@kodycodes/cli 1.6.0 → 1.8.0

package/README.md

@@ -60,8 +60,9 @@ Or run via `npx @kodycodes/cli` without a global install.
 | `kody install` | Detect running local MCP clients, write their config, and start host OAuth. **Recommended long-term path.** |
 | `kody skill install` | Copies the getting-started skill into Claude Code / Cursor / Agents. |
 | `kody login` | Browser OAuth (CIMD + PKCE) for the CLI itself. Stores access and refresh tokens. |
-| `kody logout` | Deletes stored CLI credentials. |
-| `kody status` | Shows CLI login state without printing secrets. |
+| `kody logout` | Deletes stored CLI OAuth credentials and any stored bootstrap/API token. |
+| `kody status` | Shows CLI login / stored API token state without printing secrets. |
+| `kody auth bootstrap --code` | Redeems a one-shot `kody_bc_…` from MCP `cliCredentialBootstrap` and stores the resulting `kody_at_…` for `execute --local` (never prints the token). |
 | `kody whoami` | Confirms the CLI MCP connection and lists tools. With a scoped API token (and no login), shows token identity via the Open API. |
 | `kody search [query]` | Calls Kody `search` from the CLI (prefer the host MCP tool). Token-only auth uses Open API `GET /v1/search`. |
 | `kody execute` | Calls Kody `execute` from the CLI (`--invoke`, `--code`, `--file`, or stdin via `--file -`). With a scoped API token and no login (or with `--token`), cloud execute goes through CapabilityProxy → `kody.execute` — no `kody login`. Add `--local` to run the module (and static `kody:@…` package modules) on this machine instead. |
@@ -70,13 +71,21 @@ Or run via `npx @kodycodes/cli` without a global install.
 
 ## Token-authenticated execute (no `kody login`)
 
-Scoped API tokens (`kody_at_…`, from the MCP `api` tool `tokenCreate` or
-`POST /v1/tokens`) authenticate the Open API and CapabilityProxy. They never
-replace MCP OAuth on `/mcp`. The CLI uses that token path when you pass
-`--token` / `KODY_API_TOKEN` and are not logged in (or when you pass `--token`
-explicitly):
+Agents already on Kody MCP should prefer `cliCredentialBootstrap` →
+`kody auth bootstrap --code …` (ADR 0056) so a one-shot `kody_bc_…` seeds the
+CLI store without pasting `kody_at_…` into chat. Interactive humans can use
+`kody login`. Scoped API tokens (`kody_at_…`, from bootstrap redeem,
+`tokenCreate`, or `POST /v1/tokens`) authenticate the Open API and
+CapabilityProxy. They never replace MCP OAuth on `/mcp`. The CLI uses that
+token path when you pass `--token` / `KODY_API_TOKEN` and are not logged in
+(or when you pass `--token` explicitly):
 
 ```bash
+# Preferred for agents on MCP (no tokenCreate, no second OAuth):
+# 1. MCP api / kody.cliCredentialBootstrap → { bootstrap_code, cli_command }
+npx @kodycodes/cli auth bootstrap --code 'kody_bc_…'
+npx @kodycodes/cli execute --local --file ./task.js
+
 export KODY_API_TOKEN=…   # scopes: local-execute (+ search:read for search)
 # Cloud execute — module runs in Kody's sandbox via CapabilityProxy → kody.execute
 npx @kodycodes/cli execute --code 'export default async () => ({ ok: true })'
@@ -86,17 +95,24 @@ npx @kodycodes/cli search "what can you do"
 npx @kodycodes/cli whoami
 ```
 
-- Neither `kody login` nor a token → the error tells you to mint one with the
-  MCP `api` tool `tokenCreate` (scopes: `local-execute` plus the capability
-  scopes the module will call) and pass `--token` / `KODY_API_TOKEN`.
-  `execute --local` never reads stored CLI OAuth, so login is not a substitute
-  there.
-- Wrong/expired token → 401 with a mint-fresh-token message.
+- Neither bootstrap store, `kody login`, nor a token → the error prefers
+  `cliCredentialBootstrap` → `auth bootstrap`, then `kody login`, then
+  `tokenCreate` for CI/headless (`--token` / `KODY_API_TOKEN`).
+- For `execute --local` specifically: `--token` / `KODY_API_TOKEN` wins when
+  set; else a stored bootstrap/API token from `auth bootstrap`; else the
+  stored `kody login` OAuth access token as Bearer (no under-the-hood
+  `tokenCreate`). The Open API must accept that OAuth bearer on
+  CapabilityProxy / package-graph
+  ([kentcdodds/kody#2812](https://github.com/kentcdodds/kody/issues/2812));
+  until then use bootstrap or a scoped `kody_at_…` token.
+- Wrong/expired token → 401 with a mint-fresh-token message (or the OAuth
+  platform-gap message when the bearer is login OAuth).
 - Wrong scopes → the error includes `insufficient_scope` and the required
   scope when Kody sends one.
 - Account flag off → the error includes `feature_disabled` and the
   `local-execute` feature flag. Another token does not bypass that flag.
 - Prefer the env var so the token stays out of shell history and `ps`.
+- Never scavenge host MCP OAuth tokens from disk (ADR 0053).
 
