@kici-dev/agent 0.1.15 → 0.1.17

package/dist/server.js

@@ -3,24 +3,26 @@ import { dirname as __cjs_dirname } from "node:path";
 __cjs_dirname(__cjs_fileURLToPath(import.meta.url));
 import { register } from "node:module";
 import crypto$1, { createCipheriv, createHash, createPublicKey, diffieHellman, generateKeyPairSync, hkdfSync, randomBytes, randomUUID } from "node:crypto";
+import * as os$1 from "node:os";
 import os, { hostname, tmpdir } from "node:os";
 import { PassThrough, Readable, Transform, Writable } from "node:stream";
 import { serve } from "@hono/node-server";
 import { Hono } from "hono";
 import winston from "winston";
-import { RingBuffer, createHealthRoutes, createLogger, createMeter, createMetricsRoutes, deriveSharedSecret, getPrometheusExporter, getReconnectDelay, getRequestContext, guardStartup, initTelemetry, logger, normalizeLineEndings, requestContext, setServiceName, setupGracefulShutdown, sha256, sha256File, toErrorMessage, validateRequiredTools } from "@kici-dev/shared";
+import { RingBuffer, addLogsToArchive, chunkBuffer, createHealthRoutes, createLogger, createMeter, createMetricsRoutes, deriveSharedSecret, getPrometheusExporter, getReconnectDelay, getRequestContext, guardStartup, initTelemetry, logger, normalizeLineEndings, redactConfig, requestContext, setServiceName, setupGracefulShutdown, sha256, sha256File, toErrorMessage, validateRequiredTools } from "@kici-dev/shared";
 import { z } from "zod";
 import { LOGGER_ENV_VARS, defineEnv, validateUnknownKiciVars } from "@kici-dev/shared/env";
-import { ALLOWED_SYSTEM_VARS, CacheRunEventType, CacheStepType, ExecutionJobStatus, ExecutionStepStatus, InitFailureCategory, KNOWN_ROLES, PROTOCOL_VERSION, SANDBOX_DEFAULT_VARS, WS_CLOSE_AGENT_AUTH_FAILED, WS_MAX_PAYLOAD_BYTES, deriveOsArchLabels, heartbeatSchema, hostLabel, mergeAutoLabels, orchestratorToAgentMessageSchema, resolveRoleLabels, validateNoReservedLabels } from "@kici-dev/engine";
+import { ALLOWED_SYSTEM_VARS, CacheRunEventType, CacheStepType, ExecutionJobStatus, ExecutionStepStatus, InitFailureCategory, KNOWN_ROLES, PROTOCOL_VERSION, SANDBOX_DEFAULT_VARS, WS_CLOSE_AGENT_AUTH_FAILED, WS_MAX_PAYLOAD_BYTES, applyIncludeExclude, deriveOsArchLabels, expandMatrix, heartbeatSchema, hostLabel, mergeAutoLabels, orchestratorToAgentMessageSchema, resolveRoleLabels, validateNoReservedLabels } from "@kici-dev/engine";
 import { execFile, execFileSync, execSync, fork, spawn } from "node:child_process";
 import WebSocket from "ws";
+import archiver from "archiver";
+import fs, { existsSync } from "node:fs";
+import path, { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { format, promisify } from "node:util";
-import { existsSync } from "node:fs";
-import path, { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { gcStaleTmpDirs } from "@kici-dev/core/tmp-gc";
-import { fileURLToPath, pathToFileURL } from "node:url";
-import fs, { access, lstat, mkdir, mkdtemp, readFile, readdir, realpath, rm, unlink, writeFile } from "node:fs/promises";
+import fs$1, { access, lstat, mkdir, mkdtemp, readFile, readdir, realpath, rm, unlink, writeFile } from "node:fs/promises";
 import Docker from "dockerode";
 import { buildKiciApi, isDynamicGroupRef, isDynamicJobFn, isStaticArray, isStaticObject } from "@kici-dev/sdk";
 import { c, x } from "tar";
@@ -177,6 +179,75 @@ function agentClientConnectionOptions(config) {
 	};
 }
 //#endregion
+//#region src/diagnostics/mini-bundle.ts
+/**
+* Agent fleet mini-bundle assembler.
+*
+* Builds an in-memory ZIP of the agent's recent logs, system info, redacted
+* config, and current Prometheus metrics text, streamed to the orchestrator on
+* a fleet.logs.request. No diagnostics runner exists agent-side, so this is a
+* lean subset of the orchestrator's createDebugBundle.
+*/
+async function buildAgentMiniBundle(opts) {
+	const archive = archiver("zip", { zlib: { level: 6 } });
+	const chunks = [];
+	archive.on("data", (d) => chunks.push(d));
+	const done = new Promise((resolve, reject) => {
+		archive.on("end", resolve);
+		archive.on("error", reject);
+	});
+	archive.append(JSON.stringify({
+		kind: "agent",
+		agentId: opts.agentId,
+		generatedAt: (/* @__PURE__ */ new Date()).toISOString()
+	}, null, 2), { name: "manifest.json" });
+	archive.append(JSON.stringify(redactConfig(opts.config), null, 2), { name: "config/config.json" });
+	archive.append(JSON.stringify({
+		hostname: os$1.hostname(),
+		platform: process.platform,
+		arch: process.arch,
+		nodeVersion: process.version,
+		cpus: os$1.cpus().length,
+		totalmem: os$1.totalmem(),
+		freemem: os$1.freemem(),
+		uptime: os$1.uptime()
+	}, null, 2), { name: "system/info.json" });
+	if (opts.metricsText) archive.append(opts.metricsText, { name: "system/metrics.txt" });
+	if (opts.logDir) await addLogsToArchive(archive, opts.logDir, opts.logWindowHours);
+	await archive.finalize();
+	await done;
+	return Buffer.concat(chunks);
+}
+//#endregion
+//#region src/version.ts
+/**
+* Read the agent's own package version from disk.
+*
+* Walks up from this module's location until it finds a package.json whose
+* name is '@kici-dev/agent'. This is robust to the agent's bundled dist layout
+* (build-service.mjs emits dist/index.js / dist/server.js, so a fixed relative
+* depth would be wrong). Returns null when it can't be resolved so the
+* agent.register message simply omits the field rather than failing.
+*/
+function readAgentVersion() {
+	try {
+		let dir = path.dirname(fileURLToPath(import.meta.url));
+		for (let i = 0; i < 8; i++) {
+			const candidate = path.join(dir, "package.json");
+			if (fs.existsSync(candidate)) {
+				const pkg = JSON.parse(fs.readFileSync(candidate, "utf-8"));
+				if (pkg.name === "@kici-dev/agent" && typeof pkg.version === "string") return pkg.version;
+			}
+			const parent = path.dirname(dir);
+			if (parent === dir) break;
+			dir = parent;
+		}
+		return null;
+	} catch {
+		return null;
+	}
+}
+//#endregion
 //#region src/ws/event-buffer.ts
 /**
 * In-memory buffer for agent-to-orchestrator messages during disconnection.
@@ -243,6 +314,13 @@ var OrchestratorClient = class OrchestratorClient {
 	pendingApiRequests = /* @__PURE__ */ new Map();
 	/** Pending user-cache restore/save requests awaiting orchestrator response. */
 	pendingUserCacheRequests = /* @__PURE__ */ new Map();
+	/**
+	* Pending step-approval requests awaiting the orchestrator's resolution.
+	* No client-side timeout: the orchestrator owns the (org-/SDK-configured)
+	* expiry and sends `step.approval-resolved: expired` when it lapses. The
+	* workflow-runner carries an outer safety-net timeout.
