@kya-os/cli 2.0.0 → 2.0.2

package/dist/utils/cli-kit/step-report.js

@@ -1,36 +0,0 @@
-import chalk from "chalk";
-export function statusLabel(status) {
-    switch (status) {
-        case "done":
-            return chalk.green("done");
-        case "skipped":
-            return chalk.gray("skipped");
-        case "would-change":
-            return chalk.cyan("would change");
-        case "action-required":
-            return chalk.yellow("action required");
-        case "failed":
-            return chalk.red("failed");
-    }
-}
-/**
- * Render a step-report list as aligned `title  status` lines, with a
- * detail line under any step that isn't "done" or "skipped". Returns
- * lines rather than printing them, so a consumer composes its own
- * header/footer around the shared body.
- */
-export function renderSteps(steps) {
-    if (steps.length === 0) {
-        return [];
-    }
-    const width = Math.max(...steps.map((s) => s.title.length));
-    const lines = [];
-    for (const step of steps) {
-        lines.push(`  ${step.title.padEnd(width)}  ${statusLabel(step.status)}`);
-        if (step.detail && step.status !== "done" && step.status !== "skipped") {
-            lines.push(`  ${" ".repeat(width)}  ${chalk.gray(step.detail)}`);
-        }
-    }
-    return lines;
-}
-//# sourceMappingURL=step-report.js.map

package/dist/utils/cli-kit/step-report.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"step-report.js","sourceRoot":"","sources":["../../../src/utils/cli-kit/step-report.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAgB1B,MAAM,UAAU,WAAW,CAAC,MAAkB;IAC5C,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,MAAM;YACT,OAAO,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC7B,KAAK,SAAS;YACZ,OAAO,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC/B,KAAK,cAAc;YACjB,OAAO,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACpC,KAAK,iBAAiB;YACpB,OAAO,KAAK,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;QACzC,KAAK,QAAQ;YACX,OAAO,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC/B,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,KAAmB;IAC7C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IAC5D,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACzE,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACvE,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/utils/dco/agent-metadata.d.ts

@@ -1,24 +0,0 @@
-/**
- * Persistent agent metadata written at registration time so later commands
- * (notably `dco setup`) know the agent's public name, slug, and URL
- * without another API round trip. Lives next to identity.json but contains
- * no key material (claimUrl may embed a short-lived claim capability; the
- * whole .mcpi directory is gitignored).
- */
-export interface AgentMetadata {
-    id?: string;
-    slug?: string;
-    name?: string;
-    url?: string;
-    did?: string;
-    claimUrl?: string;
-    registeredAt?: string;
-}
-export declare function readAgentMetadata(cwd: string): AgentMetadata | null;
-/**
- * Merge the given fields into .mcpi/agent.json, creating the directory and
- * file when needed. Existing fields are preserved unless overwritten by a
- * defined value in `meta`.
- */
-export declare function writeAgentMetadata(cwd: string, meta: AgentMetadata): void;
-//# sourceMappingURL=agent-metadata.d.ts.map

package/dist/utils/dco/agent-metadata.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"agent-metadata.d.ts","sourceRoot":"","sources":["../../../src/utils/dco/agent-metadata.ts"],"names":[],"mappings":"AAIA;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAQD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CAcnE;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,GAAG,IAAI,CAmBzE"}

package/dist/utils/dco/agent-metadata.js

@@ -1,46 +0,0 @@
-import { existsSync, mkdirSync, readFileSync } from "fs";
-import { join } from "path";
-import { writeFileAtomicSafe } from "../cli-kit/index.js";
-const AGENT_METADATA_FILE = "agent.json";
-function agentMetadataPath(cwd) {
-    return join(cwd, ".mcpi", AGENT_METADATA_FILE);
-}
-export function readAgentMetadata(cwd) {
-    const path = agentMetadataPath(cwd);
-    if (!existsSync(path)) {
-        return null;
-    }
-    try {
-        const parsed = JSON.parse(readFileSync(path, "utf-8"));
-        if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
-            return parsed;
-        }
-        return null;
-    }
-    catch {
-        return null;
-    }
-}
-/**
- * Merge the given fields into .mcpi/agent.json, creating the directory and
- * file when needed. Existing fields are preserved unless overwritten by a
- * defined value in `meta`.
- */
-export function writeAgentMetadata(cwd, meta) {
-    const dir = join(cwd, ".mcpi");
-    if (!existsSync(dir)) {
-        mkdirSync(dir, { recursive: true });
-    }
-    const existing = readAgentMetadata(cwd) ?? {};
-    const merged = { ...existing };
-    for (const [key, value] of Object.entries(meta)) {
-        // Empty strings are skipped alongside undefined: legacy API responses
-        // coerce missing fields to "", which must not clobber good values.
-        if (value !== undefined && value !== "") {
-            merged[key] = value;
-        }
-    }
-    // Symlink-safe: agent.json lives in a possibly-untrusted working tree.
-    writeFileAtomicSafe(agentMetadataPath(cwd), JSON.stringify(merged, null, 2) + "\n");
-}
-//# sourceMappingURL=agent-metadata.js.map

