@kodycodes/cli 1.3.0 → 1.5.0

package/dist/local-runtime-source.js

@@ -0,0 +1,199 @@
+/**
+ * Sources for the workerd process behind `execute --local`. User code sees the
+ * same `kody:runtime` surface as ad hoc cloud execute; every call becomes a
+ * `{ path, args }` hop to the CLI's loopback bridge, which adds the API token
+ * and forwards it to CapabilityProxy. The token never enters workerd.
+ */
+export const localExecuteCompatibilityDate = '2026-04-16';
+export const localExecuteCompatibilityFlags = ['nodejs_compat'];
+export const localWorkerModuleNames = {
+    entry: '__kody_local_entry.js',
+    user: 'main.js',
+    runtime: 'kody:runtime',
+};
+/** Header carrying the per-run secret on workerd → bridge and CLI → workerd hops. */
+export const runSecretHeader = 'x-kody-run-secret';
+export const runSecretEnvVar = 'KODY_RUN_SECRET';
+export function createLocalRuntimeModuleSource() {
+    return `
+let __kodyBridge = null;
+
+export function __kodyInstallLocalBridge(bridge) {
+	__kodyBridge = bridge;
+}
+
+function __kodyCall(path, args) {
+	if (__kodyBridge === null) {
+		throw new Error('kody:runtime is only available while an execute --local run is in progress.');
+	}
+	return __kodyBridge(path, args);
+}
+
+function __kodyNamespace(path) {
+	const label = '[KodyRuntime:' + path.join('.') + ']';
+	return new Proxy(function () {}, {
+		get(_target, property) {
+			if (typeof property === 'symbol' || property === 'then' || property === 'toJSON') {
+				return undefined;
+			}
+			if (property === 'toString' || property === 'inspect') return () => label;
+			return __kodyNamespace([...path, property]);
+		},
+		apply(_target, _thisArg, args) {
+			return __kodyCall(path, args);
+		},
+	});
+}
+
+export const kody = __kodyNamespace(['kody']);
+
+export const workflows = {
+	create: async (input) => await __kodyCall(['workflows', 'create'], [input ?? {}]),
+};
+
+export const packages = {
+	invoke: async (specifier, options) => {
+		if (typeof specifier !== 'string') {
+			throw new Error(
+				'Object-only packages.invoke was removed. Use a static import (import fn from "kody:@owner/package/export") when the name is known, or import(specifier) when the name is data.',
+			);
+		}
+		return await __kodyCall(['packages', 'invoke'], [specifier, options ?? {}]);
+	},
+};
+
+export function packageStorage() {
+	throw new Error(
+		'packageStorage() requires package provenance: this module was not bundled from a saved package and the run has no package context. ' +
+			'Ad hoc execute has no scratch SQLite helper. Persist durable state from a saved package with packageStorage().',
+	);
+}
+
+function __kodyPackageSecretsUnavailable() {
+	throw new Error(
+		'packageSecrets is not available in this execution context. It is bound for stamped saved-package modules and saved-package runtime contexts.',
+	);
+}
+
+export const packageSecrets = {
+	get: async () => __kodyPackageSecretsUnavailable(),
+	has: async () => __kodyPackageSecretsUnavailable(),
+};
+export const packageContext = Object.freeze({});
+export const email = null;
+export const events = null;
+export const createAuthenticatedFetch = undefined;
+export const secretHeaders = undefined;
+export const oauthClientCredentials = undefined;
+
+const __kodyRuntimeDefault = Object.freeze({
+	kody,
+	packageStorage,
+	createAuthenticatedFetch,
+	secretHeaders,
+	oauthClientCredentials,
+	packageContext,
+	packageSecrets,
+	email,
+	workflows,
+	packages,
+	events,
+});
+export default __kodyRuntimeDefault;
+export const KodyRuntime = Object.freeze({ defaultValue: __kodyRuntimeDefault });
+`.trimStart();
+}
+export function createLocalEntrySource() {
+    return `
