@kici-dev/agent 0.1.10 → 0.1.11

package/dist/server.js

@@ -12,14 +12,14 @@ import { RingBuffer, createHealthRoutes, createLogger, createMeter, createMetric
 import { z } from "zod";
 import { LOGGER_ENV_VARS, defineEnv, validateUnknownKiciVars } from "@kici-dev/shared/env";
 import { ALLOWED_SYSTEM_VARS, ExecutionJobStatus, ExecutionStepStatus, KNOWN_ROLES, PROTOCOL_VERSION, SANDBOX_DEFAULT_VARS, WS_CLOSE_AGENT_AUTH_FAILED, WS_MAX_PAYLOAD_BYTES, deriveOsArchLabels, heartbeatSchema, hostLabel, mergeAutoLabels, orchestratorToAgentMessageSchema, resolveRoleLabels, validateNoReservedLabels } from "@kici-dev/engine";
-import { execFileSync, execSync, fork, spawn } from "node:child_process";
+import { execFile, execFileSync, execSync, fork, spawn } from "node:child_process";
 import WebSocket from "ws";
 import { AsyncLocalStorage } from "node:async_hooks";
-import { format } from "node:util";
+import { format, promisify } from "node:util";
 import { existsSync } from "node:fs";
-import path, { dirname, join } from "node:path";
+import path, { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
-import fs, { access, mkdir, mkdtemp, readFile, rm, unlink, writeFile } from "node:fs/promises";
+import fs, { access, lstat, mkdir, mkdtemp, readFile, readdir, realpath, rm, unlink, writeFile } from "node:fs/promises";
 import Docker from "dockerode";
 import { buildKiciApi, isDynamicGroupRef, isDynamicJobFn, isStaticArray, isStaticObject } from "@kici-dev/sdk";
 import { c, x } from "tar";
@@ -27,6 +27,7 @@ import https from "node:https";
 import http from "node:http";
 import { pipeline } from "node:stream/promises";
 import { createGunzip } from "node:zlib";
+import { PackageManager, detectPackageManagerFromManifests } from "@kici-dev/shared/package-manager";
 import { createInterface } from "node:readline";
 var __defProp = Object.defineProperty;
 var __esmMin = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
@@ -974,14 +975,14 @@ var init_console_capture = __esmMin((() => {
 init_console_capture();
 function safe(name, fallback = "unknown") {
 	switch (name) {
-		case "version": return "0.1.10";
-		case "buildCommit": return "6bf528b56";
-		case "sdkVersion": return "0.1.10";
+		case "version": return "0.1.11";
+		case "buildCommit": return "b9e5aed32";
+		case "sdkVersion": return "0.1.11";
 		case "sdkBundleHash": return "675aafe4de03e677785ef2794d8f34951b14e2bd1e6f0ea825953d6c2abfe128";
-		case "sharedVersion": return "0.1.10";
+		case "sharedVersion": return "0.1.11";
 		case "sharedBundleHash": return "36a23a454fd75ec35f258d39f254543ec0451c6b543fe3618ce427e6e6369aae";
-		case "engineVersion": return "0.1.10";
-		case "engineBundleHash": return "dff25bbd7602e853cec6e6e985c6c956ad773e245830273cd52950fff958d4bb";
+		case "engineVersion": return "0.1.11";
+		case "engineBundleHash": return "4ab08e63bcb8558b1191c5d3ab8d58b71950b77d911af56c9955ae1d787c4302";
 		default: return fallback;
 	}
 }
@@ -1628,7 +1629,7 @@ async function extractStepsFromDynamicJob(workflow, dynamicIndex, jobName, event
 }
 var AGENT_SDK_VERSION, AGENT_SDK_BUNDLE_HASH, hookRegistered;
 var init_workflow_loader = __esmMin((() => {
-	AGENT_SDK_VERSION = "0.1.10";
+	AGENT_SDK_VERSION = "0.1.11";
 	AGENT_SDK_BUNDLE_HASH = "675aafe4de03e677785ef2794d8f34951b14e2bd1e6f0ea825953d6c2abfe128";
 	hookRegistered = false;
 }));
@@ -1746,8 +1747,8 @@ async function streamFetchAndExtract(url, targetDir) {
 * We sidestep the race entirely by extracting each attempt into a unique
 * scratch dir under `.kici/`. Failed attempts leave orphan scratch dirs whose
 * draining writes are harmless — the next attempt does not touch them. On
-* success we `fs.rename` `${scratchDir}/node_modules` into the final location
-* (atomic on the same filesystem), then best-effort clean the scratch dir.
+* success `moveScratchIntoRepo` renames the extracted entries into place
+* (atomic on the same filesystem), then best-effort cleans the scratch dir.
 *
 * Scratch dirs land inside the customer's cloned working tree, so the clone
 * phase registers `SCRATCH_DIR_GIT_EXCLUDE_GLOB` in `.git/info/exclude` to
@@ -1783,13 +1784,58 @@ function resolveOrchestratorUrl(url) {
 	}
 }
 /**
-* Restore dependencies from a cached tarball.
