@kici-dev/agent 0.1.15 → 0.1.17

package/dist/workflow-runner.js

@@ -1,21 +1,27 @@
 import { register } from "node:module";
 import { createInterface } from "node:readline";
-import crypto, { createHash, randomUUID } from "node:crypto";
+import crypto$1, { createHash, randomUUID } from "node:crypto";
 import { existsSync } from "node:fs";
-import fsPromises, { access, cp, mkdir, mkdtemp, readFile, readdir, rename, rm, unlink, writeFile } from "node:fs/promises";
+import fsPromises, { access, cp, lstat, mkdir, mkdtemp, readFile, readdir, realpath, rename, rm, unlink, writeFile } from "node:fs/promises";
 import os, { homedir, tmpdir } from "node:os";
 import path, { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { $ } from "zx";
 import { createLogger, deriveSharedSecret, initZx, normalizeLineEndings, sha256, sha256File, toErrorMessage } from "@kici-dev/shared";
 import { CacheOutcome, CacheStepType, ExecutionJobStatus, ExecutionStepStatus, TimeoutReason } from "@kici-dev/engine";
-import { buildKiciApi, createStepSecrets, evaluateRules, isDynamicJobFn, normalizeCacheSpecs, resolveJobOutputs, resolveStepOutputs, setJobOutputsMap, setStepOutputsMap, setStepRefMap } from "@kici-dev/sdk";
+import { buildKiciApi, createStepSecrets, evaluateRules, isDynamicJobFn, normalizeCacheSpecs, normalizeRequireApproval, provenanceSubjectIsPath, resolveJobOutputs, resolveStepOutputs, setJobOutputsMap, setStepOutputsMap, setStepRefMap } from "@kici-dev/sdk";
+import { OIDC_TOKEN_REQUEST_METHOD } from "@kici-dev/engine/protocol/messages/oidc-token-relay";
+import { sha256File as sha256File$1 } from "@kici-dev/core";
+import { calculateJwkThumbprint, decodeJwt, exportJWK, generateKeyPair } from "jose";
+import { IN_TOTO_PAYLOAD_TYPE, KICI_PROVENANCE_AUDIENCE, KICI_PROVENANCE_BUNDLE_MEDIA_TYPE } from "@kici-dev/engine/provenance/bundle";
+import { IN_TOTO_STATEMENT_TYPE, KICI_WORKFLOW_BUILD_TYPE, SLSA_PROVENANCE_PREDICATE_TYPE } from "@kici-dev/engine/provenance/schema";
+import { buildDsseEnvelope, dssePae } from "@kici-dev/engine/provenance/dsse";
+import https from "node:https";
+import http from "node:http";
 import { Readable, Transform } from "node:stream";
 import { pipeline } from "node:stream/promises";
 import { createGunzip } from "node:zlib";
-import { c, x } from "tar";
-import https from "node:https";
-import http from "node:http";
 import { fileURLToPath, pathToFileURL } from "node:url";
+import { c, x } from "tar";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 import { PNPM_IGNORE_BUILD_GATE_ARG, PackageManager, detectPackageManagerFromManifests } from "@kici-dev/shared/package-manager";
@@ -32,6 +38,122 @@ var __exportAll = (all, no_symbols) => {
 };
 import.meta.url;
 //#endregion
+//#region src/provenance/statement-builder.ts
+/**
+* Build a SLSA v1.0 in-toto provenance statement from the server-truth identity
+* token claims plus the caller-supplied subject. The build context comes
+* entirely from the JWT claims (Platform-minted, unforgeable), so the
+* statement's identity equals the token's identity by construction.
+*/
+/** Build a KiCI SLSA v1.0 provenance statement (validates against the P1.1 schema). */
+function buildProvenanceStatement(input) {
+	const c = input.tokenClaims;
+	return {
+		_type: IN_TOTO_STATEMENT_TYPE,
+		subject: [{
+			name: input.subject.name,
+			digest: input.subject.digest
+		}],
+		predicateType: SLSA_PROVENANCE_PREDICATE_TYPE,
+		predicate: {
+			buildDefinition: {
+				buildType: KICI_WORKFLOW_BUILD_TYPE,
+				externalParameters: { workflow: {
+					repository: c.repository ?? "",
+					ref: c.ref ?? "",
+					path: c.workflow_ref ?? ""
+				} },
+				internalParameters: {
+					...c.sha ? { commit: c.sha } : {},
+					runId: c.kici_run_id,
+					jobId: c.kici_job_id
+				}
+			},
+			runDetails: {
+				builder: {
+					id: `${c.iss}/orchestrator/${c.orchestrator_id ?? "unknown"}`,
+					version: input.builderVersions
+				},
+				metadata: {
+					invocationId: c.kici_run_id,
+					startedOn: input.startedOn,
+					finishedOn: input.finishedOn
+				}
+			}
+		}
+	};
+}
+//#endregion
+//#region src/provenance/sign.ts
+/**
+* Ephemeral-key DSSE signer for KiCI provenance (Mode A).