+import { __kodyInstallLocalBridge } from ${JSON.stringify(localWorkerModuleNames.runtime)};
+
+const __kodyRunSecretHeader = ${JSON.stringify(runSecretHeader)};
+let __kodyClaimed = false;
+
+function __kodyFormatLogArgs(args) {
+	return args.map(String).join(' ');
+}
+
+export default {
+	async fetch(request, env) {
+		const secret = env.${runSecretEnvVar};
+		if (__kodyClaimed || !secret || request.headers.get(__kodyRunSecretHeader) !== secret) {
+			return new Response('Forbidden', { status: 403 });
+		}
+		__kodyClaimed = true;
+		const { params } = await request.json();
+		__kodyInstallLocalBridge(async (path, args) => {
+			const response = await env.KODY_BRIDGE.fetch('http://kody-bridge/call', {
+				method: 'POST',
+				headers: { 'content-type': 'application/json', [__kodyRunSecretHeader]: secret },
+				body: JSON.stringify({ path, args }),
+			});
+			const data = await response.json();
+			if (data.error) throw new Error(data.error);
+			return data.result;
+		});
+		const logs = [];
+		const nativeConsole = globalThis.console;
+		globalThis.console = {
+			...nativeConsole,
+			log: (...a) => { logs.push(__kodyFormatLogArgs(a)); },
+			info: (...a) => { logs.push('[info] ' + __kodyFormatLogArgs(a)); },
+			debug: (...a) => { logs.push('[debug] ' + __kodyFormatLogArgs(a)); },
+			warn: (...a) => { logs.push('[warn] ' + __kodyFormatLogArgs(a)); },
+			error: (...a) => { logs.push('[error] ' + __kodyFormatLogArgs(a)); },
+		};
+		try {
+			const module = await import(${JSON.stringify(`./${localWorkerModuleNames.user}`)});
+			if (typeof module?.default !== 'function') {
+				throw new Error('Kody execute modules must default export a function.');
+			}
+			const result = await module.default(params);
+			return new Response(JSON.stringify({ result, logs }), {
+				headers: { 'content-type': 'application/json' },
+			});
+		} catch (error) {
+			const message = error instanceof Error ? error.message : String(error);
+			return Response.json({ error: message, logs });
+		} finally {
+			globalThis.console = nativeConsole;
+		}
+	},
+};
+`.trimStart();
+}
+/**
+ * workerd text config. `files` are embedded relative to the config file.
+ * Outbound fetch reaches public and private networks: local execute runs as
+ * the user on their own machine, and reaching local services is part of why
+ * one would run locally.
+ */
+export function createWorkerdConfig(input) {
+    const flags = localExecuteCompatibilityFlags.map((flag) => JSON.stringify(flag)).join(', ');
+    return `using Workerd = import "/workerd/workerd.capnp";
+
+const config :Workerd.Config = (
+  services = [
+    (name = "main", worker = .kodyWorker),
+    (name = "kody-bridge", external = (address = "127.0.0.1:${input.bridgePort}", http = ())),
+    (name = "internet", network = (allow = ["public", "private", "local"], tlsOptions = (trustBrowserCas = true))),
+  ],
+  sockets = [ (name = "http", address = "127.0.0.1:0", http = (), service = "main") ],
+);
+
+const kodyWorker :Workerd.Worker = (
+  modules = [
+    (name = ${JSON.stringify(localWorkerModuleNames.entry)}, esModule = embed ${JSON.stringify(input.files.entry)}),
+    (name = ${JSON.stringify(localWorkerModuleNames.user)}, esModule = embed ${JSON.stringify(input.files.user)}),
+    (name = ${JSON.stringify(localWorkerModuleNames.runtime)}, esModule = embed ${JSON.stringify(input.files.runtime)}),
+  ],
+  compatibilityDate = ${JSON.stringify(localExecuteCompatibilityDate)},
+  compatibilityFlags = [${flags}],
+  globalOutbound = "internet",
+  bindings = [
+    (name = "KODY_BRIDGE", service = "kody-bridge"),
+    (name = ${JSON.stringify(runSecretEnvVar)}, fromEnvironment = ${JSON.stringify(runSecretEnvVar)}),
+  ],
+);
+`;
+}
+//# sourceMappingURL=local-runtime-source.js.map

