@kya-os/cli 1.8.1 → 1.8.3

package/dist/utils/dco/claude-config.d.ts

@@ -1,3 +1,4 @@
+import { type MergeJsonResult, type UpsertResult as CliKitUpsertResult } from "../cli-kit/index.js";
 /**
  * Claude Code integration: a managed block in CLAUDE.md instructs the agent
  * harness to attribute PRs to the registered agent, and .claude/settings.json
@@ -6,37 +7,40 @@
  * The PR byline can only be influenced through instructions because the PR
  * body is composed by the model at PR time; commit trailers are enforced
  * mechanically by the git hook instead (see git-config.ts).
+ *
+ * The block used to interpolate a specific agent's name/URL/DID as literal
+ * strings. That was wrong for any repo that receives dispatched work from
+ * more than one agent: CLAUDE.md is committed, so the literal values only
+ * ever reflected whichever agent happened to run `dco setup` first, and
+ * every other agent's PRs in that repo would carry a false attribution with
+ * no way to correct it short of re-running `dco setup` (which a dispatch
+ * flow generally can't do per task). The block below is agent-agnostic
+ * instead: it tells the agent to run `dco whoami` and use whatever
+ * that reports, so the byline is always whichever identity is actually
+ * configured in the current checkout. See resolve-agent.ts.
  */
 export declare const CLAUDE_MD_START = "<!-- mcpi:dco:start -->";
 export declare const CLAUDE_MD_END = "<!-- mcpi:dco:end -->";
 export interface AttributionBlockParams {
-    agentName: string;
-    agentUrl: string;
-    /**
-     * The agent's DID (e.g. `did:key:z6Mk...`). Included as a machine-readable
-     * companion to the human-readable byline so PR metadata resolves back to a
-     * specific KYA-OS registered agent identity, not just a display name.
-     */
-    agentDid?: string;
     /**
      * When the git hook could not be installed (foreign hook, unsafe
      * core.hooksPath, or install failure), trailer duty falls back to
      * instructions.
      */
     includeTrailerInstructions?: boolean;
-    humanName?: string;
-    humanEmail?: string;
-    agentEmail?: string;
 }
-export declare function buildAttributionBlock(params: AttributionBlockParams): string;
-export type UpsertResult = "created" | "updated" | "unchanged" | "would-change";
+export declare const DID_PATTERN: RegExp;
+export declare const MAX_DID_LENGTH = 200;
+export declare function isValidDid(value: string): boolean;
+export declare function buildAttributionBlock(params?: AttributionBlockParams): string;
+export type UpsertResult = CliKitUpsertResult;
 export declare function upsertClaudeMdBlock(cwd: string, block: string, options?: {
     dryRun?: boolean;
 }): {
     result: UpsertResult;
     path: string;
 };
-export type SettingsResult = "created" | "updated" | "unchanged" | "skipped-invalid" | "would-change";
+export type SettingsResult = MergeJsonResult;
 /**
  * Set includeCoAuthoredBy: false in .claude/settings.json, preserving every
  * other key. A file we cannot parse is left untouched: clobbering a user's

package/dist/utils/dco/claude-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"claude-config.d.ts","sourceRoot":"","sources":["../../../src/utils/dco/claude-config.ts"],"names":[],"mappings":"AAIA;;;;;;;;GAQG;AAEH,eAAO,MAAM,eAAe,4BAA4B,CAAC;AACzD,eAAO,MAAM,aAAa,0BAA0B,CAAC;AAErD,MAAM,WAAW,sBAAsB;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,0BAA0B,CAAC,EAAE,OAAO,CAAC;IACrC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AA6BD,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,sBAAsB,GAAG,MAAM,CA4B5E;AAED,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,SAAS,GAAG,WAAW,GAAG,cAAc,CAAC;AAEhF,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,EACb,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAA;CAAO,GACjC;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAiCxC;AAED,MAAM,MAAM,cAAc,GACtB,SAAS,GACT,SAAS,GACT,WAAW,GACX,iBAAiB,GACjB,cAAc,CAAC;AAEnB;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,MAAM,EACX,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAA;CAAO,GACjC;IAAE,MAAM,EAAE,cAAc,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAqC1C"}