+	*/
+	pendingStepApprovals = /* @__PURE__ */ new Map();
 	/** Pending concurrency report requests awaiting orchestrator ack. */
 	pendingConcurrencyRequests = /* @__PURE__ */ new Map();
 	url;
@@ -256,6 +334,7 @@ var OrchestratorClient = class OrchestratorClient {
 	getInFlightJobs;
 	roles;
 	scalerManaged;
+	getFleetBundleInputs;
 	/** Timestamp when the connection was lost, used for gap marker outage duration. */
 	disconnectedAt = null;
 	/** Set to true when auth.failure is received. Prevents retrying with a bad token. */
@@ -282,6 +361,7 @@ var OrchestratorClient = class OrchestratorClient {
 		this.getInFlightJobs = options.getInFlightJobs;
 		this.roles = options.roles;
 		this.scalerManaged = options.scalerManaged ?? false;
+		this.getFleetBundleInputs = options.getFleetBundleInputs;
 		this.eventBuffer = new EventBuffer({ maxSize: options.maxBufferSize ?? 5e3 });
 		this.logBuffer = new LogBuffer({ maxLines: options.maxLogBufferLines ?? 1e4 });
 	}
@@ -416,6 +496,47 @@ var OrchestratorClient = class OrchestratorClient {
 		});
 	}
 	/**
+	* Request a presigned PUT URL for a provenance bundle. Sends a
+	* `provenance.upload.request` and waits for a `provenance.upload.response`
+	* (resolved via the shared upload-request pending map). Times out after 30s.
+	*/
+	async requestProvenanceUploadUrl(jobId, subjectDigest) {
+		const messageId = randomUUID();
+		return new Promise((resolve, reject) => {
+			const timer = setTimeout(() => {
+				this.pendingUploadRequests.delete(messageId);
+				reject(/* @__PURE__ */ new Error("Provenance upload URL request timed out (30s)"));
+			}, 3e4);
+			this.pendingUploadRequests.set(messageId, {
+				resolve: (url) => {
+					clearTimeout(timer);
+					resolve(url);
+				},
+				reject: (err) => {
+					clearTimeout(timer);
+					reject(err);
+				}
+			});
+			this.sendDirect({
+				type: "provenance.upload.request",
+				messageId,
+				jobId,
+				subjectDigest
+			});
+		});
+	}
+	/** Notify the orchestrator a provenance bundle upload completed (records an attestations row). */
+	sendProvenanceUploadComplete(jobId, subjectName, subjectDigest, mediaType) {
+		this.sendDirect({
+			type: "provenance.upload.complete",
+			messageId: randomUUID(),
+			jobId,
+			subjectName,
+			subjectDigest,
+			mediaType
+		});
+	}
+	/**
 	* Send an event.emit WS message to the orchestrator and await the response.
 	*
 	* Used by the job runner to relay custom event emissions from the sandbox
@@ -453,6 +574,36 @@ var OrchestratorClient = class OrchestratorClient {
 		});
 	}
 	/**
+	* Build this agent's fleet mini-bundle and stream it back to the orchestrator
+	* as ordered fleet.bundle.chunk frames (the WS frame cap forbids one frame).
+	* On failure, sends a single fleet.bundle.error. Public for unit testing.
+	*/
+	async streamFleetBundle(req) {
+		try {
+			const inputs = await this.getFleetBundleInputs?.() ?? { config: {} };
+			const buf = await buildAgentMiniBundle({
+				agentId: this.agentId,
+				logDir: inputs.logDir,
+				logWindowHours: req.logWindowHours,
+				config: inputs.config,
+				metricsText: inputs.metricsText
+			});
+			for (const f of chunkBuffer(buf)) this.sendDirect({
+				type: "fleet.bundle.chunk",
+				requestId: req.requestId,
+				seq: f.seq,
+				isLast: f.isLast,
+				dataB64: f.dataB64
+			});
+		} catch (err) {
+			this.sendDirect({
+				type: "fleet.bundle.error",
+				requestId: req.requestId,
+				message: toErrorMessage(err)
+			});
+		}
+	}
+	/**
 	* Send a typed API request to the orchestrator and await the response.
 	*
 	* This is the transport layer for the agent private API. The SDK's typed
@@ -547,6 +698,58 @@ var OrchestratorClient = class OrchestratorClient {
 		});
 	}
 	/**
+	* Relay a provenance bundle upload operation to the orchestrator. Maps the
+	* IPC `provenance.request` onto `requestProvenanceUploadUrl` (returns the
+	* presigned URL) or `sendProvenanceUploadComplete` (fire-and-forget) and
+	* returns the result on the IPC response shape.
+	*/
+	async relayProvenance(jobId, request) {
+		if (request.op === "complete") {
+			this.sendProvenanceUploadComplete(jobId, request.subjectName, request.subjectDigest, request.mediaType);
+			return {
+				type: "provenance.response",
+				requestId: request.requestId
+			};
+		}
+		const uploadUrl = await this.requestProvenanceUploadUrl(jobId, request.subjectDigest);
+		return {
+			type: "provenance.response",
+			requestId: request.requestId,
+			uploadUrl
+		};
+	}
+	/**
+	* Relay a step-level approval request to the orchestrator. Sends a
+	* `step.approval-request` WS message and resolves with the orchestrator's
+	* `step.approval-resolved` mapped onto the IPC response shape. No client-side
+	* timeout — the orchestrator owns the approval expiry and replies with an
+	* `expired` outcome when it lapses. Rejects only on disconnect (the relay
+	* caller treats a rejection as a fail-closed reject).
+	*/
+	async sendStepApproval(runId, jobId, request) {
+		const messageId = randomUUID();
+		return new Promise((resolve, reject) => {
+			this.pendingStepApprovals.set(messageId, {
+				resolve: (response) => resolve({
+					...response,
+					requestId: request.requestId
+				}),
+				reject
+			});
+			this.sendDirect({
+				type: "step.approval-request",
+				messageId,
+				runId,
+				jobId,
+				stepIndex: request.stepIndex,
+				stepName: request.stepName,
+				clauses: request.clauses,
+				reason: request.reason,
+				...request.timeoutSeconds !== void 0 && { timeoutSeconds: request.timeoutSeconds }
+			});
+		});
+	}
+	/**
 	* Send a job.context message to the orchestrator.