package/dist/utils/dco/agent-metadata.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"agent-metadata.js","sourceRoot":"","sources":["../../../src/utils/dco/agent-metadata.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AACzD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAmB1D,MAAM,mBAAmB,GAAG,YAAY,CAAC;AAEzC,SAAS,iBAAiB,CAAC,GAAW;IACpC,OAAO,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,mBAAmB,CAAC,CAAC;AACjD,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,MAAM,IAAI,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;QACvD,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnE,OAAO,MAAuB,CAAC;QACjC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAW,EAAE,IAAmB;IACjE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC/B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtC,CAAC;IACD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9C,MAAM,MAAM,GAAkB,EAAE,GAAG,QAAQ,EAAE,CAAC;IAC9C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAChD,sEAAsE;QACtE,mEAAmE;QACnE,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACvC,MAAkC,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACnD,CAAC;IACH,CAAC;IACD,uEAAuE;IACvE,mBAAmB,CACjB,iBAAiB,CAAC,GAAG,CAAC,EACtB,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CACvC,CAAC;AACJ,CAAC"}

package/dist/utils/dco/claude-config.d.ts

@@ -1,55 +0,0 @@
-import { type MergeJsonResult, type UpsertResult as CliKitUpsertResult } from "../cli-kit/index.js";
-/**
- * Claude Code integration: a managed block in CLAUDE.md instructs the agent
- * harness to attribute PRs to the registered agent, and .claude/settings.json
- * disables the stock "Generated with Claude Code" attribution.
- *
- * The PR byline can only be influenced through instructions because the PR
- * body is composed by the model at PR time; commit trailers are enforced
- * mechanically by the git hook instead (see git-config.ts).
- *
- * The block used to interpolate a specific agent's name/URL/DID as literal
- * strings. That was wrong for any repo that receives dispatched work from
- * more than one agent: CLAUDE.md is committed, so the literal values only
- * ever reflected whichever agent happened to run `dco setup` first, and
- * every other agent's PRs in that repo would carry a false attribution with
- * no way to correct it short of re-running `dco setup` (which a dispatch
- * flow generally can't do per task). The block below is agent-agnostic
- * instead: it tells the agent to run `dco whoami` and use whatever
- * that reports, so the byline is always whichever identity is actually
- * configured in the current checkout. See resolve-agent.ts.
- */
-export declare const CLAUDE_MD_START = "<!-- mcpi:dco:start -->";
-export declare const CLAUDE_MD_END = "<!-- mcpi:dco:end -->";
-export interface AttributionBlockParams {
-    /**
-     * When the git hook could not be installed (foreign hook, unsafe
-     * core.hooksPath, or install failure), trailer duty falls back to
-     * instructions.
-     */
-    includeTrailerInstructions?: boolean;
-}
-export declare const DID_PATTERN: RegExp;
-export declare const MAX_DID_LENGTH = 200;
-export declare function isValidDid(value: string): boolean;
-export declare function buildAttributionBlock(params?: AttributionBlockParams): string;
-export type UpsertResult = CliKitUpsertResult;
-export declare function upsertClaudeMdBlock(cwd: string, block: string, options?: {
-    dryRun?: boolean;
-}): {
-    result: UpsertResult;
-    path: string;
-};
-export type SettingsResult = MergeJsonResult;
-/**
- * Set includeCoAuthoredBy: false in .claude/settings.json, preserving every
- * other key. A file we cannot parse is left untouched: clobbering a user's
- * settings is worse than leaving the stock byline on.
- */
-export declare function updateClaudeSettings(cwd: string, options?: {
-    dryRun?: boolean;
-}): {
-    result: SettingsResult;
-    path: string;
-};
-//# sourceMappingURL=claude-config.d.ts.map

