@kici-dev/agent 0.1.15 → 0.1.16

package/dist/diagnostics/mini-bundle.d.ts

@@ -0,0 +1,9 @@
+export interface AgentMiniBundleOptions {
+    agentId: string;
+    logDir?: string;
+    logWindowHours: number;
+    config: Record<string, unknown>;
+    metricsText?: string;
+}
+export declare function buildAgentMiniBundle(opts: AgentMiniBundleOptions): Promise<Buffer>;
+//# sourceMappingURL=mini-bundle.d.ts.map

package/dist/execution/job-runner.d.ts

@@ -1,6 +1,6 @@
 import type { AgentToOrchestratorMessage, JobDispatch } from '@kici-dev/engine';
 import type { AppConfig } from '../config.js';
-import type { CacheRequestIpc, CacheResponseIpc } from './sandbox/index.js';
+import type { CacheRequestIpc, CacheResponseIpc, StepApprovalRequestIpc, StepApprovalResolvedIpc } from './sandbox/index.js';
 /**
  * Dependencies injected into JobRunner.
  */
@@ -91,6 +91,14 @@ export interface JobRunnerDeps {
      * Optional for backward compatibility (callers that don't support the cache).
      */
     requestUserCache?: (jobId: string, request: CacheRequestIpc) => Promise<CacheResponseIpc>;
+    /**
+     * Relay a step-level approval request to the orchestrator and await the
+     * resolution. Translates the sandbox `approval.request` IPC into a
+     * `step.approval-request` WS message and returns the orchestrator's
+     * `step.approval-resolved` mapped onto the IPC response shape. Optional for
+     * backward compatibility (callers that don't support approvals).
+     */
+    sendStepApproval?: (runId: string, jobId: string, request: StepApprovalRequestIpc) => Promise<StepApprovalResolvedIpc>;
 }
 interface ActiveJob {
     abortController: AbortController;
@@ -125,6 +133,7 @@ export declare class JobRunner {
     private readonly _sendConcurrencyReport;
     private readonly _sendApiRequest?;
     private readonly _requestUserCache?;
+    private readonly _sendStepApproval?;
     /** Tracks running jobs for concurrency and cancellation */
     readonly activeJobs: Map<string, ActiveJob>;
     /** Active sandbox for the current job (used for abort). */

package/dist/execution/sandbox/index.d.ts

@@ -5,7 +5,7 @@
  *   import { BareMetalSandbox, ContainerSandbox, buildSanitizedEnv } from './sandbox/index.js';
  */
 export type { ExecutionSandbox, SandboxSetupOptions, JobExecutionOptions, JobExecutionResult, SandboxStepResult, } from './types.js';
-export type { RunnerToAgentMessage, AgentToRunnerMessage, EventEmitRequest, EventEmitResponse, CacheRequestIpc, CacheResponseIpc, JobExecutionRequest, } from './ipc-protocol.js';
+export type { RunnerToAgentMessage, AgentToRunnerMessage, EventEmitRequest, EventEmitResponse, CacheRequestIpc, CacheResponseIpc, StepApprovalRequestIpc, StepApprovalResolvedIpc, JobExecutionRequest, } from './ipc-protocol.js';
 export { buildSanitizedEnv } from './env-sanitizer.js';
 export { ALLOWED_SYSTEM_VARS, KICI_AGENT_ENV_PREFIX, AGENT_REQUIRED_KICI_VARS, } from '@kici-dev/engine';
 export { BareMetalSandbox } from './bare-metal-sandbox.js';

package/dist/execution/sandbox/ipc-protocol.d.ts

@@ -159,7 +159,33 @@ export interface CacheRequestIpc {
     /** Tarball size in bytes (drives quota accounting). `completeSave` only. */
     sizeBytes?: number;
 }
-export type RunnerToAgentMessage = ReadyMessage | StepStartMessage | StepCompleteMessage | LogLineMessage | StepSecretMountMessage | JobCompleteMessage | EventEmitRequest | ConcurrencyReportMessage | AgentApiRequestIpc | CacheRequestIpc;
+/**
+ * Request a step-level approval hold (runner -> agent). The sandbox runner
+ * blocks the step loop before a `requireApproval` step; the agent relays this
+ * as a `step.approval-request` WS message and pipes the orchestrator's
+ * resolution back as a {@link StepApprovalResolvedIpc}. Mirrors the
+ * {@link CacheRequestIpc} relay pattern.