 ## Local execute
 
@@ -105,19 +121,34 @@ with `--params`) on this machine instead of in Kody's cloud sandbox. Local CPU
 is free; every `kody:runtime` call (`kody.*`, `kody.mcp.*`, `workflows.create`)
 is proxied to Kody's CapabilityProxy and metered like a cloud hop. Static
 `kody:@scope/package/export` imports are **resolved into the local workerd
-bundle** via `POST /v1/local-execute/package-graph` (same Open API token —
-never hosted MCP `execute`, and never a whole-module CapabilityProxy →
-`kody.execute` defer). There is no author-facing `packages.invoke`.
+bundle** via `POST /v1/local-execute/package-graph` (same Bearer as
+CapabilityProxy — never hosted MCP `execute`, and never a whole-module
+CapabilityProxy → `kody.execute` defer). There is no author-facing
+`packages.invoke`.
 
 ```bash
-export KODY_API_TOKEN=…   # scoped token minted through the Kody `api` tool
+# Prefer login when already signed in (no temporary API token to paste):
+npx @kodycodes/cli login
+npx @kodycodes/cli execute --local --file ./task.js --params '{"to":"me@example.com"}'
+
+# Agents on MCP: bootstrap code → store (no tokenCreate, no second OAuth):
+npx @kodycodes/cli auth bootstrap --code 'kody_bc_…'
+npx @kodycodes/cli execute --local --file ./task.js --params '{"to":"me@example.com"}'
+
+# Or a scoped API token (still wins over login / bootstrap store when set):
+export KODY_API_TOKEN=…   # minted through the Kody `api` tool
 npx @kodycodes/cli execute --local --file ./task.js --params '{"to":"me@example.com"}'
 ```
 
-- **Auth:** a scoped API token from `--token` or `KODY_API_TOKEN` (prefer the
-  env var so the token stays out of shell history and `ps`). No `kody login`,
-  and the CLI never reads MCP OAuth tokens from other hosts. The token stays in
-  the CLI process; the sandbox only talks to a loopback bridge.
+- **Auth:** `--token` / `KODY_API_TOKEN` when set; else stored `auth bootstrap`
+  API token; else a valid `kody login` session (OAuth access token as Bearer —
+  never printed, never exchanged via `tokenCreate`). Prefer the env var for
+  API tokens so they stay out of shell history and `ps`. The bearer stays in
+  the CLI process; the sandbox only talks to a loopback bridge. Host MCP OAuth
+  from other clients is never read. Until
+  [kentcdodds/kody#2812](https://github.com/kentcdodds/kody/issues/2812)
+  ships, login-only Bearer is rejected by the Open API — use bootstrap or a
+  `kody_at_…` token in that case.
 - **Node.js:** 22 or newer (`package.json` `engines` is `>=22`). Older Node
   fails immediately with that requirement, before workerd is downloaded or
   started.
@@ -167,8 +198,9 @@ If the keychain is unavailable (common on headless Linux), the CLI writes a
 
 Access tokens refresh automatically on expiry or HTTP 401.
 
-`execute --local` and token-only cloud execute do not use stored CLI
-credentials; they only read `--token` / `KODY_API_TOKEN`.
+`execute --local` prefers `--token` / `KODY_API_TOKEN` when set; otherwise it
+uses stored CLI credentials from `kody login`. Token-only cloud execute still
+only reads `--token` / `KODY_API_TOKEN`.
 
 ## Releases
 

package/dist/api-token-store.d.ts

@@ -0,0 +1,28 @@
+import { type SecretBackend, type StoreResolution } from './store.js';
+/**
+ * Scoped API token stored by `auth bootstrap` (ADR 0056) for
+ * `execute --local`. Separate from `kody login` OAuth credentials.
+ */
+export type StoredApiToken = {
+    version: 1;
+    apiUrl: string;
+    token: string;
+    tokenId: string;
+    name?: string;
+    scopes?: Array<string>;
+    expiresAt?: string | null;
+    maxExpiresAt?: string | null;
+    createdVia?: string;
+};
+export declare function accountForApiUrl(apiUrl: string): string;
+export declare function apiTokenFileStorePath(apiUrl: string, home?: string): string;
+export declare function createApiTokenKeyringBackend(apiUrl: string): SecretBackend;
+export declare function parseStoredApiToken(raw: string): StoredApiToken;
+export declare function loadStoredApiToken(apiUrl?: string, backend?: SecretBackend, resolution?: StoreResolution): StoredApiToken | null;
+export declare function saveStoredApiToken(credentials: StoredApiToken, backend?: SecretBackend, resolution?: StoreResolution): {
+    backend: SecretBackend;
+};
+export declare function deleteStoredApiToken(apiUrl?: string, backend?: SecretBackend, resolution?: StoreResolution): {
+    deleted: boolean;
+    backend: SecretBackend;
+};