package/dist/utils/dco/claude-config.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"claude-config.d.ts","sourceRoot":"","sources":["../../../src/utils/dco/claude-config.ts"],"names":[],"mappings":"AACA,OAAO,EAGL,KAAK,eAAe,EACpB,KAAK,YAAY,IAAI,kBAAkB,EACxC,MAAM,qBAAqB,CAAC;AAE7B;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,eAAO,MAAM,eAAe,4BAA4B,CAAC;AACzD,eAAO,MAAM,aAAa,0BAA0B,CAAC;AAErD,MAAM,WAAW,sBAAsB;IACrC;;;;OAIG;IACH,0BAA0B,CAAC,EAAE,OAAO,CAAC;CACtC;AAQD,eAAO,MAAM,WAAW,QAAuC,CAAC;AAChE,eAAO,MAAM,cAAc,MAAM,CAAC;AAElC,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEjD;AAED,wBAAgB,qBAAqB,CAAC,MAAM,GAAE,sBAA2B,GAAG,MAAM,CAqBjF;AAED,MAAM,MAAM,YAAY,GAAG,kBAAkB,CAAC;AAE9C,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,EACb,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAA;CAAO,GACjC;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CASxC;AAED,MAAM,MAAM,cAAc,GAAG,eAAe,CAAC;AAE7C;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,MAAM,EACX,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAA;CAAO,GACjC;IAAE,MAAM,EAAE,cAAc,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAG1C"}

package/dist/utils/dco/claude-config.js

@@ -1,66 +0,0 @@
-import { join } from "path";
-import { mergeJsonFile, upsertMarkerBlock, } from "../cli-kit/index.js";
-/**
- * Claude Code integration: a managed block in CLAUDE.md instructs the agent
- * harness to attribute PRs to the registered agent, and .claude/settings.json
- * disables the stock "Generated with Claude Code" attribution.
- *
- * The PR byline can only be influenced through instructions because the PR
- * body is composed by the model at PR time; commit trailers are enforced
- * mechanically by the git hook instead (see git-config.ts).
- *
- * The block used to interpolate a specific agent's name/URL/DID as literal
- * strings. That was wrong for any repo that receives dispatched work from
- * more than one agent: CLAUDE.md is committed, so the literal values only
- * ever reflected whichever agent happened to run `dco setup` first, and
- * every other agent's PRs in that repo would carry a false attribution with
- * no way to correct it short of re-running `dco setup` (which a dispatch
- * flow generally can't do per task). The block below is agent-agnostic
- * instead: it tells the agent to run `dco whoami` and use whatever
- * that reports, so the byline is always whichever identity is actually
- * configured in the current checkout. See resolve-agent.ts.
- */
-export const CLAUDE_MD_START = "<!-- mcpi:dco:start -->";
-export const CLAUDE_MD_END = "<!-- mcpi:dco:end -->";
-// did:key / did:web / etc: a lowercase method name, then method-specific-id
-// drawn from the DID spec's idchar set. No backtick, "<", "!", or whitespace
-// can appear in a matching value. Exported for verify.ts, which validates a
-// DID claimed in a PR body against this same shape before ever resolving
-// it, and for resolve-agent.ts, which validates the DID read from
-// .mcpi/identity.json before it's ever printed by `dco whoami`.
-export const DID_PATTERN = /^did:[a-z0-9]+:[A-Za-z0-9.\-_:%]+$/;
-export const MAX_DID_LENGTH = 200;
-export function isValidDid(value) {
-    return value.length <= MAX_DID_LENGTH && DID_PATTERN.test(value);
-}
-export function buildAttributionBlock(params = {}) {
-    const lines = [
-        CLAUDE_MD_START,
-        "## Agent attribution (managed by `dco setup`)",
-        "",
-        "- Before creating a pull request, run `dco whoami --json` in this repo to find the agent identity configured in this checkout.",
-        '- If it reports `"configured": true`, end the PR description with exactly these two lines, filled in from that command\'s `name`, `url`, and `did` fields (curly braces mark what to fill in; every other character, including the square/round brackets and the angle brackets around the DID line, is literal):',
-        "  `Generated with [{name}]({url})`",
-        "  `Agent DID: {did}`",
-        '- If it reports `"configured": false`, do not add a "Generated with" or "Agent DID" line at all.',
-        '- Never add "Generated with Claude Code" or any other tool byline to PR descriptions or commit messages.',
-    ];
-    if (params.includeTrailerInstructions) {
-        lines.push("- End every commit message with these trailers. Resolve the first line from `git config user.name` / `git config user.email`, and the second from `dco whoami --json`'s `name` and `email` fields (omit this line entirely if `configured` is false). Curly braces mark what to fill in; the angle brackets around each email are literal characters git trailers require, keep them:", "  `Signed-off-by: {your name} <{your email}>`", "  `Co-authored-by: {agent name} <{agent email}>`");
-    }
-    lines.push(CLAUDE_MD_END);
-    return lines.join("\n");
-}
-export function upsertClaudeMdBlock(cwd, block, options = {}) {
-    return upsertMarkerBlock(cwd, "CLAUDE.md", CLAUDE_MD_START, CLAUDE_MD_END, block, options);
-}
-/**
- * Set includeCoAuthoredBy: false in .claude/settings.json, preserving every
- * other key. A file we cannot parse is left untouched: clobbering a user's
- * settings is worse than leaving the stock byline on.
- */
-export function updateClaudeSettings(cwd, options = {}) {
-    const path = join(cwd, ".claude", "settings.json");
-    return mergeJsonFile(path, { includeCoAuthoredBy: false }, options);
-}
-//# sourceMappingURL=claude-config.js.map

