@kodycodes/cli 3.0.5 → 3.1.0

package/dist/{git-credential-6CJWVNED.js → git-credential-NTAPSLZP.js}

@@ -7,23 +7,23 @@ import {
   gitCredentialHostFromMcpUrl,
   resolveCliTokenLifetime,
   setupGitDefaultScopes
-} from "./chunk-PUQGDXIY.js";
+} from "./chunk-JNQKDAPN.js";
 import "./chunk-6ZYUGXVW.js";
 import {
   ensureOpenApiCredentials
-} from "./chunk-SSBZQMVX.js";
+} from "./chunk-QI3ZICHR.js";
 import "./chunk-CASGRYOF.js";
 import "./chunk-GVSGNTG6.js";
+import "./chunk-CWWHR4FH.js";
 import {
   callOpenApiOperation
-} from "./chunk-PIPQ2TTK.js";
+} from "./chunk-TGBFPYAY.js";
 import "./chunk-46IJPEID.js";
-import "./chunk-BML3W5CO.js";
 import {
   loadStoredApiToken
 } from "./chunk-CCRCEU7S.js";
+import "./chunk-BML3W5CO.js";
 import "./chunk-NHRYNRXG.js";
-import "./chunk-CWWHR4FH.js";
 import {
   loadCredentials
 } from "./chunk-3H72XY5R.js";
@@ -167,4 +167,4 @@ export {
   parseGitCredentialInput,
   readGitCredentialStdin
 };
-//# sourceMappingURL=git-credential-6CJWVNED.js.map
+//# sourceMappingURL=git-credential-NTAPSLZP.js.map

package/dist/{local-execute-O7FXIINV.js → local-execute-6NSAVTAV.js}

@@ -4,15 +4,10 @@ import {
   forwardLocalGatewayFetchStream,
   installMockFetchShimModules,
   startLocalRuntimeBridge
-} from "./chunk-WDVDHEEN.js";
-import {
-  resolveMockFetchGateway,
-  tryHandleMockGatewayFetchCall
-} from "./chunk-DCQ57UXY.js";
+} from "./chunk-FDRTJFCM.js";
 import {
   bundleLocalUserModule
 } from "./chunk-7RLOLQIT.js";
-import "./chunk-XV6D6HSG.js";
 import {
   createLocalEntrySource,
   createLocalRuntimeModuleSource,
@@ -27,7 +22,13 @@ import {
   runSecretEnvVar,
   runSecretHeader,
   writePackageModuleFiles
-} from "./chunk-YXJ5S67U.js";
+} from "./chunk-5BIXRCH7.js";
+import {
+  resolveMockFetchGateway,
+  tryHandleMockGatewayFetchCall
+} from "./chunk-DCQ57UXY.js";
+import "./chunk-XV6D6HSG.js";
+import "./chunk-EJXEVGWF.js";
 import {
   assertLocalExecuteNodeEngine
 } from "./chunk-2XPH7L2P.js";
@@ -35,9 +36,6 @@ import {
   redact
 } from "./chunk-CASGRYOF.js";
 import "./chunk-46IJPEID.js";
-import {
-  ensureWorkerdBinary
-} from "./chunk-BML3W5CO.js";
 import {
   assertTokenSafeApiUrl,
   callCapabilityProxy,
@@ -46,8 +44,10 @@ import {
   openCapabilityProxySession,
   sessionSupportsCredentialCallMap
 } from "./chunk-CCRCEU7S.js";
+import {
+  ensureWorkerdBinary
+} from "./chunk-BML3W5CO.js";
 import "./chunk-NHRYNRXG.js";
-import "./chunk-EJXEVGWF.js";
 import "./chunk-3H72XY5R.js";
 import {
   apiTokenEnvVar
@@ -396,4 +396,4 @@ export {
   runLocalExecute,
   savedPackageImportLocalResolveStatus
 };
-//# sourceMappingURL=local-execute-O7FXIINV.js.map
+//# sourceMappingURL=local-execute-6NSAVTAV.js.map