+ */
+export interface StepApprovalRequestIpc {
+    type: 'approval.request';
+    /** UUID for correlating the response. */
+    requestId: string;
+    /** Step index within the job. */
+    stepIndex: number;
+    /** Step name (for the hold reason / logs). */
+    stepName: string;
+    /** AND-list of approver clauses (empty = any approval-capable member). */
+    clauses: Array<{
+        team: string;
+    } | {
+        user: string;
+    }>;
+    /** Human label for the gate. */
+    reason: string;
+    /** Per-gate timeout override (seconds) from the SDK `requireApproval.timeout`. */
+    timeoutSeconds?: number;
+}
+export type RunnerToAgentMessage = ReadyMessage | StepStartMessage | StepCompleteMessage | LogLineMessage | StepSecretMountMessage | JobCompleteMessage | EventEmitRequest | ConcurrencyReportMessage | AgentApiRequestIpc | CacheRequestIpc | StepApprovalRequestIpc;
 /** Instruct the workflow runner to execute a job. */
 interface ExecuteMessage {
     type: 'execute';
@@ -233,7 +259,24 @@ export interface CacheResponseIpc {
     /** Error description (present when the relay or orchestrator failed). */
     error?: string;
 }
-export type AgentToRunnerMessage = ExecuteMessage | AbortMessage | EventEmitResponse | ConcurrencyAckMessage | AgentApiResponseIpc | CacheResponseIpc;
+/**
+ * Resolution of a step-level approval hold (agent -> runner). Relayed from the
+ * orchestrator's `step.approval-resolved` WS message. On `approved` the runner
+ * runs the step; on `rejected`/`expired` it fails the job. `error` is set when
+ * the relay itself failed (treated as a fail-closed reject by the runner).
+ */
+export interface StepApprovalResolvedIpc {
+    type: 'approval.resolved';
+    /** Matches the original request's requestId. */
+    requestId: string;
+    /** Outcome of the hold. */
+    outcome?: 'approved' | 'rejected' | 'expired';
+    /** Optional human reason (e.g. the reject reason). */
+    reason?: string;
+    /** Error description (present when the relay or orchestrator failed). */
+    error?: string;
+}
+export type AgentToRunnerMessage = ExecuteMessage | AbortMessage | EventEmitResponse | ConcurrencyAckMessage | AgentApiResponseIpc | CacheResponseIpc | StepApprovalResolvedIpc;
 /**
  * All data the workflow runner needs to execute a job inside the sandbox.
  *

package/dist/execution/sandbox/step-loop.d.ts

@@ -19,7 +19,7 @@ export interface JobHooks {
     cleanup?: HookInput;
 }
 /** Options for the step execution loop. */
-interface StepLoopOptions {
+export interface StepLoopOptions {
     steps: Step[];
     /** Factory that creates a StepContext for a given step index and name. */
     createStepContext: (stepIndex: number, stepName: string) => StepContext;
@@ -83,6 +83,29 @@ interface StepLoopOptions {
      * them for the next step. Never throws -- errors are logged by the wired impl.
      */
     afterStepApplyEnvFiles?: () => Promise<void>;
+    /**
+     * Block a `requireApproval` step pending an orchestrator-side approval hold.
+     * The runner sends the normalized requirement and awaits the resolution; the
+     * agent keeps job heartbeats flowing during the wait so the agent isn't
+     * reaped. Absent ⇒ approvals are not gated (CT / unit harnesses) and steps
+     * run unconditionally.