package/dist/local-runtime-source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-runtime-source.js","sourceRoot":"","sources":["../src/local-runtime-source.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,CAAC,MAAM,6BAA6B,GAAG,YAAY,CAAA;AACzD,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,eAAe,CAAU,CAAA;AAExE,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACrC,KAAK,EAAE,uBAAuB;IAC9B,IAAI,EAAE,SAAS;IACf,OAAO,EAAE,cAAc;CACd,CAAA;AAEV,qFAAqF;AACrF,MAAM,CAAC,MAAM,eAAe,GAAG,mBAAmB,CAAA;AAClD,MAAM,CAAC,MAAM,eAAe,GAAG,iBAAiB,CAAA;AAEhD,MAAM,UAAU,8BAA8B;IAC7C,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsFP,CAAC,SAAS,EAAE,CAAA;AACb,CAAC;AAED,MAAM,UAAU,sBAAsB;IACrC,OAAO;2CACmC,IAAI,CAAC,SAAS,CAAC,sBAAsB,CAAC,OAAO,CAAC;;gCAEzD,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC;;;;;;;;;uBASxC,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;iCA2BL,IAAI,CAAC,SAAS,CAAC,KAAK,sBAAsB,CAAC,IAAI,EAAE,CAAC;;;;;;;;;;;;;;;;CAgBlF,CAAC,SAAS,EAAE,CAAA;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAGnC;IACA,MAAM,KAAK,GAAG,8BAA8B,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC3F,OAAO;;;;;8DAKsD,KAAK,CAAC,UAAU;;;;;;;;cAQhE,IAAI,CAAC,SAAS,CAAC,sBAAsB,CAAC,KAAK,CAAC,sBAAsB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC;cACnG,IAAI,CAAC,SAAS,CAAC,sBAAsB,CAAC,IAAI,CAAC,sBAAsB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC;cACjG,IAAI,CAAC,SAAS,CAAC,sBAAsB,CAAC,OAAO,CAAC,sBAAsB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC;;wBAE7F,IAAI,CAAC,SAAS,CAAC,6BAA6B,CAAC;0BAC3C,KAAK;;;;cAIjB,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,uBAAuB,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC;;;CAGlG,CAAA;AACD,CAAC"}