+*
+* Generates a fresh in-process ES256 keypair (never persisted), DSSE-signs the
+* PAE of the statement bytes with the private half, and returns the envelope
+* plus the public JWK. The public key travels in the bundle so the verifier can
+* check the signature; the key needs no separate trust root because the bundle's
+* identity JWT (verified against the Platform JWKS) anchors the whole package.
+*/
+/** DSSE-sign `statementBytes` with a fresh in-process ephemeral ES256 key. */
+async function signStatementDsse(payloadType, statementBytes) {
+	const { privateKey, publicKey } = await generateKeyPair("ES256", { extractable: true });
+	const publicJwk = await exportJWK(publicKey);
+	publicJwk.alg = "ES256";
+	publicJwk.use = "sig";
+	const kid = await calculateJwkThumbprint(publicJwk, "sha256");
+	publicJwk.kid = kid;
+	const pae = dssePae(payloadType, statementBytes);
+	return {
+		envelope: buildDsseEnvelope(payloadType, statementBytes, [{
+			keyid: kid,
+			sig: new Uint8Array(await crypto.subtle.sign({
+				name: "ECDSA",
+				hash: "SHA-256"
+			}, privateKey, pae))
+		}]),
+		publicJwk
+	};
+}
+//#endregion
+//#region src/provenance/attest.ts
+/**
+* Provenance attestation orchestration (Mode A): request the identity token,
+* build the in-toto statement from its claims, DSSE-sign it with an ephemeral
+* key, assemble the KiCI bundle, and persist it.
+*/
+async function attestProvenance(deps, input) {
+	const audience = input.audience ?? KICI_PROVENANCE_AUDIENCE;
+	const { token } = await deps.getIdToken({ audience });
+	const claims = decodeJwt(token);
+	const now = (deps.now ?? (() => (/* @__PURE__ */ new Date()).toISOString()))();
+	const statement = buildProvenanceStatement({
+		tokenClaims: claims,
+		subject: input.subject,
+		builderVersions: deps.builderVersions,
+		startedOn: now,
+		finishedOn: now
+	});
+	const { envelope, publicJwk } = await signStatementDsse(IN_TOTO_PAYLOAD_TYPE, new TextEncoder().encode(JSON.stringify(statement)));
+	const bundle = {
+		mediaType: KICI_PROVENANCE_BUNDLE_MEDIA_TYPE,
+		dsseEnvelope: envelope,
+		verificationMaterial: {
+			publicKey: publicJwk,
+			identityToken: token
+		}
+	};
+	const subjectDigest = subjectDigestString(input.subject);
+	return {
+		storageKey: await deps.persist(bundle, subjectDigest),
+		bundle,
+		subjectDigest
+	};
+}
+/** Pick the primary digest (`sha256` preferred) as the storage-key discriminator. */
+function subjectDigestString(subject) {
+	return subject.digest.sha256 ?? Object.values(subject.digest)[0];
+}
+//#endregion
 //#region src/execution/dep-restore.ts
 /**
 * Dependency restoration from cached tarballs.
@@ -370,6 +492,7 @@ var init_download = __esmMin((() => {
 }));
 //#endregion
 //#region src/execution/cache/cache-engine.ts
+init_download();
 /**
 * User-facing cache engine (sandbox-side).
 *
@@ -769,7 +892,8 @@ function applyEnvDelta(delta, options) {
 	}
 	const appliedPaths = [];
 	if (delta.pathPrepends.length > 0) {
-		for (const dir of [...delta.pathPrepends].reverse()) target.PATH = target.PATH ? `${dir}:${target.PATH}` : dir;
+		const sep = options.pathSeparator ?? (process.platform === "win32" ? ";" : ":");
+		for (const dir of [...delta.pathPrepends].reverse()) target.PATH = target.PATH ? `${dir}${sep}${target.PATH}` : dir;
 		appliedPaths.push(...delta.pathPrepends);
 	}
 	return {
@@ -1123,6 +1247,65 @@ async function evaluateStepRulesAndMaybeSkip(step, stepIndex, opts) {
 	};
 }
 /**
+* Manual approval gate for a step. When the step declares `requireApproval`
+* and the harness wired `awaitStepApproval`, block until the orchestrator
+* resolves the hold. Returns a failed `StepIterationOutcome` (breaking the
+* loop) on reject/expired; returns null when approved or when no gate applies.
