ossrules.md

control-kody

Drive and verify the Kody app with a Feature Map and one CLI. Use when changing UI, account routes, preview deploys, or proving a Cloud Agent change with a real origin, session, and /health SHA.

Install
npx skills add 'https://github.com/kentcdodds/kody/tree/main/.agents/skills/control-kody'
Download bundle ↓
main · 8beb6cd ↗Scanned 2026-09-15

Contributors

GitHub-linked commit authors for this SKILL.md at the saved revision. Co-authors and history before file renames are not included.

File history ↗

references/features/secrets.md

references/features/secrets.mdBrowse 27 files
View on GitHub
275 tokens

1,102 bytes
Token encoding: o200k_base
Snapshot 8beb6cd

← Back to SKILL.md

Secrets

User, session, and package secret rows. Host approval and package grants.

How to get there

/account/secrets → new /account/secrets/new → detail under /account/secrets/{user|session|package}/…. Package grant lane: /account/secrets/approve. Host approval: /connect/secrets.

Drive it

node tools/control-kody.ts preview -- \
  --request 'GET /account/secrets.json' \
  --check /account/secrets

GET the page body after a claimed fix. A “try https://kody.codes/account/secrets” note with no body is not proof.

APIs

  • GET|POST /account/secrets.json

Gotchas

  • Never paste secret values into chat, PRs, or execute params.
  • Preview seed starts with zero secrets.
  • /connect/secrets rejects hosts that are not hostname-shaped (truncated tokens, paths, empty values). Those must not appear as a successful Allow target, and they must not land in allowedHosts.
  • Package grants on user secrets are website-only (/account/secrets/approve or the secret editor). secretLock returns an approval URL; it does not add allowed_packages.
← All Kody skillsProject instructions →