 	*
 	* Conveys execution environment details (runtime, sandbox type, env vars)
@@ -684,6 +887,8 @@ var OrchestratorClient = class OrchestratorClient {
 			this.pendingUserCacheRequests.clear();
 			for (const [_id, pending] of this.pendingConcurrencyRequests) pending.reject(/* @__PURE__ */ new Error("WebSocket disconnected"));
 			this.pendingConcurrencyRequests.clear();
+			for (const [_id, pending] of this.pendingStepApprovals) pending.reject(/* @__PURE__ */ new Error("WebSocket disconnected"));
+			this.pendingStepApprovals.clear();
 			if (!this.intentionalDisconnect) this.scheduleReconnect();
 		});
 		this.ws.on("error", (err) => {
@@ -700,7 +905,7 @@ var OrchestratorClient = class OrchestratorClient {
 			return;
 		}
 		const rawMsg = raw;
-		if (rawMsg.type === "cache.upload.response") {
+		if (rawMsg.type === "cache.upload.response" || rawMsg.type === "provenance.upload.response") {
 			const pending = this.pendingUploadRequests.get(rawMsg.requestId);
 			if (pending) {
 				this.pendingUploadRequests.delete(rawMsg.requestId);
@@ -814,6 +1019,33 @@ var OrchestratorClient = class OrchestratorClient {
 					}
 					break;
 				}
+				case "step.approval-resolved": {
+					logger$11.info("Step approval resolved", {
+						requestId: msg.requestId,
+						runId: msg.runId,
+						jobId: msg.jobId,
+						stepIndex: msg.stepIndex,
+						outcome: msg.outcome
+					});
+					const pending = this.pendingStepApprovals.get(msg.requestId);
+					if (pending) {
+						this.pendingStepApprovals.delete(msg.requestId);
+						pending.resolve({
+							type: "approval.resolved",
+							requestId: msg.requestId,
+							outcome: msg.outcome,
+							...msg.reason !== void 0 && { reason: msg.reason }
+						});
+					}
+					break;
+				}
+				case "fleet.logs.request":
+					logger$11.info("Fleet log collection requested", {
+						requestId: msg.requestId,
+						logWindowHours: msg.logWindowHours
+					});
+					this.streamFleetBundle(msg);
+					break;
 			}
 			return;
 		}
@@ -953,6 +1185,10 @@ var OrchestratorClient = class OrchestratorClient {
 			totalMemoryMb: Math.round(os.totalmem() / (1024 * 1024)),
 			cpuCount: os.cpus().length,
 			nodeVersion: process.versions.node,
+			...(() => {
+				const v = readAgentVersion();
+				return v ? { version: v } : {};
+			})(),
 			...(() => {
 				try {
 					const info = os.userInfo();
@@ -1061,14 +1297,14 @@ var init_console_capture = __esmMin((() => {
 init_console_capture();
 function safe(name, fallback = "unknown") {
 	switch (name) {
-		case "version": return "0.1.15";
-		case "buildCommit": return "831f6a763";
-		case "sdkVersion": return "0.1.15";
-		case "sdkBundleHash": return "cee24b67bbb4a1d2a770e4063dd37a9af33409faeb5ce32f936703b4431316dd";
-		case "sharedVersion": return "0.1.15";
-		case "sharedBundleHash": return "e82a8b68a7d72698674352158c5de4c0d10824c61bfa7166cc8f846044b8b5e4";
-		case "engineVersion": return "0.1.15";
-		case "engineBundleHash": return "032d6b28b3d32bcbea80ba80a52934b017ee2c86a97fcaf8fe8db0d86d72a7f7";
+		case "version": return "0.1.17";
+		case "buildCommit": return "5596f8a3c";
+		case "sdkVersion": return "0.1.17";
+		case "sdkBundleHash": return "df47ed5db86eaaa2de8394c0db08335f368e8d620a898cc409765f4545eb3972";
+		case "sharedVersion": return "0.1.17";
+		case "sharedBundleHash": return "9e8a753da73b26fb87d08817f70b4d836f67f599385fa268b2c1f68b97996f54";
+		case "engineVersion": return "0.1.17";
+		case "engineBundleHash": return "706d94fa54a47aea0f69bde105d40213befff401f717604aded2c62a1291cb51";
 		default: return fallback;
 	}
 }
@@ -1625,7 +1861,7 @@ async function buildAssetDigestFromResolvedPaths(workDir, resolvedPaths) {
 	for (const rel of resolvedPaths) {
 		const abs = path.join(workDir, rel);
 		try {
-			const content = await fs.readFile(abs, "utf-8");
+			const content = await fs$1.readFile(abs, "utf-8");
 			parts.push(`${rel}\n${content}`);
 		} catch {
 			parts.push(`${rel}\n`);
@@ -1650,7 +1886,7 @@ async function loadWorkflowSource(workDir, sourceFile, expectedContentHash, reso
 	ensureLoaderHookRegistered();
 	const filePath = path.join(workDir, sourceFile);
 	if (expectedContentHash) {
-		const rawSource = await fs.readFile(filePath, "utf-8");
+		const rawSource = await fs$1.readFile(filePath, "utf-8");
 		let assetDigest;
 		if (resolvedHashFiles?.length) assetDigest = await buildAssetDigestFromResolvedPaths(workDir, resolvedHashFiles);
 		const actualHash = computeContentHash(rawSource, assetDigest);
@@ -1752,8 +1988,8 @@ async function extractStepsFromDynamicJob(workflow, dynamicIndex, jobName, event
 }
 var AGENT_SDK_VERSION, AGENT_SDK_BUNDLE_HASH, hookRegistered;
 var init_workflow_loader = __esmMin((() => {
-	AGENT_SDK_VERSION = "0.1.15";
-	AGENT_SDK_BUNDLE_HASH = "cee24b67bbb4a1d2a770e4063dd37a9af33409faeb5ce32f936703b4431316dd";
+	AGENT_SDK_VERSION = "0.1.17";
+	AGENT_SDK_BUNDLE_HASH = "df47ed5db86eaaa2de8394c0db08335f368e8d620a898cc409765f4545eb3972";
 	hookRegistered = false;
 }));
 //#endregion
@@ -1919,24 +2155,24 @@ function resolveOrchestratorUrl(url) {
 * have nothing to race; the defensive `rm` covers re-runs.
 */
 async function moveScratchIntoRepo(scratchDir, workDir) {
-	for (const child of await fs.readdir(scratchDir)) if (child === ".kici") {
+	for (const child of await fs$1.readdir(scratchDir)) if (child === ".kici") {
 		const kiciScratch = join(scratchDir, ".kici");
-		for (const sub of await fs.readdir(kiciScratch)) await moveInto(join(kiciScratch, sub), join(workDir, ".kici", sub));
+		for (const sub of await fs$1.readdir(kiciScratch)) await moveInto(join(kiciScratch, sub), join(workDir, ".kici", sub));
 	} else await moveInto(join(scratchDir, child), join(workDir, child));
 }
 /** Move `src` to `dest`, creating the parent and clearing any stale dest. */
 async function moveInto(src, dest) {
 	await mkdir(dirname(dest), { recursive: true });
-	await fs.rm(dest, {
+	await fs$1.rm(dest, {
 		recursive: true,
 		force: true
 	});
-	await fs.rename(src, dest);
+	await fs$1.rename(src, dest);
 }
 /** Best-effort cleanup of a settled scratch dir; logs and continues on failure. */
 async function cleanupScratch(scratchDir) {
 	try {
-		await fs.rm(scratchDir, {
+		await fs$1.rm(scratchDir, {
 			recursive: true,
 			force: true
 		});
@@ -1970,7 +2206,7 @@ async function restoreDeps(workDir, depsUrl, depsHash) {
 	const kiciDir = join(workDir, ".kici");
 	if (depsUrl.startsWith("file://")) {
 		const localPath = fileURLToPath(depsUrl);
-		const data = await fs.readFile(localPath);
+		const data = await fs$1.readFile(localPath);
 		if (depsHash) {
 			const actualHash = computeHash(data);
 			if (actualHash !== depsHash) throw new Error(`Dep tarball hash mismatch: expected ${depsHash}, got ${actualHash}`);
@@ -2129,7 +2365,7 @@ async function restoreSource(workDir, sourceTarUrl) {
 	let data;
 	if (sourceTarUrl.startsWith("file://")) {
 		const localPath = fileURLToPath(sourceTarUrl);
-		data = await fs.readFile(localPath);
+		data = await fs$1.readFile(localPath);
 	} else if (sourceTarUrl.startsWith("http://") || sourceTarUrl.startsWith("https://")) data = await downloadUrl(sourceTarUrl);
 	else throw new Error(`Unsupported source tarball URL scheme: ${sourceTarUrl}`);
 	await extractSourceTarball(data, workDir);
@@ -2198,6 +2434,28 @@ function findJobByName(workflow, jobName) {
 async function evaluateDynamicFields(workflow, jobName, event, flags, timeoutMs = 6e4) {
 	const job = findJobByName(workflow, jobName);
 	const result = {};
+	if (flags.dynamicMatrix && typeof job.matrix === "function") {
+		const matrixContext = {
+			$: (await import("zx")).$,
+			ctx: {
+				workflow: { name: workflow.name },
+				job: {
+					name: jobName,
+					runsOn: job.runsOn
+				}
+			},
+			log: {
+				info: () => {},
+				warn: () => {},