+* Move a fully-extracted scratch tree into the cloned repo. The dep tarball is
+* packed repo-root-relative, so the scratch holds repo-root entries:
+* `.kici/node_modules` for every manager, plus (for pnpm) the root
+* `node_modules/.pnpm` store and in-repo workspace sibling dirs. `.kici/` itself
+* already exists in the work tree (cloned or source-restored), so its children
+* are moved individually; every other top-level entry is moved wholesale.
 *
-* For HTTP/HTTPS URLs: uses a streaming pipeline (response -> hash -> gunzip -> tar)
-* with a 5-minute timeout and up to 2 retries. This avoids buffering entire tarballs
-* in memory, eliminating memory spikes proportional to tarball size.
+* On a cache-hit execution agent the destinations do not pre-exist (source
+* restore excludes node_modules and never carries sibling dirs), so the renames
+* have nothing to race; the defensive `rm` covers re-runs.
+*/
+async function moveScratchIntoRepo(scratchDir, workDir) {
+	for (const child of await fs.readdir(scratchDir)) if (child === ".kici") {
+		const kiciScratch = join(scratchDir, ".kici");
+		for (const sub of await fs.readdir(kiciScratch)) await moveInto(join(kiciScratch, sub), join(workDir, ".kici", sub));
+	} else await moveInto(join(scratchDir, child), join(workDir, child));
+}
+/** Move `src` to `dest`, creating the parent and clearing any stale dest. */
+async function moveInto(src, dest) {
+	await mkdir(dirname(dest), { recursive: true });
+	await fs.rm(dest, {
+		recursive: true,
+		force: true
+	});
+	await fs.rename(src, dest);
+}
+/** Best-effort cleanup of a settled scratch dir; logs and continues on failure. */
+async function cleanupScratch(scratchDir) {
+	try {
+		await fs.rm(scratchDir, {
+			recursive: true,
+			force: true
+		});
+	} catch (cleanupErr) {
+		logger$8.warn("Scratch dir cleanup failed (orphan left behind)", {
+			scratchDir,
+			error: cleanupErr instanceof Error ? cleanupErr.message : String(cleanupErr)
+		});
+	}
+}
+/**
+* Restore dependencies from a cached tarball into the cloned repo.
 *
-* For file:// URLs: uses a buffer-based approach (local, no streaming benefit).
+* The tarball is packed repo-root-relative (see `dep-packer.ts`): every manager
+* carries `.kici/node_modules`; pnpm additionally carries the root
+* `node_modules/.pnpm` store and the in-repo workspace siblings `.kici` resolves.
+* Restore extracts into a scratch dir, then moves each entry into place — one
+* code path for all managers.
+*
+* For HTTP/HTTPS URLs: a streaming pipeline (response -> hash -> gunzip -> tar)
+* with a 5-minute timeout and up to 2 retries avoids buffering whole tarballs.
+* For file:// URLs: a buffer-based approach (local, no streaming benefit).
 *
 * @param workDir - Root directory of the cloned repository
 * @param depsUrl - URL to the dependency tarball (http://, https://, or file://)
@@ -1806,11 +1852,14 @@ async function restoreDeps(workDir, depsUrl, depsHash) {
 			const actualHash = computeHash(data);
 			if (actualHash !== depsHash) throw new Error(`Dep tarball hash mismatch: expected ${depsHash}, got ${actualHash}`);
 		}
-		await extractTarball(data, kiciDir);
+		const scratchDir = join(kiciDir, `${SCRATCH_DIR_BASENAME_PREFIX}${process.pid}-file-${Date.now()}`);
+		await extractTarball(data, scratchDir);
+		await moveScratchIntoRepo(scratchDir, workDir);
+		await cleanupScratch(scratchDir);
 		const sizeMB = (data.length / (1024 * 1024)).toFixed(2);
 		logger$8.info("Dependencies restored from cache (file)", {
 			sizeMB,
-			targetDir: kiciDir
+			targetDir: workDir
 		});
 		return;
 	}
@@ -1824,19 +1873,9 @@ async function restoreDeps(workDir, depsUrl, depsHash) {
 		try {
 			const { scratchDir, hash } = await extractIntoScratch(depsUrl, kiciDir, attempt);
 			if (depsHash && hash !== depsHash) throw new Error(`Dep tarball hash mismatch: expected ${depsHash}, got ${hash}`);
-			await fs.rename(join(scratchDir, "node_modules"), join(kiciDir, "node_modules"));
-			try {
-				await fs.rm(scratchDir, {
-					recursive: true,
-					force: true
-				});
-			} catch (cleanupErr) {
-				logger$8.warn("Scratch dir cleanup failed (orphan left behind)", {
-					scratchDir,
-					error: cleanupErr instanceof Error ? cleanupErr.message : String(cleanupErr)
-				});
-			}
-			logger$8.info("Dependencies restored from cache (stream)", { targetDir: kiciDir });
+			await moveScratchIntoRepo(scratchDir, workDir);
+			await cleanupScratch(scratchDir);
+			logger$8.info("Dependencies restored from cache (stream)", { targetDir: workDir });
 			return;
 		} catch (err) {
 			lastError = err instanceof Error ? err : new Error(String(err));
@@ -2704,46 +2743,208 @@ function redactNpmOutput(input, tokens) {
 }
 var init_npm_registry_config = __esmMin((() => {}));
 //#endregion
+//#region src/execution/validate-kici-deps.ts
+/**
+* Pre-install validation for `.kici/` dependency specifiers.