package/dist/api-token-store.js

@@ -0,0 +1,120 @@
+import { Entry } from '@napi-rs/keyring';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { defaultApiUrl, keyringService } from './defaults.js';
+import { createFileBackend, secretServiceKeyringOptions, } from './store.js';
+export function accountForApiUrl(apiUrl) {
+    return `cli-api-token:${new URL(apiUrl).origin}`;
+}
+export function apiTokenFileStorePath(apiUrl, home = homedir()) {
+    const origin = new URL(apiUrl).host.replace(/[^a-zA-Z0-9.-]/g, '_');
+    const base = process.platform === 'win32'
+        ? join(process.env.APPDATA || join(home, 'AppData', 'Roaming'), 'kody')
+        : process.platform === 'darwin'
+            ? join(home, 'Library', 'Application Support', 'kody')
+            : join(process.env.XDG_CONFIG_HOME || join(home, '.config'), 'kody');
+    return join(base, `api-token-${origin}.json`);
+}
+export function createApiTokenKeyringBackend(apiUrl) {
+    const entry = new Entry(keyringService, accountForApiUrl(apiUrl), secretServiceKeyringOptions);
+    return {
+        kind: 'keyring',
+        get() {
+            try {
+                return entry.getPassword();
+            }
+            catch {
+                return null;
+            }
+        },
+        set(value) {
+            entry.setPassword(value);
+        },
+        delete() {
+            try {
+                return entry.deleteCredential();
+            }
+            catch {
+                return false;
+            }
+        },
+    };
+}
+function fileBackendFor(apiUrl, resolution) {
+    const path = resolution?.fileStorePath?.(apiUrl) ?? apiTokenFileStorePath(apiUrl);
+    return createFileBackend(path);
+}
+function resolveApiTokenBackend(apiUrl, preferred, resolution) {
+    if (preferred)
+        return preferred;
+    try {
+        return (resolution?.createKeyring ?? createApiTokenKeyringBackend)(apiUrl);
+    }
+    catch {
+        return fileBackendFor(apiUrl, resolution);
+    }
+}
+export function parseStoredApiToken(raw) {
+    const parsed = JSON.parse(raw);
+    if (parsed.version !== 1 ||
+        typeof parsed.token !== 'string' ||
+        !parsed.token.startsWith('kody_at_') ||
+        typeof parsed.apiUrl !== 'string' ||
+        typeof parsed.tokenId !== 'string') {
+        throw new Error('Stored Kody API token is invalid. Run `kody auth bootstrap --code …` again.');
+    }
+    return parsed;
+}
+function readParsed(store) {
+    const raw = store.get();
+    if (!raw)
+        return null;
+    return parseStoredApiToken(raw);
+}
+export function loadStoredApiToken(apiUrl = defaultApiUrl, backend, resolution) {
+    const store = resolveApiTokenBackend(apiUrl, backend, resolution);
+    try {
+        const loaded = readParsed(store);
+        if (loaded)
+            return loaded;
+    }
+    catch (error) {
+        if (!(store.kind === 'keyring' && !backend))
+            throw error;
+    }
+    if (store.kind === 'keyring' && !backend) {
+        return readParsed(fileBackendFor(apiUrl, resolution));
+    }
+    return null;
+}
+export function saveStoredApiToken(credentials, backend, resolution) {
+    const store = resolveApiTokenBackend(credentials.apiUrl, backend, resolution);
+    try {
+        store.set(JSON.stringify(credentials));
+        return { backend: store };
+    }
+    catch (error) {
+        if (store.kind === 'keyring' && !backend) {
+            const fallback = fileBackendFor(credentials.apiUrl, resolution);
+            fallback.set(JSON.stringify(credentials));
+            return { backend: fallback };
+        }
+        throw error;
+    }
+}
+export function deleteStoredApiToken(apiUrl = defaultApiUrl, backend, resolution) {
+    const store = resolveApiTokenBackend(apiUrl, backend, resolution);
+    let deleted = false;
+    try {
+        deleted = store.delete();
+    }
+    catch {
+        deleted = false;
+    }
+    if (store.kind === 'keyring' && !backend) {
+        const file = fileBackendFor(apiUrl, resolution);
+        deleted = file.delete() || deleted;
+    }
+    return { deleted, backend: store };
+}
+//# sourceMappingURL=api-token-store.js.map

package/dist/api-token-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-token-store.js","sourceRoot":"","sources":["../src/api-token-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACxC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAC7D,OAAO,EACN,iBAAiB,EACjB,2BAA2B,GAG3B,MAAM,YAAY,CAAA;AAkBnB,MAAM,UAAU,gBAAgB,CAAC,MAAc;IAC9C,OAAO,iBAAiB,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,CAAA;AACjD,CAAC;AAED,MAAM,UAAU,qBAAqB,CACpC,MAAc,EACd,OAAe,OAAO,EAAE;IAExB,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAA;IACnE,MAAM,IAAI,GACT,OAAO,CAAC,QAAQ,KAAK,OAAO;QAC3B,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QACvE,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,QAAQ;YAC9B,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,qBAAqB,EAAE,MAAM,CAAC;YACtD,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,MAAM,CAAC,CAAA;IACvE,OAAO,IAAI,CAAC,IAAI,EAAE,aAAa,MAAM,OAAO,CAAC,CAAA;AAC9C,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,MAAc;IAC1D,MAAM,KAAK,GAAG,IAAI,KAAK,CACtB,cAAc,EACd,gBAAgB,CAAC,MAAM,CAAC,EACxB,2BAA2B,CAC3B,CAAA;IACD,OAAO;QACN,IAAI,EAAE,SAAS;QACf,GAAG;YACF,IAAI,CAAC;gBACJ,OAAO,KAAK,CAAC,WAAW,EAAE,CAAA;YAC3B,CAAC;YAAC,MAAM,CAAC;gBACR,OAAO,IAAI,CAAA;YACZ,CAAC;QACF,CAAC;QACD,GAAG,CAAC,KAAa;YAChB,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,CAAA;QACzB,CAAC;QACD,MAAM;YACL,IAAI,CAAC;gBACJ,OAAO,KAAK,CAAC,gBAAgB,EAAE,CAAA;YAChC,CAAC;YAAC,MAAM,CAAC;gBACR,OAAO,KAAK,CAAA;YACb,CAAC;QACF,CAAC;KACD,CAAA;AACF,CAAC;AAED,SAAS,cAAc,CACtB,MAAc,EACd,UAA4B;IAE5B,MAAM,IAAI,GACT,UAAU,EAAE,aAAa,EAAE,CAAC,MAAM,CAAC,IAAI,qBAAqB,CAAC,MAAM,CAAC,CAAA;IACrE,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAA;AAC/B,CAAC;AAED,SAAS,sBAAsB,CAC9B,MAAc,EACd,SAAyB,EACzB,UAA4B;IAE5B,IAAI,SAAS;QAAE,OAAO,SAAS,CAAA;IAC/B,IAAI,CAAC;QACJ,OAAO,CAAC,UAAU,EAAE,aAAa,IAAI,4BAA4B,CAAC,CAAC,MAAM,CAAC,CAAA;IAC3E,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,cAAc,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;IAC1C,CAAC;AACF,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAmB,CAAA;IAChD,IACC,MAAM,CAAC,OAAO,KAAK,CAAC;QACpB,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ;QAChC,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC;QACpC,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ;QACjC,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,EACjC,CAAC;QACF,MAAM,IAAI,KAAK,CACd,6EAA6E,CAC7E,CAAA;IACF,CAAC;IACD,OAAO,MAAM,CAAA;AACd,CAAC;AAED,SAAS,UAAU,CAAC,KAAoB;IACvC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,EAAE,CAAA;IACvB,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAA;IACrB,OAAO,mBAAmB,CAAC,GAAG,CAAC,CAAA;AAChC,CAAC;AAED,MAAM,UAAU,kBAAkB,CACjC,SAAiB,aAAa,EAC9B,OAAuB,EACvB,UAA4B;IAE5B,MAAM,KAAK,GAAG,sBAAsB,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,CAAC,CAAA;IACjE,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,CAAA;QAChC,IAAI,MAAM;YAAE,OAAO,MAAM,CAAA;IAC1B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC;YAAE,MAAM,KAAK,CAAA;IACzD,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,OAAO,EAAE,CAAC;QAC1C,OAAO,UAAU,CAAC,cAAc,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAA;IACtD,CAAC;IACD,OAAO,IAAI,CAAA;AACZ,CAAC;AAED,MAAM,UAAU,kBAAkB,CACjC,WAA2B,EAC3B,OAAuB,EACvB,UAA4B;IAE5B,MAAM,KAAK,GAAG,sBAAsB,CAAC,WAAW,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,CAAC,CAAA;IAC7E,IAAI,CAAC;QACJ,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAA;QACtC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAA;IAC1B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,OAAO,EAAE,CAAC;YAC1C,MAAM,QAAQ,GAAG,cAAc,CAAC,WAAW,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;YAC/D,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAA;YACzC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAA;QAC7B,CAAC;QACD,MAAM,KAAK,CAAA;IACZ,CAAC;AACF,CAAC;AAED,MAAM,UAAU,oBAAoB,CACnC,SAAiB,aAAa,EAC9B,OAAuB,EACvB,UAA4B;IAE5B,MAAM,KAAK,GAAG,sBAAsB,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,CAAC,CAAA;IACjE,IAAI,OAAO,GAAG,KAAK,CAAA;IACnB,IAAI,CAAC;QACJ,OAAO,GAAG,KAAK,CAAC,MAAM,EAAE,CAAA;IACzB,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,GAAG,KAAK,CAAA;IAChB,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,OAAO,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,cAAc,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;QAC/C,OAAO,GAAG,IAAI,CAAC,MAAM,EAAE,IAAI,OAAO,CAAA;IACnC,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAA;AACnC,CAAC"}

