matches the workerd the Kody platform runs; bump together with the digests. */
+export declare const workerdVersion = "1.20260815.1";
+/** sha256 of each gzipped release asset on github.com/cloudflare/workerd. */
+export declare const workerdAssetDigests: {
+    readonly 'linux-64': "05099ec6f50832fcbc327490e5a971d682c97231fb01943b61726db07677e559";
+    readonly 'linux-arm64': "0331597b53771170df2ab8344d9ae81d38bad4959e47152dd86592eedd9264c7";
+    readonly 'darwin-64': "752ec91c01dfc44d660de6e3a654879cfc1277caa7f3c5312871c608c4c2d6df";
+    readonly 'darwin-arm64': "c189fc08f691739c37d8784945e943e33b66cbd4e14635a061fe516dc95f2b39";
+};
+export type WorkerdTarget = keyof typeof workerdAssetDigests;
+export declare function workerdTargetFor(platform?: NodeJS.Platform, arch?: string): WorkerdTarget;
+export declare function workerdAssetUrl(target: WorkerdTarget, version?: string): string;
+export declare function userCacheDir(env?: NodeJS.ProcessEnv, platform?: NodeJS.Platform, home?: string): string;
+export declare function cachedWorkerdPath(cacheDir: string, target: WorkerdTarget): string;
+/**
+ * Returns a runnable workerd path: `KODY_WORKERD_PATH` when set, otherwise the
+ * pinned release under the user cache dir (downloaded and verified on first use).
+ */
+export declare function ensureWorkerdBinary(input?: {
+    env?: NodeJS.ProcessEnv;
+    cacheDir?: string;
+    target?: WorkerdTarget;
+    fetchFn?: typeof fetch;
+    onDownload?: (url: string) => void;
+}): Promise<string>;
+export declare function downloadVerifiedGzip(input: {
+    url: string;
+    sha256: string;
+    destination: string;
+    fetchFn: typeof fetch;
+}): Promise<void>;