+*
+* The agent clones a single source repository and installs its `.kici/`
+* dependencies with the repo's package manager. Local-protocol specifiers —
+* `workspace:`, `file:`, `link:`, `portal:` — resolve a dependency against
+* another package on the same filesystem rather than a registry. Whether they
+* are resolvable depends on the manager and the layout:
+*
+* - npm has no `workspace:` protocol and cannot resolve any of these from a
+*   registry, so they are rejected up front with an actionable message
+*   instead of the raw `EUNSUPPORTEDPROTOCOL` npm would emit.
+* - pnpm resolves `workspace:` against the repo's pnpm workspace (the agent
+*   clones the whole repo, so an in-repo sibling is present), and resolves
+*   `file:`/`link:`/`portal:` against a path — allowed when that path stays
+*   inside the cloned repo, rejected when it escapes the clone.
+*
+* This module performs that classification so unresolvable specifiers fail
+* fast with guidance rather than a cryptic install error.
+*/
+/**
+* Scan a parsed `.kici/package.json` for dependency specifiers that use a
+* local protocol (`workspace:`/`file:`/`link:`/`portal:`). Returns one entry
+* per dependency, in field order. Returns an empty array when there are none.
+*/
+function findLocalProtocolDeps(pkg) {
+	const found = [];
+	for (const field of DEP_FIELDS) {
+		const deps = pkg[field];
+		if (!deps || typeof deps !== "object") continue;
+		for (const [name, spec] of Object.entries(deps)) {
+			if (typeof spec !== "string") continue;
+			const protocol = LOCAL_PROTOCOLS.find((proto) => spec.startsWith(proto));
+			if (protocol) found.push({
+				name,
+				spec,
+				protocol
+			});
+		}
+	}
+	return found;
+}
+/** Parse `.kici/package.json`, returning `null` when it is missing or invalid. */
+async function readKiciPackageJson(kiciDir) {
+	let raw;
+	try {
+		raw = await readFile(join(kiciDir, "package.json"), "utf-8");
+	} catch {
+		return null;
+	}
+	try {
+		return JSON.parse(raw);
+	} catch {
+		return null;
+	}
+}
+/**
+* Whether `.kici/package.json` declares any local-protocol dependency. Used to
+* decide whether the agent must build the in-repo workspace dependency closure
+* after a pnpm install (so a `workspace:` sibling's build output exists before
+* the workflow that imports it loads).
+*/
+async function kiciHasLocalProtocolDeps(kiciDir) {
+	const pkg = await readKiciPackageJson(kiciDir);
+	if (!pkg) return false;
+	return findLocalProtocolDeps(pkg).length > 0;
+}
+async function fileExists$1(target) {
+	try {
+		await access(target);
+		return true;
+	} catch {
+		return false;
+	}
+}
+/** Resolve a `file:`/`link:`/`portal:` spec to an absolute path under kiciDir. */
+function resolveLocalPath(kiciDir, dep) {
+	const rawPath = dep.spec.slice(dep.protocol.length);
+	return isAbsolute(rawPath) ? resolve(rawPath) : resolve(kiciDir, rawPath);
+}
+/** Whether `target` is `repoRoot` itself or a path inside it. */
+function isInsideRepo(repoRoot, target) {
+	const rel = relative(repoRoot, target);
+	return rel === "" || !rel.startsWith("..") && !isAbsolute(rel);
+}
+/**
+* Classify each local-protocol dependency for the detected package manager and
+* return the ones that are unresolvable in the agent's single-clone model.
+*/
+async function findUnresolvableDeps(deps, packageManager, kiciDir, repoRoot) {
+	if (packageManager === PackageManager.Npm) return [...deps];
+	const hasWorkspaceFile = await fileExists$1(join(repoRoot, "pnpm-workspace.yaml"));
+	const unresolvable = [];
+	for (const dep of deps) {
+		if (dep.protocol === "workspace:") {
+			if (!hasWorkspaceFile) unresolvable.push(dep);
+			continue;
+		}
+		if (!isInsideRepo(repoRoot, resolveLocalPath(kiciDir, dep))) unresolvable.push(dep);
+	}
+	return unresolvable;
+}
+/** Build the actionable error for unresolvable local-protocol dependencies. */
+function formatUnresolvableDepError(offenders, packageManager) {
+	const list = offenders.map((o) => `${o.name}: ${o.spec}`).join(", ");
+	if (packageManager === PackageManager.Npm) return `These .kici/ dependencies use local-protocol specifiers npm cannot resolve from a registry: ${list}. npm has no workspace protocol — pin a published version, publish the package to your registry, or use pnpm so an in-repo workspace sibling can be resolved.`;
+	return `These .kici/ dependencies point outside the cloned repository, which the agent never has: ${list}. A workspace: dependency requires a pnpm-workspace.yaml at the repo root, and file:/link:/portal: paths must stay inside this repository.`;
+}
+/**
+* Throw an actionable error when `.kici/package.json` declares a local-protocol
+* dependency the detected package manager cannot resolve from the single cloned
+* repository. A missing or unparseable package.json is left for the install to
+* report.