package/dist/network-error.d.ts

@@ -0,0 +1,2 @@
+/** `fetch failed` alone hides why; undici puts ECONNREFUSED / ENOTFOUND on `cause.code`. */
+export declare function describeNetworkError(error: unknown): string;

package/dist/network-error.js

@@ -0,0 +1,11 @@
+/** `fetch failed` alone hides why; undici puts ECONNREFUSED / ENOTFOUND on `cause.code`. */
+export function describeNetworkError(error) {
+    if (!(error instanceof Error))
+        return String(error);
+    const cause = error.cause;
+    const causeCode = cause && typeof cause === 'object' && 'code' in cause && typeof cause.code === 'string'
+        ? cause.code
+        : null;
+    return causeCode ? `${error.message}: ${causeCode}` : error.message;
+}
+//# sourceMappingURL=network-error.js.map

package/dist/network-error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"network-error.js","sourceRoot":"","sources":["../src/network-error.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,MAAM,UAAU,oBAAoB,CAAC,KAAc;IAClD,IAAI,CAAC,CAAC,KAAK,YAAY,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAA;IACnD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAA;IACzB,MAAM,SAAS,GACd,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,IAAI,KAAK,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;QACtF,CAAC,CAAC,KAAK,CAAC,IAAI;QACZ,CAAC,CAAC,IAAI,CAAA;IACR,OAAO,SAAS,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAA;AACpE,CAAC"}

package/dist/open-api-client.d.ts

@@ -0,0 +1,40 @@
+import type { ToolCallResult } from './mcp.js';
+export type OpenApiClientInput = {
+    apiUrl?: string;
+    token: string;
+    fetchFn?: typeof fetch;
+};
+export declare class OpenApiError extends Error {
+    readonly status: number | null;
+    readonly code: string | null;
+    constructor(message: string, options?: {
+        status?: number | null;
+        code?: string | null;
+    });
+}
+export declare function openApiGet(input: OpenApiClientInput & {
+    path: string;
+    query?: Record<string, string | number | undefined>;
+}): Promise<unknown>;
+export declare function searchWithApiToken(input: OpenApiClientInput & {
+    query?: string;
+    domain?: string;
+    limit?: number;
+    entity?: string;
+}): Promise<ToolCallResult>;
+export declare function whoamiWithApiToken(input: OpenApiClientInput): Promise<{
+    mcpUrl?: undefined;
+    apiUrl: string;
+    token: {
+        id: string;
+        name: string | null;
+        scopes: Array<string>;
+        expiresAt: string | null;
+        maxExpiresAt: string | null;
+    };
+    user: {
+        userId: string;
+        email: string;
+        displayName: string;
+    } | null;
+}>;