+				error: () => {},
+				debug: () => {}
+			},
+			env: { ...process.env }
+		};
+		let combos = expandMatrix(await withTimeout(() => job.matrix(matrixContext), timeoutMs, `dynamicMatrix for job '${jobName}'`));
+		if (job.include || job.exclude) combos = applyIncludeExclude(combos, job.include, job.exclude);
+		result.matrixValues = combos;
+	}
 	if (flags.dynamicEnvironment && typeof job.environment === "function") {
 		const value = await withTimeout(() => job.environment(event), timeoutMs, `dynamicEnvironment for job '${jobName}'`);
 		if (value !== void 0 && value !== null) result.environmentName = value;
@@ -2400,6 +2658,7 @@ var MatrixExpansionError, DYNAMIC_FIELD_TIMEOUT_MS;
 var init_dynamic_job_serializer = __esmMin((() => {
 	init_timeout_util();
 	MatrixExpansionError = class MatrixExpansionError extends Error {
+		jobName;
 		name = "MatrixExpansionError";
 		constructor(jobName, message) {
 			super(message);
@@ -2673,7 +2932,7 @@ function decryptBuffer(encrypted, aesKey) {
 */
 async function applyOverlay(config) {
 	const { tarballUrl, cliPublicKey, orchestratorPrivateKey, repoDir } = config;
-	const tmpDir = await fs.mkdtemp(path.join(os.tmpdir(), "kici-overlay-"));
+	const tmpDir = await fs$1.mkdtemp(path.join(os.tmpdir(), "kici-overlay-"));
 	try {
 		logger$7.info("Downloading overlay tarball", { url: tarballUrl.replace(/\?.*$/, "?[redacted]") });
 		let encryptedData;
@@ -2687,7 +2946,7 @@ async function applyOverlay(config) {
 		const decryptedData = decryptBuffer(encryptedData, aesKey);
 		logger$7.info("Extracting overlay tarball", { size: decryptedData.length });
 		const extractDir = path.join(tmpDir, "extracted");
-		await fs.mkdir(extractDir, { recursive: true });
+		await fs$1.mkdir(extractDir, { recursive: true });
 		try {
 			const readable = Readable.from(decryptedData);
 			await new Promise((resolve, reject) => {
@@ -2702,7 +2961,7 @@ async function applyOverlay(config) {
 		const manifestPath = path.join(extractDir, ".kici-overlay-tmp", "manifest.json");
 		let manifestContent;
 		try {
-			manifestContent = await fs.readFile(manifestPath, "utf-8");
+			manifestContent = await fs$1.readFile(manifestPath, "utf-8");
 		} catch {
 			throw new Error("Overlay manifest not found: expected .kici-overlay-tmp/manifest.json in tarball");
 		}
@@ -2723,15 +2982,15 @@ async function applyOverlay(config) {
 		for (const file of checksumFiles) {
 			const srcPath = path.join(extractDir, file);
 			const destPath = path.join(repoDir, file);
-			await fs.mkdir(path.dirname(destPath), { recursive: true });
-			await fs.copyFile(srcPath, destPath);
+			await fs$1.mkdir(path.dirname(destPath), { recursive: true });
+			await fs$1.copyFile(srcPath, destPath);
 			filesApplied++;
 		}
 		let filesDeleted = 0;
 		for (const file of manifest.deletions) {
 			const targetPath = path.join(repoDir, file);
 			try {
-				await fs.unlink(targetPath);
+				await fs$1.unlink(targetPath);
 				filesDeleted++;
 			} catch {
 				logger$7.debug("Deletion target not found, skipping", { file });
@@ -2747,7 +3006,7 @@ async function applyOverlay(config) {
 			verified: true
 		};
 	} finally {
-		await fs.rm(tmpDir, {
+		await fs$1.rm(tmpDir, {
 			recursive: true,
 			force: true
 		}).catch(() => {});
@@ -2896,6 +3155,11 @@ var init_npm_registry_config = __esmMin((() => {}));
 *   clones the whole repo, so an in-repo sibling is present), and resolves
 *   `file:`/`link:`/`portal:` against a path — allowed when that path stays
 *   inside the cloned repo, rejected when it escapes the clone.
+* - yarn classic (v1) has no `workspace:` protocol and no `portal:` — it links
+*   in-repo siblings by version range, not by a local specifier — so both are
+*   rejected with guidance; `file:`/`link:` are allowed when the path stays
+*   inside the clone, rejected when it escapes. (yarn berry is not yet
+*   supported.)
 *
 * This module performs that classification so unresolvable specifiers fail
 * fast with guidance rather than a cryptic install error.
@@ -2971,6 +3235,17 @@ function isInsideRepo(repoRoot, target) {
 */
 async function findUnresolvableDeps(deps, packageManager, kiciDir, repoRoot) {
 	if (packageManager === PackageManager.Npm) return [...deps];
+	if (packageManager === PackageManager.Yarn) {
+		const unresolvable = [];
+		for (const dep of deps) {
+			if (dep.protocol === "workspace:" || dep.protocol === "portal:") {
+				unresolvable.push(dep);
+				continue;
+			}
+			if (!isInsideRepo(repoRoot, resolveLocalPath(kiciDir, dep))) unresolvable.push(dep);
+		}
+		return unresolvable;
+	}
 	const hasWorkspaceFile = await fileExists$1(join(repoRoot, "pnpm-workspace.yaml"));
 	const unresolvable = [];
 	for (const dep of deps) {
@@ -2986,6 +3261,7 @@ async function findUnresolvableDeps(deps, packageManager, kiciDir, repoRoot) {
 function formatUnresolvableDepError(offenders, packageManager) {
 	const list = offenders.map((o) => `${o.name}: ${o.spec}`).join(", ");
 	if (packageManager === PackageManager.Npm) return `These .kici/ dependencies use local-protocol specifiers npm cannot resolve from a registry: ${list}. npm has no workspace protocol — pin a published version, publish the package to your registry, or use pnpm so an in-repo workspace sibling can be resolved.`;
+	if (packageManager === PackageManager.Yarn) return `These .kici/ dependencies use specifiers yarn classic cannot resolve: ${list}. yarn classic has no workspace: or portal: protocol — reference an in-repo sibling by a version range (yarn links matching workspace members), use pnpm, or keep file:/link: paths inside this repository. (yarn berry support is planned.)`;
 	return `These .kici/ dependencies point outside the cloned repository, which the agent never has: ${list}. A workspace: dependency requires a pnpm-workspace.yaml at the repo root, and file:/link:/portal: paths must stay inside this repository.`;
 }
 /**
@@ -3019,6 +3295,102 @@ var init_validate_kici_deps = __esmMin((() => {
 	];
 }));
 //#endregion
+//#region src/execution/workspace-siblings.ts
+/**
+* In-repo workspace-sibling discovery for the agent's dependency handling.
+*
+* A pnpm or yarn-classic workspace lays out a `.kici/` member's `workspace:`
+* (pnpm) or version-range (yarn) siblings as symlinks pointing at package
+* directories that live inside the clone but outside `.kici/` and outside the
+* `node_modules` store. The dep-cache packer must travel those sibling dirs with
+* the closure (their symlinks would dangle otherwise), and the yarn install path
+* must build them (the install links a sibling but does not build it).
+*
+* `collectInRepoSiblings` walks a starting `node_modules` (and transitively each
+* discovered sibling's `node_modules`), returning each in-repo sibling directory
+* once, repo-root-relative, in breadth-first discovery order. The starting
+* `node_modules` is a parameter so it serves pnpm + yarn-standalone (seeded at
+* `.kici/node_modules`) and yarn-workspace-member (seeded at the hoisted root
+* `node_modules`).
+*/
+/**
+* The directory yarn lays `.kici`'s dependencies into. A standalone `.kici`
+* (own lockfile, no parent workspace) gets `.kici/node_modules`; a workspace
+* member hoists everything to the repo-root `node_modules`, leaving no
+* `.kici/node_modules`.
+*/
+function resolveYarnNodeModulesRoot(repoRoot, kiciDir) {
+	const kiciNm = join(kiciDir, "node_modules");
+	return existsSync(kiciNm) ? kiciNm : join(repoRoot, "node_modules");
+}
+/**
+* Walk `seedNodeModules` (and transitively each in-repo sibling's
+* `node_modules`) collecting the repo-root-relative directories of workspace
+* siblings — package dirs that live inside the clone but outside `.kici/` and
+* outside the repo-root `node_modules/` store. Returns each dir once, in
+* discovery (BFS) order.