+*/
+async function assertResolvableDeps(args) {
+	const pkg = await readKiciPackageJson(args.kiciDir);
+	if (!pkg) return;
+	const localDeps = findLocalProtocolDeps(pkg);
+	if (localDeps.length === 0) return;
+	const offenders = await findUnresolvableDeps(localDeps, args.packageManager, args.kiciDir, args.repoRoot);
+	if (offenders.length === 0) return;
+	throw new Error(formatUnresolvableDepError(offenders, args.packageManager));
+}
+var LOCAL_PROTOCOLS, DEP_FIELDS;
+var init_validate_kici_deps = __esmMin((() => {
+	LOCAL_PROTOCOLS = [
+		"workspace:",
+		"file:",
+		"link:",
+		"portal:"
+	];
+	DEP_FIELDS = [
+		"dependencies",
+		"devDependencies",
+		"optionalDependencies",
+		"peerDependencies"
+	];
+}));
+//#endregion
 //#region src/execution/dep-installer.ts
 /**
 * Inline dependency installation for graceful degradation.
 *
-* When dep cache is unavailable or download fails, the agent falls back
-* to running npm install directly.
+* When the dep cache is unavailable or a download fails, the agent installs
+* `.kici/` dependencies directly with the repository's package manager.
 *
-* Only npm is supported — it ships with every Node.js installation.
-* .kici/package.json is required — its presence signals deps should be installed.
+* The package manager is detected from the cloned repo (npm / pnpm); the
+* presence of `.kici/package.json` signals that deps should be installed. npm
+* is the default and ships with every Node.js install; pnpm is used when the
+* repo is a pnpm workspace so a `.kici/` member can resolve in-repo
+* `workspace:` siblings. yarn is detected but not yet supported and is
+* rejected with an actionable error.
 *
-* Security: npm runs with an isolated per-invocation cache directory to prevent
-* cache poisoning across build jobs. A malicious package.json in one repo cannot
-* taint the cache used by subsequent builds. The same pressure rules out letting
-* lifecycle scripts see synthesized auth env vars — npm runs with
-* `--ignore-scripts` whenever a private registry is configured.
+* Security: the install runs with an isolated per-invocation cache/store
+* directory to prevent cache poisoning across build jobs — a malicious
+* package.json in one repo cannot taint the cache used by subsequent builds.
+* The same pressure rules out letting lifecycle scripts see synthesized auth
+* env vars — the install runs with `--ignore-scripts` whenever a private
+* registry is configured.
 */
 /**
-* Install dependencies inline using npm.
-*
-* Falls back to this when the dep cache is unavailable or download fails.
+* Detect the package manager for the cloned repo from its committed manifests.
+* A pnpm workspace's `packageManager` field + `pnpm-lock.yaml` live at the repo
+* root, so check there first; fall back to `.kici/` for a standalone
+* (non-workspace) project that carries its own lockfile; default to npm when
+* neither carries a signal. Uses the manifests-only detector so the agent's own
+* launch env (`npm_config_user_agent`) never leaks into the decision.
+*/
+async function detectKiciPackageManager(repoRoot, kiciDir) {
+	return await detectPackageManagerFromManifests(repoRoot) ?? await detectPackageManagerFromManifests(kiciDir) ?? PackageManager.Npm;
+}
+/**
+* Install `.kici/` dependencies inline with the repo's package manager.
 *
-* npm runs with an isolated cache directory (created in os.tmpdir()) to prevent
-* cache poisoning between build jobs. The cache is removed after installation.
+* Falls back to this when the dep cache is unavailable or a download fails.
+* The install runs with an isolated cache/store directory (created in
+* `os.tmpdir()`) to prevent cache poisoning between build jobs; the directory
+* is removed after installation.
 *
-* If `opts.npmRegistries` / `opts.installEnvSecrets` is provided, the helper
-* synthesizes a job-scoped `.kici/.npmrc` overlay for the install, restores
-* the original file in `finally`, and runs npm with `--ignore-scripts` so
-* lifecycle scripts in committed `package.json` cannot exfiltrate the
-* synthesized token env vars.
+* If `opts.npmRegistries` / `opts.installEnvSecrets` is provided, a job-scoped
+* `.kici/.npmrc` overlay is synthesized for the install, restored in `finally`,
+* and the install runs with `--ignore-scripts` so lifecycle scripts in a
+* committed `package.json` cannot exfiltrate the synthesized token env vars.