package/dist/open-api-client.js

@@ -0,0 +1,152 @@
+import { apiTokenEnvVar, cliName, defaultApiUrl } from './defaults.js';
+import { assertTokenSafeApiUrl, capabilityProxyUrl } from './capability-proxy.js';
+import { describeNetworkError } from './network-error.js';
+import { readPackageVersion } from './package-info.js';
+export class OpenApiError extends Error {
+    status;
+    code;
+    constructor(message, options = {}) {
+        super(message);
+        this.name = 'OpenApiError';
+        this.status = options.status ?? null;
+        this.code = options.code ?? null;
+    }
+}
+export async function openApiGet(input) {
+    const apiUrl = input.apiUrl || defaultApiUrl;
+    assertTokenSafeApiUrl(apiUrl);
+    const url = capabilityProxyUrl(apiUrl, input.path);
+    if (input.query) {
+        for (const [key, value] of Object.entries(input.query)) {
+            if (value === undefined || value === '')
+                continue;
+            url.searchParams.set(key, String(value));
+        }
+    }
+    const fetchFn = input.fetchFn ?? fetch;
+    let response;
+    try {
+        response = await fetchFn(url, {
+            method: 'GET',
+            headers: {
+                accept: 'application/json',
+                authorization: `Bearer ${input.token}`,
+                'user-agent': `${cliName}/${readPackageVersion()}`,
+            },
+        });
+    }
+    catch (error) {
+        const reason = describeNetworkError(error);
+        throw new OpenApiError(`Could not reach the Kody API at ${url.origin} (${reason}). Check --api-url / KODY_API_URL and your network.`);
+    }
+    const body = await readJson(response);
+    if (!response.ok) {
+        throw describeOpenApiFailure(response.status, body, url);
+    }
+    return body;
+}
+export async function searchWithApiToken(input) {
+    if (input.entity) {
+        throw new OpenApiError(`Open API search does not support --entity yet. Run \`kody login\` and use MCP search, or omit --entity.`, { status: null, code: 'unsupported' });
+    }
+    const body = await openApiGet({
+        ...input,
+        path: 'v1/search',
+        query: {
+            query: input.query,
+            domain: input.domain,
+            limit: input.limit,
+        },
+    });
+    const text = JSON.stringify(body, null, 2);
+    return {
+        content: [{ type: 'text', text }],
+        structuredContent: body,
+        isError: false,
+    };
+}
+export async function whoamiWithApiToken(input) {
+    const apiUrl = input.apiUrl || defaultApiUrl;
+    const current = (await openApiGet({
+        ...input,
+        apiUrl,
+        path: 'v1/tokens/current',
+    }));
+    let user = null;
+    try {
+        const me = (await openApiGet({
+            ...input,
+            apiUrl,
+            path: 'v1/me',
+        }));
+        user = {
+            userId: String(me.user_id ?? ''),
+            email: String(me.email ?? ''),
+            displayName: String(me.display_name ?? ''),
+        };
+    }
+    catch (error) {
+        // account:read is optional; tokens/current needs no scope.
+        if (!(error instanceof OpenApiError && error.status === 403))
+            throw error;
+    }
+    return {
+        apiUrl,
+        token: {
+            id: String(current.id ?? ''),
+            name: typeof current.name === 'string' ? current.name : null,
+            scopes: Array.isArray(current.scopes)
+                ? current.scopes.filter((scope) => typeof scope === 'string')
+                : [],
+            expiresAt: typeof current.expires_at === 'string' ? current.expires_at : null,
+            maxExpiresAt: typeof current.max_expires_at === 'string' ? current.max_expires_at : null,
+        },
+        user,
+    };
+}
+async function readJson(response) {
+    const text = await response.text();
+    if (!text)
+        return null;
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return text;
+    }
+}
+function readErrorBody(body) {
+    if (!isRecord(body) || body.error == null)
+        return null;
+    const { error } = body;
+    if (typeof error === 'string')
+        return { code: null, message: error };
+    if (isRecord(error)) {
+        const code = typeof error.code === 'string' ? error.code : null;
+        const message = typeof error.message === 'string' ? error.message : code ?? JSON.stringify(error);
+        return { code, message };
+    }
+    return { code: null, message: String(error) };
+}
+function describeOpenApiFailure(status, body, url) {
+    const failure = readErrorBody(body);
+    const code = failure?.code ?? null;
+    const detail = failure?.message ? ` Server said: ${failure.message}` : '';
+    if (status === 401) {
+        return new OpenApiError(`Kody rejected the API token (expired, revoked, or malformed). Mint a fresh scoped token and pass it with --token or ${apiTokenEnvVar}.${detail}`, { status, code });
+    }
+    if (status === 403 && code === 'insufficient_scope') {
+        const required = isRecord(body) && isRecord(body.error) && isRecord(body.error.details)
+            ? body.error.details.required_scope
+            : null;
+        const scopeHint = typeof required === 'string'
+            ? ` Mint a token that includes "${required}".`
+            : ' Mint a token with the required scope.';
+        return new OpenApiError(`The API token is missing a required scope.${scopeHint}${detail}`, { status, code });
+    }
+    return new OpenApiError(failure?.message ?? `Kody API request failed with HTTP ${status} (${url.pathname}).`, { status, code });
+}
+function isRecord(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+//# sourceMappingURL=open-api-client.js.map

