@kodycodes/cli 1.3.0 → 1.5.0

package/README.md

@@ -62,12 +62,73 @@ Or run via `npx @kodycodes/cli` without a global install.
 | `kody login` | Browser OAuth (CIMD + PKCE) for the CLI itself. Stores access and refresh tokens. |
 | `kody logout` | Deletes stored CLI credentials. |
 | `kody status` | Shows CLI login state without printing secrets. |
-| `kody whoami` | Confirms the CLI MCP connection and lists tools. |
-| `kody search [query]` | Calls Kody `search` from the CLI (prefer the host MCP tool). |
-| `kody execute` | Calls Kody `execute` from the CLI (`--invoke`, `--code`, `--file`, or stdin via `--file -`). |
+| `kody whoami` | Confirms the CLI MCP connection and lists tools. With a scoped API token (and no login), shows token identity via the Open API. |
+| `kody search [query]` | Calls Kody `search` from the CLI (prefer the host MCP tool). Token-only auth uses Open API `GET /v1/search`. |
+| `kody execute` | Calls Kody `execute` from the CLI (`--invoke`, `--code`, `--file`, or stdin via `--file -`). With a scoped API token and no login (or with `--token`), cloud execute goes through CapabilityProxy → `kody.execute` — no `kody login`. Add `--local` to run the module on this machine instead. |
 
 `--json` prints structured MCP results.
 
+## Token-authenticated execute (no `kody login`)
+
+Scoped API tokens (`kody_at_…`, from the MCP `api` tool `tokenCreate` or
+`POST /v1/tokens`) authenticate the Open API and CapabilityProxy. They never
+replace MCP OAuth on `/mcp`. The CLI uses that token path when you pass
+`--token` / `KODY_API_TOKEN` and are not logged in (or when you pass `--token`
+explicitly):
+
+```bash
+export KODY_API_TOKEN=…   # scopes: local-execute (+ search:read for search)
+# Cloud execute — module runs in Kody's sandbox via CapabilityProxy → kody.execute
+npx @kodycodes/cli execute --code 'export default async () => ({ ok: true })'
+# Same token, module runs on this machine
+npx @kodycodes/cli execute --local --file ./task.js --params '{"to":"me@example.com"}'
+npx @kodycodes/cli search "what can you do"
+npx @kodycodes/cli whoami
+```
+
+- Missing token → prompt to set `--token` / `KODY_API_TOKEN` or run `kody login`.
+- Wrong/expired token → 401 with a mint-fresh-token message.
+- Token lacks `local-execute` (or the account flag is off) → 403 naming the
+  scope or `local-execute` feature flag before any module runs.
+- Prefer the env var so the token stays out of shell history and `ps`.
+
+## Local execute
+
+`kody execute --local` runs the same execute module (default export called
+with `--params`) on this machine instead of in Kody's cloud sandbox. Local CPU
+is free; every `kody:runtime` call (`kody.*`, `kody.mcp.*`, `workflows`,
+`packages`) is proxied to Kody's CapabilityProxy and metered like a cloud hop.
+
+```bash
+export KODY_API_TOKEN=…   # scoped token minted through the Kody `api` tool
+npx @kodycodes/cli execute --local --file ./task.js --params '{"to":"me@example.com"}'
+```
+
+- **Auth:** a scoped API token from `--token` or `KODY_API_TOKEN` (prefer the
+  env var so the token stays out of shell history and `ps`). No `kody login`,
+  and the CLI never reads MCP OAuth tokens from other hosts. The token stays in
+  the CLI process; the sandbox only talks to a loopback bridge.
+- **Runtime:** a pinned [workerd](https://github.com/cloudflare/workerd)
+  release, downloaded once from GitHub, sha256-verified, and cached under
+  `~/.cache/kody` (Linux, or `$XDG_CACHE_HOME/kody`) or
+  `~/Library/Caches/kody` (macOS). Override with `KODY_CACHE_DIR`, or point
+  `KODY_WORKERD_PATH` at your own binary. No Docker required. Linux and macOS
+  (x64/arm64) only for now.
+- **API:** `https://api.kody.codes` by default (`--api-url` or `KODY_API_URL`
+  to override). The CLI calls `GET /v1/capability-proxy/session` before
+  starting workerd and `POST /v1/capability-proxy/call` with
+  `{ path, args, conversationId? }` for each runtime call.
+- **Errors:** an expired/revoked token or an account without the
+  `local-execute` flag fails fast with a clear message before any code runs.
+  The token is only sent over https (plain http is allowed for localhost).
+- **Lifetime:** no execution time limit locally; Ctrl-C (or SIGTERM) stops
+  workerd and removes the temporary module.
+- **Not yet:** static `kody:@scope/package/export` imports and `--invoke`
+  (use cloud execute or `packages.invoke`). `packageStorage()`,
+  `packageSecrets`, `email`, and `events` stay unbound like ad hoc cloud
+  execute. Outbound `fetch` goes straight from this machine, including to
+  local-network hosts.
+
 ## Token storage
 
 CLI credentials are stored in the OS secret store:
@@ -82,6 +143,9 @@ If the keychain is unavailable (common on headless Linux), the CLI writes a
 
 Access tokens refresh automatically on expiry or HTTP 401.
 
+`execute --local` and token-only cloud execute do not use stored CLI
+credentials; they only read `--token` / `KODY_API_TOKEN`.
+
 ## Releases
 
 This repo uses [semantic-release](https://github.com/semantic-release/semantic-release)

package/dist/api-token.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Scoped Open API / CapabilityProxy token (`kody_at_…`). Same source for
+ * `execute --local`, token-only cloud execute, and Open API search/whoami.
+ */
+export declare function readApiToken(values?: {
+    token?: string;
+}, env?: NodeJS.ProcessEnv): string | null;
+export declare function requireApiToken(values?: {
+    token?: string;
+}, env?: NodeJS.ProcessEnv, purpose?: string): string;
+/** True when the user passed `--token` (not only the env var). */
+export declare function hasExplicitTokenFlag(values: {
+    token?: string;
+}): boolean;

package/dist/api-token.js

@@ -0,0 +1,21 @@
+import { apiTokenEnvVar } from './defaults.js';
+/**
+ * Scoped Open API / CapabilityProxy token (`kody_at_…`). Same source for
+ * `execute --local`, token-only cloud execute, and Open API search/whoami.
+ */
+export function readApiToken(values = {}, env = process.env) {
+    const token = (values.token ?? env[apiTokenEnvVar] ?? '').trim();
+    return token.length > 0 ? token : null;
+}
+export function requireApiToken(values = {}, env = process.env, purpose = 'this command') {
+    const token = readApiToken(values, env);
+    if (!token) {
+        throw new Error(`${purpose} needs a scoped Kody API token: pass --token or set ${apiTokenEnvVar}. Mint one with the Kody \`api\` tool (tokenCreate) or POST /v1/tokens.`);
+    }
+    return token;
+}
+/** True when the user passed `--token` (not only the env var). */
+export function hasExplicitTokenFlag(values) {
+    return typeof values.token === 'string' && values.token.trim().length > 0;
+}
+//# sourceMappingURL=api-token.js.map