package/dist/api-token.d.ts

@@ -1,3 +1,5 @@
+/** Platform tracking for login OAuth as CapabilityProxy / package-graph Bearer. */
+export declare const localExecuteOauthPlatformIssueUrl = "https://github.com/kentcdodds/kody/issues/2812";
 /**
  * Scoped Open API / CapabilityProxy token (`kody_at_…`). Same source for
  * `execute --local`, token-only cloud execute, and Open API search/whoami.
@@ -5,15 +7,26 @@
 export declare function readApiToken(values?: {
     token?: string;
 }, env?: NodeJS.ProcessEnv): string | null;
+/** True when the bearer looks like a minted Open API token (not MCP OAuth). */
+export declare function isScopedApiToken(token: string): boolean;
 /**
- * How to mint the scoped token this CLI already accepts. There is no second
- * auth flow here — callers use the MCP `api` tool they already have.
+ * How to mint a scoped token for CI/headless. Interactive agents on MCP should
+ * prefer `cliCredentialBootstrap` → `auth bootstrap` instead.
  */
 export declare function apiTokenMintInstructions(): string;
-/** `execute --local` never reads stored CLI OAuth, so login is not a substitute. */
+/** Preferred interactive path for agents already on Kody MCP (ADR 0056). */
+export declare function cliBootstrapInstructions(): string;
+/** Token-only Open API paths (search / whoami / cloud token execute) with no token. */
 export declare function missingApiTokenMessage(purpose: string): string;
+/**
+ * `execute --local` with neither env/`--token`, stored bootstrap token, nor
+ * `kody login`. Prefer bootstrap (MCP) → login → tokenCreate (CI).
+ */
+export declare function missingLocalExecuteAuthMessage(purpose?: string): string;
 /** Cloud search / whoami / execute when the process has neither a session nor a token. */
 export declare function missingCliAuthMessage(): string;
+/** 401 when CapabilityProxy rejected a non-`kody_at_` bearer (typically CLI OAuth). */
+export declare function rejectedOauthBearerMessage(): string;
 export declare function insufficientScopeMessage(input: {
     requiredScope?: string | null;
     /** CapabilityProxy execute needs `local-execute` plus the capability scopes. */