+*/
+async function collectInRepoSiblings(workDir, kiciDir, seedNodeModules = join(kiciDir, "node_modules")) {
+	const repoRoot = resolve(workDir);
+	const kiciResolved = resolve(kiciDir);
+	const rootNodeModules = resolve(join(workDir, "node_modules"));
+	const found = /* @__PURE__ */ new Set();
+	const visited = /* @__PURE__ */ new Set();
+	const queue = [seedNodeModules];
+	while (queue.length > 0) {
+		const nmDir = queue.shift();
+		const real = await realpath(nmDir).catch(() => null);
+		if (!real || visited.has(real)) continue;
+		visited.add(real);
+		for (const target of await resolveNodeModulesLinks(nmDir)) {
+			if (!isInside(repoRoot, target)) continue;
+			if (isInside(kiciResolved, target) || isInside(rootNodeModules, target)) continue;
+			const rel = relative(workDir, target);
+			if (!found.has(rel)) {
+				found.add(rel);
+				queue.push(join(target, "node_modules"));
+			}
+		}
+	}
+	return [...found];
+}
+/** Resolve every package symlink target under a `node_modules` dir (descending one level into `@scope` dirs). */
+async function resolveNodeModulesLinks(nmDir) {
+	const targets = [];
+	for (const entry of await readdir(nmDir).catch(() => [])) {
+		if (entry.startsWith(".")) continue;
+		const entryPath = join(nmDir, entry);
+		if (entry.startsWith("@")) {
+			for (const scoped of await readdir(entryPath).catch(() => [])) {
+				const target = await resolveIfSymlink(join(entryPath, scoped));
+				if (target) targets.push(target);
+			}
+			continue;
+		}
+		const target = await resolveIfSymlink(entryPath);
+		if (target) targets.push(target);
+	}
+	return targets;
+}
+/** Return the real path of `p` if it is a symlink, else null. */
+async function resolveIfSymlink(p) {
+	try {
+		if (!(await lstat(p)).isSymbolicLink()) return null;
+		return await realpath(p);
+	} catch {
+		return null;
+	}
+}
+/** Whether `target` is `root` itself or a path inside it. */
+function isInside(root, target) {
+	const rel = relative(root, target);
+	return rel === "" || !rel.startsWith("..") && !rel.startsWith(`..${sep}`) && !isAbsoluteRel(rel);
+}
+function isAbsoluteRel(rel) {
+	return rel.length > 1 && rel[1] === ":";
+}
+var init_workspace_siblings = __esmMin((() => {}));
+//#endregion
 //#region src/execution/dep-installer.ts
 /**
 * Inline dependency installation for graceful degradation.
@@ -3026,12 +3398,14 @@ var init_validate_kici_deps = __esmMin((() => {
 * When the dep cache is unavailable or a download fails, the agent installs
 * `.kici/` dependencies directly with the repository's package manager.
 *
-* The package manager is detected from the cloned repo (npm / pnpm); the
+* The package manager is detected from the cloned repo (npm / pnpm / yarn); the
 * presence of `.kici/package.json` signals that deps should be installed. npm
 * is the default and ships with every Node.js install; pnpm is used when the
 * repo is a pnpm workspace so a `.kici/` member can resolve in-repo
-* `workspace:` siblings. yarn is detected but not yet supported and is
-* rejected with an actionable error.
+* `workspace:` siblings. yarn classic (v1) is supported for registry
+* dependencies and version-range workspace siblings (which it links but does
+* not build, so the agent builds the in-repo closure after install). yarn
+* berry (v2+) is not yet supported.
 *
 * Security: the install runs with an isolated per-invocation cache/store
 * directory to prevent cache poisoning across build jobs — a malicious
@@ -3075,7 +3449,6 @@ async function installDeps(kiciDir, opts = {}) {
 		dir: kiciDir
 	});
 	process.stderr.write(`[dep-installer:trace] starting install: pm=${packageManager}, cwd=${kiciDir}\n`);
-	if (packageManager === PackageManager.Yarn) throw new Error("This repository uses yarn, which the KiCI agent does not yet support for .kici/ dependency installation. Use npm or pnpm for the .kici/ project, or open a feature request for yarn support.");
 	await assertResolvableDeps({
 		kiciDir,
 		repoRoot,
@@ -3095,6 +3468,11 @@ async function installDeps(kiciDir, opts = {}) {
 			hasPrivateRegistry,
 			registryConfig
 		});
+		else if (packageManager === PackageManager.Yarn) await runYarnInstall({
+			kiciDir,
+			hasPrivateRegistry,
+			registryConfig
+		});
 		else await runNpmInstall({
 			kiciDir,
 			hasPrivateRegistry,
@@ -3109,6 +3487,7 @@ async function installDeps(kiciDir, opts = {}) {
 		await registryConfig.cleanup();
 	}
 	if (packageManager === PackageManager.Pnpm && await kiciHasLocalProtocolDeps(kiciDir)) await buildWorkspaceClosure(repoRoot);
+	if (packageManager === PackageManager.Yarn) await buildYarnWorkspaceClosure(repoRoot, kiciDir);
 	const durationMs = Date.now() - startTime;
 	process.stderr.write(`[dep-installer:trace] install complete: ${durationMs}ms\n`);
 	logger$6.info("Deps installed inline", {
@@ -3196,6 +3575,101 @@ async function runPnpmInstall(args) {
 		}).catch(() => {});
 	}
 }
+/** Pure: argv for `yarn install` with an isolated cache folder. */
+function buildYarnInstallArgs(cacheDir, hasPrivateRegistry) {
+	const a = [
+		"install",
+		"--cache-folder",
+		cacheDir,
+		"--non-interactive",
+		"--no-progress"
+	];
+	if (hasPrivateRegistry) a.push("--ignore-scripts");
+	return a;
+}
+/**
+* Run `yarn install` from `.kici/` with an isolated cache folder. yarn classic
+* reads the synthesized `.kici/.npmrc` (registry + `${VAR}` token expansion) for
+* private-registry auth. A workspace member hoists deps to the repo-root
+* node_modules; a standalone `.kici` gets `.kici/node_modules`. Not
+* `--frozen-lockfile` (resolved URLs in the lockfile may point at a different
+* registry than the synthesized `.npmrc`, e.g. localhost tunnel vs direct IP).
+*/
+async function runYarnInstall(args) {
+	await assertYarnAvailable();
+	const { nodeDir } = resolveNpm();
+	const cacheDir = await mkdtemp(join(tmpdir(), "kici-yarn-cache-"));
+	const env = envWithNodeOnPath(args.registryConfig.extraEnv, nodeDir);
+	const argv = buildYarnInstallArgs(cacheDir, args.hasPrivateRegistry);
+	try {
+		process.stderr.write(`[dep-installer:trace] running: yarn ${argv.join(" ")}\n`);
+		await execFileAsync("yarn", argv, {
+			cwd: args.kiciDir,
+			env,
+			timeout: INSTALL_TIMEOUT_MS,
+			maxBuffer: INSTALL_MAX_BUFFER
+		});
+	} finally {
+		await rm(cacheDir, {
+			recursive: true,
+			force: true
+		}).catch(() => {});
+	}
+}
+/** Throw an actionable error when the repo needs yarn but it is not installed. */
+async function assertYarnAvailable() {
+	try {
+		await execFileAsync("yarn", ["--version"], {
+			timeout: 3e4,
+			cwd: tmpdir()
+		});
+	} catch (e) {
+		throw new Error(`This repository uses yarn, but yarn is not available on this agent. Install yarn (e.g. \`corepack enable\`) or run on a container/Firecracker agent that bundles it. (${toErrorMessage(e)})`);
+	}
+}
+/**
+* Build the in-repo workspace siblings `.kici` depends on (yarn links them on
+* install but does not build them). Walks siblings from the resolved
+* node_modules root and runs each sibling's `build` script in leaf-first
+* (reverse-discovery) order with a clean env (no synthesized registry tokens).
+* Deep cross-sibling build chains may build out of strict topological order —
+* real `.kici` closures are shallow.
