feat: add kody api command mirroring MCP api tool

[kentcdodds]

Why

Agents and scripts with CLI auth (auth bootstrap / KODY_API_TOKEN) need a way to call any Open API operationId without going through MCP. This adds a thin CLI twin of the MCP api tool.

Usage

# Auth: --token / KODY_API_TOKEN → stored auth bootstrap token
kody api usageGet --params '{}'
kody api metaGetCurrentUser --params '{}'
kody api search --params '{"query":"email","limit":5}'

Same shape as MCP api: operationId + flat params object (path/query/body fields together). Resolves method/path from https://api.kody.codes/openapi.json. Always prints JSON.

Auth

Uses existing requireApiToken / resolveScopedApiToken:

1. --token / KODY_API_TOKEN
2. Stored bootstrap/API token from kody auth bootstrap --code
3. Clear error (Open API needs a scoped kody_at_…; kody login OAuth is not accepted for general /v1 ops)

Safety

• Refuses cliCredentialBootstrapRedeem — redeem returns a token; use kody auth bootstrap --code instead (stores, never prints).
• tokenCreate / tokenRotate still work and may print a one-time token value (same as MCP api); prefer env storage over pasting into chat.
• Errors go through existing redaction for kody_at_ / kody_bc_.

Scope kept small

No api list / operation discovery CLI beyond a clear unknown-operationId error pointing at /openapi.json.

Version bump

Repo uses semantic-release (0.0.0-semantically-released). This feat: commit will publish a minor bump on merge to main. No manual package.json version edit.

Verification

• npm run validate (typecheck, tests, build) — green locally
• Live smoke (after auth bootstrap): kody api usageGet --params '{}' → { "plan": "pro", ... }
• Unit/integration coverage for OpenAPI indexing, path/query/body split, unknown op, redeem refusal, and CLI end-to-end with mocked fetch

Relation to MCP api

Identical call shape (operationId + params). MCP invokes operations in-process; the CLI loads /openapi.json and issues the corresponding HTTPS request with a scoped Bearer token.

  

[kody-bot]

bugbot run

[cursor]

Skipping Bugbot: Unable to authenticate your request. Please make sure Bugbot is properly installed and configured for this repository.

[kentcdodds]

bugbot run

[cursor]

Skipping Bugbot: Bugbot is disabled for this repository. Visit the Bugbot dashboard to update your settings.

[github-actions]

🎉 This PR is included in version 1.9.0 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