 *
-* @param kiciDir - Path to the .kici/ directory containing package.json
-* @param opts    - Optional registry / installEnv configuration. When absent,
-*                  behavior is identical to the pre-private-registry version.
+* @param kiciDir - Path to the `.kici/` directory containing package.json.
+* @param opts    - Optional registry / installEnv / repoRoot configuration.
 */
 async function installDeps(kiciDir, opts = {}) {
+	const repoRoot = opts.repoRoot ?? dirname(kiciDir);
+	const packageManager = await detectKiciPackageManager(repoRoot, kiciDir);
 	logger$5.info("Installing deps inline", {
-		packageManager: "npm",
+		packageManager,
 		dir: kiciDir
 	});
-	process.stderr.write(`[dep-installer:trace] starting install: pm=npm, cwd=${kiciDir}\n`);
+	process.stderr.write(`[dep-installer:trace] starting install: pm=${packageManager}, cwd=${kiciDir}\n`);
+	if (packageManager === PackageManager.Yarn) throw new Error("This repository uses yarn, which the KiCI agent does not yet support for .kici/ dependency installation. Use npm or pnpm for the .kici/ project, or open a feature request for yarn support.");
+	await assertResolvableDeps({
+		kiciDir,
+		repoRoot,
+		packageManager
+	});
 	const startTime = Date.now();
 	const hasPrivateRegistry = (opts.npmRegistries?.length ?? 0) > 0 || (opts.installEnvSecrets ? Object.keys(opts.installEnvSecrets).length > 0 : false);
 	const registryConfig = await applyNpmRegistryConfig({
@@ -2753,125 +2954,297 @@ async function installDeps(kiciDir, opts = {}) {
 		jobIdShort: opts.jobIdShort ?? "00000000"
 	});
 	try {
-		const { npmCliPath, nodeExe, nodeDir } = resolveNpm();
-		const npmCmd = "install";
-		const cacheDir = await mkdtemp(join(tmpdir(), "kici-npm-cache-"));
-		const { NODE_ENV: _, ...restEnv } = process.env;
-		const envWithNode = {
-			...restEnv,
-			...registryConfig.extraEnv,
-			PATH: `${nodeDir}${process.platform === "win32" ? ";" : ":"}${process.env.PATH ?? ""}`
-		};
-		const { execFile } = await import("node:child_process");
-		const { promisify } = await import("node:util");
-		const execFileAsync = promisify(execFile);
-		const buildArgs = (...prefix) => {
-			const args = [
-				...prefix,
-				npmCmd,
-				"--cache",
-				cacheDir,
-				"--no-audit",
-				"--no-fund"
-			];
-			if (hasPrivateRegistry) args.push("--ignore-scripts");
-			return args;
-		};
-		try {
-			if (npmCliPath) {
-				process.stderr.write(`[dep-installer:trace] running: ${nodeExe} ${npmCliPath} ${buildArgs().join(" ")}\n`);
-				await execFileAsync(nodeExe, buildArgs(npmCliPath), {
-					cwd: kiciDir,
-					env: envWithNode,
-					timeout: 6e5,
-					maxBuffer: 128 * 1024 * 1024
-				});
-			} else {
-				process.stderr.write(`[dep-installer:trace] running: npm ${buildArgs().join(" ")}\n`);
-				await execFileAsync("npm", buildArgs(), {
-					cwd: kiciDir,
-					env: envWithNode,
-					timeout: 6e5,
-					maxBuffer: 128 * 1024 * 1024
-				});
-			}
-		} finally {
-			await rm(cacheDir, {
-				recursive: true,
-				force: true
-			}).catch(() => {});
-		}
+		if (packageManager === PackageManager.Pnpm) await runPnpmInstall({
+			kiciDir,
+			hasPrivateRegistry,
+			registryConfig
+		});
+		else await runNpmInstall({
+			kiciDir,
+			hasPrivateRegistry,
+			registryConfig
+		});
 	} catch (e) {
-		const msg = toErrorMessage(e);
 		const tokens = registryConfig.tokensForRedaction;
-		process.stderr.write(`[dep-installer:trace] INSTALL FAILED: ${redactNpmOutput(msg, tokens)}\n`);
-		if (e && typeof e === "object" && "stdout" in e) process.stderr.write(`[dep-installer:trace] stdout: ${redactNpmOutput(String(e.stdout), tokens).slice(0, 500)}\n`);