package/dist/api-token.js

@@ -1,4 +1,6 @@
 import { apiTokenEnvVar } from './defaults.js';
+/** Platform tracking for login OAuth as CapabilityProxy / package-graph Bearer. */
+export const localExecuteOauthPlatformIssueUrl = 'https://github.com/kentcdodds/kody/issues/2812';
 /**
  * Scoped Open API / CapabilityProxy token (`kody_at_…`). Same source for
  * `execute --local`, token-only cloud execute, and Open API search/whoami.
@@ -7,20 +9,39 @@ export function readApiToken(values = {}, env = process.env) {
     const token = (values.token ?? env[apiTokenEnvVar] ?? '').trim();
     return token.length > 0 ? token : null;
 }
+/** True when the bearer looks like a minted Open API token (not MCP OAuth). */
+export function isScopedApiToken(token) {
+    return token.startsWith('kody_at_');
+}
 /**
- * How to mint the scoped token this CLI already accepts. There is no second
- * auth flow here — callers use the MCP `api` tool they already have.
+ * How to mint a scoped token for CI/headless. Interactive agents on MCP should
+ * prefer `cliCredentialBootstrap` → `auth bootstrap` instead.
  */
 export function apiTokenMintInstructions() {
     return `Mint one with the Kody MCP \`api\` tool \`tokenCreate\` (include the \`local-execute\` scope plus the capability scopes this command needs) and pass --token or set ${apiTokenEnvVar}.`;
 }
-/** `execute --local` never reads stored CLI OAuth, so login is not a substitute. */
+/** Preferred interactive path for agents already on Kody MCP (ADR 0056). */
+export function cliBootstrapInstructions() {
+    return `From MCP, call \`cliCredentialBootstrap\` (MCP \`api\` / \`kody.cliCredentialBootstrap\`), then run \`npx @kodycodes/cli auth bootstrap --code <kody_bc_…>\``;
+}
+/** Token-only Open API paths (search / whoami / cloud token execute) with no token. */
 export function missingApiTokenMessage(purpose) {
-    return `${purpose} needs a scoped Kody API token. ${apiTokenMintInstructions()} Stored \`kody login\` credentials are not used on this path.`;
+    return `${purpose} needs a scoped Kody API token. ${cliBootstrapInstructions()}, or ${apiTokenMintInstructions()}`;
+}
+/**
+ * `execute --local` with neither env/`--token`, stored bootstrap token, nor
+ * `kody login`. Prefer bootstrap (MCP) → login → tokenCreate (CI).
+ */
+export function missingLocalExecuteAuthMessage(purpose = 'execute --local') {
+    return `${purpose} needs auth. ${cliBootstrapInstructions()}; or run \`kody login\`; or for CI/headless, ${apiTokenMintInstructions()}`;
 }
 /** Cloud search / whoami / execute when the process has neither a session nor a token. */
 export function missingCliAuthMessage() {
-    return `Not logged in, and no API token is set. ${apiTokenMintInstructions()} Or run \`kody login\` for browser OAuth (search, whoami, and cloud execute).`;
+    return `Not logged in, and no API token is set. ${cliBootstrapInstructions()}; or run \`kody login\` for browser OAuth (search, whoami, cloud execute, and login-backed \`execute --local\`); or for CI/headless, ${apiTokenMintInstructions()}`;
+}
+/** 401 when CapabilityProxy rejected a non-`kody_at_` bearer (typically CLI OAuth). */
+export function rejectedOauthBearerMessage() {
+    return `Kody rejected the bearer from \`kody login\`: the Open API still accepts only scoped \`kody_at_…\` API tokens on CapabilityProxy / package-graph (not MCP OAuth). See ${localExecuteOauthPlatformIssueUrl}. Until that lands, ${apiTokenMintInstructions()}`;
 }
 export function insufficientScopeMessage(input) {
     const required = input.requiredScope ? ` The server requires "${input.requiredScope}".` : '';

package/dist/api-token.js.map

@@ -1 +1 @@
-{"version":3,"file":"api-token.js","sourceRoot":"","sources":["../src/api-token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAE9C;;;GAGG;AACH,MAAM,UAAU,YAAY,CAC3B,SAA6B,EAAE,EAC/B,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;IAChE,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;AACvC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB;IACvC,OAAO,uKAAuK,cAAc,GAAG,CAAA;AAChM,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,sBAAsB,CAAC,OAAe;IACrD,OAAO,GAAG,OAAO,mCAAmC,wBAAwB,EAAE,+DAA+D,CAAA;AAC9I,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,qBAAqB;IACpC,OAAO,2CAA2C,wBAAwB,EAAE,+EAA+E,CAAA;AAC5J,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,KAIxC;IACA,MAAM,QAAQ,GAAG,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,yBAAyB,KAAK,CAAC,aAAa,IAAI,CAAC,CAAC,CAAC,EAAE,CAAA;IAC5F,MAAM,IAAI,GAAG,KAAK,CAAC,mBAAmB;QACrC,CAAC,CAAC,wBAAwB,EAAE;QAC5B,CAAC,CAAC,8DACA,KAAK,CAAC,aAAa;YAClB,CAAC,CAAC,mBAAmB,KAAK,CAAC,aAAa,GAAG;YAC3C,CAAC,CAAC,mCACJ,8BAA8B,cAAc,GAAG,CAAA;IACjD,OAAO,oCAAoC,QAAQ,IAAI,IAAI,EAAE,CAAA;AAC9D,CAAC;AAED,MAAM,UAAU,sBAAsB;IACrC,OAAO,gSAAgS,CAAA;AACxS,CAAC;AAED,MAAM,UAAU,eAAe,CAC9B,SAA6B,EAAE,EAC/B,MAAyB,OAAO,CAAC,GAAG,EACpC,UAAkB,cAAc;IAEhC,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACvC,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC,CAAA;IAC5D,OAAO,KAAK,CAAA;AACb,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,oBAAoB,CAAC,MAA0B;IAC9D,OAAO,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAA;AAC1E,CAAC"}
+{"version":3,"file":"api-token.js","sourceRoot":"","sources":["../src/api-token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAE9C,mFAAmF;AACnF,MAAM,CAAC,MAAM,iCAAiC,GAC7C,gDAAgD,CAAA;AAEjD;;;GAGG;AACH,MAAM,UAAU,YAAY,CAC3B,SAA6B,EAAE,EAC/B,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;IAChE,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;AACvC,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC7C,OAAO,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,CAAA;AACpC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB;IACvC,OAAO,uKAAuK,cAAc,GAAG,CAAA;AAChM,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,wBAAwB;IACvC,OAAO,8JAA8J,CAAA;AACtK,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,sBAAsB,CAAC,OAAe;IACrD,OAAO,GAAG,OAAO,mCAAmC,wBAAwB,EAAE,QAAQ,wBAAwB,EAAE,EAAE,CAAA;AACnH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,8BAA8B,CAC7C,UAAkB,iBAAiB;IAEnC,OAAO,GAAG,OAAO,gBAAgB,wBAAwB,EAAE,gDAAgD,wBAAwB,EAAE,EAAE,CAAA;AACxI,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,qBAAqB;IACpC,OAAO,2CAA2C,wBAAwB,EAAE,wIAAwI,wBAAwB,EAAE,EAAE,CAAA;AACjP,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,0BAA0B;IACzC,OAAO,yKAAyK,iCAAiC,uBAAuB,wBAAwB,EAAE,EAAE,CAAA;AACrQ,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,KAIxC;IACA,MAAM,QAAQ,GAAG,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,yBAAyB,KAAK,CAAC,aAAa,IAAI,CAAC,CAAC,CAAC,EAAE,CAAA;IAC5F,MAAM,IAAI,GAAG,KAAK,CAAC,mBAAmB;QACrC,CAAC,CAAC,wBAAwB,EAAE;QAC5B,CAAC,CAAC,8DACA,KAAK,CAAC,aAAa;YAClB,CAAC,CAAC,mBAAmB,KAAK,CAAC,aAAa,GAAG;YAC3C,CAAC,CAAC,mCACJ,8BAA8B,cAAc,GAAG,CAAA;IACjD,OAAO,oCAAoC,QAAQ,IAAI,IAAI,EAAE,CAAA;AAC9D,CAAC;AAED,MAAM,UAAU,sBAAsB;IACrC,OAAO,gSAAgS,CAAA;AACxS,CAAC;AAED,MAAM,UAAU,eAAe,CAC9B,SAA6B,EAAE,EAC/B,MAAyB,OAAO,CAAC,GAAG,EACpC,UAAkB,cAAc;IAEhC,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACvC,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC,CAAA;IAC5D,OAAO,KAAK,CAAA;AACb,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,oBAAoB,CAAC,MAA0B;IAC9D,OAAO,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAA;AAC1E,CAAC"}