package/dist/{local-package-graph-FEPI7JNQ.js → local-package-graph-UU3XHKIM.js}

@@ -30,7 +30,7 @@ import {
   rewriteLocalModulesToPackageFacades,
   synthesizePackageGraphEntry,
   writePackageModuleFiles
-} from "./chunk-YXJ5S67U.js";
+} from "./chunk-5BIXRCH7.js";
 import "./chunk-CCRCEU7S.js";
 import "./chunk-NHRYNRXG.js";
 import "./chunk-3H72XY5R.js";
@@ -68,4 +68,4 @@ export {
   synthesizePackageGraphEntry,
   writePackageModuleFiles
 };
-//# sourceMappingURL=local-package-graph-FEPI7JNQ.js.map
+//# sourceMappingURL=local-package-graph-UU3XHKIM.js.map

package/dist/{local-package-run-42R3CP2A.js → local-package-run-RATCOPRD.js}

@@ -4,21 +4,21 @@ import {
   packageIdMatchesLocalPackage,
   resolveLocalPackageBinding,
   runLocalPackageModule
-} from "./chunk-HO4GCC6N.js";
-import "./chunk-WDVDHEEN.js";
-import "./chunk-DCQ57UXY.js";
-import "./chunk-VMP2UL6Z.js";
+} from "./chunk-YFDVDTNX.js";
+import "./chunk-PDDX5RJS.js";
+import "./chunk-FDRTJFCM.js";
 import "./chunk-7RLOLQIT.js";
+import "./chunk-5BIXRCH7.js";
+import "./chunk-DCQ57UXY.js";
 import "./chunk-RAZBIC6O.js";
 import "./chunk-XV6D6HSG.js";
-import "./chunk-YXJ5S67U.js";
+import "./chunk-EJXEVGWF.js";
 import "./chunk-CASGRYOF.js";
-import "./chunk-PIPQ2TTK.js";
+import "./chunk-TGBFPYAY.js";
 import "./chunk-46IJPEID.js";
-import "./chunk-BML3W5CO.js";
 import "./chunk-CCRCEU7S.js";
+import "./chunk-BML3W5CO.js";
 import "./chunk-NHRYNRXG.js";
-import "./chunk-EJXEVGWF.js";
 import "./chunk-3H72XY5R.js";
 import "./chunk-BTL3PJ2H.js";
 import "./chunk-UW6AWLXX.js";
@@ -28,4 +28,4 @@ export {
   resolveLocalPackageBinding,
   runLocalPackageModule
 };
-//# sourceMappingURL=local-package-run-42R3CP2A.js.map
+//# sourceMappingURL=local-package-run-RATCOPRD.js.map

package/dist/{mock-dep-resolve-TTCQQEN2.js → mock-dep-resolve-FM5GKMKE.js}

@@ -1,18 +1,18 @@
 import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
 import {
   resolveLocalExecuteBearer
-} from "./chunk-PZKBPKJ2.js";
-import "./chunk-SSBZQMVX.js";
+} from "./chunk-FS3BGXCK.js";
+import "./chunk-QI3ZICHR.js";
 import "./chunk-CASGRYOF.js";
 import "./chunk-GVSGNTG6.js";
-import "./chunk-PIPQ2TTK.js";
+import "./chunk-CWWHR4FH.js";
+import "./chunk-TGBFPYAY.js";
 import "./chunk-46IJPEID.js";
-import "./chunk-BML3W5CO.js";
 import {
   resolveScopedApiToken
 } from "./chunk-CCRCEU7S.js";
+import "./chunk-BML3W5CO.js";
 import "./chunk-NHRYNRXG.js";
-import "./chunk-CWWHR4FH.js";
 import "./chunk-3H72XY5R.js";
 import {
   defaultApiUrl,
@@ -57,4 +57,4 @@ async function tryResolveMockDepResolve(input) {
 export {
   tryResolveMockDepResolve
 };
-//# sourceMappingURL=mock-dep-resolve-TTCQQEN2.js.map
+//# sourceMappingURL=mock-dep-resolve-FM5GKMKE.js.map