package/dist/workerd-binary.js

@@ -0,0 +1,98 @@
+import { createHash } from 'node:crypto';
+import { createReadStream, createWriteStream, existsSync } from 'node:fs';
+import { chmod, mkdir, rename, rm } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { Readable, Transform } from 'node:stream';
+import { pipeline } from 'node:stream/promises';
+import { createGunzip } from 'node:zlib';
+import { describeNetworkError } from './network-error.js';
+/** Matches the workerd the Kody platform runs; bump together with the digests. */
+export const workerdVersion = '1.20260815.1';
+/** sha256 of each gzipped release asset on github.com/cloudflare/workerd. */
+export const workerdAssetDigests = {
+    'linux-64': '05099ec6f50832fcbc327490e5a971d682c97231fb01943b61726db07677e559',
+    'linux-arm64': '0331597b53771170df2ab8344d9ae81d38bad4959e47152dd86592eedd9264c7',
+    'darwin-64': '752ec91c01dfc44d660de6e3a654879cfc1277caa7f3c5312871c608c4c2d6df',
+    'darwin-arm64': 'c189fc08f691739c37d8784945e943e33b66cbd4e14635a061fe516dc95f2b39',
+};
+export function workerdTargetFor(platform = process.platform, arch = process.arch) {
+    const os = platform === 'linux' ? 'linux' : platform === 'darwin' ? 'darwin' : null;
+    const cpu = arch === 'x64' ? '64' : arch === 'arm64' ? 'arm64' : null;
+    if (!os || !cpu) {
+        throw new Error(`execute --local supports Linux and macOS on x64 or arm64 (this machine is ${platform}-${arch}).`);
+    }
+    return `${os}-${cpu}`;
+}
+export function workerdAssetUrl(target, version = workerdVersion) {
+    return `https://github.com/cloudflare/workerd/releases/download/v${version}/workerd-${target}.gz`;
+}
+export function userCacheDir(env = process.env, platform = process.platform, home = homedir()) {
+    if (env.KODY_CACHE_DIR)
+        return env.KODY_CACHE_DIR;
+    if (platform === 'darwin')
+        return join(home, 'Library', 'Caches', 'kody');
+    return join(env.XDG_CACHE_HOME || join(home, '.cache'), 'kody');
+}
+export function cachedWorkerdPath(cacheDir, target) {
+    return join(cacheDir, 'workerd', `${workerdVersion}-${target}`, 'workerd');
+}
+/**
+ * Returns a runnable workerd path: `KODY_WORKERD_PATH` when set, otherwise the
+ * pinned release under the user cache dir (downloaded and verified on first use).
+ */
+export async function ensureWorkerdBinary(input = {}) {
+    const env = input.env ?? process.env;
+    if (env.KODY_WORKERD_PATH)
+        return env.KODY_WORKERD_PATH;
+    const target = input.target ?? workerdTargetFor();
+    const binaryPath = cachedWorkerdPath(input.cacheDir ?? userCacheDir(env), target);
+    if (existsSync(binaryPath))
+        return binaryPath;
+    const url = workerdAssetUrl(target);
+    input.onDownload?.(url);
+    await downloadVerifiedGzip({
+        url,
+        sha256: workerdAssetDigests[target],
+        destination: binaryPath,
+        fetchFn: input.fetchFn ?? fetch,
+    });
+    return binaryPath;
+}
+export async function downloadVerifiedGzip(input) {
+    let response;
+    try {
+        response = await input.fetchFn(input.url);
+    }
+    catch (error) {
+        throw new Error(`Could not download workerd from ${input.url} (${describeNetworkError(error)}).`);
+    }
+    if (!response.ok || !response.body) {
+        throw new Error(`Could not download workerd from ${input.url} (HTTP ${response.status}).`);
+    }
+    await mkdir(dirname(input.destination), { recursive: true });
+    const gzipPath = `${input.destination}.${process.pid}.gz`;
+    const partialPath = `${input.destination}.${process.pid}.partial`;
+    const hash = createHash('sha256');
+    const hashing = new Transform({
+        transform(chunk, _encoding, callback) {
+            hash.update(chunk);
+            callback(null, chunk);
+        },
+    });
+    try {
+        await pipeline(Readable.fromWeb(response.body), hashing, createWriteStream(gzipPath));
+        const digest = hash.digest('hex');
+        if (digest !== input.sha256) {
+            throw new Error(`workerd download from ${input.url} failed verification (sha256 ${digest}, expected ${input.sha256}).`);
+        }
+        await pipeline(createReadStream(gzipPath), createGunzip(), createWriteStream(partialPath));
+        await chmod(partialPath, 0o755);
+        await rename(partialPath, input.destination);
+    }
+    finally {
+        await rm(gzipPath, { force: true });
+        await rm(partialPath, { force: true });
+    }
+}
+//# sourceMappingURL=workerd-binary.js.map