+*/
+async function buildYarnWorkspaceClosure(repoRoot, kiciDir) {
+	const siblings = await collectInRepoSiblings(repoRoot, kiciDir, resolveYarnNodeModulesRoot(repoRoot, kiciDir));
+	if (siblings.length === 0) return;
+	const { nodeDir } = resolveNpm();
+	const env = envWithNodeOnPath({}, nodeDir);
+	for (const rel of [...siblings].reverse()) {
+		const sibDir = join(repoRoot, rel);
+		if (!await siblingHasBuildScript(sibDir)) continue;
+		process.stderr.write(`[dep-installer:trace] building yarn sibling: yarn --cwd ${sibDir} run build\n`);
+		try {
+			await execFileAsync("yarn", [
+				"--cwd",
+				sibDir,
+				"run",
+				"build"
+			], {
+				cwd: repoRoot,
+				env,
+				timeout: INSTALL_TIMEOUT_MS,
+				maxBuffer: INSTALL_MAX_BUFFER
+			});
+		} catch (e) {
+			logSubprocessStreams(e, []);
+			throw new Error(`Failed to build .kici yarn workspace sibling ${rel}: ${describeExecError(e)}`);
+		}
+	}
+}
+/** Whether a sibling package.json declares a `build` script. */
+async function siblingHasBuildScript(sibDir) {
+	try {
+		return typeof JSON.parse(await readFile(join(sibDir, "package.json"), "utf-8")).scripts?.build === "string";
+	} catch {
+		return false;
+	}
+}
 /**
 * Build the in-repo dependency closure of the `.kici/` package so a
 * `workspace:` sibling's build output exists before the workflow that imports
@@ -3239,7 +3713,10 @@ function describeExecError(e) {
 /** Throw an actionable error when the repo needs pnpm but it is not installed. */
 async function assertPnpmAvailable() {
 	try {
-		await execFileAsync("pnpm", ["--version"], { timeout: 3e4 });
+		await execFileAsync("pnpm", ["--version"], {
+			timeout: 3e4,
+			cwd: tmpdir()
+		});
 	} catch (e) {
 		throw new Error(`This repository is a pnpm workspace, but pnpm is not available on this agent. Install pnpm (e.g. \`corepack enable\`) or run on a container/ Firecracker agent that bundles it. (${toErrorMessage(e)})`);
 	}
@@ -3253,6 +3730,7 @@ var logger$6, execFileAsync, INSTALL_TIMEOUT_MS, INSTALL_MAX_BUFFER;
 var init_dep_installer = __esmMin((() => {
 	init_npm_registry_config();
 	init_validate_kici_deps();
+	init_workspace_siblings();
 	logger$6 = createLogger({ prefix: "dep-installer" });
 	execFileAsync = promisify(execFile);
 	INSTALL_TIMEOUT_MS = 6e5;
@@ -3268,13 +3746,18 @@ var init_dep_installer = __esmMin((() => {
 * **repo-root-relative** (cwd = the clone root) so restore is a single layout
 * regardless of package manager:
 *
-* - npm / yarn: just `.kici/node_modules`.
+* - npm: just `.kici/node_modules`.
 * - pnpm: `.kici/node_modules` plus the repo-root `node_modules/.pnpm` virtual
 *   store and the in-repo `workspace:` sibling package directories `.kici`
 *   depends on (with their built output). pnpm lays `.kici/node_modules` out as
 *   symlinks into the root store and into sibling dirs that live outside
 *   `.kici/`, so packing `.kici/node_modules` alone would capture dangling
 *   links — the store and siblings must travel together.
+* - yarn classic: the resolved node_modules root (standalone `.kici` →
+*   `.kici/node_modules`; hoisted workspace member → the repo-root
+*   `node_modules`) plus the in-repo version-range sibling package directories
+*   `.kici` depends on (with their built output), whose symlinks would dangle
+*   otherwise.
 *
 * Uses tar.gz (Node.js built-in zlib, no external binary) in portable mode to
 * strip user/group info for cross-machine consistency; symlinks are preserved
@@ -3288,9 +3771,10 @@ var init_dep_installer = __esmMin((() => {
 * @throws Error if `.kici/node_modules` does not exist.
 */
 async function packNodeModules(kiciDir) {
-	if (!existsSync(join(kiciDir, "node_modules"))) throw new Error(`node_modules not found at ${join(kiciDir, "node_modules")}`);
 	const workDir = dirname(kiciDir);
 	const packageManager = await detectPackageManagerFromManifests(workDir) ?? await detectPackageManagerFromManifests(kiciDir) ?? PackageManager.Npm;
+	const nmRoot = packageManager === PackageManager.Yarn ? resolveYarnNodeModulesRoot(workDir, kiciDir) : join(kiciDir, "node_modules");
+	if (!existsSync(nmRoot)) throw new Error(`node_modules not found at ${nmRoot}`);
 	const entries = await closureEntries(workDir, kiciDir, packageManager);
 	logger$5.info("Packing dependency closure into tarball", {
 		dir: workDir,
@@ -3319,85 +3803,31 @@ async function packNodeModules(kiciDir) {
 	};
 }
 /**
-* Compute the repo-root-relative tar entries for the dependency closure. npm /
-* yarn need only `.kici/node_modules`; pnpm additionally needs the root store
-* and the in-repo workspace siblings `.kici` resolves.
+* Compute the repo-root-relative tar entries for the dependency closure. npm
+* needs only `.kici/node_modules`. pnpm additionally needs the root store and
+* the in-repo workspace siblings `.kici` resolves. yarn classic packs the
+* resolved node_modules root (standalone → `.kici/node_modules`; hoisted
+* workspace member → root `node_modules`) plus the in-repo version-range
+* siblings, which it links but does not place in the store.
 */
 async function closureEntries(workDir, kiciDir, packageManager) {
-	const kiciNodeModules = relative(workDir, join(kiciDir, "node_modules"));
-	if (packageManager !== PackageManager.Pnpm) return [kiciNodeModules];
-	const entries = [kiciNodeModules];
-	if (existsSync(join(workDir, "node_modules", ".pnpm"))) entries.push(join("node_modules", ".pnpm"));
-	for (const sibling of await collectInRepoSiblings(workDir, kiciDir)) entries.push(sibling);
-	return entries;
-}
-/**
-* Walk `.kici`'s `node_modules` (and transitively each in-repo sibling's
-* `node_modules`) collecting the repo-relative directories of `workspace:`
-* siblings — package dirs that live inside the clone but outside `.kici/` and
-* outside the root `node_modules/` store. Returns each dir once.