package/dist/open-api-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"open-api-client.js","sourceRoot":"","sources":["../src/open-api-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AACtE,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAA;AACjF,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAA;AAEzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AAQtD,MAAM,OAAO,YAAa,SAAQ,KAAK;IAC7B,MAAM,CAAe;IACrB,IAAI,CAAe;IAE5B,YACC,OAAe,EACf,UAA4D,EAAE;QAE9D,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,cAAc,CAAA;QAC1B,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,IAAI,CAAA;QACpC,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,IAAI,CAAA;IACjC,CAAC;CACD;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC/B,KAAiG;IAEjG,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,aAAa,CAAA;IAC5C,qBAAqB,CAAC,MAAM,CAAC,CAAA;IAC7B,MAAM,GAAG,GAAG,kBAAkB,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAA;IAClD,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QACjB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YACxD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE;gBAAE,SAAQ;YACjD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAA;QACzC,CAAC;IACF,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,KAAK,CAAA;IACtC,IAAI,QAAkB,CAAA;IACtB,IAAI,CAAC;QACJ,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE;YAC7B,MAAM,EAAE,KAAK;YACb,OAAO,EAAE;gBACR,MAAM,EAAE,kBAAkB;gBAC1B,aAAa,EAAE,UAAU,KAAK,CAAC,KAAK,EAAE;gBACtC,YAAY,EAAE,GAAG,OAAO,IAAI,kBAAkB,EAAE,EAAE;aAClD;SACD,CAAC,CAAA;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAA;QAC1C,MAAM,IAAI,YAAY,CACrB,mCAAmC,GAAG,CAAC,MAAM,KAAK,MAAM,qDAAqD,CAC7G,CAAA;IACF,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAA;IACrC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QAClB,MAAM,sBAAsB,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,CAAA;IACzD,CAAC;IACD,OAAO,IAAI,CAAA;AACZ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,KAKxC;IACA,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QAClB,MAAM,IAAI,YAAY,CACrB,yGAAyG,EACzG,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE,CACrC,CAAA;IACF,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC;QAC7B,GAAG,KAAK;QACR,IAAI,EAAE,WAAW;QACjB,KAAK,EAAE;YACN,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,KAAK,EAAE,KAAK,CAAC,KAAK;SAClB;KACD,CAAC,CAAA;IACF,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;IAC1C,OAAO;QACN,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QACjC,iBAAiB,EAAE,IAAI;QACvB,OAAO,EAAE,KAAK;KACd,CAAA;AACF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACvC,KAAyB;IAazB,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,aAAa,CAAA;IAC5C,MAAM,OAAO,GAAG,CAAC,MAAM,UAAU,CAAC;QACjC,GAAG,KAAK;QACR,MAAM;QACN,IAAI,EAAE,mBAAmB;KACzB,CAAC,CAA4B,CAAA;IAE9B,IAAI,IAAI,GAAkE,IAAI,CAAA;IAC9E,IAAI,CAAC;QACJ,MAAM,EAAE,GAAG,CAAC,MAAM,UAAU,CAAC;YAC5B,GAAG,KAAK;YACR,MAAM;YACN,IAAI,EAAE,OAAO;SACb,CAAC,CAA4B,CAAA;QAC9B,IAAI,GAAG;YACN,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,OAAO,IAAI,EAAE,CAAC;YAChC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC;YAC7B,WAAW,EAAE,MAAM,CAAC,EAAE,CAAC,YAAY,IAAI,EAAE,CAAC;SAC1C,CAAA;IACF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,2DAA2D;QAC3D,IAAI,CAAC,CAAC,KAAK,YAAY,YAAY,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,CAAC;YAAE,MAAM,KAAK,CAAA;IAC1E,CAAC;IAED,OAAO;QACN,MAAM;QACN,KAAK,EAAE;YACN,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC;YAC5B,IAAI,EAAE,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;YAC5D,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;gBACpC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;gBAC9E,CAAC,CAAC,EAAE;YACL,SAAS,EAAE,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI;YAC7E,YAAY,EAAE,OAAO,OAAO,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI;SACxF;QACD,IAAI;KACJ,CAAA;AACF,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,QAAkB;IACzC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;IAClC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAA;IACtB,IAAI,CAAC;QACJ,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACxB,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA;IACZ,CAAC;AACF,CAAC;AAED,SAAS,aAAa,CAAC,IAAa;IACnC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI;QAAE,OAAO,IAAI,CAAA;IACtD,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAA;IACtB,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAA;IACpE,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,GAAG,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAA;QAC/D,MAAM,OAAO,GACZ,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;QAClF,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;IACzB,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAA;AAC9C,CAAC;AAED,SAAS,sBAAsB,CAAC,MAAc,EAAE,IAAa,EAAE,GAAQ;IACtE,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,CAAA;IACnC,MAAM,IAAI,GAAG,OAAO,EAAE,IAAI,IAAI,IAAI,CAAA;IAClC,MAAM,MAAM,GAAG,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,iBAAiB,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IACzE,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACpB,OAAO,IAAI,YAAY,CACtB,uHAAuH,cAAc,IAAI,MAAM,EAAE,EACjJ,EAAE,MAAM,EAAE,IAAI,EAAE,CAChB,CAAA;IACF,CAAC;IACD,IAAI,MAAM,KAAK,GAAG,IAAI,IAAI,KAAK,oBAAoB,EAAE,CAAC;QACrD,MAAM,QAAQ,GACb,QAAQ,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;YACrE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc;YACnC,CAAC,CAAC,IAAI,CAAA;QACR,MAAM,SAAS,GACd,OAAO,QAAQ,KAAK,QAAQ;YAC3B,CAAC,CAAC,gCAAgC,QAAQ,IAAI;YAC9C,CAAC,CAAC,wCAAwC,CAAA;QAC5C,OAAO,IAAI,YAAY,CACtB,6CAA6C,SAAS,GAAG,MAAM,EAAE,EACjE,EAAE,MAAM,EAAE,IAAI,EAAE,CAChB,CAAA;IACF,CAAC;IACD,OAAO,IAAI,YAAY,CACtB,OAAO,EAAE,OAAO,IAAI,qCAAqC,MAAM,KAAK,GAAG,CAAC,QAAQ,IAAI,EACpF,EAAE,MAAM,EAAE,IAAI,EAAE,CAChB,CAAA;AACF,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;AAC5E,CAAC"}