package/dist/utils/dco/claude-config.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"claude-config.js","sourceRoot":"","sources":["../../../src/utils/dco/claude-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EACL,aAAa,EACb,iBAAiB,GAGlB,MAAM,qBAAqB,CAAC;AAE7B;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,yBAAyB,CAAC;AACzD,MAAM,CAAC,MAAM,aAAa,GAAG,uBAAuB,CAAC;AAWrD,4EAA4E;AAC5E,6EAA6E;AAC7E,4EAA4E;AAC5E,yEAAyE;AACzE,kEAAkE;AAClE,gEAAgE;AAChE,MAAM,CAAC,MAAM,WAAW,GAAG,oCAAoC,CAAC;AAChE,MAAM,CAAC,MAAM,cAAc,GAAG,GAAG,CAAC;AAElC,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,OAAO,KAAK,CAAC,MAAM,IAAI,cAAc,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,SAAiC,EAAE;IACvE,MAAM,KAAK,GAAG;QACZ,eAAe;QACf,+CAA+C;QAC/C,EAAE;QACF,gIAAgI;QAChI,mTAAmT;QACnT,oCAAoC;QACpC,sBAAsB;QACtB,kGAAkG;QAClG,0GAA0G;KAC3G,CAAC;IACF,IAAI,MAAM,CAAC,0BAA0B,EAAE,CAAC;QACtC,KAAK,CAAC,IAAI,CACR,uXAAuX,EACvX,+CAA+C,EAC/C,kDAAkD,CACnD,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC1B,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAID,MAAM,UAAU,mBAAmB,CACjC,GAAW,EACX,KAAa,EACb,UAAgC,EAAE;IAElC,OAAO,iBAAiB,CACtB,GAAG,EACH,WAAW,EACX,eAAe,EACf,aAAa,EACb,KAAK,EACL,OAAO,CACR,CAAC;AACJ,CAAC;AAID;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,GAAW,EACX,UAAgC,EAAE;IAElC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;IACnD,OAAO,aAAa,CAAC,IAAI,EAAE,EAAE,mBAAmB,EAAE,KAAK,EAAE,EAAE,OAAO,CAAC,CAAC;AACtE,CAAC"}