+{"version":3,"file":"claude-config.d.ts","sourceRoot":"","sources":["../../../src/utils/dco/claude-config.ts"],"names":[],"mappings":"AACA,OAAO,EAGL,KAAK,eAAe,EACpB,KAAK,YAAY,IAAI,kBAAkB,EACxC,MAAM,qBAAqB,CAAC;AAE7B;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,eAAO,MAAM,eAAe,4BAA4B,CAAC;AACzD,eAAO,MAAM,aAAa,0BAA0B,CAAC;AAErD,MAAM,WAAW,sBAAsB;IACrC;;;;OAIG;IACH,0BAA0B,CAAC,EAAE,OAAO,CAAC;CACtC;AAQD,eAAO,MAAM,WAAW,QAAuC,CAAC;AAChE,eAAO,MAAM,cAAc,MAAM,CAAC;AAElC,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEjD;AAED,wBAAgB,qBAAqB,CAAC,MAAM,GAAE,sBAA2B,GAAG,MAAM,CAqBjF;AAED,MAAM,MAAM,YAAY,GAAG,kBAAkB,CAAC;AAE9C,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,EACb,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAA;CAAO,GACjC;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CASxC;AAED,MAAM,MAAM,cAAc,GAAG,eAAe,CAAC;AAE7C;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,MAAM,EACX,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAA;CAAO,GACjC;IAAE,MAAM,EAAE,cAAc,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAG1C"}

package/dist/utils/dco/claude-config.js

@@ -1,6 +1,5 @@
-import { existsSync, mkdirSync, readFileSync } from "fs";
 import { join } from "path";
-import { writeFileAtomicSafe } from "./fs-safe.js";
+import { mergeJsonFile, upsertMarkerBlock, } from "../cli-kit/index.js";
 /**
  * Claude Code integration: a managed block in CLAUDE.md instructs the agent
  * harness to attribute PRs to the registered agent, and .claude/settings.json
@@ -9,86 +8,51 @@ import { writeFileAtomicSafe } from "./fs-safe.js";
  * The PR byline can only be influenced through instructions because the PR
  * body is composed by the model at PR time; commit trailers are enforced
  * mechanically by the git hook instead (see git-config.ts).
+ *
+ * The block used to interpolate a specific agent's name/URL/DID as literal
+ * strings. That was wrong for any repo that receives dispatched work from
+ * more than one agent: CLAUDE.md is committed, so the literal values only
+ * ever reflected whichever agent happened to run `dco setup` first, and
+ * every other agent's PRs in that repo would carry a false attribution with
+ * no way to correct it short of re-running `dco setup` (which a dispatch
+ * flow generally can't do per task). The block below is agent-agnostic
+ * instead: it tells the agent to run `dco whoami` and use whatever
+ * that reports, so the byline is always whichever identity is actually
+ * configured in the current checkout. See resolve-agent.ts.
  */
 export const CLAUDE_MD_START = "<!-- mcpi:dco:start -->";
 export const CLAUDE_MD_END = "<!-- mcpi:dco:end -->";
-/**
- * Values interpolated into the managed block come from .mcpi/agent.json and
- * git config, both attacker-influenceable in a cloned repo. Clamp everything
- * to a single line with no control characters so crafted metadata cannot
- * inject extra instructions into a block the harness treats as trusted.
- */
-function singleLine(value) {
-    // eslint-disable-next-line no-control-regex
-    return value.replace(/[\u0000-\u001f\u007f]+/g, " ").trim();
-}
 // did:key / did:web / etc: a lowercase method name, then method-specific-id
 // drawn from the DID spec's idchar set. No backtick, "<", "!", or whitespace
-// can appear in a matching value, so a well-formed DID can neither break out
-// of the surrounding code span nor smuggle the literal end marker that
-// upsertClaudeMdBlock's indexOf() scan looks for. An attacker-influenceable
-// value that doesn't match is rejected outright rather than sanitized, since
-// clamping a corrupt DID to "look single-line" would still let a crafted
-// value through by construction. The length cap keeps a hostile/corrupt DID
-// from bloating CLAUDE.md and every PR body generated from it.