+*/
+async function maybeGateStepApproval(step, stepIndex, opts) {
+	if (step.requireApproval === void 0 || !opts.awaitStepApproval) return null;
+	const normalized = normalizeRequireApproval(step.requireApproval);
+	opts.sendIpc({
+		type: "log.line",
+		stepIndex,
+		line: `[kici] Step '${step.name}' awaiting approval...`
+	});
+	const resolution = await opts.awaitStepApproval({
+		stepIndex,
+		stepName: step.name,
+		clauses: normalized.clauses,
+		reason: normalized.reason ?? `Approval required for step '${step.name}'`,
+		timeoutSeconds: normalized.timeoutSeconds
+	});
+	if (resolution.outcome === "approved") {
+		opts.sendIpc({
+			type: "log.line",
+			stepIndex,
+			line: `[kici] Step '${step.name}' approved.`
+		});
+		return null;
+	}
+	const why = resolution.outcome === "expired" ? "approval expired" : `approval rejected${resolution.reason ? `: ${resolution.reason}` : ""}`;
+	opts.sendIpc({
+		type: "step.start",
+		stepIndex,
+		stepName: step.name
+	});
+	opts.sendIpc({
+		type: "step.complete",
+		stepIndex,
+		status: ExecutionStepStatus.enum.failed,
+		durationMs: 0
+	});
+	opts.sendIpc({
+		type: "log.line",
+		stepIndex,
+		line: `[kici] Step '${step.name}' ${why}.`
+	});
+	await opts.disposeStepResources?.();
+	return {
+		result: {
+			name: step.name,
+			stepIndex,
+			status: ExecutionStepStatus.enum.failed,
+			durationMs: 0,
+			error: { message: `Step '${step.name}' ${why}` }
+		},
+		shouldBreak: true,
+		failedStepName: step.name
+	};
+}
+/**
 * Run a single observer hook (beforeStep / afterStep). Failures only emit a
 * log line — they never change job status. Centralises the per-call boilerplate
 * so the per-step body can stay flat.
@@ -1169,6 +1352,8 @@ async function runStepIteration(step, stepIndex, opts) {
 			shouldBreak: false
 		};
 	}
+	const gate = await maybeGateStepApproval(step, stepIndex, opts);
+	if (gate) return gate;
 	if (opts.jobHooks?.beforeStep) await runObserverHook({
 		hook: opts.jobHooks.beforeStep,
 		hookType: "beforeStep",
@@ -1453,6 +1638,256 @@ async function runOneInit(spec, index, stepIndex, stepType, opts) {
 	}
 }
 //#endregion
+//#region src/execution/env-init/presets/directives.ts
+function isPresetString(item) {
+	return item === "mise";
+}
+function isMiseObject(item) {
+	return typeof item === "object" && item !== null && "mise" in item;
+}
+function normalizeOne(item) {
+	if (isPresetString(item)) return {
+		kind: "preset",
+		name: "mise",
+		config: {}
+	};
+	if (isMiseObject(item)) return {
+		kind: "preset",
+		name: "mise",
+		config: item.mise
+	};
+	return {
+		kind: "generic",
+		config: item
+	};
+}
+/**
+* Normalize `Job.init` to an ordered list of directives, without touching the
+* filesystem. `false`/`undefined` -> []; `'auto'` -> one auto directive;
+* presets/generic configs -> their directive; arrays map element-wise.
+* `'auto'` is a scalar only — finding it inside an array throws.
+*/
+function normalizeInitItems(job) {
+	const init = job?.init;
+	if (init === void 0 || init === false) return [];
+	if (init === "auto") return [{ kind: "auto" }];
+	if (Array.isArray(init)) return init.map((item) => {
+		if (item === "auto") throw new Error("init: 'auto' cannot be combined in an array — use it as the sole value");
+		return normalizeOne(item);
+	});
+	return [normalizeOne(init)];
+}
+//#endregion
+//#region src/execution/env-init/presets/mise/cache-key.ts
+/** mise config files, in the fixed order they feed the content hash. */
+const MISE_CONFIG_FILES = [
+	"mise.toml",
+	".mise.toml",
+	".tool-versions"
+];
+/**
+* Derive the default mise cache key from the committed mise config under
+* `cloneRoot`. Concatenates whichever of {@link MISE_CONFIG_FILES} exist (in
+* fixed order) and hashes them. Returns `mise-noconfig` when none exist.
+*/
+async function miseCacheKey(cloneRoot) {
+	const hash = createHash("sha256");
+	let found = false;
+	for (const name of MISE_CONFIG_FILES) try {
+		const buf = await readFile(join(cloneRoot, name));
+		hash.update(name);
+		hash.update(buf);
+		found = true;
+	} catch {}
+	if (!found) return "mise-noconfig";
+	return `mise-${hash.digest("hex").slice(0, 16)}`;
+}
+//#endregion
+//#region src/execution/env-init/presets/mise/templates.ts
+const BASH_RUN = `set -euo pipefail
+command -v mise >/dev/null || curl -fsSL https://mise.run | sh
+export PATH="$HOME/.local/bin:$PATH"
+# Trust the committed config at the clone root (CWD): mise refuses to load an
+# untrusted config, and the author committing it to their repo is the trust signal.