package/dist/auth-bootstrap.d.ts

@@ -0,0 +1,51 @@
+import { type StoredApiToken } from './api-token-store.js';
+import type { SecretBackend, StoreResolution } from './store.js';
+/** ADR 0056 one-shot bootstrap code prefix (`kody_bc_…`). */
+export declare const cliBootstrapCodePrefix = "kody_bc_";
+export declare const bootstrapRedeemPath = "v1/tokens/bootstrap/redeem";
+export type BootstrapRedeemResponse = {
+    token: string;
+    token_type?: string;
+    id: string;
+    name?: string | null;
+    scopes?: Array<string>;
+    status?: string;
+    idle_ttl_seconds?: number;
+    expires_at?: string | null;
+    max_expires_at?: string | null;
+    created_via?: string;
+};
+export declare function parseCliBootstrapCode(value: string): {
+    codeId: string;
+    secret: string;
+} | null;
+export declare function assertCliBootstrapCode(code: string): string;
+/**
+ * POST /v1/tokens/bootstrap/redeem with JSON `{ code }` and **no** Authorization
+ * header (ADR 0056). Returns the minted `kody_at_…` once.
+ */
+export declare function redeemBootstrapCode(input: {
+    code: string;
+    apiUrl?: string;
+    fetchFn?: typeof fetch;
+}): Promise<BootstrapRedeemResponse>;
+export declare function storedApiTokenFromRedeem(input: {
+    apiUrl: string;
+    redeemed: BootstrapRedeemResponse;
+}): StoredApiToken;
+/**
+ * Redeem a one-shot `kody_bc_…` and persist the resulting API token for
+ * `execute --local`. Never returns the token string to callers that print
+ * success output — use `stored.tokenId` / backend kind only.
+ */
+export declare function authBootstrap(input: {
+    code: string;
+    apiUrl?: string;
+    fetchFn?: typeof fetch;
+    backend?: SecretBackend;
+    resolution?: StoreResolution;
+}): Promise<{
+    stored: StoredApiToken;
+    backendKind: SecretBackend['kind'];
+    backendPath?: string;
+}>;