package/dist/utils/dco/dispatch.d.ts

@@ -1,59 +0,0 @@
-/**
- * `dco dispatch` — ship a real, agent-signed PR in one command: branch,
- * signed commit, push, `gh pr create` with an `Agent DID:` line, then verify
- * the attribution the same way `dco verify` would.
- *
- * This is the command form of the quickstart runbook's Step 2 block
- * (docs/runbook-mcpi-dco-quickstart.md), including its cold-start
- * self-heal: a repo with no commits gets an initial commit, a repo with
- * no `origin` gets a private GitHub repo created for it.
- */
-export interface DcoDispatchResult {
-    ok: boolean;
-    /** Human-readable description of the step that failed, when !ok. */
-    failure?: string;
-    agent?: {
-        name: string;
-        slug: string;
-    };
-    did?: string;
-    /** PR title (and commit-subject source); echoed back for --json callers. */
-    title?: string;
-    branch?: string;
-    commitSha?: string;
-    signed?: boolean;
-    /** Set when the cold-start self-heal had to create a GitHub repo. */
-    createdRemote?: string;
-    prUrl?: string;
-    verified?: boolean;
-}
-export interface DcoDispatchOptions {
-    /**
-     * Dispatch as this existing agent instead of the checkout's `.mcpi/`
-     * identity: sign with `~/.mcpi/keys/<slug>` via per-invocation git config,
-     * so it works from any repo and ignores conflicting repo signing config.
-     */
-    agent?: string;
-    /**
-     * PR title (and the source for the commit subject). Defaults to the
-     * description's first line, truncated to MAX_TITLE_LENGTH.
-     */
-    title?: string;
-}
-/**
- * Resolve the PR title: the explicit `--title`, or the description's first
- * NON-EMPTY line when omitted (a description that opens with a blank line,
- * e.g. "\n\nActual title", must not yield an empty title). Either way it's
- * truncated to a safe length, since the title also seeds the commit subject
- * and a raw description can run long.
- */
-export declare function deriveDispatchTitle(description: string, explicitTitle?: string): string;
-/**
- * Lowercase subject on purpose: commitlint `subject-case` hooks reject an
- * uppercase one, and lowercase passes everywhere. Truncated separately from
- * the title (after the "docs: " prefix) so a title near MAX_TITLE_LENGTH
- * still yields a commit subject well inside commitlint's own length rule.
- */
-export declare function buildDispatchCommitSubject(title: string): string;
-export declare function runDcoDispatch(cwd: string, description: string, options?: DcoDispatchOptions): Promise<DcoDispatchResult>;
-//# sourceMappingURL=dispatch.d.ts.map

package/dist/utils/dco/dispatch.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"dispatch.d.ts","sourceRoot":"","sources":["../../../src/utils/dco/dispatch.ts"],"names":[],"mappings":"AAiBA;;;;;;;;;GASG;AACH,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,OAAO,CAAC;IACZ,oEAAoE;IACpE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACvC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,4EAA4E;IAC5E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,qEAAqE;IACrE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AA8BD,MAAM,WAAW,kBAAkB;IACjC;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAYD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,MAAM,EACnB,aAAa,CAAC,EAAE,MAAM,GACrB,MAAM,CASR;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEhE;AAoDD,wBAAsB,cAAc,CAClC,GAAG,EAAE,MAAM,EACX,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,iBAAiB,CAAC,CAqP5B"}