+mise trust
+mise install
+mise env -s bash | sed -n 's/^export //p' | sed '/^PATH=/d' \\
+  | sed -E 's/^([A-Za-z_][A-Za-z0-9_]*)="(.*)"$/\\1=\\2/' >> "$KICI_ENV"
+echo "$HOME/.local/share/mise/shims" >> "$KICI_PATH"`;
+const PWSH_RUN = `$ErrorActionPreference = 'Stop'
+# mise writes informational output (\`mise trusted …\`, install progress) to
+# stderr even on success. Under \`$ErrorActionPreference = 'Stop'\` PowerShell
+# turns any native-command stderr line into a terminating error, so a
+# successful \`mise trust\` would abort the step. Run each mise invocation with
+# the preference relaxed and gate on the real exit code via \`$LASTEXITCODE\`.
+function Invoke-Mise {
+  param([Parameter(ValueFromRemainingArguments = $true)][string[]] $MiseArgs)
+  $prev = $ErrorActionPreference
+  $ErrorActionPreference = 'Continue'
+  try {
+    $output = & mise @MiseArgs 2>&1
+    $code = $LASTEXITCODE
+  } finally {
+    $ErrorActionPreference = $prev
+  }
+  if ($code -ne 0) {
+    throw "mise $($MiseArgs -join ' ') failed (exit $code): $($output -join ' | ')"
+  }
+  return $output
+}
+if (-not (Get-Command mise -ErrorAction SilentlyContinue)) {
+  # The standalone Windows zip extracts to mise/bin/mise.exe, so prepend the
+  # nested bin dir (not the extraction root) to PATH.
+  $dest = Join-Path $env:USERPROFILE '.local\\mise'
+  New-Item -ItemType Directory -Force -Path $dest | Out-Null
+  $zip = Join-Path $env:TEMP 'mise.zip'
+  Invoke-WebRequest -Uri '<ASSET_URL>' -OutFile $zip
+  Expand-Archive -Path $zip -DestinationPath $dest -Force
+  $env:PATH = "$dest\\mise\\bin;$env:PATH"
+}
+# Trust the committed config at the clone root (CWD) — mise refuses to load an
+# untrusted config; the author committing it to their repo is the trust signal.
+Invoke-Mise trust | Out-Null
+Invoke-Mise install | Out-Null
+Invoke-Mise env -s pwsh | ForEach-Object {
+  if ($_ -match '^\\$env:([^=]+) = ''(.*)''$' -and $Matches[1] -ne 'PATH') { "$($Matches[1])=$($Matches[2])" }
+} | Add-Content -Path $env:KICI_ENV
+# Add the real tool install dirs (not the shims dir): the standalone mise lives
+# in a temp dir that is gone by step time, so the shim wrappers (which re-invoke
+# mise) cannot resolve it. bin-paths points straight at the installed binaries.
+Invoke-Mise bin-paths | Add-Content -Path $env:KICI_PATH`;
+/**
+* Pick the mise template for a host platform (Node `process.platform` value).
+* The Windows `run` carries an `<ASSET_URL>` placeholder the expander replaces
+* with the resolved GitHub-release zip URL.
+*/
+function selectMiseTemplate(platform) {
+	if (platform === "win32") return {
+		run: PWSH_RUN,
+		shell: "pwsh",
+		cachePaths: ["~/AppData/Local/mise"]
+	};
+	if (platform === "linux" || platform === "darwin") return {
+		run: BASH_RUN,
+		shell: "bash",
+		cachePaths: ["~/.local/share/mise"]
+	};
+	throw new Error(`unsupported platform for mise preset: ${platform}`);
+}
+//#endregion
+//#region src/execution/env-init/presets/mise/windows-install.ts
+/** Map a Windows `PROCESSOR_ARCHITECTURE` value to mise's asset arch slug. */
+function miseWindowsArch(processorArch) {
+	return processorArch?.toUpperCase() === "ARM64" ? "arm64" : "x64";
+}
+const LATEST_RELEASE_URL = "https://api.github.com/repos/jdx/mise/releases/latest";
+/**
+* Resolve the download URL of the latest mise standalone Windows zip for `arch`.
+* `fetchJson` is injected (defaults to a real fetch) so the resolution is
+* unit-testable without network.