+     */
+    awaitStepApproval?: (req: {
+        stepIndex: number;
+        stepName: string;
+        clauses: Array<{
+            team: string;
+        } | {
+            user: string;
+        }>;
+        reason: string;
+        timeoutSeconds?: number;
+    }) => Promise<StepApprovalResolution>;
+}
+/** Outcome of an awaited step-level approval hold. */
+export interface StepApprovalResolution {
+    outcome: 'approved' | 'rejected' | 'expired';
+    reason?: string;
 }
 /** Result of the step execution loop. */
 interface StepLoopResult {

package/dist/execution/sandbox/types.d.ts

@@ -1,5 +1,5 @@
 import type { JobDispatch } from '@kici-dev/engine';
-import type { EventEmitRequest, EventEmitResponse, ConcurrencyReportMessage, ConcurrencyAckMessage, CacheRequestIpc, CacheResponseIpc } from './ipc-protocol.js';
+import type { EventEmitRequest, EventEmitResponse, ConcurrencyReportMessage, ConcurrencyAckMessage, CacheRequestIpc, CacheResponseIpc, StepApprovalRequestIpc, StepApprovalResolvedIpc } from './ipc-protocol.js';
 /**
  * Common interface for all execution sandbox backends.
  *
@@ -89,6 +89,15 @@ export interface JobExecutionOptions {
      * working — the runner falls back to a "not configured" cache response.
      */
     onCacheRequest?: (request: CacheRequestIpc) => Promise<CacheResponseIpc>;
+    /**
+     * Callback for relaying a step-level approval request from the sandbox to the
+     * orchestrator. The sandbox runner sends `approval.request` IPC; the agent
+     * wraps it in a `step.approval-request` WS message and forwards to the
+     * orchestrator, awaiting the `step.approval-resolved` response which it pipes
+     * back as `approval.resolved`. Optional so harnesses that don't thread
+     * approvals keep working — the runner falls back to a fail-closed reject.
+     */
+    onApprovalRequest?: (request: StepApprovalRequestIpc) => Promise<StepApprovalResolvedIpc>;
     /**
      * Callback fired once per `ctx.secrets.mountFile` / `exposeFile` call the
      * workflow runner performs. Carries only key names + the resulting path /

package/dist/server.js

@@ -3,17 +3,19 @@ import { dirname as __cjs_dirname } from "node:path";
 __cjs_dirname(__cjs_fileURLToPath(import.meta.url));
 import { register } from "node:module";
 import crypto$1, { createCipheriv, createHash, createPublicKey, diffieHellman, generateKeyPairSync, hkdfSync, randomBytes, randomUUID } from "node:crypto";
+import * as os$1 from "node:os";
 import os, { hostname, tmpdir } from "node:os";
 import { PassThrough, Readable, Transform, Writable } from "node:stream";
 import { serve } from "@hono/node-server";
 import { Hono } from "hono";
 import winston from "winston";
-import { RingBuffer, createHealthRoutes, createLogger, createMeter, createMetricsRoutes, deriveSharedSecret, getPrometheusExporter, getReconnectDelay, getRequestContext, guardStartup, initTelemetry, logger, normalizeLineEndings, requestContext, setServiceName, setupGracefulShutdown, sha256, sha256File, toErrorMessage, validateRequiredTools } from "@kici-dev/shared";
+import { RingBuffer, addLogsToArchive, chunkBuffer, createHealthRoutes, createLogger, createMeter, createMetricsRoutes, deriveSharedSecret, getPrometheusExporter, getReconnectDelay, getRequestContext, guardStartup, initTelemetry, logger, normalizeLineEndings, redactConfig, requestContext, setServiceName, setupGracefulShutdown, sha256, sha256File, toErrorMessage, validateRequiredTools } from "@kici-dev/shared";
 import { z } from "zod";
 import { LOGGER_ENV_VARS, defineEnv, validateUnknownKiciVars } from "@kici-dev/shared/env";
 import { ALLOWED_SYSTEM_VARS, CacheRunEventType, CacheStepType, ExecutionJobStatus, ExecutionStepStatus, InitFailureCategory, KNOWN_ROLES, PROTOCOL_VERSION, SANDBOX_DEFAULT_VARS, WS_CLOSE_AGENT_AUTH_FAILED, WS_MAX_PAYLOAD_BYTES, deriveOsArchLabels, heartbeatSchema, hostLabel, mergeAutoLabels, orchestratorToAgentMessageSchema, resolveRoleLabels, validateNoReservedLabels } from "@kici-dev/engine";
 import { execFile, execFileSync, execSync, fork, spawn } from "node:child_process";
 import WebSocket from "ws";
+import archiver from "archiver";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { format, promisify } from "node:util";
 import { existsSync } from "node:fs";
@@ -177,6 +179,46 @@ function agentClientConnectionOptions(config) {
 	};
 }
 //#endregion
+//#region src/diagnostics/mini-bundle.ts
+/**
+* Agent fleet mini-bundle assembler.