package/dist/utils/dco/dispatch.js

@@ -1,332 +0,0 @@
-import { execFile } from "child_process";
-import { existsSync, lstatSync, readFileSync, rmSync } from "fs";
-import { basename, join } from "path";
-import { promisify } from "util";
-import { writeFileAtomicSafe } from "../cli-kit/index.js";
-import { getPullRequestBody } from "./github.js";
-import { signingKeyPath } from "./paths.js";
-import { resolveAgentIdentity } from "./resolve-agent.js";
-import { RESOLVE_TIMEOUT_MS, didWebToHttpsUrl, hasAgentDidClaim, verifyPrAttribution, } from "./verify.js";
-const execFileAsync = promisify(execFile);
-async function run(cmd, args, cwd) {
-    const { stdout } = await execFileAsync(cmd, args, {
-        cwd,
-        encoding: "utf8",
-        maxBuffer: 10 * 1024 * 1024,
-    });
-    return stdout.trim();
-}
-async function gitSucceeds(args, cwd) {
-    try {
-        await run("git", args, cwd);
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
-function errorMessage(error) {
-    if (error && typeof error === "object" && "stderr" in error) {
-        const stderr = String(error.stderr ?? "").trim();
-        if (stderr) {
-            return stderr;
-        }
-    }
-    return error instanceof Error ? error.message : String(error);
-}
-// commitlint's default subject-max-length is 100; ~72 for the PR title
-// mirrors GitHub's own soft wrap, and ~60 after the "docs: " prefix keeps the
-// full commit subject comfortably inside that even in stricter repos.
-const MAX_TITLE_LENGTH = 72;
-const MAX_COMMIT_SUBJECT_LENGTH = 60;
-function truncate(value, maxLength) {
-    return value.length > maxLength ? value.slice(0, maxLength).trimEnd() : value;
-}
-/**
- * Resolve the PR title: the explicit `--title`, or the description's first
- * NON-EMPTY line when omitted (a description that opens with a blank line,
- * e.g. "\n\nActual title", must not yield an empty title). Either way it's
- * truncated to a safe length, since the title also seeds the commit subject
- * and a raw description can run long.
- */
-export function deriveDispatchTitle(description, explicitTitle) {
-    if (explicitTitle && explicitTitle.trim().length > 0) {
-        return truncate(explicitTitle.trim(), MAX_TITLE_LENGTH);
-    }
-    const firstNonEmptyLine = description
-        .split(/\r?\n/)
-        .map((line) => line.trim())
-        .find((line) => line.length > 0);
-    return truncate(firstNonEmptyLine ?? "", MAX_TITLE_LENGTH);
-}
-/**
- * Lowercase subject on purpose: commitlint `subject-case` hooks reject an
- * uppercase one, and lowercase passes everywhere. Truncated separately from
- * the title (after the "docs: " prefix) so a title near MAX_TITLE_LENGTH
- * still yields a commit subject well inside commitlint's own length rule.
- */
-export function buildDispatchCommitSubject(title) {
-    return `docs: ${truncate(title.toLowerCase(), MAX_COMMIT_SUBJECT_LENGTH)}`;
-}
-/**
- * Extra `git -c` config prepended to the commit so it signs with the exact
- * key belonging to the agent this run is attributing the PR to, regardless
- * of what the repo's ambient config says (and so agent-slug mode works from
- * any repo, with no `.mcpi/` state there at all).
- */
-function buildSigningConfig(keyPath) {
-    return [
-        "-c",
-        "gpg.format=ssh",
-        "-c",
-        "commit.gpgsign=true",
-        "-c",
-        `user.signingkey=${keyPath}`,
-    ];
-}
-/** Fail fast when the DID isn't claimed/resolvable, BEFORE any git or GitHub
- * side effects: an unclaimed agent otherwise only surfaces as a verification
- * failure after a junk repo, branch, and PR already exist. */
-async function resolveDidPreflight(did) {
-    const documentUrl = didWebToHttpsUrl(did);
-    if (!documentUrl) {
-        return `could not derive a document URL from ${did}`;
-    }
-    try {
-        const controller = new AbortController();
-        const timer = setTimeout(() => controller.abort(), RESOLVE_TIMEOUT_MS);
-        let response;
-        try {
-            response = await fetch(documentUrl, {
-                signal: controller.signal,
-                redirect: "manual",
-            });
-        }
-        finally {
-            clearTimeout(timer);
-        }
-        if (!response.ok) {
-            return `HTTP ${response.status} from ${documentUrl}`;
-        }
-        const doc = (await response.json());
-        if (doc?.id !== did) {
-            return `${documentUrl} describes ${String(doc?.id)}, not ${did}`;
-        }
-        return null;
-    }
-    catch (error) {
-        return `${documentUrl} unreachable: ${errorMessage(error)}`;
-    }
-}
-export async function runDcoDispatch(cwd, description, options = {}) {
-    if (!description || description.trim().length === 0) {
-        return { ok: false, failure: "A PR description is required." };
-    }
-    // Dispatch always appends its own authoritative `Agent DID:` line. A
-    // description that already carries one would put two DIDs in the PR body,