package/dist/mock-fetch-gateway-TNK74HEP.js

@@ -14,9 +14,9 @@ import {
   unmockedRequestError
 } from "./chunk-DCQ57UXY.js";
 import "./chunk-XV6D6HSG.js";
+import "./chunk-EJXEVGWF.js";
 import "./chunk-BML3W5CO.js";
 import "./chunk-NHRYNRXG.js";
-import "./chunk-EJXEVGWF.js";
 import "./chunk-UW6AWLXX.js";
 export {
   assertOutboundAllowed,

package/dist/{mock-local-deps-Z6DBUQTP.js → mock-local-deps-6I7HSHXD.js}

@@ -7,14 +7,14 @@ import {
   parseKodyPackageSpecifier,
   resolveLocalPackageModules,
   tryLoadSelfManifest
-} from "./chunk-VMP2UL6Z.js";
+} from "./chunk-PDDX5RJS.js";
 import "./chunk-7RLOLQIT.js";
+import "./chunk-5BIXRCH7.js";
 import "./chunk-RAZBIC6O.js";
 import "./chunk-XV6D6HSG.js";
-import "./chunk-YXJ5S67U.js";
+import "./chunk-EJXEVGWF.js";
 import "./chunk-CCRCEU7S.js";
 import "./chunk-NHRYNRXG.js";
-import "./chunk-EJXEVGWF.js";
 import "./chunk-3H72XY5R.js";
 import "./chunk-BTL3PJ2H.js";
 import "./chunk-UW6AWLXX.js";
@@ -27,4 +27,4 @@ export {
   resolveLocalPackageModules,
   tryLoadSelfManifest
 };
-//# sourceMappingURL=mock-local-deps-Z6DBUQTP.js.map
+//# sourceMappingURL=mock-local-deps-6I7HSHXD.js.map

package/dist/mock-server-CJQI6B3A.js

@@ -8,9 +8,9 @@ import {
 } from "./chunk-5X563FYY.js";
 import "./chunk-DCQ57UXY.js";
 import "./chunk-XV6D6HSG.js";
+import "./chunk-EJXEVGWF.js";
 import "./chunk-BML3W5CO.js";
 import "./chunk-NHRYNRXG.js";
-import "./chunk-EJXEVGWF.js";
 import "./chunk-UW6AWLXX.js";
 export {
   ensureMockTarget,

package/dist/{open-api-client-42L6TM2U.js → open-api-client-7TV5SPHT.js}

@@ -17,10 +17,10 @@ import {
   searchWithApiToken,
   toolResultFromHttpBody,
   whoamiWithApiToken
-} from "./chunk-PIPQ2TTK.js";
+} from "./chunk-TGBFPYAY.js";
 import "./chunk-46IJPEID.js";
-import "./chunk-BML3W5CO.js";
 import "./chunk-CCRCEU7S.js";
+import "./chunk-BML3W5CO.js";
 import "./chunk-NHRYNRXG.js";
 import "./chunk-3H72XY5R.js";
 import "./chunk-BTL3PJ2H.js";
@@ -44,4 +44,4 @@ export {
   toolResultFromHttpBody,
   whoamiWithApiToken
 };
-//# sourceMappingURL=open-api-client-42L6TM2U.js.map
+//# sourceMappingURL=open-api-client-7TV5SPHT.js.map

package/dist/{remote-execute-J35MQTUC.js → remote-execute-XLKI7JTI.js}

@@ -4,12 +4,12 @@ import {
 } from "./chunk-SLNAWWQK.js";
 import {
   openApiRequest
-} from "./chunk-PIPQ2TTK.js";
+} from "./chunk-TGBFPYAY.js";
 import "./chunk-46IJPEID.js";
-import "./chunk-BML3W5CO.js";
 import {
   assertTokenSafeApiUrl
 } from "./chunk-CCRCEU7S.js";
+import "./chunk-BML3W5CO.js";
 import "./chunk-NHRYNRXG.js";
 import "./chunk-3H72XY5R.js";
 import "./chunk-BTL3PJ2H.js";
@@ -122,4 +122,4 @@ export {
   resolveRemoteExecuteCode,
   runRemoteExecuteWithToken
 };
-//# sourceMappingURL=remote-execute-J35MQTUC.js.map
+//# sourceMappingURL=remote-execute-XLKI7JTI.js.map