-const DID_PATTERN = /^did:[a-z0-9]+:[A-Za-z0-9.\-_:%]+$/;
-const MAX_DID_LENGTH = 200;
-function isValidDid(value) {
+// can appear in a matching value. Exported for verify.ts, which validates a
+// DID claimed in a PR body against this same shape before ever resolving
+// it, and for resolve-agent.ts, which validates the DID read from
+// .mcpi/identity.json before it's ever printed by `dco whoami`.
+export const DID_PATTERN = /^did:[a-z0-9]+:[A-Za-z0-9.\-_:%]+$/;
+export const MAX_DID_LENGTH = 200;
+export function isValidDid(value) {
     return value.length <= MAX_DID_LENGTH && DID_PATTERN.test(value);
 }
-export function buildAttributionBlock(params) {
-    const agentName = singleLine(params.agentName);
-    const agentUrl = singleLine(params.agentUrl);
-    const agentDid = params.agentDid && isValidDid(params.agentDid) ? params.agentDid : undefined;
+export function buildAttributionBlock(params = {}) {
     const lines = [
         CLAUDE_MD_START,
-        "## Agent attribution (managed by `mcpi dco setup`)",
+        "## Agent attribution (managed by `dco setup`)",
         "",
-        agentDid
-            ? "- When creating pull requests, end the PR description with exactly these two lines:"
-            : "- When creating pull requests, end the PR description with exactly this byline:",
-        `  \`Generated with [${agentName}](${agentUrl})\``,
+        "- Before creating a pull request, run `dco whoami --json` in this repo to find the agent identity configured in this checkout.",
+        '- If it reports `"configured": true`, end the PR description with exactly these two lines, filled in from that command\'s `name`, `url`, and `did` fields (curly braces mark what to fill in; every other character, including the square/round brackets and the angle brackets around the DID line, is literal):',
+        "  `Generated with [{name}]({url})`",
+        "  `Agent DID: {did}`",
+        '- If it reports `"configured": false`, do not add a "Generated with" or "Agent DID" line at all.',
+        '- Never add "Generated with Claude Code" or any other tool byline to PR descriptions or commit messages.',
     ];
-    if (agentDid) {
-        lines.push(`  \`Agent DID: ${agentDid}\``);
-    }
-    lines.push('- Never add "Generated with Claude Code" or any other tool byline to PR descriptions or commit messages.');
     if (params.includeTrailerInstructions) {
-        lines.push("- End every commit message with these trailers:", `  \`Signed-off-by: ${singleLine(params.humanName ?? "")} <${singleLine(params.humanEmail ?? "")}>\``, `  \`Co-authored-by: ${agentName} <${singleLine(params.agentEmail ?? "")}>\``);
+        lines.push("- End every commit message with these trailers. Resolve the first line from `git config user.name` / `git config user.email`, and the second from `dco whoami --json`'s `name` and `email` fields (omit this line entirely if `configured` is false). Curly braces mark what to fill in; the angle brackets around each email are literal characters git trailers require, keep them:", "  `Signed-off-by: {your name} <{your email}>`", "  `Co-authored-by: {agent name} <{agent email}>`");
     }
     lines.push(CLAUDE_MD_END);
     return lines.join("\n");
 }
 export function upsertClaudeMdBlock(cwd, block, options = {}) {
-    const path = join(cwd, "CLAUDE.md");
-    if (!existsSync(path)) {
-        if (options.dryRun) {
-            return { result: "would-change", path };
-        }
-        writeFileAtomicSafe(path, block + "\n");
-        return { result: "created", path };
-    }
-    const existing = readFileSync(path, "utf-8");
-    const startIdx = existing.indexOf(CLAUDE_MD_START);
-    const endIdx = existing.indexOf(CLAUDE_MD_END);
-    let next;
-    if (startIdx !== -1 && endIdx !== -1 && endIdx > startIdx) {
-        const before = existing.slice(0, startIdx);
-        const after = existing.slice(endIdx + CLAUDE_MD_END.length);
-        next = before + block + after;
-    }
-    else {
-        const separator = existing.endsWith("\n") ? "\n" : "\n\n";
-        next = existing + separator + block + "\n";
-    }
-    if (next === existing) {
-        return { result: "unchanged", path };
-    }
-    if (options.dryRun) {
-        return { result: "would-change", path };
-    }
-    writeFileAtomicSafe(path, next);
-    return { result: "updated", path };
+    return upsertMarkerBlock(cwd, "CLAUDE.md", CLAUDE_MD_START, CLAUDE_MD_END, block, options);
 }
 /**
  * Set includeCoAuthoredBy: false in .claude/settings.json, preserving every
@@ -96,37 +60,7 @@ export function upsertClaudeMdBlock(cwd, block, options = {}) {
  * settings is worse than leaving the stock byline on.
