prefer-local-kody-execute

Files (1)

• SKILL.md

SKILL.md (first lines)

# Prefer local CLI execute

When Node is 22 or newer and `@kodycodes/cli` is available, run one-off modules
with local execute. Do not use hosted MCP `execute`. This skill and
[Local CLI execute](https://kody.codes/docs/local-execute)
(`guide:local_execute`) are the source of truth. Open API fallback:
[Open API](https://kody.codes/docs/open-api) (`guide:open_api`).

Local CPU is not counted as `execute` or `dynamic_worker_day`. Capabilities
called through the proxy still meter normally. Prefer `KODY_API_TOKEN` in the
environment over `--token` so the secret is not visible in process arguments.

## Command

Agents already on MCP: call `cliCredentialBootstrap` with a required lifetime
(single-task agents use `short`), then run the returned `cli_command` (it
already includes lifetime flags). Humans who can finish browser OAuth:
`npx @kodycodes/cli login` once. CI with no MCP session and no interactive
login: set `KODY_API_TOKEN` in the environment. Never paste a `kody_at_…` into
chat.

```json
{
	"operationId": "cliCredentialBootstrap",
	"params": { "lifetime": "short" }
}
```

```bash
npx @kodycodes/cli auth bootstrap --code 'kody_bc_…' --lifetime short
npx @kodycodes/cli execute --local --code 'import { kody } from "kody:runtime"; export default async function main() { return await kody.metaGetCurrentUser({}) }'
```

Saved packages keep `--local` and a static `kody:@…` import.

## Failure

- Node is below 22, the CLI is missing, or the host cannot run workerd. Use Open
  API / MCP `api`, or fix the environment. Hosted MCP `execute` stays banned.
- Lifetime is missing. Pass `lifetime: "short"|"long"` (or both idle/max
  seconds) to `cliCredentialBootstrap`, and `--lifetime short|long` (or both
  `--idle-ttl-seconds` / `--max-lifetime-seconds`) to `auth bootstrap`.
- The bootstrap code is rejected. Call `cliCredentialBootstrap` again with
  `lifetime: "short"`. Do not switch to `kody login` or `tokenCreate` while an
  MCP session exists.
- `search` is forbidden. Default bootstrap scopes are local-execute use scopes
  (`org:execute`, `org:read`, package/integration/secret/email/job/app/memory
  use scopes), plus `package:write` and `token:delete` — not `search:read`
  ([ADR 0056](https://github.com/kody-hq/kody/blob/main/docs/contributing/decisions/0056-cli-credential-bootstrap.md)).
  `whoami` works. Use MCP `search`, or a token with `search:read`.
- The module imports `kody:@…`. Keep `--local`. Default bootstrap includes
  `package:execute` and `integration:read` so package-graph and
  `createAuthenticatedFetch` work for saved packages.
- The CLI asks for a login, a bootstrap, or a token. Priority is `--token` /
  `KODY_API_TOKEN`, then the stored bootstrap token, then `kody login`.

From kentcdodds/kcd-skills, MIT.

More from kentcdodds/kcd-skills