+*
+* Builds an in-memory ZIP of the agent's recent logs, system info, redacted
+* config, and current Prometheus metrics text, streamed to the orchestrator on
+* a fleet.logs.request. No diagnostics runner exists agent-side, so this is a
+* lean subset of the orchestrator's createDebugBundle.
+*/
+async function buildAgentMiniBundle(opts) {
+	const archive = archiver("zip", { zlib: { level: 6 } });
+	const chunks = [];
+	archive.on("data", (d) => chunks.push(d));
+	const done = new Promise((resolve, reject) => {
+		archive.on("end", resolve);
+		archive.on("error", reject);
+	});
+	archive.append(JSON.stringify({
+		kind: "agent",
+		agentId: opts.agentId,
+		generatedAt: (/* @__PURE__ */ new Date()).toISOString()
+	}, null, 2), { name: "manifest.json" });
+	archive.append(JSON.stringify(redactConfig(opts.config), null, 2), { name: "config/config.json" });
+	archive.append(JSON.stringify({
+		hostname: os$1.hostname(),
+		platform: process.platform,
+		arch: process.arch,
+		nodeVersion: process.version,
+		cpus: os$1.cpus().length,
+		totalmem: os$1.totalmem(),
+		freemem: os$1.freemem(),
+		uptime: os$1.uptime()
+	}, null, 2), { name: "system/info.json" });
+	if (opts.metricsText) archive.append(opts.metricsText, { name: "system/metrics.txt" });
+	if (opts.logDir) await addLogsToArchive(archive, opts.logDir, opts.logWindowHours);
+	await archive.finalize();
+	await done;
+	return Buffer.concat(chunks);
+}
+//#endregion
 //#region src/ws/event-buffer.ts
 /**
 * In-memory buffer for agent-to-orchestrator messages during disconnection.
@@ -243,6 +285,13 @@ var OrchestratorClient = class OrchestratorClient {
 	pendingApiRequests = /* @__PURE__ */ new Map();
 	/** Pending user-cache restore/save requests awaiting orchestrator response. */
 	pendingUserCacheRequests = /* @__PURE__ */ new Map();
+	/**
+	* Pending step-approval requests awaiting the orchestrator's resolution.
+	* No client-side timeout: the orchestrator owns the (org-/SDK-configured)
+	* expiry and sends `step.approval-resolved: expired` when it lapses. The
+	* workflow-runner carries an outer safety-net timeout.
+	*/
+	pendingStepApprovals = /* @__PURE__ */ new Map();
 	/** Pending concurrency report requests awaiting orchestrator ack. */
 	pendingConcurrencyRequests = /* @__PURE__ */ new Map();
 	url;
@@ -256,6 +305,7 @@ var OrchestratorClient = class OrchestratorClient {
 	getInFlightJobs;
 	roles;
 	scalerManaged;
+	getFleetBundleInputs;
 	/** Timestamp when the connection was lost, used for gap marker outage duration. */
 	disconnectedAt = null;
 	/** Set to true when auth.failure is received. Prevents retrying with a bad token. */
@@ -282,6 +332,7 @@ var OrchestratorClient = class OrchestratorClient {
 		this.getInFlightJobs = options.getInFlightJobs;
 		this.roles = options.roles;
 		this.scalerManaged = options.scalerManaged ?? false;
+		this.getFleetBundleInputs = options.getFleetBundleInputs;
 		this.eventBuffer = new EventBuffer({ maxSize: options.maxBufferSize ?? 5e3 });
 		this.logBuffer = new LogBuffer({ maxLines: options.maxLogBufferLines ?? 1e4 });
 	}
@@ -453,6 +504,36 @@ var OrchestratorClient = class OrchestratorClient {
 		});
 	}
 	/**
+	* Build this agent's fleet mini-bundle and stream it back to the orchestrator
+	* as ordered fleet.bundle.chunk frames (the WS frame cap forbids one frame).