  */
 export function updateClaudeSettings(cwd, options = {}) {
-    const dir = join(cwd, ".claude");
-    const path = join(dir, "settings.json");
-    let settings = {};
-    if (existsSync(path)) {
-        try {
-            const parsed = JSON.parse(readFileSync(path, "utf-8"));
-            if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-                return { result: "skipped-invalid", path };
-            }
-            settings = parsed;
-        }
-        catch {
-            return { result: "skipped-invalid", path };
-        }
-        if (settings.includeCoAuthoredBy === false) {
-            return { result: "unchanged", path };
-        }
-        if (options.dryRun) {
-            return { result: "would-change", path };
-        }
-        settings.includeCoAuthoredBy = false;
-        writeFileAtomicSafe(path, JSON.stringify(settings, null, 2) + "\n");
-        return { result: "updated", path };
-    }
-    if (options.dryRun) {
-        return { result: "would-change", path };
-    }
-    if (!existsSync(dir)) {
-        mkdirSync(dir, { recursive: true });
-    }
-    writeFileAtomicSafe(path, JSON.stringify({ includeCoAuthoredBy: false }, null, 2) + "\n");
-    return { result: "created", path };
+    const path = join(cwd, ".claude", "settings.json");
+    return mergeJsonFile(path, { includeCoAuthoredBy: false }, options);
 }
 //# sourceMappingURL=claude-config.js.map

package/dist/utils/dco/claude-config.js.map

@@ -1 +1 @@
-{"version":3,"file":"claude-config.js","sourceRoot":"","sources":["../../../src/utils/dco/claude-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AACzD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAEnD;;;;;;;;GAQG;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,yBAAyB,CAAC;AACzD,MAAM,CAAC,MAAM,aAAa,GAAG,uBAAuB,CAAC;AAsBrD;;;;;GAKG;AACH,SAAS,UAAU,CAAC,KAAa;IAC/B,4CAA4C;IAC5C,OAAO,KAAK,CAAC,OAAO,CAAC,yBAAyB,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AAC9D,CAAC;AAED,4EAA4E;AAC5E,6EAA6E;AAC7E,6EAA6E;AAC7E,uEAAuE;AACvE,4EAA4E;AAC5E,6EAA6E;AAC7E,yEAAyE;AACzE,4EAA4E;AAC5E,+DAA+D;AAC/D,MAAM,WAAW,GAAG,oCAAoC,CAAC;AACzD,MAAM,cAAc,GAAG,GAAG,CAAC;AAE3B,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,KAAK,CAAC,MAAM,IAAI,cAAc,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,MAA8B;IAClE,MAAM,SAAS,GAAG,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9F,MAAM,KAAK,GAAa;QACtB,eAAe;QACf,oDAAoD;QACpD,EAAE;QACF,QAAQ;YACN,CAAC,CAAC,qFAAqF;YACvF,CAAC,CAAC,iFAAiF;QACrF,uBAAuB,SAAS,KAAK,QAAQ,KAAK;KACnD,CAAC;IACF,IAAI,QAAQ,EAAE,CAAC;QACb,KAAK,CAAC,IAAI,CAAC,kBAAkB,QAAQ,IAAI,CAAC,CAAC;IAC7C,CAAC;IACD,KAAK,CAAC,IAAI,CACR,0GAA0G,CAC3G,CAAC;IACF,IAAI,MAAM,CAAC,0BAA0B,EAAE,CAAC;QACtC,KAAK,CAAC,IAAI,CACR,iDAAiD,EACjD,sBAAsB,UAAU,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,KAAK,UAAU,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC,KAAK,EACrG,uBAAuB,SAAS,KAAK,UAAU,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC,KAAK,CAC9E,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC1B,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAID,MAAM,UAAU,mBAAmB,CACjC,GAAW,EACX,KAAa,EACb,UAAgC,EAAE;IAElC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IAEpC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACtB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC;QAC1C,CAAC;QACD,mBAAmB,CAAC,IAAI,EAAE,KAAK,GAAG,IAAI,CAAC,CAAC;QACxC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IACrC,CAAC;IAED,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAE/C,IAAI,IAAY,CAAC;IACjB,IAAI,QAAQ,KAAK,CAAC,CAAC,IAAI,MAAM,KAAK,CAAC,CAAC,IAAI,MAAM,GAAG,QAAQ,EAAE,CAAC;QAC1D,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;QAC3C,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;QAC5D,IAAI,GAAG,MAAM,GAAG,KAAK,GAAG,KAAK,CAAC;IAChC,CAAC;SAAM,CAAC;QACN,MAAM,SAAS,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;QAC1D,IAAI,GAAG,QAAQ,GAAG,SAAS,GAAG,KAAK,GAAG,IAAI,CAAC;IAC7C,CAAC;IAED,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IACvC,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC;IAC1C,CAAC;IACD,mBAAmB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAChC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AACrC,CAAC;AASD;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,GAAW,EACX,UAAgC,EAAE;IAElC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IACjC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IAExC,IAAI,QAAQ,GAA4B,EAAE,CAAC;IAC3C,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;YACvD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBACnE,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC;YAC7C,CAAC;YACD,QAAQ,GAAG,MAAiC,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC;QAC7C,CAAC;QACD,IAAI,QAAQ,CAAC,mBAAmB,KAAK,KAAK,EAAE,CAAC;YAC3C,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;QACvC,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC;QAC1C,CAAC;QACD,QAAQ,CAAC,mBAAmB,GAAG,KAAK,CAAC;QACrC,mBAAmB,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QACpE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IACrC,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC;IAC1C,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtC,CAAC;IACD,mBAAmB,CACjB,IAAI,EACJ,IAAI,CAAC,SAAS,CAAC,EAAE,mBAAmB,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAC/D,CAAC;IACF,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AACrC,CAAC"}
+{"version":3,"file":"claude-config.js","sourceRoot":"","sources":["../../../src/utils/dco/claude-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EACL,aAAa,EACb,iBAAiB,GAGlB,MAAM,qBAAqB,CAAC;AAE7B;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,yBAAyB,CAAC;AACzD,MAAM,CAAC,MAAM,aAAa,GAAG,uBAAuB,CAAC;AAWrD,4EAA4E;AAC5E,6EAA6E;AAC7E,4EAA4E;AAC5E,yEAAyE;AACzE,kEAAkE;AAClE,gEAAgE;AAChE,MAAM,CAAC,MAAM,WAAW,GAAG,oCAAoC,CAAC;AAChE,MAAM,CAAC,MAAM,cAAc,GAAG,GAAG,CAAC;AAElC,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,OAAO,KAAK,CAAC,MAAM,IAAI,cAAc,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,SAAiC,EAAE;IACvE,MAAM,KAAK,GAAG;QACZ,eAAe;QACf,+CAA+C;QAC/C,EAAE;QACF,gIAAgI;QAChI,mTAAmT;QACnT,oCAAoC;QACpC,sBAAsB;QACtB,kGAAkG;QAClG,0GAA0G;KAC3G,CAAC;IACF,IAAI,MAAM,CAAC,0BAA0B,EAAE,CAAC;QACtC,KAAK,CAAC,IAAI,CACR,uXAAuX,EACvX,+CAA+C,EAC/C,kDAAkD,CACnD,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC1B,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAID,MAAM,UAAU,mBAAmB,CACjC,GAAW,EACX,KAAa,EACb,UAAgC,EAAE;IAElC,OAAO,iBAAiB,CACtB,GAAG,EACH,WAAW,EACX,eAAe,EACf,aAAa,EACb,KAAK,EACL,OAAO,CACR,CAAC;AACJ,CAAC;AAID;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,GAAW,EACX,UAAgC,EAAE;IAElC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;IACnD,OAAO,aAAa,CAAC,IAAI,EAAE,EAAE,mBAAmB,EAAE,KAAK,EAAE,EAAE,OAAO,CAAC,CAAC;AACtE,CAAC"}

package/dist/utils/dco/dispatch.d.ts

@@ -0,0 +1,134 @@
+/**
+ * `dco dispatch` — ship a real, agent-signed PR in one command: branch,
+ * signed commit, push, `gh pr create` with an `Agent DID:` line, then verify
+ * the attribution the same way `dco verify` would.