package/dist/{setup-git-IGLLNSLA.js → setup-git-LQVUW2D4.js}

@@ -37,12 +37,12 @@ import {
   setupGitConfigScopes,
   setupGitDefaultScopes,
   setupGitRequiredScopes
-} from "./chunk-PUQGDXIY.js";
+} from "./chunk-JNQKDAPN.js";
 import "./chunk-6ZYUGXVW.js";
-import "./chunk-PIPQ2TTK.js";
+import "./chunk-TGBFPYAY.js";
 import "./chunk-46IJPEID.js";
-import "./chunk-BML3W5CO.js";
 import "./chunk-CCRCEU7S.js";
+import "./chunk-BML3W5CO.js";
 import "./chunk-NHRYNRXG.js";
 import "./chunk-3H72XY5R.js";
 import "./chunk-BTL3PJ2H.js";
@@ -86,4 +86,4 @@ export {
   setupGitDefaultScopes,
   setupGitRequiredScopes
 };
-//# sourceMappingURL=setup-git-IGLLNSLA.js.map
+//# sourceMappingURL=setup-git-LQVUW2D4.js.map

package/dist/skill-7B2RL273.js

@@ -0,0 +1,38 @@
+import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
+import {
+  agentSkillsOriginFromMcpUrl,
+  bundledSkillPath,
+  extractSkillBodyForDigest,
+  fetchHostedKodyCliSkill,
+  hostedAgentSkillsIndexPath,
+  hostedSkillFetchTimeoutMs,
+  installSkill,
+  projectSkillTargets,
+  refreshInstalledSkills,
+  scheduleDetachedSkillRefresh,
+  sha256Digest,
+  skillRefreshEntryPath,
+  userSkillTargets,
+  wrapHostedSkillBody,
+  writeFileAtomic
+} from "./chunk-TCJSXIEG.js";
+import "./chunk-BTL3PJ2H.js";
+import "./chunk-UW6AWLXX.js";
+export {
+  agentSkillsOriginFromMcpUrl,
+  bundledSkillPath,
+  extractSkillBodyForDigest,
+  fetchHostedKodyCliSkill,
+  hostedAgentSkillsIndexPath,
+  hostedSkillFetchTimeoutMs,
+  installSkill,
+  projectSkillTargets,
+  refreshInstalledSkills,
+  scheduleDetachedSkillRefresh,
+  sha256Digest,
+  skillRefreshEntryPath,
+  userSkillTargets,
+  wrapHostedSkillBody,
+  writeFileAtomic
+};
+//# sourceMappingURL=skill-7B2RL273.js.map

package/dist/skill-7B2RL273.js.map

@@ -0,0 +1,6 @@
+{
+  "version": 3,
+  "sources": [],
+  "mappings": "",
+  "names": []
+}

package/dist/skill-refresh.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/skill-refresh.js

@@ -0,0 +1,20 @@
+#!/usr/bin/env node
+import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
+import {
+  refreshInstalledSkills
+} from "./chunk-TCJSXIEG.js";
+import "./chunk-BTL3PJ2H.js";
+import "./chunk-UW6AWLXX.js";
+
+// src/skill-refresh.ts
+function readOrigin(argv) {
+  const index = argv.indexOf("--origin");
+  if (index < 0) return void 0;
+  const value = argv[index + 1];
+  return typeof value === "string" && value.trim() !== "" ? value.trim() : void 0;
+}
+await refreshInstalledSkills({
+  origin: readOrigin(process.argv.slice(2))
+}).catch(() => {
+});
+//# sourceMappingURL=skill-refresh.js.map

package/dist/skill-refresh.js.map

@@ -0,0 +1,6 @@
+{
+  "version": 3,
+  "sources": ["../src/skill-refresh.ts"],
+  "mappings": ";;;;;;;;;AAOA,SAAS,WAAW,MAAyC;AAC5D,QAAM,QAAQ,KAAK,QAAQ,UAAU;AACrC,MAAI,QAAQ,EAAG,QAAO;AACtB,QAAM,QAAQ,KAAK,QAAQ,CAAC;AAC5B,SAAO,OAAO,UAAU,YAAY,MAAM,KAAK,MAAM,KAClD,MAAM,KAAK,IACX;AACJ;AAEA,MAAM,uBAAuB;AAAA,EAC5B,QAAQ,WAAW,QAAQ,KAAK,MAAM,CAAC,CAAC;AACzC,CAAC,EAAE,MAAM,MAAM;AAEf,CAAC;",
+  "names": []
+}