package/dist/auth-bootstrap.js

@@ -0,0 +1,157 @@
+import { assertTokenSafeApiUrl, capabilityProxyUrl } from './capability-proxy.js';
+import { cliName, defaultApiUrl } from './defaults.js';
+import { describeNetworkError } from './network-error.js';
+import { readPackageVersion } from './package-info.js';
+import { saveStoredApiToken, } from './api-token-store.js';
+/** ADR 0056 one-shot bootstrap code prefix (`kody_bc_…`). */
+export const cliBootstrapCodePrefix = 'kody_bc_';
+/** Platform shape: `kody_bc_<16 alnum>_<32 base64url>`. */
+const bootstrapCodePattern = /^kody_bc_([a-z0-9]{16})_([A-Za-z0-9_-]{32})$/;
+export const bootstrapRedeemPath = 'v1/tokens/bootstrap/redeem';
+export function parseCliBootstrapCode(value) {
+    const match = bootstrapCodePattern.exec(value.trim());
+    if (!match)
+        return null;
+    const [, codeId, secret] = match;
+    if (!codeId || !secret)
+        return null;
+    return { codeId, secret };
+}
+export function assertCliBootstrapCode(code) {
+    const trimmed = code.trim();
+    if (!parseCliBootstrapCode(trimmed)) {
+        throw new Error(`Invalid bootstrap code. Expected a one-shot ${cliBootstrapCodePrefix}… from cliCredentialBootstrap (MCP api / kody.cliCredentialBootstrap).`);
+    }
+    return trimmed;
+}
+/**
+ * POST /v1/tokens/bootstrap/redeem with JSON `{ code }` and **no** Authorization
+ * header (ADR 0056). Returns the minted `kody_at_…` once.
+ */
+export async function redeemBootstrapCode(input) {
+    const code = assertCliBootstrapCode(input.code);
+    const apiUrl = input.apiUrl || defaultApiUrl;
+    assertTokenSafeApiUrl(apiUrl);
+    const url = capabilityProxyUrl(apiUrl, bootstrapRedeemPath);
+    const fetchFn = input.fetchFn ?? fetch;
+    let response;
+    try {
+        response = await fetchFn(url, {
+            method: 'POST',
+            headers: {
+                accept: 'application/json',
+                'content-type': 'application/json',
+                'user-agent': `${cliName}/${readPackageVersion()}`,
+            },
+            body: JSON.stringify({ code }),
+        });
+    }
+    catch (error) {
+        const reason = describeNetworkError(error);
+        throw new Error(`Could not reach the Kody API at ${url.origin} (${reason}). Check --api-url / KODY_API_URL and your network.`);
+    }
+    const body = await readJson(response);
+    if (!response.ok) {
+        throw describeRedeemFailure(response.status, body, url);
+    }
+    return parseRedeemResponse(body);
+}
+export function storedApiTokenFromRedeem(input) {
+    const token = input.redeemed.token.trim();
+    if (!token.startsWith('kody_at_')) {
+        throw new Error('Bootstrap redeem did not return a scoped kody_at_… API token.');
+    }
+    return {
+        version: 1,
+        apiUrl: input.apiUrl,
+        token,
+        tokenId: input.redeemed.id,
+        ...(input.redeemed.name ? { name: input.redeemed.name } : {}),
+        ...(Array.isArray(input.redeemed.scopes) ? { scopes: input.redeemed.scopes } : {}),
+        expiresAt: input.redeemed.expires_at ?? null,
+        maxExpiresAt: input.redeemed.max_expires_at ?? null,
+        createdVia: input.redeemed.created_via ?? 'cli-bootstrap',
+    };
+}
+/**
+ * Redeem a one-shot `kody_bc_…` and persist the resulting API token for
+ * `execute --local`. Never returns the token string to callers that print
+ * success output — use `stored.tokenId` / backend kind only.
+ */
+export async function authBootstrap(input) {
+    const apiUrl = input.apiUrl || defaultApiUrl;
+    const redeemed = await redeemBootstrapCode({
+        code: input.code,
+        apiUrl,
+        fetchFn: input.fetchFn,
+    });
+    const stored = storedApiTokenFromRedeem({ apiUrl, redeemed });
+    const saved = saveStoredApiToken(stored, input.backend, input.resolution);
+    return {
+        stored,
+        backendKind: saved.backend.kind,
+        ...(saved.backend.path ? { backendPath: saved.backend.path } : {}),
+    };
+}
+function parseRedeemResponse(body) {
+    if (!isRecord(body) || typeof body.token !== 'string' || typeof body.id !== 'string') {
+        throw new Error('Bootstrap redeem returned an unexpected response.');
+    }
+    return {
+        token: body.token,
+        token_type: typeof body.token_type === 'string' ? body.token_type : undefined,
+        id: body.id,
+        name: typeof body.name === 'string' ? body.name : null,
+        scopes: Array.isArray(body.scopes)
+            ? body.scopes.filter((scope) => typeof scope === 'string')
+            : undefined,
+        status: typeof body.status === 'string' ? body.status : undefined,
+        idle_ttl_seconds: typeof body.idle_ttl_seconds === 'number' ? body.idle_ttl_seconds : undefined,
+        expires_at: typeof body.expires_at === 'string' ? body.expires_at : null,
+        max_expires_at: typeof body.max_expires_at === 'string' ? body.max_expires_at : null,
+        created_via: typeof body.created_via === 'string' ? body.created_via : undefined,
+    };
+}
+function describeRedeemFailure(status, body, url) {
+    const failure = readErrorBody(body);
+    const detail = failure?.message ? ` Server said: ${failure.message}` : '';
+    if (status === 400 || status === 401 || status === 403 || status === 404) {
+        return new Error(`Bootstrap redeem failed (HTTP ${status}). The code may be invalid, expired, or already used. Call cliCredentialBootstrap again for a fresh code.${detail}`);
+    }
+    return new Error(failure?.message ??
+        `Bootstrap redeem failed with HTTP ${status} (${url.pathname}).${detail}`);
+}
+async function readJson(response) {
+    const text = await response.text();
+    if (!text)
+        return null;
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return text;
+    }
+}
+function readErrorBody(body) {
+    if (!isRecord(body) || body.error == null) {
+        if (typeof body === 'string' && body.trim())
+            return { code: null, message: body };
+        if (isRecord(body) && typeof body.message === 'string') {
+            return { code: null, message: body.message };
+        }
+        return null;
+    }
+    const { error } = body;
+    if (typeof error === 'string')
+        return { code: null, message: error };
+    if (isRecord(error)) {
+        const code = typeof error.code === 'string' ? error.code : null;
+        const message = typeof error.message === 'string' ? error.message : code ?? JSON.stringify(error);
+        return { code, message };
+    }
+    return { code: null, message: String(error) };
+}
+function isRecord(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+//# sourceMappingURL=auth-bootstrap.js.map