+ *
+ * This is the command form of the quickstart runbook's Step 2 block
+ * (docs/runbook-mcpi-dco-quickstart.md), including its cold-start
+ * self-heal: a repo with no commits gets an initial commit, a repo with
+ * no `origin` gets a private GitHub repo created for it.
+ */
+export interface DcoDispatchResult {
+    ok: boolean;
+    /** Human-readable description of the step that failed, when !ok. */
+    failure?: string;
+    agent?: {
+        name: string;
+        slug: string;
+    };
+    did?: string;
+    /** PR title (and commit-subject source); echoed back for --json callers. */
+    title?: string;
+    branch?: string;
+    commitSha?: string;
+    signed?: boolean;
+    /** Set when the cold-start self-heal had to create a GitHub repo. */
+    createdRemote?: string;
+    prUrl?: string;
+    verified?: boolean;
+}
+export interface DcoDispatchOptions {
+    /**
+     * Dispatch as this existing agent instead of the checkout's `.mcpi/`
+     * identity: sign with `~/.mcpi/keys/<slug>` via per-invocation git config,
+     * so it works from any repo and ignores conflicting repo signing config.
+     */
+    agent?: string;
+    /**
+     * PR title (and the source for the commit subject). Defaults to the
+     * description's first line, truncated to MAX_TITLE_LENGTH.
+     */
+    title?: string;
+}
+/**
+ * Resolve the PR title: the explicit `--title`, or the description's first
+ * NON-EMPTY line when omitted (a description that opens with a blank line,
+ * e.g. "\n\nActual title", must not yield an empty title). Either way it's
+ * truncated to a safe length, since the title also seeds the commit subject
+ * and a raw description can run long.
+ */
+export declare function deriveDispatchTitle(description: string, explicitTitle?: string): string;
+/**
+ * Lowercase subject on purpose: commitlint `subject-case` hooks reject an
+ * uppercase one, and lowercase passes everywhere. Truncated separately from
+ * the title (after the "docs: " prefix) so a title near MAX_TITLE_LENGTH
+ * still yields a commit subject well inside commitlint's own length rule.
+ */
+export declare function buildDispatchCommitSubject(title: string): string;
+/**
+ * Whether `rawCommit` (the raw `git cat-file commit HEAD` output) carries a
+ * `gpgsig` header — the reliable signed-commit check (`git log
+ * --show-signature` needs `gpg.ssh.allowedSignersFile` locally and
+ * misreports otherwise). Exported so `dispatch.ts` and `fix.ts` share the
+ * exact same check rather than each re-deriving it: a raw commit object is
+ * headers, then ONE blank line, then the free-text commit message, and a
+ * naive `/^gpgsig /m.test(rawCommit)` over the WHOLE string false-positives
+ * on an unsigned commit whose message body happens to contain a line
+ * starting with "gpgsig " (an agent-composed `-m`/`--message` value is
+ * exactly that kind of free text). Splitting off the header section before
+ * testing closes that gap: git's object format guarantees no blank line
+ * appears within the headers themselves, including a multi-line `gpgsig`
+ * value's space-prefixed continuation lines, so the first `\n\n` reliably
+ * marks the header/message boundary.