package/dist/skill.d.ts

@@ -1,18 +1,60 @@
-export declare function bundledSkillPath(): string;
-export declare function userSkillTargets(home?: string): Array<{
-    host: string;
-    path: string;
-}>;
-export declare function projectSkillTargets(cwd?: string): Array<{
+import { type SpawnOptions } from 'node:child_process';
+export declare const hostedAgentSkillsIndexPath = "/.well-known/agent-skills/index.json";
+export type SkillTarget = {
     host: string;
     path: string;
-}>;
+};
+export declare function bundledSkillPath(): string;
+export declare function agentSkillsOriginFromMcpUrl(mcpUrl?: string): string;
+export declare function userSkillTargets(home?: string): Array<SkillTarget>;
+export declare function projectSkillTargets(cwd?: string): Array<SkillTarget>;
+export declare function sha256Digest(body: string): string;
+export declare function wrapHostedSkillBody(body: string): string;
+/** Body bytes that should match the hosted index digest (no local frontmatter). */
+export declare function extractSkillBodyForDigest(fileContents: string): string;
+/** Bound hosted skill fetches so install/refresh can fall back offline. */
+export declare const hostedSkillFetchTimeoutMs = 5000;
+export declare function fetchHostedKodyCliSkill(input: {
+    origin?: string;
+    fetchImpl?: typeof fetch;
+    timeoutMs?: number;
+}): Promise<{
+    body: string;
+    digest: string;
+    url: string;
+} | null>;
 export declare function installSkill(input: {
     project?: boolean;
     cwd?: string;
     home?: string;
     sourcePath?: string;
-}): Promise<Array<{
-    host: string;
-    path: string;
-}>>;
+    origin?: string;
+    fetchImpl?: typeof fetch;
+}): Promise<Array<SkillTarget>>;
+/**
+ * Refresh user-level installed skill copies when the hosted digest changed.
+ * Best-effort: missing files and network failures are ignored. Project copies
+ * are left alone so a repo that ships or commits its own skill is not rewritten
+ * by an unrelated CLI command.
+ */
+export declare function refreshInstalledSkills(input?: {
+    home?: string;
+    origin?: string;
+    fetchImpl?: typeof fetch;
+}): Promise<Array<SkillTarget>>;
+/** Write then rename so concurrent readers never see a partial skill file. */
+export declare function writeFileAtomic(path: string, body: string): Promise<void>;
+export declare function skillRefreshEntryPath(): string;
+/**
+ * Spawn a detached child to refresh hosted skills so the parent CLI can exit
+ * without waiting on network I/O. Best-effort; spawn failures are ignored.
+ */
+type SkillRefreshChild = {
+    unref: () => void;
+    on?: (event: string, listener: (...args: Array<unknown>) => void) => unknown;
+};
+export declare function scheduleDetachedSkillRefresh(input?: {
+    origin?: string;
+    spawnImpl?: (command: string, args: Array<string>, options: SpawnOptions) => SkillRefreshChild;
+}): void;
+export {};

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@kodycodes/cli",
-	"version": "3.0.5",
+	"version": "3.1.0",
 	"description": "Official Kody CLI: login, secure token storage, search, and execute over the OpenAPI.",
 	"type": "module",
 	"bin": {
@@ -23,7 +23,7 @@
 		"build": "node scripts/build.mjs && tsc -p tsconfig.build.json",
 		"bench": "node scripts/bench.mjs",
 		"typecheck": "tsc --noEmit",
-		"test": "tsx --test test/*.test.ts",
+		"test": "KODY_SKIP_SKILL_REFRESH=1 KODY_SKIP_GIT_HELPER_REFRESH=1 tsx --test test/*.test.ts",
 		"validate": "npm run typecheck && npm run test && npm run build"
 	},
 	"engines": {

package/skills/kody/SKILL.md

@@ -1,142 +1,28 @@
 ---
 name: kody
 description: >
-  Install Kody as a remote MCP server, then use `search` / MCP tools and prefer
-  `kody execute --local` when the CLI and Node are available. Use when the user
-  mentions Kody, kody.codes, durable agent tasks, or wants to search/execute via
-  Kody.
+  Install and bootstrap the Kody CLI, then prefer `execute --local` when Node
+  and a shell are available. Use when the person mentions Kody or wants local
+  execute instead of hosted Worker compute days.
 ---
 