-		if (e && typeof e === "object" && "stderr" in e) process.stderr.write(`[dep-installer:trace] stderr: ${redactNpmOutput(String(e.stderr), tokens).slice(0, 500)}\n`);
+		process.stderr.write(`[dep-installer:trace] INSTALL FAILED: ${redactNpmOutput(toErrorMessage(e), tokens)}\n`);
+		logSubprocessStreams(e, tokens);
 		throw e;
 	} finally {
 		await registryConfig.cleanup();
 	}
+	if (packageManager === PackageManager.Pnpm && await kiciHasLocalProtocolDeps(kiciDir)) await buildWorkspaceClosure(repoRoot);
 	const durationMs = Date.now() - startTime;
 	process.stderr.write(`[dep-installer:trace] install complete: ${durationMs}ms\n`);
 	logger$5.info("Deps installed inline", {
-		packageManager: "npm",
+		packageManager,
 		durationMs
 	});
 }
-var logger$5;
+/** Build the Node binary directory onto PATH so spawned tools find `node`. */
+function envWithNodeOnPath(extraEnv, nodeDir) {
+	const { NODE_ENV: _NODE_ENV, ...restEnv } = process.env;
+	return {
+		...restEnv,
+		...extraEnv,
+		PATH: `${nodeDir}${process.platform === "win32" ? ";" : ":"}${process.env.PATH ?? ""}`
+	};
+}
+/** Run `npm install` in `.kici/` with an isolated cache directory. */
+async function runNpmInstall(args) {
+	const { npmCliPath, nodeExe, nodeDir } = resolveNpm();
+	const cacheDir = await mkdtemp(join(tmpdir(), "kici-npm-cache-"));
+	const env = envWithNodeOnPath(args.registryConfig.extraEnv, nodeDir);
+	const buildArgs = (...prefix) => {
+		const a = [
+			...prefix,
+			"install",
+			"--cache",
+			cacheDir,
+			"--no-audit",
+			"--no-fund"
+		];
+		if (args.hasPrivateRegistry) a.push("--ignore-scripts");
+		return a;
+	};
+	try {
+		const bin = npmCliPath ? nodeExe : "npm";
+		const argv = npmCliPath ? buildArgs(npmCliPath) : buildArgs();
+		process.stderr.write(`[dep-installer:trace] running: ${bin} ${argv.join(" ")}\n`);
+		await execFileAsync(bin, argv, {
+			cwd: args.kiciDir,
+			env,
+			timeout: INSTALL_TIMEOUT_MS,
+			maxBuffer: INSTALL_MAX_BUFFER
+		});
+	} finally {
+		await rm(cacheDir, {
+			recursive: true,
+			force: true
+		}).catch(() => {});
+	}
+}
+/**
+* Run `pnpm install` from `.kici/`. pnpm walks up to the workspace root, so a
+* `workspace:` sibling in the same cloned repo resolves. Uses an isolated store
+* (`--config.store-dir`) for cross-job isolation, `package-import-method=copy`
+* so the on-disk store is a self-contained tree of real files (a later dep
+* cache tars it), and disables interactive purge prompts + the side-effects
+* cache for deterministic, non-interactive runs.
+*/
+async function runPnpmInstall(args) {
+	await assertPnpmAvailable();
+	const { nodeDir } = resolveNpm();
+	const storeDir = await mkdtemp(join(tmpdir(), "kici-pnpm-store-"));
+	const env = envWithNodeOnPath(args.registryConfig.extraEnv, nodeDir);
+	const argv = [
+		"install",
+		`--config.store-dir=${storeDir}`,
+		"--config.package-import-method=copy",
+		"--config.confirm-modules-purge=false",
+		"--config.side-effects-cache=false"
+	];
+	if (args.hasPrivateRegistry) argv.push("--ignore-scripts");
+	try {
+		process.stderr.write(`[dep-installer:trace] running: pnpm ${argv.join(" ")}\n`);
+		await execFileAsync("pnpm", argv, {
+			cwd: args.kiciDir,
+			env,
+			timeout: INSTALL_TIMEOUT_MS,
+			maxBuffer: INSTALL_MAX_BUFFER
+		});
+	} finally {
+		await rm(storeDir, {
+			recursive: true,
+			force: true
+		}).catch(() => {});
+	}
+}
+/**
+* Build the in-repo dependency closure of the `.kici/` package so a
+* `workspace:` sibling's build output exists before the workflow that imports
+* it loads. `--filter "{.kici}^..."` selects only `.kici`'s dependencies (not
+* `.kici` itself); `--if-present` skips siblings without a build script. Runs
+* with a clean env (no synthesized registry tokens).