package/dist/api-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-token.js","sourceRoot":"","sources":["../src/api-token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAE9C;;;GAGG;AACH,MAAM,UAAU,YAAY,CAC3B,SAA6B,EAAE,EAC/B,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;IAChE,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;AACvC,CAAC;AAED,MAAM,UAAU,eAAe,CAC9B,SAA6B,EAAE,EAC/B,MAAyB,OAAO,CAAC,GAAG,EACpC,UAAkB,cAAc;IAEhC,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACvC,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACd,GAAG,OAAO,uDAAuD,cAAc,yEAAyE,CACxJ,CAAA;IACF,CAAC;IACD,OAAO,KAAK,CAAA;AACb,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,oBAAoB,CAAC,MAA0B;IAC9D,OAAO,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAA;AAC1E,CAAC"}

package/dist/auth.js

@@ -1,6 +1,6 @@
 import { createServer, } from 'node:http';
 import { auth, } from '@modelcontextprotocol/client';
-import { accessTokenSkewMs, cliRedirectUrl, defaultMcpUrl, defaultScopes, loginTimeoutMs, } from './defaults.js';
+import { accessTokenSkewMs, apiTokenEnvVar, cliRedirectUrl, defaultMcpUrl, defaultScopes, loginTimeoutMs, } from './defaults.js';
 import { createCliOAuthProvider } from './oauth-provider.js';
 import { redactError } from './redact.js';
 import { loadCredentials, saveCredentials, } from './store.js';
@@ -84,7 +84,7 @@ export async function ensureFreshCredentials(input) {
     const mcpUrl = input.mcpUrl ?? defaultMcpUrl;
     const credentials = loadCredentials(mcpUrl, input.backend);
     if (!credentials) {
-        throw new Error('Not logged in. Run `kody login`.');
+        throw new Error(`Not logged in. Run \`kody login\`, or pass a scoped API token with --token / ${apiTokenEnvVar} (search, whoami, and execute — including cloud execute without --local).`);
     }
     if (!isAccessTokenExpired(credentials, input.now)) {
         return credentials;