-    // and `extractAgentDid` treats a multi-DID body as unverifiable, so the PR
-    // would be created and then fail its own verification. `hasAgentDidClaim`
-    // uses the exact same line pattern the verifier does, so it catches the
-    // backticked, mid-line form the managed CLAUDE.md block emits, not just a
-    // line-start one. Reject before any side effects.
-    if (hasAgentDidClaim(description)) {
-        return {
-            ok: false,
-            failure: "The description already contains an `Agent DID:` line. Dispatch adds the attribution automatically; pass only your prose so the PR body has exactly one Agent DID line.",
-        };
-    }
-    let agent;
-    let signingConfig;
-    if (options.agent) {
-        let keyPath;
-        try {
-            keyPath = signingKeyPath(options.agent);
-        }
-        catch (error) {
-            return { ok: false, failure: errorMessage(error) };
-        }
-        if (!existsSync(keyPath)) {
-            return {
-                ok: false,
-                failure: `No signing key for agent "${options.agent}" at ${keyPath}. Run \`dco setup ${options.agent}\` once, or check the slug.`,
-            };
-        }
-        agent = {
-            name: options.agent,
-            slug: options.agent,
-            url: `https://knowthat.ai/agents/${options.agent}`,
-        };
-        signingConfig = buildSigningConfig(keyPath);
-    }
-    else {
-        const resolved = await resolveAgentIdentity(cwd);
-        if (!resolved) {
-            return {
-                ok: false,
-                failure: "No agent identity configured in this checkout. Run `kya-os register` + `dco setup` here, or dispatch as an existing agent by passing its slug (`dco dispatch <slug> <description>`).",
-            };
-        }
-        agent = { name: resolved.name, slug: resolved.slug, url: resolved.url };
-        // Sign with the SAME agent's key the PR is attributed to, exactly like
-        // agent-slug mode, instead of silently relying on whatever ambient repo git
-        // config happens to be configured: without this, a checkout signed by a
-        // different key (or unsigned) than the one named in the Agent DID line
-        // would produce a commit whose signature and attribution disagree.
-        let keyPath;
-        try {
-            keyPath = signingKeyPath(resolved.slug);
-        }
-        catch (error) {
-            return { ok: false, failure: errorMessage(error) };
-        }
-        if (!existsSync(keyPath)) {
-            return {
-                ok: false,
-                failure: `No signing key for agent "${resolved.slug}" at ${keyPath}. Run \`dco setup\` in this checkout, then dispatch again.`,
-            };
-        }
-        signingConfig = buildSigningConfig(keyPath);
-    }
-    const title = deriveDispatchTitle(description, options.title);
-    // Built from the slug instead of trusting identity.json's `did`, which can
-    // still hold the unresolvable pre-claim placeholder (known bug; see the
-    // quickstart runbook). The slug is what registration actually persisted.
-    const did = `did:web:knowthat.ai:agents:${agent.slug}`;
-    const result = {
-        ok: false,
-        agent: { name: agent.name, slug: agent.slug },
-        did,
-        title,
-    };
-    const unresolvable = await resolveDidPreflight(did);
-    if (unresolvable) {
-        result.failure =
-            `Agent DID ${did} does not resolve (${unresolvable}). ` +
-                "Only a claimed registry agent can sign a verifiable PR. Dispatch with the slug of a claimed agent (`dco dispatch <slug> <description>`), or claim this one first.";
-        return result;
-    }
-    try {
-        if (!(await gitSucceeds(["rev-parse", "--is-inside-work-tree"], cwd))) {
-            await run("git", ["init", "-q"], cwd);
-        }
-        if (!(await gitSucceeds(["rev-parse", "HEAD"], cwd))) {
-            // Symlink-safe: a planted `.gitkeep` symlink in an untrusted cwd must
-            // not make this follow it and clobber an arbitrary file.
-            writeFileAtomicSafe(join(cwd, ".gitkeep"), "# demo repo\n");
-            await run("git", ["add", ".gitkeep"], cwd);
-            // Signed like the demo commit below: without this, agent-slug mode's
-            // cold-start init commit would fall back to ambient repo signing
-            // config (or none at all), landing an unsigned or wrong-key commit
-            // before the attributed one even exists. `-- .gitkeep` restricts the
-            // commit to that one file so nothing else already in the index rides
-            // along, and hooks are disabled so a stale prepare-commit-msg hook
-            // can't stamp this boilerplate commit with the wrong agent.
-            await run("git", [
-                "-c",
-                "core.hooksPath=/dev/null",
-                ...signingConfig,