-# Kody
+# Kody CLI
 
-Kody is a remote MCP personal assistant. Install it as an MCP server in this
-agent for `search`, `api`, and discovery. Prefer local CLI execute when Node ≥22
-and `@kodycodes/cli` are available. Use MCP / hosted paths when the CLI or Node
-cannot run.
+Always-current skill:
+https://kody.codes/.well-known/agent-skills/kody-cli/SKILL.md
 
-`@kodycodes/cli` installs host MCP config and runs local execute against real
-secrets while keeping `kody:runtime` hops on CapabilityProxy.
+Index (with digests): https://kody.codes/.well-known/agent-skills/index.json
 
-## Install the MCP server (recommended)
+## Quick start
 
 ```bash
-npx @kodycodes/cli install
+npx -y @kodycodes/cli@latest skill install
+npx -y @kodycodes/cli@latest execute --local --code 'import { kody } from "kody:runtime"; export default async function main() { return await kody.metaGetCurrentUser({}) }'
 ```
 
-That command lists **running local** agents and writes each host's remote MCP
-entry for `https://kody.codes/mcp`. Host OAuth stays in that client — do not run
-`kody login` for the host connection.
+If the CLI is not signed in and you already have Kody MCP: call `api` with
+`cliCredentialBootstrap`, then run the returned `cli_command`. Interactive
+humans: `npx -y @kodycodes/cli@latest login`.
 