package/dist/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,YAAY,GAIZ,MAAM,WAAW,CAAA;AAClB,OAAO,EACN,IAAI,GAGJ,MAAM,8BAA8B,CAAA;AACrC,OAAO,EACN,iBAAiB,EACjB,cAAc,EACd,aAAa,EACb,aAAa,EACb,cAAc,GACd,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAA;AAC5D,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,EACN,eAAe,EACf,eAAe,GAGf,MAAM,YAAY,CAAA;AAYnB,MAAM,UAAU,oBAAoB,CACnC,WAA8B,EAC9B,MAAc,IAAI,CAAC,GAAG,EAAE;IAExB,IAAI,CAAC,WAAW,CAAC,SAAS;QAAE,OAAO,KAAK,CAAA;IACxC,OAAO,GAAG,GAAG,iBAAiB,IAAI,WAAW,CAAC,SAAS,CAAA;AACxD,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,KAQrC;IACA,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAA;IACnC,MAAM,SAAS,GACd,OAAO,KAAK,CAAC,MAAM,CAAC,UAAU,KAAK,QAAQ;QAC1C,CAAC,CAAC,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,UAAU,GAAG,IAAI;QACtC,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,SAAS,CAAA;IAC7B,OAAO;QACN,OAAO,EAAE,CAAC;QACV,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,SAAS;QAChC,YAAY,EACX,eAAe,IAAI,KAAK,CAAC,MAAM;YAC9B,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa;YAC5B,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,YAAY;QAChC,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;QACtC,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,aAAa,IAAI,KAAK,CAAC,QAAQ,EAAE,YAAY;QACxE,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,UAAU,IAAI,QAAQ;QAC9C,SAAS;QACT,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,IAAI,KAAK,CAAC,QAAQ,EAAE,KAAK;KAClD,CAAA;AACF,CAAC;AAED,KAAK,UAAU,wBAAwB,CAAC,KAMvC;IAIA,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAA;IAC5C,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,iBAAiB,EAAE,CAAA;IACvD,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAA;IACrE,CAAC;IACD,MAAM,WAAW,GAAG,qBAAqB,CAAC;QACzC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,QAAQ,EAAE,KAAK,CAAC,MAAM;QACtB,sBAAsB,EACrB,MAAM,CAAC,MAAM;YACb,KAAK,CAAC,QAAQ,EAAE,sBAAsB;YACtC,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM;QAC7B,MAAM;QACN,MAAM;QACN,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,GAAG,EAAE,KAAK,CAAC,GAAG;KACd,CAAC,CAAA;IACF,MAAM,KAAK,GAAG,eAAe,CAAC,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,CAAA;IACzD,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,CAAA;AAC9B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,KAK9C;IACA,MAAM,EAAE,WAAW,EAAE,GAAG,KAAK,CAAA;IAC7B,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAA;IACjE,CAAC;IACD,MAAM,QAAQ,GAAG,sBAAsB,CAAC;QACvC,MAAM,EAAE,WAAW,CAAC,MAAM;QAC1B,WAAW,EAAE,cAAc,EAAE;QAC7B,QAAQ,EAAE,WAAW;QACrB,gBAAgB,EAAE,IAAI;QACtB,WAAW,EAAE,KAAK;QAClB,aAAa,EAAE,MAAM,CAAC,UAAU,EAAE;KAClC,CAAC,CAAA;IACF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE;QACnC,SAAS,EAAE,WAAW,CAAC,MAAM;QAC7B,KAAK,EAAE,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC;QAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;KACtB,CAAC,CAAA;IACF,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAA;IAC9D,CAAC;IACD,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,MAAM,wBAAwB,CAAC;QAC5D,MAAM,EAAE,WAAW,CAAC,MAAM;QAC1B,QAAQ;QACR,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,WAAW;QACrB,GAAG,EAAE,KAAK,CAAC,GAAG;KACd,CAAC,CAAA;IACF,OAAO,IAAI,CAAA;AACZ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,KAK5C;IACA,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,aAAa,CAAA;IAC5C,MAAM,WAAW,GAAG,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,CAAA;IAC1D,IAAI,CAAC,WAAW,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAA;IACpD,CAAC;IACD,IAAI,CAAC,oBAAoB,CAAC,WAAW,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACnD,OAAO,WAAW,CAAA;IACnB,CAAC;IACD,OAAO,MAAM,wBAAwB,CAAC;QACrC,WAAW;QACX,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,OAAO,EAAE,KAAK,CAAC,OAAO;KACtB,CAAC,CAAA;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,WAAgB;IAC5C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACtC,MAAM,MAAM,GAAG,YAAY,EAAE,CAAA;QAC7B,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAA;QACrC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAA;QAChE,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YAC5B,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBACpD,MAAM,CACL,IAAI,KAAK,CACR,uBAAuB,IAAI,gDAAgD,CAC3E,CACD,CAAA;gBACD,OAAM;YACP,CAAC;YACD,MAAM,CAAC,KAAK,CAAC,CAAA;QACd,CAAC,CAAC,CAAA;IACH,CAAC,CAAC,CAAA;AACH,CAAC;AAED,SAAS,eAAe,CAAC,KAKxB;IACA,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACtC,MAAM,MAAM,GAAG,CAAC,KAAmB,EAAE,MAAuC,EAAE,EAAE;YAC/E,YAAY,CAAC,KAAK,CAAC,CAAA;YACnB,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,CAAA;YACpB,IAAI,KAAK;gBAAE,MAAM,CAAC,KAAK,CAAC,CAAA;;gBACnB,OAAO,CAAC,MAAM,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAA;QACrC,CAAC,CAAA;QACD,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC7B,MAAM,CAAC,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC,CAAA;QAC9D,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,CAAA;QAEnB,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,OAAwB,EAAE,QAAwB,EAAE,EAAE;YACjF,IAAI,CAAC;gBACJ,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,KAAK,CAAC,WAAW,CAAC,CAAA;gBAC1D,IAAI,GAAG,CAAC,QAAQ,KAAK,KAAK,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC;oBACjD,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;oBACxC,OAAM;gBACP,CAAC;gBACD,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;gBAC3C,IAAI,KAAK,EAAE,CAAC;oBACX,MAAM,WAAW,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,EAAE,CAAA;oBACnE,QAAQ;yBACN,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC;yBAC/C,GAAG,CAAC,yDAAyD,CAAC,CAAA;oBAChE,MAAM,CAAC,IAAI,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,CAAC,CAAA;oBACvC,OAAM;gBACP,CAAC;gBACD,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;gBAC3C,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;gBACzC,MAAM,GAAG,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,SAAS,CAAA;gBACpD,IAAI,KAAK,KAAK,KAAK,CAAC,aAAa,IAAI,CAAC,IAAI,EAAE,CAAC;oBAC5C,QAAQ;yBACN,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC;yBAC/C,GAAG,CAAC,2DAA2D,CAAC,CAAA;oBAClE,MAAM,CAAC,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC,CAAA;oBAC1D,OAAM;gBACP,CAAC;gBACD,QAAQ;qBACN,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC;qBAC/C,GAAG,CAAC,0DAA0D,CAAC,CAAA;gBACjE,MAAM,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAA;YAChD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAA;YAC3B,CAAC;QACF,CAAC,CAAC,CAAA;IACH,CAAC,CAAC,CAAA;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,UAAwB,EAAE;IAMrD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,aAAa,CAAA;IAC9C,MAAM,WAAW,GAAG,cAAc,EAAE,CAAA;IACpC,MAAM,aAAa,GAAG,MAAM,CAAC,UAAU,EAAE,CAAA;IACzC,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,WAAW,CAAC,CAAA;IACrD,IAAI,gBAAgB,GAAG,WAAW,CAAA;IAClC,MAAM,QAAQ,GAAG,sBAAsB,CAAC;QACvC,MAAM;QACN,WAAW;QACX,gBAAgB,EAAE,KAAK;QACvB,WAAW,EAAE,OAAO,CAAC,WAAW,KAAK,KAAK;QAC1C,aAAa;QACb,kBAAkB,EAAE,CAAC,GAAG,EAAE,EAAE;YAC3B,gBAAgB,GAAG,GAAG,CAAA;YACtB,OAAO,CAAC,kBAAkB,EAAE,CAAC,GAAG,CAAC,CAAA;QAClC,CAAC;KACD,CAAC,CAAA;IACF,IAAI,CAAC;QACJ,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE;YAClC,SAAS,EAAE,MAAM;YACjB,KAAK,EAAE,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC;YAC9B,OAAO,EAAE,OAAO,CAAC,OAAO;SACxB,CAAC,CAAA;QACF,IAAI,KAAK,KAAK,YAAY,EAAE,CAAC;YAC5B,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC;gBACtC,MAAM;gBACN,WAAW;gBACX,aAAa;gBACb,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,cAAc;aAC9C,CAAC,CAAA;YACF,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE;gBACtC,SAAS,EAAE,MAAM;gBACjB,iBAAiB,EAAE,QAAQ,CAAC,IAAI;gBAChC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9C,KAAK,EAAE,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC;gBAC9B,OAAO,EAAE,OAAO,CAAC,OAAO;aACxB,CAAC,CAAA;YACF,IAAI,SAAS,KAAK,YAAY,EAAE,CAAC;gBAChC,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAA;YAC5D,CAAC;QACF,CAAC;aAAM,CAAC;YACP,MAAM,CAAC,KAAK,EAAE,CAAA;QACf,CAAC;QACD,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,MAAM,wBAAwB,CAAC;YAC7D,MAAM;YACN,QAAQ;YACR,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE;SACpB,CAAC,CAAA;QACF,OAAO;YACN,WAAW;YACX,gBAAgB;YAChB,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI;YAC/B,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI;SAC/B,CAAA;IACF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,CAAC,KAAK,EAAE,CAAA;QACd,MAAM,WAAW,CAAC,KAAK,CAAC,CAAA;IACzB,CAAC;AACF,