+	* On failure, sends a single fleet.bundle.error. Public for unit testing.
+	*/
+	async streamFleetBundle(req) {
+		try {
+			const inputs = await this.getFleetBundleInputs?.() ?? { config: {} };
+			const buf = await buildAgentMiniBundle({
+				agentId: this.agentId,
+				logDir: inputs.logDir,
+				logWindowHours: req.logWindowHours,
+				config: inputs.config,
+				metricsText: inputs.metricsText
+			});
+			for (const f of chunkBuffer(buf)) this.sendDirect({
+				type: "fleet.bundle.chunk",
+				requestId: req.requestId,
+				seq: f.seq,
+				isLast: f.isLast,
+				dataB64: f.dataB64
+			});
+		} catch (err) {
+			this.sendDirect({
+				type: "fleet.bundle.error",
+				requestId: req.requestId,
+				message: toErrorMessage(err)
+			});
+		}
+	}
+	/**
 	* Send a typed API request to the orchestrator and await the response.
 	*
 	* This is the transport layer for the agent private API. The SDK's typed
@@ -547,6 +628,37 @@ var OrchestratorClient = class OrchestratorClient {
 		});
 	}
 	/**
+	* Relay a step-level approval request to the orchestrator. Sends a
+	* `step.approval-request` WS message and resolves with the orchestrator's
+	* `step.approval-resolved` mapped onto the IPC response shape. No client-side
+	* timeout — the orchestrator owns the approval expiry and replies with an
+	* `expired` outcome when it lapses. Rejects only on disconnect (the relay
+	* caller treats a rejection as a fail-closed reject).
+	*/
+	async sendStepApproval(runId, jobId, request) {
+		const messageId = randomUUID();
+		return new Promise((resolve, reject) => {
+			this.pendingStepApprovals.set(messageId, {
+				resolve: (response) => resolve({
+					...response,
+					requestId: request.requestId
+				}),
+				reject
+			});
+			this.sendDirect({
+				type: "step.approval-request",
+				messageId,
+				runId,
+				jobId,
+				stepIndex: request.stepIndex,
+				stepName: request.stepName,
+				clauses: request.clauses,
+				reason: request.reason,
+				...request.timeoutSeconds !== void 0 && { timeoutSeconds: request.timeoutSeconds }
+			});
+		});
+	}
+	/**
 	* Send a job.context message to the orchestrator.
 	*
 	* Conveys execution environment details (runtime, sandbox type, env vars)
@@ -684,6 +796,8 @@ var OrchestratorClient = class OrchestratorClient {
 			this.pendingUserCacheRequests.clear();
 			for (const [_id, pending] of this.pendingConcurrencyRequests) pending.reject(/* @__PURE__ */ new Error("WebSocket disconnected"));
 			this.pendingConcurrencyRequests.clear();
+			for (const [_id, pending] of this.pendingStepApprovals) pending.reject(/* @__PURE__ */ new Error("WebSocket disconnected"));
+			this.pendingStepApprovals.clear();
 			if (!this.intentionalDisconnect) this.scheduleReconnect();
 		});
 		this.ws.on("error", (err) => {
@@ -814,6 +928,33 @@ var OrchestratorClient = class OrchestratorClient {
 					}
 					break;
 				}
+				case "step.approval-resolved": {
+					logger$11.info("Step approval resolved", {
+						requestId: msg.requestId,
+						runId: msg.runId,
+						jobId: msg.jobId,
+						stepIndex: msg.stepIndex,
+						outcome: msg.outcome
+					});
+					const pending = this.pendingStepApprovals.get(msg.requestId);
+					if (pending) {
+						this.pendingStepApprovals.delete(msg.requestId);
+						pending.resolve({
+							type: "approval.resolved",
+							requestId: msg.requestId,
+							outcome: msg.outcome,
+							...msg.reason !== void 0 && { reason: msg.reason }
+						});
+					}
+					break;
+				}