-*/
-async function collectInRepoSiblings(workDir, kiciDir) {
-	const repoRoot = resolve(workDir);
-	const kiciResolved = resolve(kiciDir);
-	const rootNodeModules = resolve(join(workDir, "node_modules"));
-	const found = /* @__PURE__ */ new Set();
-	const visited = /* @__PURE__ */ new Set();
-	const queue = [join(kiciDir, "node_modules")];
-	while (queue.length > 0) {
-		const nmDir = queue.shift();
-		const real = await realpath(nmDir).catch(() => null);
-		if (!real || visited.has(real)) continue;
-		visited.add(real);
-		for (const target of await resolveNodeModulesLinks(nmDir)) {
-			if (!isInside(repoRoot, target)) continue;
-			if (isInside(kiciResolved, target) || isInside(rootNodeModules, target)) continue;
-			const rel = relative(workDir, target);
-			if (!found.has(rel)) {
-				found.add(rel);
-				queue.push(join(target, "node_modules"));
-			}
-		}
+	if (packageManager === PackageManager.Pnpm) {
+		const entries = [relative(workDir, join(kiciDir, "node_modules"))];
+		if (existsSync(join(workDir, "node_modules", ".pnpm"))) entries.push(join("node_modules", ".pnpm"));
+		for (const sibling of await collectInRepoSiblings(workDir, kiciDir)) entries.push(sibling);
+		return entries;
 	}
-	return [...found];
-}
-/** Resolve every package symlink target under a `node_modules` dir (descending one level into `@scope` dirs). */
-async function resolveNodeModulesLinks(nmDir) {
-	const targets = [];
-	for (const entry of await readdir(nmDir).catch(() => [])) {
-		if (entry.startsWith(".")) continue;
-		const entryPath = join(nmDir, entry);
-		if (entry.startsWith("@")) {
-			for (const scoped of await readdir(entryPath).catch(() => [])) {
-				const target = await resolveIfSymlink(join(entryPath, scoped));
-				if (target) targets.push(target);
-			}
-			continue;
-		}
-		const target = await resolveIfSymlink(entryPath);
-		if (target) targets.push(target);
-	}
-	return targets;
-}
-/** Return the real path of `p` if it is a symlink, else null. */
-async function resolveIfSymlink(p) {
-	try {
-		if (!(await lstat(p)).isSymbolicLink()) return null;
-		return await realpath(p);
-	} catch {
-		return null;
+	if (packageManager === PackageManager.Yarn) {
+		const nmRoot = resolveYarnNodeModulesRoot(workDir, kiciDir);
+		const entries = [relative(workDir, nmRoot)];
+		for (const sibling of await collectInRepoSiblings(workDir, kiciDir, nmRoot)) entries.push(sibling);
+		return entries;
 	}
-}
-/** Whether `target` is `root` itself or a path inside it. */
-function isInside(root, target) {
-	const rel = relative(root, target);
-	return rel === "" || !rel.startsWith("..") && !rel.startsWith(`..${sep}`) && !isAbsoluteRel(rel);
-}
-function isAbsoluteRel(rel) {
-	return rel.length > 1 && rel[1] === ":";
+	return [relative(workDir, join(kiciDir, "node_modules"))];
 }
 var logger$5;
 var init_dep_packer = __esmMin((() => {
+	init_workspace_siblings();
 	logger$5 = createLogger({ prefix: "dep-packer" });
 }));
 //#endregion
@@ -3541,6 +3971,8 @@ var init_secret_encryption = __esmMin((() => {
 function buildRequest(dispatch, workDir) {
 	const jobConfig = dispatch.jobConfig;
 	return {
+		runId: dispatch.runId,
+		jobId: dispatch.jobId,
 		workDir,
 		repoUrl: dispatch.repoUrl,
 		ref: dispatch.ref,
@@ -3553,8 +3985,9 @@ function buildRequest(dispatch, workDir) {
 		depsUrl: dispatch.depsUrl,
 		depsHash: dispatch.depsHash,
 		workflowName: jobConfig.workflowName ?? "",
-		jobName: jobConfig.name ?? "",
+		jobName: jobConfig.baseJobName ?? jobConfig.name ?? "",
 		runsOn: jobConfig.runsOn ?? "",
+		matrixValues: jobConfig.matrixValues,
 		secrets: dispatch.secrets,
 		namespacedSecrets: dispatch.namespacedSecrets,
 		sourceFile: jobConfig.source?.file,
@@ -3821,6 +4254,42 @@ function relayCacheRequest$1(msg, ctx) {
 		error: toErrorMessage(err)
 	}));
 }
+/** Relay `provenance.request` and pipe the orchestrator response (or an error
+*  response, or a "not configured" response when the callback isn't wired) back
+*  into the sandbox runner. */
+function relayProvenanceRequest$1(msg, ctx) {
+	if (!ctx.execOptions.onProvenanceRequest) {
+		safeSendToChild(ctx.child, {
+			type: "provenance.response",
+			requestId: msg.requestId,
+			error: "Provenance not available in this agent configuration"
+		});
+		return;
+	}
+	ctx.execOptions.onProvenanceRequest(msg).then((response) => safeSendToChild(ctx.child, response), (err) => safeSendToChild(ctx.child, {
+		type: "provenance.response",
+		requestId: msg.requestId,
+		error: toErrorMessage(err)
+	}));
+}
+/** Relay `approval.request` and pipe the orchestrator's resolution (or a
+*  fail-closed reject when the callback isn't wired or the relay throws) back
+*  into the sandbox runner. */
+function relayApprovalRequest$1(msg, ctx) {
+	if (!ctx.execOptions.onApprovalRequest) {
+		safeSendToChild(ctx.child, {
+			type: "approval.resolved",
+			requestId: msg.requestId,
+			error: "Approvals not available in this agent configuration"
+		});
+		return;
+	}
+	ctx.execOptions.onApprovalRequest(msg).then((response) => safeSendToChild(ctx.child, response), (err) => safeSendToChild(ctx.child, {
+		type: "approval.resolved",
+		requestId: msg.requestId,
+		error: toErrorMessage(err)
+	}));
+}
 /** Resolve the result promise for `job.complete` IPC messages. Encrypts
 *  secret outputs (when a runPublicKey is available) and overrides status to
 *  `cancelled` if a cancel was already in flight. */
@@ -3893,6 +4362,12 @@ function relayChildIpcMessage(msg, dispatch, ctx) {
 		case "cache.request":
 			relayCacheRequest$1(msg, ctx);
 			return;
+		case "provenance.request":
+			relayProvenanceRequest$1(msg, ctx);
+			return;
+		case "approval.request":
+			relayApprovalRequest$1(msg, ctx);
+			return;
 		case "job.complete":
 			handleJobComplete(msg, dispatch, ctx);
 			return;
@@ -4314,6 +4789,58 @@ function relayCacheRequest(stream, options, cacheMsg) {
 	}));
 }
 /**
+* Relay provenance.request from the container runner to the orchestrator via
+* options.onProvenanceRequest, then write the response back through `stream`.
+* If the agent doesn't expose a provenance relay, write a structured error so
+* the runner doesn't hang.
+*/
+function relayProvenanceRequest(stream, options, provMsg) {
+	const writeResponse = (response) => {
+		try {
+			stream.write(JSON.stringify(response) + "\n");
+		} catch {}
+	};
+	if (!options.onProvenanceRequest) {
+		writeResponse({
+			type: "provenance.response",
+			requestId: provMsg.requestId,
+			error: "Provenance not available in this agent configuration"
+		});
+		return;
+	}
+	options.onProvenanceRequest(provMsg).then((response) => writeResponse(response), (err) => writeResponse({
+		type: "provenance.response",
+		requestId: provMsg.requestId,
+		error: toErrorMessage(err)
+	}));
+}
+/**
+* Relay approval.request from the container runner to the orchestrator via
+* options.onApprovalRequest, then write the resolution back through `stream`.
+* If the agent doesn't expose an approval relay (or it throws), write a
+* fail-closed reject so the runner doesn't hang.
+*/
+function relayApprovalRequest(stream, options, approvalMsg) {
+	const writeResponse = (response) => {
+		try {
+			stream.write(JSON.stringify(response) + "\n");
+		} catch {}
+	};
+	if (!options.onApprovalRequest) {
+		writeResponse({
+			type: "approval.resolved",
+			requestId: approvalMsg.requestId,
+			error: "Approvals not available in this agent configuration"
+		});
+		return;
+	}
+	options.onApprovalRequest(approvalMsg).then((response) => writeResponse(response), (err) => writeResponse({
+		type: "approval.resolved",
+		requestId: approvalMsg.requestId,
+		error: toErrorMessage(err)
+	}));
+}
+/**
 * Apply a job.complete message to the mutable runner state: capture status,
 * merge any bulk-reported step results, propagate plain outputs, and encrypt
 * secret outputs if a run public key is available.
@@ -4570,6 +5097,12 @@ var init_container_sandbox = __esmMin((() => {
 				case "cache.request":
 					relayCacheRequest(stream, options, msg);
 					return false;
+				case "provenance.request":
+					relayProvenanceRequest(stream, options, msg);
+					return false;
+				case "approval.request":
+					relayApprovalRequest(stream, options, msg);
+					return false;
 				case "job.complete":
 					applyJobComplete(msg, stepResults, state, options);
 					return true;
@@ -4666,7 +5199,7 @@ var job_runner_exports = /* @__PURE__ */ __exportAll({ JobRunner: () => JobRunne
 */
 async function fileExists(p) {
 	try {
-		await fs.access(p);
+		await fs$1.access(p);
 		return true;
 	} catch {
 		return false;
@@ -4740,6 +5273,8 @@ var init_job_runner = __esmMin((() => {
 		_sendConcurrencyReport;
 		_sendApiRequest;
 		_requestUserCache;
+		_relayProvenance;
+		_sendStepApproval;
 		/** Tracks running jobs for concurrency and cancellation */
 		activeJobs = /* @__PURE__ */ new Map();
 		/** Active sandbox for the current job (used for abort). */
@@ -4758,6 +5293,8 @@ var init_job_runner = __esmMin((() => {
 			this._sendConcurrencyReport = deps.sendConcurrencyReport;
 			this._sendApiRequest = deps.sendApiRequest;
 			this._requestUserCache = deps.requestUserCache;
+			this._relayProvenance = deps.relayProvenance;
+			this._sendStepApproval = deps.sendStepApproval;
 		}
 		/**
 		* Execute a dispatched job through its full lifecycle.