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,YAAY,GAIZ,MAAM,WAAW,CAAA;AAClB,OAAO,EACN,IAAI,GAGJ,MAAM,8BAA8B,CAAA;AACrC,OAAO,EACN,iBAAiB,EACjB,cAAc,EACd,cAAc,EACd,aAAa,EACb,aAAa,EACb,cAAc,GACd,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAA;AAC5D,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,EACN,eAAe,EACf,eAAe,GAGf,MAAM,YAAY,CAAA;AAYnB,MAAM,UAAU,oBAAoB,CACnC,WAA8B,EAC9B,MAAc,IAAI,CAAC,GAAG,EAAE;IAExB,IAAI,CAAC,WAAW,CAAC,SAAS;QAAE,OAAO,KAAK,CAAA;IACxC,OAAO,GAAG,GAAG,iBAAiB,IAAI,WAAW,CAAC,SAAS,CAAA;AACxD,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,KAQrC;IACA,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAA;IACnC,MAAM,SAAS,GACd,OAAO,KAAK,CAAC,MAAM,CAAC,UAAU,KAAK,QAAQ;QAC1C,CAAC,CAAC,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,UAAU,GAAG,IAAI;QACtC,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,SAAS,CAAA;IAC7B,OAAO;QACN,OAAO,EAAE,CAAC;QACV,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,SAAS;QAChC,YAAY,EACX,eAAe,IAAI,KAAK,CAAC,MAAM;YAC9B,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa;YAC5B,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,YAAY;QAChC,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;QACtC,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,aAAa,IAAI,KAAK,CAAC,QAAQ,EAAE,YAAY;QACxE,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,UAAU,IAAI,QAAQ;QAC9C,SAAS;QACT,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,IAAI,KAAK,CAAC,QAAQ,EAAE,KAAK;KAClD,CAAA;AACF,CAAC;AAED,KAAK,UAAU,wBAAwB,CAAC,KAMvC;IAIA,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAA;IAC5C,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,iBAAiB,EAAE,CAAA;IACvD,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAA;IACrE,CAAC;IACD,MAAM,WAAW,GAAG,qBAAqB,CAAC;QACzC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,QAAQ,EAAE,KAAK,CAAC,MAAM;QACtB,sBAAsB,EACrB,MAAM,CAAC,MAAM;YACb,KAAK,CAAC,QAAQ,EAAE,sBAAsB;YACtC,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM;QAC7B,MAAM;QACN,MAAM;QACN,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,GAAG,EAAE,KAAK,CAAC,GAAG;KACd,CAAC,CAAA;IACF,MAAM,KAAK,GAAG,eAAe,CAAC,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,CAAA;IACzD,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,CAAA;AAC9B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,KAK9C;IACA,MAAM,EAAE,WAAW,EAAE,GAAG,KAAK,CAAA;IAC7B,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAA;IACjE,CAAC;IACD,MAAM,QAAQ,GAAG,sBAAsB,CAAC;QACvC,MAAM,EAAE,WAAW,CAAC,MAAM;QAC1B,WAAW,EAAE,cAAc,EAAE;QAC7B,QAAQ,EAAE,WAAW;QACrB,gBAAgB,EAAE,IAAI;QACtB,WAAW,EAAE,KAAK;QAClB,aAAa,EAAE,MAAM,CAAC,UAAU,EAAE;KAClC,CAAC,CAAA;IACF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE;QACnC,SAAS,EAAE,WAAW,CAAC,MAAM;QAC7B,KAAK,EAAE,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC;QAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;KACtB,CAAC,CAAA;IACF,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAA;IAC9D,CAAC;IACD,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,MAAM,wBAAwB,CAAC;QAC5D,MAAM,EAAE,WAAW,CAAC,MAAM;QAC1B,QAAQ;QACR,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,WAAW;QACrB,GAAG,EAAE,KAAK,CAAC,GAAG;KACd,CAAC,CAAA;IACF,OAAO,IAAI,CAAA;AACZ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,KAK5C;IACA,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,aAAa,CAAA;IAC5C,MAAM,WAAW,GAAG,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,CAAA;IAC1D,IAAI,CAAC,WAAW,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CACd,gFAAgF,cAAc,2EAA2E,CACzK,CAAA;IACF,CAAC;IACD,IAAI,CAAC,oBAAoB,CAAC,WAAW,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACnD,OAAO,WAAW,CAAA;IACnB,CAAC;IACD,OAAO,MAAM,wBAAwB,CAAC;QACrC,WAAW;QACX,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,OAAO,EAAE,KAAK,CAAC,OAAO;KACtB,CAAC,CAAA;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,WAAgB;IAC5C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACtC,MAAM,MAAM,GAAG,YAAY,EAAE,CAAA;QAC7B,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAA;QACrC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAA;QAChE,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YAC5B,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBACpD,MAAM,CACL,IAAI,KAAK,CACR,uBAAuB,IAAI,gDAAgD,CAC3E,CACD,CAAA;gBACD,OAAM;YACP,CAAC;YACD,MAAM,CAAC,KAAK,CAAC,CAAA;QACd,CAAC,CAAC,CAAA;IACH,CAAC,CAAC,CAAA;AACH,CAAC;AAED,SAAS,eAAe,CAAC,KAKxB;IACA,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACtC,MAAM,MAAM,GAAG,CAAC,KAAmB,EAAE,MAAuC,EAAE,EAAE;YAC/E,YAAY,CAAC,KAAK,CAAC,CAAA;YACnB,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,CAAA;YACpB,IAAI,KAAK;gBAAE,MAAM,CAAC,KAAK,CAAC,CAAA;;gBACnB,OAAO,CAAC,MAAM,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAA;QACrC,CAAC,CAAA;QACD,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC7B,MAAM,CAAC,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC,CAAA;QAC9D,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,CAAA;QAEnB,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,OAAwB,EAAE,QAAwB,EAAE,EAAE;YACjF,IAAI,CAAC;gBACJ,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,KAAK,CAAC,WAAW,CAAC,CAAA;gBAC1D,IAAI,GAAG,CAAC,QAAQ,KAAK,KAAK,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC;oBACjD,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;oBACxC,OAAM;gBACP,CAAC;gBACD,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;gBAC3C,IAAI,KAAK,EAAE,CAAC;oBACX,MAAM,WAAW,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,EAAE,CAAA;oBACnE,QAAQ;yBACN,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC;yBAC/C,GAAG,CAAC,yDAAyD,CAAC,CAAA;oBAChE,MAAM,CAAC,IAAI,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,CAAC,CAAA;oBACvC,OAAM;gBACP,CAAC;gBACD,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;gBAC3C,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;gBACzC,MAAM,GAAG,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,SAAS,CAAA;gBACpD,IAAI,KAAK,KAAK,KAAK,CAAC,aAAa,IAAI,CAAC,IAAI,EAAE,CAAC;oBAC5C,QAAQ;yBACN,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC;yBAC/C,GAAG,CAAC,2DAA2D,CAAC,CAAA;oBAClE,MAAM,CAAC,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC,CAAA;oBAC1D,OAAM;gBACP,CAAC;gBACD,QAAQ;qBACN,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC;qBAC/C,GAAG,CAAC,0DAA0D,CAAC,CAAA;gBACjE,MAAM,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAA;YAChD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAA;YAC3B,CAAC;QACF,CAAC,CAAC,CAAA;IACH,CAAC,CAAC,CAAA;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,UAAwB,EAAE;IAMrD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,aAAa,CAAA;IAC9C,MAAM,WAAW,GAAG,cAAc,EAAE,CAAA;IACpC,MAAM,aAAa,GAAG,MAAM,CAAC,UAAU,EAAE,CAAA;IACzC,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,WAAW,CAAC,CAAA;IACrD,IAAI,gBAAgB,GAAG,WAAW,CAAA;IAClC,MAAM,QAAQ,GAAG,sBAAsB,CAAC;QACvC,MAAM;QACN,WAAW;QACX,gBAAgB,EAAE,KAAK;QACvB,WAAW,EAAE,OAAO,CAAC,WAAW,KAAK,KAAK;QAC1C,aAAa;QACb,kBAAkB,EAAE,CAAC,GAAG,EAAE,EAAE;YAC3B,gBAAgB,GAAG,GAAG,CAAA;YACtB,OAAO,CAAC,kBAAkB,EAAE,CAAC,GAAG,CAAC,CAAA;QAClC,CAAC;KACD,CAAC,CAAA;IACF,IAAI,CAAC;QACJ,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE;YAClC,SAAS,EAAE,MAAM;YACjB,KAAK,EAAE,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC;YAC9B,OAAO,EAAE,OAAO,CAAC,OAAO;SACxB,CAAC,CAAA;QACF,IAAI,KAAK,KAAK,YAAY,EAAE,CAAC;YAC5B,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC;gBACtC,MAAM;gBACN,WAAW;gBACX,aAAa;gBACb,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,cAAc;aAC9C,CAAC,CAAA;YACF,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE;gBACtC,SAAS,EAAE,MAAM;gBACjB,iBAAiB,EAAE,QAAQ,CAAC,IAAI;gBAChC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9C,KAAK,EAAE,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC;gBAC9B,OAAO,EAAE,OAAO,CAAC,OAAO;aACxB,CAAC,CAAA;YACF,IAAI,SAAS,KAAK,YAAY,EAAE,CAAC;gBAChC,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAA;YAC5D,CAAC;QACF,CAAC;aAAM,CAAC;YACP,MAAM,CAAC,KAAK,EAAE,CAAA;QACf,CAAC;QACD,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,MAAM,wBAAwB,CAAC;YAC7D,MAAM;YACN,QAAQ;YACR,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE;SACpB,CAAC,CAAA;QACF,OAAO;YACN,WAAW;YACX,gBAAgB;YAChB,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI;YAC/B,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI;SAC/B,CAAA;IACF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,CAAC,KAAK,EAAE,CAAA;QACd,MAAM,WAAW,CAAC,KAAK,CAAC,CAAA;IACzB,CAAC;AACF,CAAC"}