-                "commit",
-                "-q",
-                "-m",
-                "chore: init",
-                "--",
-                ".gitkeep",
-            ], cwd);
-        }
-        if (!(await gitSucceeds(["remote", "get-url", "origin"], cwd))) {
-            const repoName = `${basename(cwd)}-${Math.floor(Date.now() / 1000)}`;
-            await run("gh", [
-                "repo",
-                "create",
-                repoName,
-                "--private",
-                "--source=.",
-                "--remote=origin",
-                "--push",
-            ], cwd);
-            result.createdRemote = repoName;
-        }
-        const branch = `dco-demo-${Math.floor(Date.now() / 1000)}`;
-        await run("git", ["checkout", "-b", branch], cwd);
-        result.branch = branch;
-        // Symlink-safe append. Two vectors, both closed here:
-        //  - Read: if a planted DCO-DEMO.md is a symlink, remove it (lstatSync
-        //    does not follow the link) rather than readFileSync through it, so
-        //    another file's contents can never be read into the committed demo
-        //    file. A regular file is read and appended to as normal.
-        //  - Write: writeFileAtomicSafe creates its temp sibling with O_EXCL and
-        //    renameSync-replaces the destination inode without following it, so
-        //    the write never lands outside the working tree.
-        const dcoDemoPath = join(cwd, "DCO-DEMO.md");
-        if (existsSync(dcoDemoPath) && lstatSync(dcoDemoPath).isSymbolicLink()) {
-            rmSync(dcoDemoPath);
-        }
-        const existingDcoDemo = existsSync(dcoDemoPath)
-            ? readFileSync(dcoDemoPath, "utf-8")
-            : "";
-        writeFileAtomicSafe(dcoDemoPath, `${existingDcoDemo}${new Date().toISOString()} - ${title} - signed by ${agent.name} (${did})\n`);
-        await run("git", ["add", "DCO-DEMO.md"], cwd);
-        const commitSubject = buildDispatchCommitSubject(title);
-        // Own the trailers explicitly instead of relying on the setup-installed
-        // prepare-commit-msg hook: that hook is baked to whichever agent ran
-        // `dco setup`, which for a dispatch as a different slug (or in a fresh
-        // directory with no hook at all) would attribute the commit to the wrong
-        // agent, or to no agent. Disabling hooks and adding the sign-off (`-s`,
-        // the human committer) plus a Co-authored-by for THIS dispatch's agent
-        // keeps the commit trailer, the signing key, and the PR `Agent DID:` line
-        // all pointing at the same identity. `-- DCO-DEMO.md` restricts the
-        // commit to the demo file so unrelated staged changes never ride along.
-        const coAuthoredTrailer = `Co-authored-by: ${agent.name} <${agent.slug}@agents.knowthat.ai>`;
-        await run("git", [
-            "-c",
-            "core.hooksPath=/dev/null",
-            ...signingConfig,
-            "commit",
-            "-s",
-            "--trailer",
-            coAuthoredTrailer,
-            "-m",
-            commitSubject,
-            "--",
-            "DCO-DEMO.md",
-        ], cwd);
-        result.commitSha = await run("git", ["rev-parse", "HEAD"], cwd);
-        // `git log --show-signature` needs gpg.ssh.allowedSignersFile locally and
-        // misreports otherwise; the raw gpgsig header is the reliable check.
-        const rawCommit = await run("git", ["cat-file", "commit", "HEAD"], cwd);
-        result.signed = /^gpgsig /m.test(rawCommit);
-        if (!result.signed) {
-            result.failure =
-                "The commit was created but is NOT signed. Run `dco setup` in this repo, then dispatch again.";
-            return result;
-        }
-        await run("git", ["push", "-u", "origin", "HEAD"], cwd);
-        const body = [
-            description,
-            "",
-            `Agent: [${agent.name}](${agent.url})`,
-            `Agent DID: ${did}`,
-        ].join("\n");
-        const prOutput = await run("gh", ["pr", "create", "--title", title, "--body", body], cwd);
-        const urlMatch = prOutput.match(/https:\/\/github\.com\/\S+\/pull\/\d+/);
-        if (!urlMatch) {
-            result.failure = `Could not find a PR URL in \`gh pr create\` output: ${prOutput}`;
-            return result;
-        }
-        result.prUrl = urlMatch[0];
-        const prBody = await getPullRequestBody(result.prUrl);
-        const verification = await verifyPrAttribution(prBody);
-        result.verified = verification.ok;
-        if (!verification.ok) {
-            result.failure = `PR created (${result.prUrl}) but attribution verification failed: ${verification.detail ?? verification.reason ?? "unknown"}`;
-            return result;
-        }
-        result.ok = true;
-        return result;
-    }
-    catch (error) {
-        result.failure = errorMessage(error);
-        return result;
-    }
-}
-//# sourceMappingURL=dispatch.js.map