@@ -4768,11 +5305,11 @@ var init_job_runner = __esmMin((() => {
 		async execute(dispatch) {
 			const { runId: _runId, jobId, jobConfig: _jobConfig } = dispatch;
 			const abortController = new AbortController();
-			const workDir = await fs.mkdtemp(join(tmpdir(), "kici-"));
+			const workDir = await fs$1.mkdtemp(join(tmpdir(), "kici-"));
 			const completionPromise = this.runJob(dispatch, workDir, abortController).finally(async () => {
 				this.activeJobs.delete(jobId);
 				this.activeSandbox = null;
-				await fs.rm(workDir, {
+				await fs$1.rm(workDir, {
 					recursive: true,
 					force: true
 				}).catch(() => {});
@@ -4997,6 +5534,8 @@ var init_job_runner = __esmMin((() => {
 				},
 				onApiRequest: this._sendApiRequest ? async (method, params) => this._sendApiRequest(method, params) : void 0,
 				onCacheRequest: this._requestUserCache ? async (request) => this._requestUserCache(jobId, request) : void 0,
+				onProvenanceRequest: this._relayProvenance ? async (request) => this._relayProvenance(jobId, request) : void 0,
+				onApprovalRequest: this._sendStepApproval ? async (request) => this._sendStepApproval(dispatch.runId, dispatch.jobId, request) : void 0,
 				onSecretMount: (event) => {
 					this.emitRunEvent(runId, "step.secret_mount", {
 						jobId,
@@ -5315,11 +5854,12 @@ var init_job_runner = __esmMin((() => {
 				const initResult = await runCaptured(initSink, async () => {
 					const { module } = await loadWorkflowSource(workDir, config.source, config.contentHash, config.resolvedHashFiles);
 					const workflow = extractWorkflow(module, config.workflowName);
-					initLog(`Evaluating dynamic fields for job '${config.targetJobName}' (env=${config.dynamicEnv} environment=${config.dynamicEnvironment} concurrencyGroup=${config.dynamicConcurrencyGroup})`);
+					initLog(`Evaluating dynamic fields for job '${config.targetJobName}' (env=${config.dynamicEnv} environment=${config.dynamicEnvironment} concurrencyGroup=${config.dynamicConcurrencyGroup} matrix=${config.dynamicMatrix ?? false})`);
 					return evaluateDynamicFields(workflow, config.targetJobName, config.event, {
 						dynamicEnvironment: config.dynamicEnvironment,
 						dynamicEnv: config.dynamicEnv,
-						dynamicConcurrencyGroup: config.dynamicConcurrencyGroup
+						dynamicConcurrencyGroup: config.dynamicConcurrencyGroup,
+						dynamicMatrix: config.dynamicMatrix ?? false
 					}, config.timeoutMs);
 				});
 				logger$2.info("Init job completed successfully", {
@@ -5669,14 +6209,14 @@ var init_job_runner = __esmMin((() => {
 */
 init_console_capture();
 init_npm_resolver();
-const AGENT_VERSION = "0.1.15";
-const BUILD_COMMIT = "831f6a763";
-const SDK_VERSION = "0.1.15";
-const SDK_BUNDLE_HASH = "cee24b67bbb4a1d2a770e4063dd37a9af33409faeb5ce32f936703b4431316dd";
-const SHARED_VERSION = "0.1.15";
-const SHARED_BUNDLE_HASH = "e82a8b68a7d72698674352158c5de4c0d10824c61bfa7166cc8f846044b8b5e4";
-const ENGINE_VERSION = "0.1.15";
-const ENGINE_BUNDLE_HASH = "032d6b28b3d32bcbea80ba80a52934b017ee2c86a97fcaf8fe8db0d86d72a7f7";
+const AGENT_VERSION = "0.1.17";
+const BUILD_COMMIT = "5596f8a3c";
+const SDK_VERSION = "0.1.17";
+const SDK_BUNDLE_HASH = "df47ed5db86eaaa2de8394c0db08335f368e8d620a898cc409765f4545eb3972";
+const SHARED_VERSION = "0.1.17";
+const SHARED_BUNDLE_HASH = "9e8a753da73b26fb87d08817f70b4d836f67f599385fa268b2c1f68b97996f54";
+const ENGINE_VERSION = "0.1.17";
+const ENGINE_BUNDLE_HASH = "706d94fa54a47aea0f69bde105d40213befff401f717604aded2c62a1291cb51";
 initTelemetry({
 	serviceName: "kici-agent",
 	otlpEndpoint: process.env.OTEL_EXPORTER_OTLP_ENDPOINT
@@ -5685,6 +6225,26 @@ const { connectionStatus, jobsActive, jobsTotal } = await Promise.resolve().then
 const { JobRunner } = await Promise.resolve().then(() => (init_job_runner(), job_runner_exports));
 setServiceName("agent");
 const logger$1 = createLogger({ prefix: "agent" });
+/**
+* Serialize the agent's current Prometheus metrics to text. The OTel
+* PrometheusExporter exposes no direct serialize method, so the metrics are
+* piped through its request handler with a mock ServerResponse. Returns an
+* empty string when no exporter is configured. Shared by the /metrics health
+* route and the fleet mini-bundle.
+*/
+async function serializeAgentMetrics() {
+	const exporter = getPrometheusExporter();
+	if (!exporter) return "";
+	return new Promise((resolve) => {
+		exporter.getMetricsRequestHandler({}, {
+			statusCode: 200,
+			setHeader: () => {},
+			end: (data) => {
+				resolve(typeof data === "string" ? data : data ? data.toString() : "");
+			}
+		});
+	});
+}
 installConsoleCapture();
 await guardStartup(logger$1, async () => {
 	const config = loadConfig();
@@ -5736,7 +6296,9 @@ await guardStartup(logger$1, async () => {
 		sendRunEvent: (runId, eventType, opts) => client.sendRunEvent(runId, eventType, opts),
 		sendConcurrencyReport: (runId, jobId, group) => client.sendConcurrencyReport(runId, jobId, group),
 		sendApiRequest: (method, params) => client.sendApiRequest(method, params ?? {}),
-		requestUserCache: (jobId, request) => client.requestUserCache(jobId, request)
+		requestUserCache: (jobId, request) => client.requestUserCache(jobId, request),
+		relayProvenance: (jobId, request) => client.relayProvenance(jobId, request),
+		sendStepApproval: (runId, jobId, request) => client.sendStepApproval(runId, jobId, request)
 	});
 	/** Build and send an agent.status message with dynamic OS metadata. */
 	function sendAgentStatus() {
@@ -5752,6 +6314,11 @@ await guardStartup(logger$1, async () => {
 	}
 	client = new OrchestratorClient({
 		...agentClientConnectionOptions(config),
+		getFleetBundleInputs: async () => ({
+			config,
+			logDir: process.env.KICI_LOG_DIR,
+			metricsText: await serializeAgentMetrics()
+		}),
 		onJobDispatch: (dispatch) => {
 			const reqId = dispatch.requestId ?? randomUUID();
 			requestContext.run({
@@ -5899,25 +6466,10 @@ await guardStartup(logger$1, async () => {
 	metricsReporter.start();
 	const app = new Hono();
 	const healthRoutes = createHealthRoutes$1({
-		getMetrics: async () => {
-			const exporter = getPrometheusExporter();
-			if (!exporter) return {
-				contentType: "text/plain",
-				body: ""
-			};
-			return new Promise((resolve) => {
-				exporter.getMetricsRequestHandler({}, {
-					statusCode: 200,
-					setHeader: () => {},
-					end: (data) => {
-						resolve({
-							contentType: "text/plain",
-							body: typeof data === "string" ? data : data ? data.toString() : ""
-						});
-					}
-				});
-			});
-		},
+		getMetrics: async () => ({
+			contentType: "text/plain",
+			body: await serializeAgentMetrics()
+		}),
 		getStatus: () => ({
 			agentId: config.agentId,
 			connected: client.state === "registered",