package/dist/remote-execute.d.ts

@@ -0,0 +1,28 @@
+import type { ToolCallResult } from './mcp.js';
+export type RemoteExecuteInput = {
+    code?: string;
+    invoke?: string;
+    params?: unknown;
+    conversationId?: string;
+    token: string;
+    apiUrl: string;
+    fetchFn?: typeof fetch;
+};
+/**
+ * Cloud (non-`--local`) execute authenticated only with a scoped API token:
+ * CapabilityProxy session + `kody.execute`. The module runs in Kody's cloud
+ * sandbox; no `kody login` and no local workerd.
+ *
+ * Requires the `local-execute` feature flag and token scope (same as
+ * `execute --local`).
+ */
+export declare function runRemoteExecuteWithToken(input: RemoteExecuteInput): Promise<ToolCallResult>;
+export declare function resolveRemoteExecuteCode(input: {
+    code?: string;
+    invoke?: string;
+}): string;
+/**
+ * Map `kody.execute` capability output (returned as CapabilityProxy `result`)
+ * into the same ToolCallResult envelope MCP execute / local execute use.
+ */
+export declare function formatExecuteCapabilityResult(payload: unknown): ToolCallResult;

package/dist/remote-execute.js

@@ -0,0 +1,99 @@
+import { assertTokenSafeApiUrl, callCapabilityProxy, openCapabilityProxySession, } from './capability-proxy.js';
+import { resolveExecuteInvokeCode } from './invoke-passthrough.js';
+/**
+ * Cloud (non-`--local`) execute authenticated only with a scoped API token:
+ * CapabilityProxy session + `kody.execute`. The module runs in Kody's cloud
+ * sandbox; no `kody login` and no local workerd.
+ *
+ * Requires the `local-execute` feature flag and token scope (same as
+ * `execute --local`).
+ */
+export async function runRemoteExecuteWithToken(input) {
+    assertTokenSafeApiUrl(input.apiUrl);
+    const code = resolveRemoteExecuteCode(input);
+    const client = { apiUrl: input.apiUrl, token: input.token, fetchFn: input.fetchFn };
+    await openCapabilityProxySession(client);
+    const args = { code };
+    if (input.params !== undefined)
+        args.params = input.params;
+    if (input.conversationId !== undefined)
+        args.conversationId = input.conversationId;
+    const payload = await callCapabilityProxy({
+        ...client,
+        path: ['kody', 'execute'],
+        args: [args],
+        conversationId: input.conversationId,
+    });
+    return formatExecuteCapabilityResult(payload);
+}
+export function resolveRemoteExecuteCode(input) {
+    const code = input.code?.trim() ? input.code : undefined;
+    const invoke = input.invoke?.trim() ? input.invoke : undefined;
+    if (code && invoke) {
+        throw new Error('--invoke cannot be combined with --code, --file, or a module string.');
+    }
+    if (invoke)
+        return resolveExecuteInvokeCode(invoke);
+    if (code)
+        return code;
+    throw new Error('Provide --invoke, --code, --file, or a module string.');
+}
+/**
+ * Map `kody.execute` capability output (returned as CapabilityProxy `result`)
+ * into the same ToolCallResult envelope MCP execute / local execute use.
+ */
+export function formatExecuteCapabilityResult(payload) {
+    const record = isRecord(payload) ? payload : null;
+    if (!record) {
+        const text = typeof payload === 'string' ? payload : JSON.stringify(payload, null, 2) ?? 'undefined';
+        return {
+            content: [{ type: 'text', text }],
+            structuredContent: { result: payload },
+            isError: false,
+        };
+    }
+    const ok = record.ok !== false && typeof record.error !== 'string';
+    const conversationId = typeof record.conversationId === 'string' ? record.conversationId : undefined;
+    const logs = Array.isArray(record.logs) ? record.logs : [];
+    const base = {
+        ...(conversationId !== undefined ? { conversationId } : {}),
+        logs,
+    };
+    for (const key of [
+        'timing',
+        'runId',
+        'replayed',
+        'inProgress',
+        'status',
+        'returnedBytes',
+        'truncated',
+        'note',
+        'errorDetails',
+        'entitlement',
+        'serverTiming',
+    ]) {
+        if (record[key] !== undefined)
+            base[key] = record[key];
+    }
+    if (!ok) {
+        const error = typeof record.error === 'string'
+            ? record.error
+            : 'Execute failed without an error message.';
+        return {
+            content: [{ type: 'text', text: `Error: ${error}` }],
+            structuredContent: { ...base, error, result: record.result },
+            isError: true,
+        };
+    }
+    const result = record.result;
+    const text = typeof result === 'string' ? result : (JSON.stringify(result, null, 2) ?? 'undefined');
+    return {
+        content: [{ type: 'text', text }],
+        structuredContent: { ...base, result },
+        isError: false,
+    };
+}
+function isRecord(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+//# sourceMappingURL=remote-execute.js.map