+*/
+async function resolveLatestMiseWindowsAsset(arch, fetchJson = defaultFetchJson) {
+	const release = await fetchJson(LATEST_RELEASE_URL);
+	const suffix = `-windows-${arch}.zip`;
+	const asset = release.assets.find((a) => a.name.endsWith(suffix));
+	if (!asset) throw new Error(`no mise windows ${arch} asset in latest release`);
+	return asset.browser_download_url;
+}
+async function defaultFetchJson(url) {
+	const res = await fetch(url, { headers: { "user-agent": "kici-agent" } });
+	if (!res.ok) throw new Error(`mise release lookup failed: ${res.status}`);
+	return await res.json();
+}
+//#endregion
+//#region src/execution/env-init/presets/mise/expander.ts
+async function buildRun(args, template) {
+	if ((args.platform ?? process.platform) !== "win32") return template.run;
+	const arch = miseWindowsArch(process.env.PROCESSOR_ARCHITECTURE);
+	const url = await (args.resolveWindowsAsset ?? ((a) => resolveLatestMiseWindowsAsset(a)))(arch);
+	return template.run.replace("<ASSET_URL>", url);
+}
+async function defaultCache(cloneRoot, paths) {
+	return {
+		key: await miseCacheKey(cloneRoot),
+		paths,
+		restoreKeys: ["mise-"]
+	};
+}
+//#endregion
+//#region src/execution/env-init/presets/registry.ts
+/**
+* The set of typed presets. Nix is added here (one row) once its provider lands.
+*/
+const PRESET_REGISTRY = { mise: { async expand(args) {
+	const template = selectMiseTemplate(args.platform ?? process.platform);
+	const run = await buildRun(args, template);
+	const cache = args.config.cache === false ? void 0 : args.config.cache ?? await defaultCache(args.cloneRoot, template.cachePaths);
+	const cfg = {
+		run,
+		shell: args.config.shell ?? template.shell,
+		timeout: args.config.timeout ?? 6e5
+	};
+	if (cache) cfg.cache = cache;
+	if (args.config.env) cfg.env = args.config.env;
+	return cfg;
+} } };
+/**
+* Ordered auto-detect table: `init: 'auto'` tries each row against the clone
+* root and accumulates matches in this order. (nix row added with its provider.)
+*/
+const AUTO_DETECT_TABLE = [{
+	markers: [
+		"mise.toml",
+		".mise.toml",
+		".tool-versions"
+	],
+	preset: "mise"
+}];
+//#endregion
+//#region src/execution/env-init/presets/expand.ts
+async function fileExists$2(p) {
+	try {
+		await access(p);
+		return true;
+	} catch {
+		return false;
+	}
+}
+/** Scan the clone root for marker files and return matched presets in table order. */
+async function autoDetect(cloneRoot) {
+	const matched = [];
+	for (const row of AUTO_DETECT_TABLE) for (const marker of row.markers) if (await fileExists$2(join(cloneRoot, marker))) {
+		matched.push(row.preset);
+		break;
+	}
+	return matched;
+}
+async function expandPreset(name, config, opts) {
+	return PRESET_REGISTRY[name].expand({
+		cloneRoot: opts.cloneRoot,
+		config,
+		...opts.platform ? { platform: opts.platform } : {}
+	});
+}
+/**
+* Expand normalized directives into concrete generic init configs, reading the
+* clone root for preset cache keys and `'auto'` marker detection.
+*/
+async function expandInitDirectives(directives, opts) {
+	const out = [];
+	for (const d of directives) if (d.kind === "generic") out.push(d.config);
+	else if (d.kind === "preset") out.push(await expandPreset(d.name, d.config, opts));
+	else {
+		const presets = await autoDetect(opts.cloneRoot);
+		if (presets.length === 0) {
+			opts.log?.("[kici] init: auto — no toolchain detected (no mise.toml / .tool-versions)");
+			continue;
+		}
+		for (const name of presets) out.push(await expandPreset(name, {}, opts));
+	}
+	return out;
+}
+//#endregion
 //#region src/execution/sandbox/job-deadline.ts
 /**
 * Arm a job-level wall-clock deadline. When `timeoutMs` is set and elapses
@@ -1901,6 +2336,17 @@ function isInsideRepo(repoRoot, target) {
 */
 async function findUnresolvableDeps(deps, packageManager, kiciDir, repoRoot) {
 	if (packageManager === PackageManager.Npm) return [...deps];
+	if (packageManager === PackageManager.Yarn) {
+		const unresolvable = [];
+		for (const dep of deps) {
+			if (dep.protocol === "workspace:" || dep.protocol === "portal:") {
+				unresolvable.push(dep);
+				continue;
+			}
+			if (!isInsideRepo(repoRoot, resolveLocalPath(kiciDir, dep))) unresolvable.push(dep);
+		}
+		return unresolvable;
+	}
 	const hasWorkspaceFile = await fileExists$1(join(repoRoot, "pnpm-workspace.yaml"));
 	const unresolvable = [];
 	for (const dep of deps) {
@@ -1916,6 +2362,7 @@ async function findUnresolvableDeps(deps, packageManager, kiciDir, repoRoot) {
 function formatUnresolvableDepError(offenders, packageManager) {
 	const list = offenders.map((o) => `${o.name}: ${o.spec}`).join(", ");
 	if (packageManager === PackageManager.Npm) return `These .kici/ dependencies use local-protocol specifiers npm cannot resolve from a registry: ${list}. npm has no workspace protocol — pin a published version, publish the package to your registry, or use pnpm so an in-repo workspace sibling can be resolved.`;