package/dist/capability-proxy.d.ts

@@ -0,0 +1,46 @@
+/**
+ * HTTP contract for Kody's CapabilityProxy (Open API `/v1`). Local execute
+ * runs user code in workerd and forwards every `kody:runtime` call here with
+ * a scoped API token.
+ *
+ * - `GET  /v1/capability-proxy/session` validates the token before workerd
+ *   starts. 200 → `{ scopes?: string[], expiresAt?: string }`.
+ * - `POST /v1/capability-proxy/call` with `{ path, args, conversationId? }`
+ *   where `path` is the runtime property path (`['kody', 'emailSend']`,
+ *   `['kody', 'mcp', server, tool]`, `['workflows', 'create']`) and `args`
+ *   is the positional argument list. 200 → `{ result }`.
+ *
+ * Errors use `{ error: { code, message } }` (a bare string is accepted too).
+ * 401 means the token is expired/revoked; 403 `feature_disabled` means the
+ * `local-execute` flag is off for the account.
+ */
+export declare const capabilityProxySessionPath = "v1/capability-proxy/session";
+export declare const capabilityProxyCallPath = "v1/capability-proxy/call";
+export type CapabilityProxySession = {
+    scopes: Array<string>;
+    expiresAt: string | null;
+};
+export type CapabilityProxyCall = {
+    path: Array<string>;
+    args: Array<unknown>;
+    conversationId?: string;
+};
+export type CapabilityProxyClientInput = {
+    apiUrl: string;
+    token: string;
+    fetchFn?: typeof fetch;
+    signal?: AbortSignal;
+};
+export declare class CapabilityProxyError extends Error {
+    readonly status: number | null;
+    readonly code: string | null;
+    constructor(message: string, options?: {
+        status?: number | null;
+        code?: string | null;
+    });
+}
+/** The bearer token must not cross the network in cleartext. */
+export declare function assertTokenSafeApiUrl(apiUrl: string): void;
+export declare function capabilityProxyUrl(apiUrl: string, path: string): URL;
+export declare function openCapabilityProxySession(input: CapabilityProxyClientInput): Promise<CapabilityProxySession>;
+export declare function callCapabilityProxy(input: CapabilityProxyClientInput & CapabilityProxyCall): Promise<unknown>;