+*/
+async function buildWorkspaceClosure(repoRoot) {
+	const { nodeDir } = resolveNpm();
+	const env = envWithNodeOnPath({}, nodeDir);
+	const argv = [
+		"--filter",
+		"{.kici}^...",
+		"run",
+		"build",
+		"--if-present"
+	];
+	process.stderr.write(`[dep-installer:trace] building workspace closure: pnpm ${argv.join(" ")}\n`);
+	await execFileAsync("pnpm", argv, {
+		cwd: repoRoot,
+		env,
+		timeout: INSTALL_TIMEOUT_MS,
+		maxBuffer: INSTALL_MAX_BUFFER
+	});
+}
+/** Throw an actionable error when the repo needs pnpm but it is not installed. */
+async function assertPnpmAvailable() {
+	try {
+		await execFileAsync("pnpm", ["--version"], { timeout: 3e4 });
+	} catch (e) {
+		throw new Error(`This repository is a pnpm workspace, but pnpm is not available on this agent. Install pnpm (e.g. \`corepack enable\`) or run on a container/ Firecracker agent that bundles it. (${toErrorMessage(e)})`);
+	}
+}
+/** Trace the redacted stdout/stderr of a failed install subprocess. */
+function logSubprocessStreams(e, tokens) {
+	if (e && typeof e === "object" && "stdout" in e) process.stderr.write(`[dep-installer:trace] stdout: ${redactNpmOutput(String(e.stdout), tokens).slice(0, 500)}\n`);
+	if (e && typeof e === "object" && "stderr" in e) process.stderr.write(`[dep-installer:trace] stderr: ${redactNpmOutput(String(e.stderr), tokens).slice(0, 500)}\n`);
+}
+var logger$5, execFileAsync, INSTALL_TIMEOUT_MS, INSTALL_MAX_BUFFER;
 var init_dep_installer = __esmMin((() => {
 	init_npm_resolver();
 	init_npm_registry_config();
+	init_validate_kici_deps();
 	logger$5 = createLogger({ prefix: "dep-installer" });
+	execFileAsync = promisify(execFile);
+	INSTALL_TIMEOUT_MS = 6e5;
+	INSTALL_MAX_BUFFER = 128 * 1024 * 1024;
 }));
 //#endregion
 //#region src/execution/dep-packer.ts
 /**
-* Node_modules tarball creation for build agents.
+* Dependency tarball creation for build agents.
+*
+* After installing dependencies the build agent packs the dependency closure
+* into a gzip tarball for upload to the dep cache. The closure is packed
+* **repo-root-relative** (cwd = the clone root) so restore is a single layout
+* regardless of package manager:
 *
-* After installing dependencies in .kici/, packs node_modules
-* into a gzip tarball for upload to the dep cache.
+* - npm / yarn: just `.kici/node_modules`.
+* - pnpm: `.kici/node_modules` plus the repo-root `node_modules/.pnpm` virtual
+*   store and the in-repo `workspace:` sibling package directories `.kici`
+*   depends on (with their built output). pnpm lays `.kici/node_modules` out as
+*   symlinks into the root store and into sibling dirs that live outside
+*   `.kici/`, so packing `.kici/node_modules` alone would capture dangling
+*   links — the store and siblings must travel together.
 *
-* Uses tar.gz format (Node.js built-in zlib, no external binary needed).
-* Uses portable mode to strip user/group info for cross-machine consistency.
+* Uses tar.gz (Node.js built-in zlib, no external binary) in portable mode to
+* strip user/group info for cross-machine consistency; symlinks are preserved
+* as symlinks so the pnpm link graph restores intact.
 */
 /**
-* Pack node_modules into a gzip tarball and compute its SHA-256 hash.
+* Pack the dependency closure into a gzip tarball and compute its SHA-256 hash.
 *
-* Creates a tar.gz archive of the `node_modules/` directory relative to
-* kiciDir. The tarball is created in-memory and returned as a Buffer
-* along with its content hash.
-*
-* @param kiciDir - Path to the .kici/ directory containing node_modules/
-* @returns Object with tarball Buffer and SHA-256 hash string
-* @throws Error if node_modules/ does not exist in kiciDir
+* @param kiciDir - Path to the `.kici/` directory containing node_modules/.
+* @returns Object with the tarball Buffer and its SHA-256 hash string.
+* @throws Error if `.kici/node_modules` does not exist.
 */
 async function packNodeModules(kiciDir) {
-	const nodeModulesPath = join(kiciDir, "node_modules");
-	if (!existsSync(nodeModulesPath)) throw new Error(`node_modules not found at ${nodeModulesPath}`);
-	logger$4.info("Packing node_modules into tarball", { dir: kiciDir });
+	if (!existsSync(join(kiciDir, "node_modules"))) throw new Error(`node_modules not found at ${join(kiciDir, "node_modules")}`);
+	const workDir = dirname(kiciDir);
+	const packageManager = await detectPackageManagerFromManifests(workDir) ?? await detectPackageManagerFromManifests(kiciDir) ?? PackageManager.Npm;
+	const entries = await closureEntries(workDir, kiciDir, packageManager);
+	logger$4.info("Packing dependency closure into tarball", {
+		dir: workDir,
+		packageManager,
+		entries
+	});
 	const startTime = Date.now();
 	const stream = c({
 		gzip: true,
-		cwd: kiciDir,
+		cwd: workDir,
 		portable: true
-	}, ["node_modules"]);
+	}, entries);
 	const chunks = [];
 	for await (const chunk of stream) chunks.push(Buffer.from(chunk));
 	const tarball = Buffer.concat(chunks);
 	const hash = sha256(tarball);
 	const sizeMB = (tarball.length / (1024 * 1024)).toFixed(2);
-	const durationMs = Date.now() - startTime;
-	logger$4.info("Node_modules packed", {
+	logger$4.info("Dependency closure packed", {
 		sizeMB,
 		hash: hash.slice(0, 12),
-		durationMs
+		durationMs: Date.now() - startTime
 	});
 	return {
 		tarball,
 		hash
 	};
 }
+/**
+* Compute the repo-root-relative tar entries for the dependency closure. npm /
+* yarn need only `.kici/node_modules`; pnpm additionally needs the root store
+* and the in-repo workspace siblings `.kici` resolves.