+	if (packageManager === PackageManager.Yarn) return `These .kici/ dependencies use specifiers yarn classic cannot resolve: ${list}. yarn classic has no workspace: or portal: protocol — reference an in-repo sibling by a version range (yarn links matching workspace members), use pnpm, or keep file:/link: paths inside this repository. (yarn berry support is planned.)`;
 	return `These .kici/ dependencies point outside the cloned repository, which the agent never has: ${list}. A workspace: dependency requires a pnpm-workspace.yaml at the repo root, and file:/link:/portal: paths must stay inside this repository.`;
 }
 /**
@@ -1934,6 +2381,101 @@ async function assertResolvableDeps(args) {
 	throw new Error(formatUnresolvableDepError(offenders, args.packageManager));
 }
 //#endregion
+//#region src/execution/workspace-siblings.ts
+/**
+* In-repo workspace-sibling discovery for the agent's dependency handling.
+*
+* A pnpm or yarn-classic workspace lays out a `.kici/` member's `workspace:`
+* (pnpm) or version-range (yarn) siblings as symlinks pointing at package
+* directories that live inside the clone but outside `.kici/` and outside the
+* `node_modules` store. The dep-cache packer must travel those sibling dirs with
+* the closure (their symlinks would dangle otherwise), and the yarn install path
+* must build them (the install links a sibling but does not build it).
+*
+* `collectInRepoSiblings` walks a starting `node_modules` (and transitively each
+* discovered sibling's `node_modules`), returning each in-repo sibling directory
+* once, repo-root-relative, in breadth-first discovery order. The starting
+* `node_modules` is a parameter so it serves pnpm + yarn-standalone (seeded at
+* `.kici/node_modules`) and yarn-workspace-member (seeded at the hoisted root
+* `node_modules`).
+*/
+/**
+* The directory yarn lays `.kici`'s dependencies into. A standalone `.kici`
+* (own lockfile, no parent workspace) gets `.kici/node_modules`; a workspace
+* member hoists everything to the repo-root `node_modules`, leaving no
+* `.kici/node_modules`.
+*/
+function resolveYarnNodeModulesRoot(repoRoot, kiciDir) {
+	const kiciNm = join(kiciDir, "node_modules");
+	return existsSync(kiciNm) ? kiciNm : join(repoRoot, "node_modules");
+}
+/**
+* Walk `seedNodeModules` (and transitively each in-repo sibling's
+* `node_modules`) collecting the repo-root-relative directories of workspace
+* siblings — package dirs that live inside the clone but outside `.kici/` and
+* outside the repo-root `node_modules/` store. Returns each dir once, in
+* discovery (BFS) order.
+*/
+async function collectInRepoSiblings(workDir, kiciDir, seedNodeModules = join(kiciDir, "node_modules")) {
+	const repoRoot = resolve(workDir);
+	const kiciResolved = resolve(kiciDir);
+	const rootNodeModules = resolve(join(workDir, "node_modules"));
+	const found = /* @__PURE__ */ new Set();
+	const visited = /* @__PURE__ */ new Set();
+	const queue = [seedNodeModules];
+	while (queue.length > 0) {
+		const nmDir = queue.shift();
+		const real = await realpath(nmDir).catch(() => null);
+		if (!real || visited.has(real)) continue;
+		visited.add(real);
+		for (const target of await resolveNodeModulesLinks(nmDir)) {
+			if (!isInside(repoRoot, target)) continue;
+			if (isInside(kiciResolved, target) || isInside(rootNodeModules, target)) continue;
+			const rel = relative(workDir, target);
+			if (!found.has(rel)) {
+				found.add(rel);
+				queue.push(join(target, "node_modules"));
+			}
+		}
+	}
+	return [...found];
+}
+/** Resolve every package symlink target under a `node_modules` dir (descending one level into `@scope` dirs). */
+async function resolveNodeModulesLinks(nmDir) {
+	const targets = [];
+	for (const entry of await readdir(nmDir).catch(() => [])) {
+		if (entry.startsWith(".")) continue;
+		const entryPath = join(nmDir, entry);
+		if (entry.startsWith("@")) {
+			for (const scoped of await readdir(entryPath).catch(() => [])) {
+				const target = await resolveIfSymlink(join(entryPath, scoped));
+				if (target) targets.push(target);
+			}
+			continue;
+		}
+		const target = await resolveIfSymlink(entryPath);
+		if (target) targets.push(target);
+	}
+	return targets;
+}
+/** Return the real path of `p` if it is a symlink, else null. */
+async function resolveIfSymlink(p) {
+	try {
+		if (!(await lstat(p)).isSymbolicLink()) return null;
+		return await realpath(p);
+	} catch {
+		return null;
+	}
+}
+/** Whether `target` is `root` itself or a path inside it. */
+function isInside(root, target) {
+	const rel = relative(root, target);
+	return rel === "" || !rel.startsWith("..") && !rel.startsWith(`..${sep}`) && !isAbsoluteRel(rel);
+}
+function isAbsoluteRel(rel) {
+	return rel.length > 1 && rel[1] === ":";
+}
+//#endregion
 //#region src/execution/dep-installer.ts
 /**
 * Inline dependency installation for graceful degradation.