package/dist/capability-proxy.js

@@ -0,0 +1,151 @@
+import { apiTokenEnvVar, cliName } from './defaults.js';
+import { describeNetworkError } from './network-error.js';
+import { readPackageVersion } from './package-info.js';
+/**
+ * HTTP contract for Kody's CapabilityProxy (Open API `/v1`). Local execute
+ * runs user code in workerd and forwards every `kody:runtime` call here with
+ * a scoped API token.
+ *
+ * - `GET  /v1/capability-proxy/session` validates the token before workerd
+ *   starts. 200 → `{ scopes?: string[], expiresAt?: string }`.
+ * - `POST /v1/capability-proxy/call` with `{ path, args, conversationId? }`
+ *   where `path` is the runtime property path (`['kody', 'emailSend']`,
+ *   `['kody', 'mcp', server, tool]`, `['workflows', 'create']`) and `args`
+ *   is the positional argument list. 200 → `{ result }`.
+ *
+ * Errors use `{ error: { code, message } }` (a bare string is accepted too).
+ * 401 means the token is expired/revoked; 403 `feature_disabled` means the
+ * `local-execute` flag is off for the account.
+ */
+export const capabilityProxySessionPath = 'v1/capability-proxy/session';
+export const capabilityProxyCallPath = 'v1/capability-proxy/call';
+export class CapabilityProxyError extends Error {
+    status;
+    code;
+    constructor(message, options = {}) {
+        super(message);
+        this.name = 'CapabilityProxyError';
+        this.status = options.status ?? null;
+        this.code = options.code ?? null;
+    }
+}
+const loopbackHosts = new Set(['localhost', '127.0.0.1', '[::1]']);
+/** The bearer token must not cross the network in cleartext. */
+export function assertTokenSafeApiUrl(apiUrl) {
+    let url;
+    try {
+        url = new URL(apiUrl);
+    }
+    catch {
+        throw new Error(`Invalid Kody API URL: ${apiUrl}`);
+    }
+    if (url.protocol === 'https:')
+        return;
+    if (url.protocol === 'http:' && loopbackHosts.has(url.hostname))
+        return;
+    throw new Error(`Refusing to send the API token to ${url.origin}: use https (plain http is only allowed for localhost).`);
+}
+export function capabilityProxyUrl(apiUrl, path) {
+    const base = apiUrl.endsWith('/') ? apiUrl : `${apiUrl}/`;
+    return new URL(path, base);
+}
+export async function openCapabilityProxySession(input) {
+    const url = capabilityProxyUrl(input.apiUrl, capabilityProxySessionPath);
+    const response = await send(input, url, { method: 'GET' });
+    const body = await readJson(response);
+    if (!response.ok) {
+        throw describeFailure(response.status, body, url, 'session');
+    }
+    const record = isRecord(body) ? body : {};
+    return {
+        scopes: Array.isArray(record.scopes)
+            ? record.scopes.filter((scope) => typeof scope === 'string')
+            : [],
+        expiresAt: typeof record.expiresAt === 'string' ? record.expiresAt : null,
+    };
+}
+export async function callCapabilityProxy(input) {
+    const url = capabilityProxyUrl(input.apiUrl, capabilityProxyCallPath);
+    const payload = { path: input.path, args: input.args };
+    if (input.conversationId !== undefined)
+        payload.conversationId = input.conversationId;
+    const response = await send(input, url, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify(payload),
+    });
+    const body = await readJson(response);
+    if (!response.ok) {
+        throw describeFailure(response.status, body, url, 'call');
+    }
+    const failure = readErrorBody(body);
+    if (failure) {
+        throw new CapabilityProxyError(failure.message, { status: response.status, code: failure.code });
+    }
+    return isRecord(body) ? body.result : undefined;
+}
+async function send(input, url, init) {
+    const fetchFn = input.fetchFn ?? fetch;
+    try {
+        return await fetchFn(url, {
+            ...init,
+            signal: input.signal,
+            headers: {
+                ...init.headers,
+                accept: 'application/json',
+                authorization: `Bearer ${input.token}`,
+                'user-agent': `${cliName}/${readPackageVersion()}`,
+            },
+        });
+    }
+    catch (error) {
+        const reason = describeNetworkError(error);
+        throw new CapabilityProxyError(`Could not reach the Kody API at ${url.origin} (${reason}). Check --api-url / KODY_API_URL and your network.`);
+    }
+}
+async function readJson(response) {
+    const text = await response.text();
+    if (!text)
+        return null;
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return text;
+    }
+}
+function readErrorBody(body) {
+    if (!isRecord(body) || body.error == null)
+        return null;
+    const { error } = body;
+    if (typeof error === 'string')
+        return { code: null, message: error };
+    if (isRecord(error)) {
+        const code = typeof error.code === 'string' ? error.code : null;
+        const message = typeof error.message === 'string' ? error.message : code ?? JSON.stringify(error);
+        return { code, message };
+    }
+    return { code: null, message: String(error) };
+}
+function describeFailure(status, body, url, stage) {
+    const failure = readErrorBody(body);
+    const code = failure?.code ?? null;
+    const detail = failure?.message ? ` Server said: ${failure.message}` : '';
+    if (status === 401) {
+        return new CapabilityProxyError(`Kody rejected the API token (expired, revoked, or malformed). Mint a fresh scoped token and pass it with --token or ${apiTokenEnvVar}.${detail}`, { status, code });
+    }
+    if (code === 'feature_disabled') {
+        return new CapabilityProxyError('CapabilityProxy is not enabled for this Kody account (feature flag `local-execute`). Use `kody login` for MCP cloud execute, or ask the Kody team for access.', { status, code });
+    }
+    if (status === 403 && stage === 'session') {
+        return new CapabilityProxyError(`The API token is not allowed to use CapabilityProxy${code ? ` (${code})` : ''}. Mint a token with the local-execute scope (needed for both \`execute --local\` and token-auth cloud execute).${detail}`, { status, code });
+    }
+    if (status === 404 && stage === 'session') {
+        return new CapabilityProxyError(`CapabilityProxy was not found at ${url.href}. Local execute may not be deployed on this Kody API yet; check --api-url / KODY_API_URL.`, { status, code });
+    }
+    return new CapabilityProxyError(failure?.message ?? `Kody API request failed with HTTP ${status} (${url.pathname}).`, { status, code });
+}
+function isRecord(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+//# sourceMappingURL=capability-proxy.js.map