+*/
+async function closureEntries(workDir, kiciDir, packageManager) {
+	const kiciNodeModules = relative(workDir, join(kiciDir, "node_modules"));
+	if (packageManager !== PackageManager.Pnpm) return [kiciNodeModules];
+	const entries = [kiciNodeModules];
+	if (existsSync(join(workDir, "node_modules", ".pnpm"))) entries.push(join("node_modules", ".pnpm"));
+	for (const sibling of await collectInRepoSiblings(workDir, kiciDir)) entries.push(sibling);
+	return entries;
+}
+/**
+* Walk `.kici`'s `node_modules` (and transitively each in-repo sibling's
+* `node_modules`) collecting the repo-relative directories of `workspace:`
+* siblings — package dirs that live inside the clone but outside `.kici/` and
+* outside the root `node_modules/` store. Returns each dir once.
+*/
+async function collectInRepoSiblings(workDir, kiciDir) {
+	const repoRoot = resolve(workDir);
+	const kiciResolved = resolve(kiciDir);
+	const rootNodeModules = resolve(join(workDir, "node_modules"));
+	const found = /* @__PURE__ */ new Set();
+	const visited = /* @__PURE__ */ new Set();
+	const queue = [join(kiciDir, "node_modules")];
+	while (queue.length > 0) {
+		const nmDir = queue.shift();
+		const real = await realpath(nmDir).catch(() => null);
+		if (!real || visited.has(real)) continue;
+		visited.add(real);
+		for (const target of await resolveNodeModulesLinks(nmDir)) {
+			if (!isInside(repoRoot, target)) continue;
+			if (isInside(kiciResolved, target) || isInside(rootNodeModules, target)) continue;
+			const rel = relative(workDir, target);
+			if (!found.has(rel)) {
+				found.add(rel);
+				queue.push(join(target, "node_modules"));
+			}
+		}
+	}
+	return [...found];
+}
+/** Resolve every package symlink target under a `node_modules` dir (descending one level into `@scope` dirs). */
+async function resolveNodeModulesLinks(nmDir) {
+	const targets = [];
+	for (const entry of await readdir(nmDir).catch(() => [])) {
+		if (entry.startsWith(".")) continue;
+		const entryPath = join(nmDir, entry);
+		if (entry.startsWith("@")) {
+			for (const scoped of await readdir(entryPath).catch(() => [])) {
+				const target = await resolveIfSymlink(join(entryPath, scoped));
+				if (target) targets.push(target);
+			}
+			continue;
+		}
+		const target = await resolveIfSymlink(entryPath);
+		if (target) targets.push(target);
+	}
+	return targets;
+}
+/** Return the real path of `p` if it is a symlink, else null. */
+async function resolveIfSymlink(p) {
+	try {
+		if (!(await lstat(p)).isSymbolicLink()) return null;
+		return await realpath(p);
+	} catch {
+		return null;
+	}
+}
+/** Whether `target` is `root` itself or a path inside it. */
+function isInside(root, target) {
+	const rel = relative(root, target);
+	return rel === "" || !rel.startsWith("..") && !rel.startsWith(`..${sep}`) && !isAbsoluteRel(rel);
+}
+function isAbsoluteRel(rel) {
+	return rel.length > 1 && rel[1] === ":";
+}
 var logger$4;
 var init_dep_packer = __esmMin((() => {
 	logger$4 = createLogger({ prefix: "dep-packer" });
@@ -5053,14 +5426,14 @@ var init_job_runner = __esmMin((() => {
 */
 init_console_capture();
 init_npm_resolver();
-const AGENT_VERSION = "0.1.10";
-const BUILD_COMMIT = "6bf528b56";
-const SDK_VERSION = "0.1.10";
+const AGENT_VERSION = "0.1.11";
+const BUILD_COMMIT = "b9e5aed32";
+const SDK_VERSION = "0.1.11";
 const SDK_BUNDLE_HASH = "675aafe4de03e677785ef2794d8f34951b14e2bd1e6f0ea825953d6c2abfe128";
-const SHARED_VERSION = "0.1.10";
+const SHARED_VERSION = "0.1.11";
 const SHARED_BUNDLE_HASH = "36a23a454fd75ec35f258d39f254543ec0451c6b543fe3618ce427e6e6369aae";
-const ENGINE_VERSION = "0.1.10";
-const ENGINE_BUNDLE_HASH = "dff25bbd7602e853cec6e6e985c6c956ad773e245830273cd52950fff958d4bb";
+const ENGINE_VERSION = "0.1.11";
+const ENGINE_BUNDLE_HASH = "4ab08e63bcb8558b1191c5d3ab8d58b71950b77d911af56c9955ae1d787c4302";
 initTelemetry({
 	serviceName: "kici-agent",
 	otlpEndpoint: process.env.OTEL_EXPORTER_OTLP_ENDPOINT