package/dist/remote-execute.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote-execute.js","sourceRoot":"","sources":["../src/remote-execute.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,qBAAqB,EACrB,mBAAmB,EACnB,0BAA0B,GAC1B,MAAM,uBAAuB,CAAA;AAE9B,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAA;AAYlE;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC9C,KAAyB;IAEzB,qBAAqB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IACnC,MAAM,IAAI,GAAG,wBAAwB,CAAC,KAAK,CAAC,CAAA;IAC5C,MAAM,MAAM,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAA;IACnF,MAAM,0BAA0B,CAAC,MAAM,CAAC,CAAA;IAExC,MAAM,IAAI,GAA4B,EAAE,IAAI,EAAE,CAAA;IAC9C,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;QAAE,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAA;IAC1D,IAAI,KAAK,CAAC,cAAc,KAAK,SAAS;QAAE,IAAI,CAAC,cAAc,GAAG,KAAK,CAAC,cAAc,CAAA;IAElF,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC;QACzC,GAAG,MAAM;QACT,IAAI,EAAE,CAAC,MAAM,EAAE,SAAS,CAAC;QACzB,IAAI,EAAE,CAAC,IAAI,CAAC;QACZ,cAAc,EAAE,KAAK,CAAC,cAAc;KACpC,CAAC,CAAA;IAEF,OAAO,6BAA6B,CAAC,OAAO,CAAC,CAAA;AAC9C,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,KAGxC;IACA,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAA;IACxD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAA;IAC9D,IAAI,IAAI,IAAI,MAAM,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAA;IACxF,CAAC;IACD,IAAI,MAAM;QAAE,OAAO,wBAAwB,CAAC,MAAM,CAAC,CAAA;IACnD,IAAI,IAAI;QAAE,OAAO,IAAI,CAAA;IACrB,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAA;AACzE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,6BAA6B,CAAC,OAAgB;IAC7D,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAA;IACjD,IAAI,CAAC,MAAM,EAAE,CAAC;QACb,MAAM,IAAI,GACT,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,WAAW,CAAA;QACxF,OAAO;YACN,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YACjC,iBAAiB,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE;YACtC,OAAO,EAAE,KAAK;SACd,CAAA;IACF,CAAC;IAED,MAAM,EAAE,GAAG,MAAM,CAAC,EAAE,KAAK,KAAK,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,CAAA;IAClE,MAAM,cAAc,GACnB,OAAO,MAAM,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAA;IAC9E,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAA;IAC1D,MAAM,IAAI,GAA4B;QACrC,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,IAAI;KACJ,CAAA;IACD,KAAK,MAAM,GAAG,IAAI;QACjB,QAAQ;QACR,OAAO;QACP,UAAU;QACV,YAAY;QACZ,QAAQ;QACR,eAAe;QACf,WAAW;QACX,MAAM;QACN,cAAc;QACd,aAAa;QACb,cAAc;KACL,EAAE,CAAC;QACZ,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,SAAS;YAAE,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IACvD,CAAC;IAED,IAAI,CAAC,EAAE,EAAE,CAAC;QACT,MAAM,KAAK,GACV,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ;YAC/B,CAAC,CAAC,MAAM,CAAC,KAAK;YACd,CAAC,CAAC,0CAA0C,CAAA;QAC9C,OAAO;YACN,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,KAAK,EAAE,EAAE,CAAC;YACpD,iBAAiB,EAAE,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;YAC5D,OAAO,EAAE,IAAI;SACb,CAAA;IACF,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAA;IAC5B,MAAM,IAAI,GACT,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,WAAW,CAAC,CAAA;IACvF,OAAO;QACN,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QACjC,iBAAiB,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE;QACtC,OAAO,EAAE,KAAK;KACd,CAAA;AACF,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;AAC5E,CAAC"}

package/dist/workerd-binary.d.ts

@@ -0,0 +1,31 @@
+/** Matches the workerd the Kody platform runs; bump together with the digests. */
+export declare const workerdVersion = "1.20260815.1";
+/** sha256 of each gzipped release asset on github.com/cloudflare/workerd. */
+export declare const workerdAssetDigests: {
+    readonly 'linux-64': "05099ec6f50832fcbc327490e5a971d682c97231fb01943b61726db07677e559";
+    readonly 'linux-arm64': "0331597b53771170df2ab8344d9ae81d38bad4959e47152dd86592eedd9264c7";
+    readonly 'darwin-64': "752ec91c01dfc44d660de6e3a654879cfc1277caa7f3c5312871c608c4c2d6df";
+    readonly 'darwin-arm64': "c189fc08f691739c37d8784945e943e33b66cbd4e14635a061fe516dc95f2b39";
+};
+export type WorkerdTarget = keyof typeof workerdAssetDigests;
+export declare function workerdTargetFor(platform?: NodeJS.Platform, arch?: string): WorkerdTarget;
+export declare function workerdAssetUrl(target: WorkerdTarget, version?: string): string;
+export declare function userCacheDir(env?: NodeJS.ProcessEnv, platform?: NodeJS.Platform, home?: string): string;
+export declare function cachedWorkerdPath(cacheDir: string, target: WorkerdTarget): string;
+/**
+ * Returns a runnable workerd path: `KODY_WORKERD_PATH` when set, otherwise the
+ * pinned release under the user cache dir (downloaded and verified on first use).
+ */
+export declare function ensureWorkerdBinary(input?: {
+    env?: NodeJS.ProcessEnv;
+    cacheDir?: string;
+    target?: WorkerdTarget;
+    fetchFn?: typeof fetch;
+    onDownload?: (url: string) => void;
+}): Promise<string>;
+export declare function downloadVerifiedGzip(input: {
+    url: string;
+    sha256: string;
+    destination: string;
+    fetchFn: typeof fetch;
+}): Promise<void>;