package/dist/capability-proxy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"capability-proxy.js","sourceRoot":"","sources":["../src/capability-proxy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAA;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AAEtD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,6BAA6B,CAAA;AACvE,MAAM,CAAC,MAAM,uBAAuB,GAAG,0BAA0B,CAAA;AAoBjE,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IACrC,MAAM,CAAe;IACrB,IAAI,CAAe;IAE5B,YACC,OAAe,EACf,UAA4D,EAAE;QAE9D,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAA;QAClC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,IAAI,CAAA;QACpC,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,IAAI,CAAA;IACjC,CAAC;CACD;AAED,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAA;AAElE,gEAAgE;AAChE,MAAM,UAAU,qBAAqB,CAAC,MAAc;IACnD,IAAI,GAAQ,CAAA;IACZ,IAAI,CAAC;QACJ,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAA;IACtB,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,KAAK,CAAC,yBAAyB,MAAM,EAAE,CAAC,CAAA;IACnD,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAM;IACrC,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAM;IACvE,MAAM,IAAI,KAAK,CACd,qCAAqC,GAAG,CAAC,MAAM,yDAAyD,CACxG,CAAA;AACF,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,MAAc,EAAE,IAAY;IAC9D,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,GAAG,CAAA;IACzD,OAAO,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;AAC3B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC/C,KAAiC;IAEjC,MAAM,GAAG,GAAG,kBAAkB,CAAC,KAAK,CAAC,MAAM,EAAE,0BAA0B,CAAC,CAAA;IACxE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAA;IAC1D,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAA;IACrC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QAClB,MAAM,eAAe,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,SAAS,CAAC,CAAA;IAC7D,CAAC;IACD,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAA;IACzC,OAAO;QACN,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;YACnC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;YAC7E,CAAC,CAAC,EAAE;QACL,SAAS,EAAE,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;KACzE,CAAA;AACF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACxC,KAAuD;IAEvD,MAAM,GAAG,GAAG,kBAAkB,CAAC,KAAK,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAA;IACrE,MAAM,OAAO,GAAwB,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAA;IAC3E,IAAI,KAAK,CAAC,cAAc,KAAK,SAAS;QAAE,OAAO,CAAC,cAAc,GAAG,KAAK,CAAC,cAAc,CAAA;IACrF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE;QACvC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;KAC7B,CAAC,CAAA;IACF,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAA;IACrC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QAClB,MAAM,eAAe,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,CAAA;IAC1D,CAAC;IACD,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,CAAA;IACnC,IAAI,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,oBAAoB,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAA;IACjG,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAA;AAChD,CAAC;AAED,KAAK,UAAU,IAAI,CAClB,KAAiC,EACjC,GAAQ,EACR,IAAiB;IAEjB,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,KAAK,CAAA;IACtC,IAAI,CAAC;QACJ,OAAO,MAAM,OAAO,CAAC,GAAG,EAAE;YACzB,GAAG,IAAI;YACP,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,OAAO,EAAE;gBACR,GAAI,IAAI,CAAC,OAA8C;gBACvD,MAAM,EAAE,kBAAkB;gBAC1B,aAAa,EAAE,UAAU,KAAK,CAAC,KAAK,EAAE;gBACtC,YAAY,EAAE,GAAG,OAAO,IAAI,kBAAkB,EAAE,EAAE;aAClD;SACD,CAAC,CAAA;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAA;QAC1C,MAAM,IAAI,oBAAoB,CAC7B,mCAAmC,GAAG,CAAC,MAAM,KAAK,MAAM,qDAAqD,CAC7G,CAAA;IACF,CAAC;AACF,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,QAAkB;IACzC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;IAClC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAA;IACtB,IAAI,CAAC;QACJ,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACxB,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA;IACZ,CAAC;AACF,CAAC;AAED,SAAS,aAAa,CAAC,IAAa;IACnC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI;QAAE,OAAO,IAAI,CAAA;IACtD,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAA;IACtB,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAA;IACpE,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,GAAG,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAA;QAC/D,MAAM,OAAO,GACZ,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;QAClF,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;IACzB,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAA;AAC9C,CAAC;AAED,SAAS,eAAe,CACvB,MAAc,EACd,IAAa,EACb,GAAQ,EACR,KAAyB;IAEzB,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,CAAA;IACnC,MAAM,IAAI,GAAG,OAAO,EAAE,IAAI,IAAI,IAAI,CAAA;IAClC,MAAM,MAAM,GAAG,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,iBAAiB,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IACzE,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACpB,OAAO,IAAI,oBAAoB,CAC9B,uHAAuH,cAAc,IAAI,MAAM,EAAE,EACjJ,EAAE,MAAM,EAAE,IAAI,EAAE,CAChB,CAAA;IACF,CAAC;IACD,IAAI,IAAI,KAAK,kBAAkB,EAAE,CAAC;QACjC,OAAO,IAAI,oBAAoB,CAC9B,+JAA+J,EAC/J,EAAE,MAAM,EAAE,IAAI,EAAE,CAChB,CAAA;IACF,CAAC;IACD,IAAI,MAAM,KAAK,GAAG,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QAC3C,OAAO,IAAI,oBAAoB,CAC9B,sDAAsD,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,kHAAkH,MAAM,EAAE,EACxM,EAAE,MAAM,EAAE,IAAI,EAAE,CAChB,CAAA;IACF,CAAC;IACD,IAAI,MAAM,KAAK,GAAG,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QAC3C,OAAO,IAAI,oBAAoB,CAC9B,oCAAoC,GAAG,CAAC,IAAI,2FAA2F,EACvI,EAAE,MAAM,EAAE,IAAI,EAAE,CAChB,CAAA;IACF,CAAC;IACD,OAAO,IAAI,oBAAoB,CAC9B,OAAO,EAAE,OAAO,IAAI,qCAAqC,MAAM,KAAK,GAAG,CAAC,QAAQ,IAAI,EACpF,EAAE,MAAM,EAAE,IAAI,EAAE,CAChB,CAAA;AACF,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;AAC5E,CAAC"}

package/dist/cli.d.ts

@@ -1,4 +1,8 @@
+export { readApiToken, requireApiToken as resolveApiToken } from './api-token.js';
 export type CommandName = 'login' | 'logout' | 'status' | 'whoami' | 'search' | 'execute' | 'install' | 'skill' | 'help' | 'version';
+export declare function apiUrlFrom(values: {
+    apiUrl?: string;
+}, env?: NodeJS.ProcessEnv): string;
 declare function parseKnown(args: Array<string>): {
     values: {
         [longOption: string]: string | boolean | undefined;
@@ -15,6 +19,9 @@ declare function parseKnown(args: Array<string>): {
         invoke?: string | boolean | undefined;
         params?: string | boolean | undefined;
         'conversation-id'?: string | boolean | undefined;
+        local?: string | boolean | undefined;
+        token?: string | boolean | undefined;
+        'api-url'?: string | boolean | undefined;
         project?: string | boolean | undefined;
         'no-browser'?: string | boolean | undefined;
         clients?: string | boolean | undefined;
@@ -48,4 +55,19 @@ export declare function buildExecuteToolArgs(input: {
     paramsJson?: string;
     conversationId?: string;
 }): Record<string, unknown>;
-export {};
+/**
+ * Prefer a scoped API token when the user passed `--token`, or when
+ * `KODY_API_TOKEN` is set and there is no stored `kody login` session.
+ * Logged-in MCP OAuth still wins over an env-only token so a leftover
+ * `KODY_API_TOKEN` does not hijack cloud MCP commands.
+ */
+export declare function shouldUseApiToken(input: {
+    tokenValues: {
+        token?: string;
+    };
+    mcpUrl: string;
+    allowEnvWithoutLogin: boolean;
+    env?: NodeJS.ProcessEnv;
+    /** Override session detection (tests). */
+    hasSession?: boolean;
+}): boolean;