package/dist/auth-bootstrap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-bootstrap.js","sourceRoot":"","sources":["../src/auth-bootstrap.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAA;AACjF,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AACtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAA;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AACtD,OAAO,EACN,kBAAkB,GAElB,MAAM,sBAAsB,CAAA;AAG7B,6DAA6D;AAC7D,MAAM,CAAC,MAAM,sBAAsB,GAAG,UAAU,CAAA;AAEhD,2DAA2D;AAC3D,MAAM,oBAAoB,GAAG,8CAA8C,CAAA;AAE3E,MAAM,CAAC,MAAM,mBAAmB,GAAG,4BAA4B,CAAA;AAe/D,MAAM,UAAU,qBAAqB,CAAC,KAAa;IAClD,MAAM,KAAK,GAAG,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAA;IACrD,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAA;IACvB,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,KAAK,CAAA;IAChC,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAA;IACnC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAA;AAC1B,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,IAAY;IAClD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;IAC3B,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CACd,+CAA+C,sBAAsB,wEAAwE,CAC7I,CAAA;IACF,CAAC;IACD,OAAO,OAAO,CAAA;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAIzC;IACA,MAAM,IAAI,GAAG,sBAAsB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC/C,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,aAAa,CAAA;IAC5C,qBAAqB,CAAC,MAAM,CAAC,CAAA;IAC7B,MAAM,GAAG,GAAG,kBAAkB,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAA;IAC3D,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,KAAK,CAAA;IACtC,IAAI,QAAkB,CAAA;IACtB,IAAI,CAAC;QACJ,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE;YAC7B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACR,MAAM,EAAE,kBAAkB;gBAC1B,cAAc,EAAE,kBAAkB;gBAClC,YAAY,EAAE,GAAG,OAAO,IAAI,kBAAkB,EAAE,EAAE;aAClD;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC;SAC9B,CAAC,CAAA;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAA;QAC1C,MAAM,IAAI,KAAK,CACd,mCAAmC,GAAG,CAAC,MAAM,KAAK,MAAM,qDAAqD,CAC7G,CAAA;IACF,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAA;IACrC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QAClB,MAAM,qBAAqB,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,CAAA;IACxD,CAAC;IACD,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAA;AACjC,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,KAGxC;IACA,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAA;IACzC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAA;IACjF,CAAC;IACD,OAAO;QACN,OAAO,EAAE,CAAC;QACV,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,KAAK;QACL,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE;QAC1B,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClF,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,UAAU,IAAI,IAAI;QAC5C,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC,cAAc,IAAI,IAAI;QACnD,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,WAAW,IAAI,eAAe;KACzD,CAAA;AACF,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KAMnC;IAKA,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,aAAa,CAAA;IAC5C,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC;QAC1C,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,MAAM;QACN,OAAO,EAAE,KAAK,CAAC,OAAO;KACtB,CAAC,CAAA;IACF,MAAM,MAAM,GAAG,wBAAwB,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAA;IAC7D,MAAM,KAAK,GAAG,kBAAkB,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,UAAU,CAAC,CAAA;IACzE,OAAO;QACN,MAAM;QACN,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI;QAC/B,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClE,CAAA;AACF,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAa;IACzC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;QACtF,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAA;IACrE,CAAC;IACD,OAAO;QACN,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,UAAU,EAAE,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;QAC7E,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,IAAI,EAAE,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;QACtD,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC;YACjC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;YAC3E,CAAC,CAAC,SAAS;QACZ,MAAM,EAAE,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;QACjE,gBAAgB,EACf,OAAO,IAAI,CAAC,gBAAgB,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS;QAC9E,UAAU,EAAE,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI;QACxE,cAAc,EAAE,OAAO,IAAI,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI;QACpF,WAAW,EAAE,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;KAChF,CAAA;AACF,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAc,EAAE,IAAa,EAAE,GAAQ;IACrE,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,CAAA;IACnC,MAAM,MAAM,GAAG,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,iBAAiB,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IACzE,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QAC1E,OAAO,IAAI,KAAK,CACf,iCAAiC,MAAM,4GAA4G,MAAM,EAAE,CAC3J,CAAA;IACF,CAAC;IACD,OAAO,IAAI,KAAK,CACf,OAAO,EAAE,OAAO;QACf,qCAAqC,MAAM,KAAK,GAAG,CAAC,QAAQ,KAAK,MAAM,EAAE,CAC1E,CAAA;AACF,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,QAAkB;IACzC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;IAClC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAA;IACtB,IAAI,CAAC;QACJ,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACxB,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA;IACZ,CAAC;AACF,CAAC;AAED,SAAS,aAAa,CAAC,IAAa;IACnC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,EAAE,CAAC;QAC3C,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE;YAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;QACjF,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YACxD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAA;QAC7C,CAAC;QACD,OAAO,IAAI,CAAA;IACZ,CAAC;IACD,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAA;IACtB,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAA;IACpE,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,GAAG,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAA;QAC/D,MAAM,OAAO,GACZ,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;QAClF,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;IACzB,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAA;AAC9C,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;AAC5E,CAAC"}

package/dist/capability-proxy.d.ts

@@ -1,7 +1,8 @@
 /**
  * HTTP contract for Kody's CapabilityProxy (Open API `/v1`). Local execute
  * runs user code in workerd and forwards every `kody:runtime` call here with
- * a scoped API token.
+ * a Bearer from `--token` / `KODY_API_TOKEN` or (when unset) `kody login`
+ * OAuth access token.
  *
  * - `GET  /v1/capability-proxy/session` validates the token before workerd
  *   starts. 200 → `{ scopes?: string[], expiresAt?: string }`.
@@ -11,8 +12,8 @@
  *   is the positional argument list. 200 → `{ result }`.
  *
  * Errors use `{ error: { code, message } }` (a bare string is accepted too).
- * 401 means the token is expired/revoked; 403 `feature_disabled` means the
- * `local-execute` flag is off for the account.
+ * 401 means the token is expired/revoked (or MCP OAuth until the platform
+ * accepts it); 403 `feature_disabled` means the `local-execute` flag is off.
  */
 export declare const capabilityProxySessionPath = "v1/capability-proxy/session";
 export declare const capabilityProxyCallPath = "v1/capability-proxy/call";