+ */
+export declare function isCommitSigned(rawCommit: string): boolean;
+export interface ResolvedSigningIdentity {
+    agent: {
+        name: string;
+        slug: string;
+        url: string;
+    };
+    /** Slug-derived `did:web:knowthat.ai:agents:<slug>`; see the inline comment at its computation below. */
+    did: string;
+    signingConfig: string[];
+    /** Path to the converted OpenSSH signing key backing `signingConfig`, e.g. for `dco fix`'s attestation signing (`fix.ts`). */
+    keyPath: string;
+}
+export type ResolveSigningIdentityResult = {
+    ok: true;
+    identity: ResolvedSigningIdentity;
+} | {
+    ok: false;
+    failure: string;
+    /** Populated only once agent/DID resolution got far enough to know them (a DID-preflight failure). */
+    agent?: {
+        name: string;
+        slug: string;
+    };
+    did?: string;
+};
+/**
+ * Resolve the agent identity, slug-derived DID, and per-invocation git
+ * signing config for a dispatch-style operation: either an explicit
+ * `--agent <slug>` (signs with `~/.mcpi/keys/<slug>`, works from any repo
+ * and ignores conflicting repo signing config) or the checkout's own
+ * `.mcpi/` identity. Fails closed, in order, BEFORE any git or GitHub side
+ * effects: invalid/missing slug, missing signing key, then DID preflight
+ * (`resolveDidPreflight`) so an unclaimed agent never reaches a git or `gh`
+ * call.
+ *
+ * `runDcoDispatch` below and `runDcoFix` (`fix.ts`) both call this instead
+ * of re-deriving the same agent/DID/signing-key logic: a second
+ * implementation that drifted from this one could sign a commit with a
+ * different key than the one an `Agent DID:`/attestation line claims.
+ */
+export declare function resolveSigningIdentity(cwd: string, agentSlug: string | undefined): Promise<ResolveSigningIdentityResult>;
+export interface ColdStartResult {
+    /** Set when no `origin` remote existed and one was created. */
+    createdRemote?: string;
+}
+/**
+ * The cold-start self-heal `runDcoDispatch` performs on `cwd` before its own
+ * demo commit: `git init` if `cwd` isn't a work tree yet, a signed initial
+ * commit if there's no `HEAD` yet, and a fresh private GitHub repo if there's
+ * no `origin` remote yet. Factored out so `kya-os agent task`
+ * (`utils/agent/task.ts`) reuses the exact same self-heal instead of a
+ * second copy that could drift on ordering or on which commit ends up
+ * signed — see this feature's design doc ("create or reuse a scratch repo
+ * the way `runDcoDispatch` cold-start does"). `agent task` runs this
+ * against a throwaway temp directory it creates itself, not the caller's own
+ * cwd, unlike `runDcoDispatch`'s in-place self-heal.
+ */
+export declare function ensureColdStartRepo(cwd: string, signingConfig: string[]): Promise<ColdStartResult>;
+export declare function runDcoDispatch(cwd: string, description: string, options?: DcoDispatchOptions): Promise<DcoDispatchResult>;
+//# sourceMappingURL=dispatch.d.ts.map

package/dist/utils/dco/dispatch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dispatch.d.ts","sourceRoot":"","sources":["../../../src/utils/dco/dispatch.ts"],"names":[],"mappings":"AAiBA;;;;;;;;;GASG;AACH,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,OAAO,CAAC;IACZ,oEAAoE;IACpE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACvC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,4EAA4E;IAC5E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,qEAAqE;IACrE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AA8BD,MAAM,WAAW,kBAAkB;IACjC;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAYD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,MAAM,EACnB,aAAa,CAAC,EAAE,MAAM,GACrB,MAAM,CASR;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEhE;AAmBD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAGzD;AAmCD,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IACnD,yGAAyG;IACzG,GAAG,EAAE,MAAM,CAAC;IACZ,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,8HAA8H;IAC9H,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,4BAA4B,GACpC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,uBAAuB,CAAA;CAAE,GAC/C;IACE,EAAE,EAAE,KAAK,CAAC;IACV,OAAO,EAAE,MAAM,CAAC;IAChB,sGAAsG;IACtG,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACvC,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,CAAC;AAEN;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,GAAG,SAAS,GAC5B,OAAO,CAAC,4BAA4B,CAAC,CA8EvC;AAED,MAAM,WAAW,eAAe;IAC9B,+DAA+D;IAC/D,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,mBAAmB,CAAC,GAAG,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,eAAe,CAAC,CA+CxG;AAED,wBAAsB,cAAc,CAClC,GAAG,EAAE,MAAM,EACX,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,iBAAiB,CAAC,CA8I5B"}