+				case "fleet.logs.request":
+					logger$11.info("Fleet log collection requested", {
+						requestId: msg.requestId,
+						logWindowHours: msg.logWindowHours
+					});
+					this.streamFleetBundle(msg);
+					break;
 			}
 			return;
 		}
@@ -1061,14 +1202,14 @@ var init_console_capture = __esmMin((() => {
 init_console_capture();
 function safe(name, fallback = "unknown") {
 	switch (name) {
-		case "version": return "0.1.15";
-		case "buildCommit": return "831f6a763";
-		case "sdkVersion": return "0.1.15";
-		case "sdkBundleHash": return "cee24b67bbb4a1d2a770e4063dd37a9af33409faeb5ce32f936703b4431316dd";
-		case "sharedVersion": return "0.1.15";
-		case "sharedBundleHash": return "e82a8b68a7d72698674352158c5de4c0d10824c61bfa7166cc8f846044b8b5e4";
-		case "engineVersion": return "0.1.15";
-		case "engineBundleHash": return "032d6b28b3d32bcbea80ba80a52934b017ee2c86a97fcaf8fe8db0d86d72a7f7";
+		case "version": return "0.1.16";
+		case "buildCommit": return "7d97bb32c";
+		case "sdkVersion": return "0.1.16";
+		case "sdkBundleHash": return "cd4b8e0d91efe578c96e7c746f89b44a3df8fcaebaec2185399168ef8eb4ebca";
+		case "sharedVersion": return "0.1.16";
+		case "sharedBundleHash": return "c58b1596e92c8423ef83958e86894cb150315d8b91578a0080f1c645000e93e8";
+		case "engineVersion": return "0.1.16";
+		case "engineBundleHash": return "a611c0017d08faa9c5aa4fd97c3dd6259f53f3cca248bd2b369ad5d30c394847";
 		default: return fallback;
 	}
 }
@@ -1752,8 +1893,8 @@ async function extractStepsFromDynamicJob(workflow, dynamicIndex, jobName, event
 }
 var AGENT_SDK_VERSION, AGENT_SDK_BUNDLE_HASH, hookRegistered;
 var init_workflow_loader = __esmMin((() => {
-	AGENT_SDK_VERSION = "0.1.15";
-	AGENT_SDK_BUNDLE_HASH = "cee24b67bbb4a1d2a770e4063dd37a9af33409faeb5ce32f936703b4431316dd";
+	AGENT_SDK_VERSION = "0.1.16";
+	AGENT_SDK_BUNDLE_HASH = "cd4b8e0d91efe578c96e7c746f89b44a3df8fcaebaec2185399168ef8eb4ebca";
 	hookRegistered = false;
 }));
 //#endregion
@@ -3821,6 +3962,24 @@ function relayCacheRequest$1(msg, ctx) {
 		error: toErrorMessage(err)
 	}));
 }
+/** Relay `approval.request` and pipe the orchestrator's resolution (or a
+*  fail-closed reject when the callback isn't wired or the relay throws) back
+*  into the sandbox runner. */
+function relayApprovalRequest$1(msg, ctx) {
+	if (!ctx.execOptions.onApprovalRequest) {
+		safeSendToChild(ctx.child, {
+			type: "approval.resolved",
+			requestId: msg.requestId,
+			error: "Approvals not available in this agent configuration"
+		});
+		return;
+	}
+	ctx.execOptions.onApprovalRequest(msg).then((response) => safeSendToChild(ctx.child, response), (err) => safeSendToChild(ctx.child, {
+		type: "approval.resolved",
+		requestId: msg.requestId,
+		error: toErrorMessage(err)
+	}));
+}
 /** Resolve the result promise for `job.complete` IPC messages. Encrypts
 *  secret outputs (when a runPublicKey is available) and overrides status to
 *  `cancelled` if a cancel was already in flight. */
@@ -3893,6 +4052,9 @@ function relayChildIpcMessage(msg, dispatch, ctx) {
 		case "cache.request":
 			relayCacheRequest$1(msg, ctx);
 			return;
+		case "approval.request":
+			relayApprovalRequest$1(msg, ctx);
+			return;
 		case "job.complete":
 			handleJobComplete(msg, dispatch, ctx);
 			return;
@@ -4314,6 +4476,32 @@ function relayCacheRequest(stream, options, cacheMsg) {
 	}));
 }
 /**
+* Relay approval.request from the container runner to the orchestrator via
+* options.onApprovalRequest, then write the resolution back through `stream`.