@@ -1941,12 +2483,14 @@ async function assertResolvableDeps(args) {
 * When the dep cache is unavailable or a download fails, the agent installs
 * `.kici/` dependencies directly with the repository's package manager.
 *
-* The package manager is detected from the cloned repo (npm / pnpm); the
+* The package manager is detected from the cloned repo (npm / pnpm / yarn); the
 * presence of `.kici/package.json` signals that deps should be installed. npm
 * is the default and ships with every Node.js install; pnpm is used when the
 * repo is a pnpm workspace so a `.kici/` member can resolve in-repo
-* `workspace:` siblings. yarn is detected but not yet supported and is
-* rejected with an actionable error.
+* `workspace:` siblings. yarn classic (v1) is supported for registry
+* dependencies and version-range workspace siblings (which it links but does
+* not build, so the agent builds the in-repo closure after install). yarn
+* berry (v2+) is not yet supported.
 *
 * Security: the install runs with an isolated per-invocation cache/store
 * directory to prevent cache poisoning across build jobs — a malicious
@@ -1995,7 +2539,6 @@ async function installDeps(kiciDir, opts = {}) {
 		dir: kiciDir
 	});
 	process.stderr.write(`[dep-installer:trace] starting install: pm=${packageManager}, cwd=${kiciDir}\n`);
-	if (packageManager === PackageManager.Yarn) throw new Error("This repository uses yarn, which the KiCI agent does not yet support for .kici/ dependency installation. Use npm or pnpm for the .kici/ project, or open a feature request for yarn support.");
 	await assertResolvableDeps({
 		kiciDir,
 		repoRoot,
@@ -2015,6 +2558,11 @@ async function installDeps(kiciDir, opts = {}) {
 			hasPrivateRegistry,
 			registryConfig
 		});
+		else if (packageManager === PackageManager.Yarn) await runYarnInstall({
+			kiciDir,
+			hasPrivateRegistry,
+			registryConfig
+		});
 		else await runNpmInstall({
 			kiciDir,
 			hasPrivateRegistry,
@@ -2029,6 +2577,7 @@ async function installDeps(kiciDir, opts = {}) {
 		await registryConfig.cleanup();
 	}
 	if (packageManager === PackageManager.Pnpm && await kiciHasLocalProtocolDeps(kiciDir)) await buildWorkspaceClosure(repoRoot);
+	if (packageManager === PackageManager.Yarn) await buildYarnWorkspaceClosure(repoRoot, kiciDir);
 	const durationMs = Date.now() - startTime;
 	process.stderr.write(`[dep-installer:trace] install complete: ${durationMs}ms\n`);
 	logger$2.info("Deps installed inline", {
@@ -2116,6 +2665,101 @@ async function runPnpmInstall(args) {
 		}).catch(() => {});
 	}
 }
+/** Pure: argv for `yarn install` with an isolated cache folder. */
+function buildYarnInstallArgs(cacheDir, hasPrivateRegistry) {
+	const a = [
+		"install",
+		"--cache-folder",
+		cacheDir,
+		"--non-interactive",
+		"--no-progress"
+	];
+	if (hasPrivateRegistry) a.push("--ignore-scripts");
+	return a;
+}
+/**
+* Run `yarn install` from `.kici/` with an isolated cache folder. yarn classic
+* reads the synthesized `.kici/.npmrc` (registry + `${VAR}` token expansion) for
+* private-registry auth. A workspace member hoists deps to the repo-root
+* node_modules; a standalone `.kici` gets `.kici/node_modules`. Not
+* `--frozen-lockfile` (resolved URLs in the lockfile may point at a different
+* registry than the synthesized `.npmrc`, e.g. localhost tunnel vs direct IP).