package/dist/workerd-binary.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workerd-binary.js","sourceRoot":"","sources":["../src/workerd-binary.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AACzE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAA;AAC3D,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AACzC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AACjD,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AACxC,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAA;AAEzD,kFAAkF;AAClF,MAAM,CAAC,MAAM,cAAc,GAAG,cAAc,CAAA;AAE5C,6EAA6E;AAC7E,MAAM,CAAC,MAAM,mBAAmB,GAAG;IAClC,UAAU,EAAE,kEAAkE;IAC9E,aAAa,EAAE,kEAAkE;IACjF,WAAW,EAAE,kEAAkE;IAC/E,cAAc,EAAE,kEAAkE;CACzE,CAAA;AAIV,MAAM,UAAU,gBAAgB,CAC/B,WAA4B,OAAO,CAAC,QAAQ,EAC5C,OAAe,OAAO,CAAC,IAAI;IAE3B,MAAM,EAAE,GAAG,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAA;IACnF,MAAM,GAAG,GAAG,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAA;IACrE,IAAI,CAAC,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACd,6EAA6E,QAAQ,IAAI,IAAI,IAAI,CACjG,CAAA;IACF,CAAC;IACD,OAAO,GAAG,EAAE,IAAI,GAAG,EAAE,CAAA;AACtB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,MAAqB,EAAE,UAAkB,cAAc;IACtF,OAAO,4DAA4D,OAAO,YAAY,MAAM,KAAK,CAAA;AAClG,CAAC;AAED,MAAM,UAAU,YAAY,CAC3B,MAAyB,OAAO,CAAC,GAAG,EACpC,WAA4B,OAAO,CAAC,QAAQ,EAC5C,OAAe,OAAO,EAAE;IAExB,IAAI,GAAG,CAAC,cAAc;QAAE,OAAO,GAAG,CAAC,cAAc,CAAA;IACjD,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAA;IACzE,OAAO,IAAI,CAAC,GAAG,CAAC,cAAc,IAAI,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAA;AAChE,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,QAAgB,EAAE,MAAqB;IACxE,OAAO,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,GAAG,cAAc,IAAI,MAAM,EAAE,EAAE,SAAS,CAAC,CAAA;AAC3E,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACxC,QAMI,EAAE;IAEN,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAA;IACpC,IAAI,GAAG,CAAC,iBAAiB;QAAE,OAAO,GAAG,CAAC,iBAAiB,CAAA;IACvD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,gBAAgB,EAAE,CAAA;IACjD,MAAM,UAAU,GAAG,iBAAiB,CAAC,KAAK,CAAC,QAAQ,IAAI,YAAY,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAA;IACjF,IAAI,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,UAAU,CAAA;IAE7C,MAAM,GAAG,GAAG,eAAe,CAAC,MAAM,CAAC,CAAA;IACnC,KAAK,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,CAAA;IACvB,MAAM,oBAAoB,CAAC;QAC1B,GAAG;QACH,MAAM,EAAE,mBAAmB,CAAC,MAAM,CAAC;QACnC,WAAW,EAAE,UAAU;QACvB,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,KAAK;KAC/B,CAAC,CAAA;IACF,OAAO,UAAU,CAAA;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,KAK1C;IACA,IAAI,QAAkB,CAAA;IACtB,IAAI,CAAC;QACJ,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC1C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CACd,mCAAmC,KAAK,CAAC,GAAG,KAAK,oBAAoB,CAAC,KAAK,CAAC,IAAI,CAChF,CAAA;IACF,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,mCAAmC,KAAK,CAAC,GAAG,UAAU,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAA;IAC3F,CAAC;IACD,MAAM,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAC5D,MAAM,QAAQ,GAAG,GAAG,KAAK,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,KAAK,CAAA;IACzD,MAAM,WAAW,GAAG,GAAG,KAAK,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,UAAU,CAAA;IACjE,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAA;IACjC,MAAM,OAAO,GAAG,IAAI,SAAS,CAAC;QAC7B,SAAS,CAAC,KAAa,EAAE,SAAS,EAAE,QAAQ;YAC3C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;YAClB,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;QACtB,CAAC;KACD,CAAC,CAAA;IACF,IAAI,CAAC;QACJ,MAAM,QAAQ,CACb,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,IAA8C,CAAC,EACzE,OAAO,EACP,iBAAiB,CAAC,QAAQ,CAAC,CAC3B,CAAA;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QACjC,IAAI,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CACd,yBAAyB,KAAK,CAAC,GAAG,gCAAgC,MAAM,cAAc,KAAK,CAAC,MAAM,IAAI,CACtG,CAAA;QACF,CAAC;QACD,MAAM,QAAQ,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EAAE,YAAY,EAAE,EAAE,iBAAiB,CAAC,WAAW,CAAC,CAAC,CAAA;QAC1F,MAAM,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,CAAA;QAC/B,MAAM,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,WAAW,CAAC,CAAA;IAC7C,CAAC;YAAS,CAAC;QACV,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QACnC,MAAM,EAAE,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACvC,CAAC;AACF,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@kodycodes/cli",
-	"version": "1.3.0",
+	"version": "1.4.0",
 	"description": "Official Kody MCP client CLI: login, secure token storage, search, and execute.",
 	"type": "module",
 	"bin": {

package/skills/kody/SKILL.md

@@ -69,3 +69,13 @@ Never ask the user to paste tokens into chat.
 
 Override the MCP URL with `--mcp-url` or `KODY_MCP_URL` for preview or local
 servers. Default: `https://kody.codes/mcp`.
+
+To run an execute module on this machine (Linux/macOS) instead of Kody's
+cloud sandbox, add `--local` and supply a scoped API token through
+`KODY_API_TOKEN` (or `--token`). `kody:runtime` calls still go to Kody; no
+`kody login` is needed. Mint the token with Kody's `api` tool — never read MCP
+OAuth tokens from the host.
+
+```bash
+KODY_API_TOKEN=… npx @kodycodes/cli execute --local --file ./task.js --params '{"q":"email"}'
+```