+* If the agent doesn't expose an approval relay (or it throws), write a
+* fail-closed reject so the runner doesn't hang.
+*/
+function relayApprovalRequest(stream, options, approvalMsg) {
+	const writeResponse = (response) => {
+		try {
+			stream.write(JSON.stringify(response) + "\n");
+		} catch {}
+	};
+	if (!options.onApprovalRequest) {
+		writeResponse({
+			type: "approval.resolved",
+			requestId: approvalMsg.requestId,
+			error: "Approvals not available in this agent configuration"
+		});
+		return;
+	}
+	options.onApprovalRequest(approvalMsg).then((response) => writeResponse(response), (err) => writeResponse({
+		type: "approval.resolved",
+		requestId: approvalMsg.requestId,
+		error: toErrorMessage(err)
+	}));
+}
+/**
 * Apply a job.complete message to the mutable runner state: capture status,
 * merge any bulk-reported step results, propagate plain outputs, and encrypt
 * secret outputs if a run public key is available.
@@ -4570,6 +4758,9 @@ var init_container_sandbox = __esmMin((() => {
 				case "cache.request":
 					relayCacheRequest(stream, options, msg);
 					return false;
+				case "approval.request":
+					relayApprovalRequest(stream, options, msg);
+					return false;
 				case "job.complete":
 					applyJobComplete(msg, stepResults, state, options);
 					return true;
@@ -4740,6 +4931,7 @@ var init_job_runner = __esmMin((() => {
 		_sendConcurrencyReport;
 		_sendApiRequest;
 		_requestUserCache;
+		_sendStepApproval;
 		/** Tracks running jobs for concurrency and cancellation */
 		activeJobs = /* @__PURE__ */ new Map();
 		/** Active sandbox for the current job (used for abort). */
@@ -4758,6 +4950,7 @@ var init_job_runner = __esmMin((() => {
 			this._sendConcurrencyReport = deps.sendConcurrencyReport;
 			this._sendApiRequest = deps.sendApiRequest;
 			this._requestUserCache = deps.requestUserCache;
+			this._sendStepApproval = deps.sendStepApproval;
 		}
 		/**
 		* Execute a dispatched job through its full lifecycle.
@@ -4997,6 +5190,7 @@ var init_job_runner = __esmMin((() => {
 				},
 				onApiRequest: this._sendApiRequest ? async (method, params) => this._sendApiRequest(method, params) : void 0,
 				onCacheRequest: this._requestUserCache ? async (request) => this._requestUserCache(jobId, request) : void 0,
+				onApprovalRequest: this._sendStepApproval ? async (request) => this._sendStepApproval(dispatch.runId, dispatch.jobId, request) : void 0,
 				onSecretMount: (event) => {
 					this.emitRunEvent(runId, "step.secret_mount", {
 						jobId,
@@ -5669,14 +5863,14 @@ var init_job_runner = __esmMin((() => {
 */
 init_console_capture();
 init_npm_resolver();
-const AGENT_VERSION = "0.1.15";
-const BUILD_COMMIT = "831f6a763";
-const SDK_VERSION = "0.1.15";
-const SDK_BUNDLE_HASH = "cee24b67bbb4a1d2a770e4063dd37a9af33409faeb5ce32f936703b4431316dd";
-const SHARED_VERSION = "0.1.15";
-const SHARED_BUNDLE_HASH = "e82a8b68a7d72698674352158c5de4c0d10824c61bfa7166cc8f846044b8b5e4";
-const ENGINE_VERSION = "0.1.15";
-const ENGINE_BUNDLE_HASH = "032d6b28b3d32bcbea80ba80a52934b017ee2c86a97fcaf8fe8db0d86d72a7f7";
+const AGENT_VERSION = "0.1.16";
+const BUILD_COMMIT = "7d97bb32c";
+const SDK_VERSION = "0.1.16";
+const SDK_BUNDLE_HASH = "cd4b8e0d91efe578c96e7c746f89b44a3df8fcaebaec2185399168ef8eb4ebca";
+const SHARED_VERSION = "0.1.16";