-After install, use the Kody MCP tools in this agent for discovery and Open API:
-
-- `search` — discover capabilities, packages, and entity detail
-- `api` — call one Open API operation directly (no sandbox)
-- Prefer `search` before composing work
-
-For one-off modules, smoke tests, and composition: when Node ≥22 and the CLI are
-available, prefer `npx @kodycodes/cli execute --local` (see
-[Local CLI execute](https://kody.codes/docs/local-execute)). If `--local` cannot
-run, use Open API / MCP `api`, or fix the environment — do **not** use hosted
-MCP `execute` for agent work when a local or Open API path exists.
-
-For web-based clients (ChatGPT, Claude.ai, Grok), point the user at
-https://kody.codes/onboarding.
-
-To copy this skill into Claude Code / Cursor / Agents:
-
-```bash
-npx @kodycodes/cli skill install
-```
-
-## CLI
-
-```bash
-npm install -g @kodycodes/cli
-kody login
-kody login --org acme
-kody search "what can you do"
-kody search --domain email
-kody execute --local --code "import { kody } from 'kody:runtime'\nexport default async function main() { return await kody.search({ query: 'what can you do' }) }"
-kody execute --local --credential github=work --code "import { credential } from 'kody:runtime'\nexport default async function main() { const gh = await credential('github'); return { name: gh.name, hosts: gh.hosts } }"
-kody status
-kody whoami
-kody logout
-```
-
-The CLI opens a browser for Kody OAuth (PKCE + Client ID Metadata Documents). If
-a browser cannot open, it prints the URL. Tokens (access + refresh) are stored
-in the OS keychain on macOS, Windows, and Linux (Secret Service). Linux without
-Secret Service — including headless machines that only have an in-memory kernel
-keyring — falls back to a `0600` file under `$XDG_CONFIG_HOME/kody`.
-
-Never ask the user to paste tokens into chat.
-
-Override the MCP URL with `--mcp-url` or `KODY_MCP_URL` for preview or local
-servers. Default: `https://kody.codes/mcp`.
-
-To run execute with a scoped API token and **no** `kody login`, set
-`KODY_API_TOKEN` (or `--token`). Cloud execute (no `--local`) goes through
-CapabilityProxy → `kody.execute`. Add `--local` to run the module on this
-machine instead (Node.js 22 or newer; older Node fails before workerd starts).
-Modules with static `kody:@…` imports keep `--local`: the CLI fetches stamped
-package modules via `POST /v1/local-execute/package-graph` and embeds them in
-local workerd (CapabilityProxy only for per-call `kody:runtime` hops — not a
-whole-module cloud defer). If that package-graph API is missing, `--local` fails
-clearly rather than silently billing a remote execute. `--file` entries are
-bundled (relative imports and npm packages; `kody:*` external) before workerd
-loads them, matching hosted execute / publish. `--code` and stdin are not
-rewritten.
-
-For `execute --local` auth: `--token` / `KODY_API_TOKEN` wins when set;
-otherwise a stored token from `kody auth bootstrap --code` (after MCP
-`cliCredentialBootstrap`); otherwise a valid `kody login` session (OAuth access
-token as Bearer only when the API and MCP URLs are paired — never print it,
-never mint via `tokenCreate` under the hood). The default pair is
-`https://api.kody.codes` and `https://kody.codes/mcp`; preview workers pair when
-the API worker name adds `-api`, and loopback hosts pair at any port. For
-another API origin, use `auth bootstrap --api-url <origin>` or set
-`KODY_API_TOKEN`. A PR preview's API host is
-`https://kody-pr-<n>-api.<subdomain>.workers.dev`, not the app origin
-`kody-pr-<n>` (which 404s `/v1/*` with HTML). Prefer bootstrap over
-`tokenCreate` for agents already on MCP so `kody_at_…` never appears in chat.
-Until the Open API accepts MCP OAuth on CapabilityProxy / package-graph
-(https://github.com/kody-hq/kody/issues/2812), use bootstrap or mint a scoped
-token with the MCP `api` tool `tokenCreate` — include `local-execute` plus the
-capability scopes the module calls — and pass `--token` or `KODY_API_TOKEN`. If
-none of those are available, the CLI error says that (bootstrap → login →
-tokenCreate for CI). `insufficient_scope` names the missing scope and prints the
-exact command to mint a token that adds it:
-`npx @kodycodes/cli auth bootstrap --lifetime short|long --scopes <list>` after
-`kody login`, or
-`cliCredentialBootstrap({ lifetime: "short"|"long", scopes: [...] })` from MCP
-(hints preserve the current token's lifetime class when known). Default
-bootstrap scopes stay least-privilege (no `package:write`), and `--scopes`
-replaces them, so list every scope you need. Publish a package after
-`packageGetGitRemote` clone/push with
-`kody package publish <@owner/leaf|package_id>` (thin
-`packagePublishExternalPush` wrapper; same auth as `kody api`). See and change
-who can use a package (teams and org members of the `--org` org) with
-`kody package collaborators <package>`,
-`kody package grant <package> --team <slug>|--user <username> --preset use|contribute|manage`,
-and
-`kody package revoke <package> --team <slug>|--user <username>|--grant <id>`.
-These need a token with `package:manage_access`. `feature_disabled` means the
-account `local-execute` flag is off. Never read MCP OAuth tokens from the host.
-
-```bash
-# Agents on MCP:
-# cliCredentialBootstrap → { bootstrap_code, cli_command }
-npx @kodycodes/cli auth bootstrap --code 'kody_bc_…'
-npx @kodycodes/cli execute --local --file ./task.js --params '{"q":"email"}'
-# Opt in to private and local network access if needed:
-npx @kodycodes/cli execute --local --allow-private-network --file ./task.js
-
-Local execute is public-network-only by default. `--allow-private-network`
-opts into private and local addresses; the loopback CapabilityProxy bridge
-continues to work either way.
-
-npx @kodycodes/cli login
-npx @kodycodes/cli execute --local --file ./task.js --params '{"q":"email"}'
-# Or with an explicit scoped token (wins over login / bootstrap store):
-KODY_API_TOKEN=… npx @kodycodes/cli execute --local --file ./task.js --params '{"q":"email"}'
-```
+`kody skill install` copies this stub and refreshes the full hosted body when
+reachable. Later CLI runs refresh local copies when the hosted digest changes.