package/dist/cli.js

@@ -1,17 +1,25 @@
 import { parseArgs } from 'node:util';
 import { readFile } from 'node:fs/promises';
-import { defaultMcpUrl, modernMcpProtocolVersion } from './defaults.js';
+import { hasExplicitTokenFlag, readApiToken, requireApiToken, } from './api-token.js';
+import { defaultApiUrl, defaultMcpUrl, modernMcpProtocolVersion } from './defaults.js';
 import { usage } from './help.js';
 import { ensureFreshCredentials, login } from './auth.js';
 import { deleteCredentials, loadCredentials } from './store.js';
 import { callKodyTool, formatToolResult, listKodyTools } from './mcp.js';
 import { runInstall } from './install.js';
+import { runLocalExecute } from './local-execute.js';
+import { searchWithApiToken, whoamiWithApiToken } from './open-api-client.js';
+import { runRemoteExecuteWithToken } from './remote-execute.js';
 import { installSkill } from './skill.js';
 import { readPackageVersion } from './package-info.js';
 import { redactError } from './redact.js';
+export { readApiToken, requireApiToken as resolveApiToken } from './api-token.js';
 function mcpUrlFrom(values) {
     return values.mcpUrl || process.env.KODY_MCP_URL || defaultMcpUrl;
 }
+export function apiUrlFrom(values, env = process.env) {
+    return values.apiUrl || env.KODY_API_URL || defaultApiUrl;
+}
 function parseKnown(args) {
     return parseArgs({
         args,
@@ -30,6 +38,9 @@ function parseKnown(args) {
             invoke: { type: 'string' },
             params: { type: 'string' },
             'conversation-id': { type: 'string' },
+            local: { type: 'boolean' },
+            token: { type: 'string' },
+            'api-url': { type: 'string' },
             project: { type: 'boolean' },
             'no-browser': { type: 'boolean' },
             clients: { type: 'string' },
@@ -73,14 +84,14 @@ export async function runCli(argv = process.argv.slice(2), io = {}) {
             write(usage);
             return 0;
         }
-        return await dispatch(parsed, write);
+        return await dispatch(parsed, write, writeErr);
     }
     catch (error) {
         writeErr(`${redactError(error).message}\n`);
         return 1;
     }
 }
-async function dispatch(parsed, write) {
+async function dispatch(parsed, write, writeErr) {
     const mcpUrl = mcpUrlFrom({
         mcpUrl: typeof parsed.values['mcp-url'] === 'string' ? parsed.values['mcp-url'] : undefined,
     });
@@ -135,6 +146,34 @@ async function dispatch(parsed, write) {
             return 0;
         }
         case 'whoami': {
+            const tokenValues = tokenFlagValues(parsed.values);
+            if (shouldUseApiToken({ tokenValues, mcpUrl, allowEnvWithoutLogin: true })) {
+                const identity = await whoamiWithApiToken({
+                    token: requireApiToken(tokenValues, process.env, 'whoami'),
+                    apiUrl: apiUrlFrom({
+                        apiUrl: typeof parsed.values['api-url'] === 'string'
+                            ? parsed.values['api-url']
+                            : undefined,
+                    }),
+                });
+                if (json) {
+                    write(`${JSON.stringify(identity, null, 2)}\n`);
+                    return 0;
+                }
+                const scopeLine = identity.token.scopes.join(', ') || '(none)';
+                const userLine = identity.user
+                    ? `${identity.user.displayName} <${identity.user.email}>`
+                    : '(account:read not on this token)';
+                write([
+                    `api: ${identity.apiUrl}`,
+                    `auth: API token (${identity.token.id})`,
+                    `user: ${userLine}`,
+                    `scopes: ${scopeLine}`,
+                    `expires: ${identity.token.expiresAt ?? 'unknown'}`,
+                    '',
+                ].join('\n'));
+                return 0;
+            }
             const credentials = await ensureFreshCredentials({ mcpUrl });
             const tools = await listKodyTools({ mcpUrl });
             if (json) {
@@ -151,6 +190,25 @@ async function dispatch(parsed, write) {
         }
         case 'search': {
             const query = parsed.positionals.join(' ').trim();
+            const tokenValues = tokenFlagValues(parsed.values);
+            if (shouldUseApiToken({ tokenValues, mcpUrl, allowEnvWithoutLogin: true })) {
+                const result = await searchWithApiToken({
+                    token: requireApiToken(tokenValues, process.env, 'search'),
+                    apiUrl: apiUrlFrom({
+                        apiUrl: typeof parsed.values['api-url'] === 'string'
+                            ? parsed.values['api-url']
+                            : undefined,
+                    }),
+                    query: query || undefined,
+                    entity: typeof parsed.values.entity === 'string' ? parsed.values.entity : undefined,
+                    domain: typeof parsed.values.domain === 'string' ? parsed.values.domain : undefined,
+                    limit: typeof parsed.values.limit === 'string'
+                        ? Number(parsed.values.limit)
+                        : undefined,
+                });
+                write(formatToolResult(result, json));
+                return result.isError ? 1 : 0;
+            }
             const args = {};
             if (query)
                 args.query = query;
@@ -169,6 +227,11 @@ async function dispatch(parsed, write) {
             const hasCodeFlag = typeof parsed.values.code === 'string';
             const hasFileFlag = typeof parsed.values.file === 'string';
             const positionalModule = parsed.positionals.join('\n').trim();
+            const local = parsed.values.local === true;
+            const tokenValues = tokenFlagValues(parsed.values);
+            if (local && invoke !== undefined) {
+                throw new Error('--invoke runs a saved package export in Kody; --local runs a module you provide (--code, --file, or a module string).');
+            }
             if (executeSourcesConflict({ invoke, hasCodeFlag, hasFileFlag, positionalModule })) {
                 throw new Error('--invoke cannot be combined with --code, --file, or a module string.');
             }
@@ -189,7 +252,36 @@ async function dispatch(parsed, write) {
                     ? parsed.values['conversation-id']
                     : undefined,
             });
-            const result = await callKodyTool({ name: 'execute', args, mcpUrl });
+            const apiUrl = apiUrlFrom({
+                apiUrl: typeof parsed.values['api-url'] === 'string'
+                    ? parsed.values['api-url']
+                    : undefined,
+            });
+            const useToken = local ||
+                shouldUseApiToken({
+                    tokenValues,
+                    mcpUrl,
+                    allowEnvWithoutLogin: true,
+                });
+            const result = local
+                ? await runLocalExecute({
+                    code: args.code,
+                    params: args.params,
+                    conversationId: args.conversationId,
+                    token: requireApiToken(tokenValues, process.env, 'execute --local'),
+                    apiUrl,
+                    onStatus: (message) => writeErr(`${message}\n`),
+                })
+                : useToken
+                    ? await runRemoteExecuteWithToken({
+                        code: typeof args.code === 'string' ? args.code : undefined,
+                        invoke,
+                        params: args.params,
+                        conversationId: args.conversationId,
+                        token: requireApiToken(tokenValues, process.env, 'execute with an API token'),
+                        apiUrl,
+                    })
+                    : await callKodyTool({ name: 'execute', args, mcpUrl });
             write(formatToolResult(result, json));
             return result.isError ? 1 : 0;
         }
@@ -260,4 +352,25 @@ function attachExecuteCommonArgs(args, input) {
     }
     return args;
 }
+function tokenFlagValues(values) {
+    return {
+        token: typeof values.token === 'string' ? values.token : undefined,
+    };
+}
+/**
+ * Prefer a scoped API token when the user passed `--token`, or when
+ * `KODY_API_TOKEN` is set and there is no stored `kody login` session.
+ * Logged-in MCP OAuth still wins over an env-only token so a leftover
+ * `KODY_API_TOKEN` does not hijack cloud MCP commands.
+ */
+export function shouldUseApiToken(input) {
+    if (hasExplicitTokenFlag(input.tokenValues))
+        return true;
+    if (!input.allowEnvWithoutLogin)
+        return false;
+    if (!readApiToken(input.tokenValues, input.env))
+        return false;
+    const loggedIn = input.hasSession ?? loadCredentials(input.mcpUrl) != null;
+    return !loggedIn;
+}
 //# sourceMappingURL=cli.js.map