+const SHARED_BUNDLE_HASH = "c58b1596e92c8423ef83958e86894cb150315d8b91578a0080f1c645000e93e8";
+const ENGINE_VERSION = "0.1.16";
+const ENGINE_BUNDLE_HASH = "a611c0017d08faa9c5aa4fd97c3dd6259f53f3cca248bd2b369ad5d30c394847";
 initTelemetry({
 	serviceName: "kici-agent",
 	otlpEndpoint: process.env.OTEL_EXPORTER_OTLP_ENDPOINT
@@ -5685,6 +5879,26 @@ const { connectionStatus, jobsActive, jobsTotal } = await Promise.resolve().then
 const { JobRunner } = await Promise.resolve().then(() => (init_job_runner(), job_runner_exports));
 setServiceName("agent");
 const logger$1 = createLogger({ prefix: "agent" });
+/**
+* Serialize the agent's current Prometheus metrics to text. The OTel
+* PrometheusExporter exposes no direct serialize method, so the metrics are
+* piped through its request handler with a mock ServerResponse. Returns an
+* empty string when no exporter is configured. Shared by the /metrics health
+* route and the fleet mini-bundle.
+*/
+async function serializeAgentMetrics() {
+	const exporter = getPrometheusExporter();
+	if (!exporter) return "";
+	return new Promise((resolve) => {
+		exporter.getMetricsRequestHandler({}, {
+			statusCode: 200,
+			setHeader: () => {},
+			end: (data) => {
+				resolve(typeof data === "string" ? data : data ? data.toString() : "");
+			}
+		});
+	});
+}
 installConsoleCapture();
 await guardStartup(logger$1, async () => {
 	const config = loadConfig();
@@ -5736,7 +5950,8 @@ await guardStartup(logger$1, async () => {
 		sendRunEvent: (runId, eventType, opts) => client.sendRunEvent(runId, eventType, opts),
 		sendConcurrencyReport: (runId, jobId, group) => client.sendConcurrencyReport(runId, jobId, group),
 		sendApiRequest: (method, params) => client.sendApiRequest(method, params ?? {}),
-		requestUserCache: (jobId, request) => client.requestUserCache(jobId, request)
+		requestUserCache: (jobId, request) => client.requestUserCache(jobId, request),
+		sendStepApproval: (runId, jobId, request) => client.sendStepApproval(runId, jobId, request)
 	});
 	/** Build and send an agent.status message with dynamic OS metadata. */
 	function sendAgentStatus() {
@@ -5752,6 +5967,11 @@ await guardStartup(logger$1, async () => {
 	}
 	client = new OrchestratorClient({
 		...agentClientConnectionOptions(config),
+		getFleetBundleInputs: async () => ({
+			config,
+			logDir: process.env.KICI_LOG_DIR,
+			metricsText: await serializeAgentMetrics()
+		}),
 		onJobDispatch: (dispatch) => {
 			const reqId = dispatch.requestId ?? randomUUID();
 			requestContext.run({
@@ -5899,25 +6119,10 @@ await guardStartup(logger$1, async () => {
 	metricsReporter.start();
 	const app = new Hono();
 	const healthRoutes = createHealthRoutes$1({
-		getMetrics: async () => {
-			const exporter = getPrometheusExporter();
-			if (!exporter) return {
-				contentType: "text/plain",
-				body: ""
-			};
-			return new Promise((resolve) => {
-				exporter.getMetricsRequestHandler({}, {
-					statusCode: 200,
-					setHeader: () => {},
-					end: (data) => {
-						resolve({
-							contentType: "text/plain",
-							body: typeof data === "string" ? data : data ? data.toString() : ""
-						});
-					}
-				});
-			});
-		},
+		getMetrics: async () => ({
+			contentType: "text/plain",
+			body: await serializeAgentMetrics()
+		}),
 		getStatus: () => ({
 			agentId: config.agentId,
 			connected: client.state === "registered",