+*/
+async function runYarnInstall(args) {
+	await assertYarnAvailable();
+	const { nodeDir } = resolveNpm();
+	const cacheDir = await mkdtemp(join(tmpdir(), "kici-yarn-cache-"));
+	const env = envWithNodeOnPath(args.registryConfig.extraEnv, nodeDir);
+	const argv = buildYarnInstallArgs(cacheDir, args.hasPrivateRegistry);
+	try {
+		process.stderr.write(`[dep-installer:trace] running: yarn ${argv.join(" ")}\n`);
+		await execFileAsync("yarn", argv, {
+			cwd: args.kiciDir,
+			env,
+			timeout: INSTALL_TIMEOUT_MS,
+			maxBuffer: INSTALL_MAX_BUFFER
+		});
+	} finally {
+		await rm(cacheDir, {
+			recursive: true,
+			force: true
+		}).catch(() => {});
+	}
+}
+/** Throw an actionable error when the repo needs yarn but it is not installed. */
+async function assertYarnAvailable() {
+	try {
+		await execFileAsync("yarn", ["--version"], {
+			timeout: 3e4,
+			cwd: tmpdir()
+		});
+	} catch (e) {
+		throw new Error(`This repository uses yarn, but yarn is not available on this agent. Install yarn (e.g. \`corepack enable\`) or run on a container/Firecracker agent that bundles it. (${toErrorMessage(e)})`);
+	}
+}
+/**
+* Build the in-repo workspace siblings `.kici` depends on (yarn links them on
+* install but does not build them). Walks siblings from the resolved
+* node_modules root and runs each sibling's `build` script in leaf-first
+* (reverse-discovery) order with a clean env (no synthesized registry tokens).
+* Deep cross-sibling build chains may build out of strict topological order —
+* real `.kici` closures are shallow.
+*/
+async function buildYarnWorkspaceClosure(repoRoot, kiciDir) {
+	const siblings = await collectInRepoSiblings(repoRoot, kiciDir, resolveYarnNodeModulesRoot(repoRoot, kiciDir));
+	if (siblings.length === 0) return;
+	const { nodeDir } = resolveNpm();
+	const env = envWithNodeOnPath({}, nodeDir);
+	for (const rel of [...siblings].reverse()) {
+		const sibDir = join(repoRoot, rel);
+		if (!await siblingHasBuildScript(sibDir)) continue;
+		process.stderr.write(`[dep-installer:trace] building yarn sibling: yarn --cwd ${sibDir} run build\n`);
+		try {
+			await execFileAsync("yarn", [
+				"--cwd",
+				sibDir,
+				"run",
+				"build"
+			], {
+				cwd: repoRoot,
+				env,
+				timeout: INSTALL_TIMEOUT_MS,
+				maxBuffer: INSTALL_MAX_BUFFER
+			});
+		} catch (e) {
+			logSubprocessStreams(e, []);
+			throw new Error(`Failed to build .kici yarn workspace sibling ${rel}: ${describeExecError(e)}`);
+		}
+	}
+}
+/** Whether a sibling package.json declares a `build` script. */
+async function siblingHasBuildScript(sibDir) {
+	try {
+		return typeof JSON.parse(await readFile(join(sibDir, "package.json"), "utf-8")).scripts?.build === "string";
+	} catch {
+		return false;
+	}
+}
 /**
 * Build the in-repo dependency closure of the `.kici/` package so a
 * `workspace:` sibling's build output exists before the workflow that imports
@@ -2159,7 +2803,10 @@ function describeExecError(e) {
 /** Throw an actionable error when the repo needs pnpm but it is not installed. */
 async function assertPnpmAvailable() {
 	try {
-		await execFileAsync("pnpm", ["--version"], { timeout: 3e4 });
+		await execFileAsync("pnpm", ["--version"], {
+			timeout: 3e4,
+			cwd: tmpdir()
+		});
 	} catch (e) {
 		throw new Error(`This repository is a pnpm workspace, but pnpm is not available on this agent. Install pnpm (e.g. \`corepack enable\`) or run on a container/ Firecracker agent that bundles it. (${toErrorMessage(e)})`);
 	}
@@ -2179,8 +2826,8 @@ function logSubprocessStreams(e, tokens) {
 * no Rolldown step at runtime. `@kici-dev/sdk` and host-repo deps resolve via
 * Node's normal ESM lookup against `.kici/node_modules/`.
 */
-const AGENT_SDK_VERSION = "0.1.15";
-const AGENT_SDK_BUNDLE_HASH = "cee24b67bbb4a1d2a770e4063dd37a9af33409faeb5ce32f936703b4431316dd";
+const AGENT_SDK_VERSION = "0.1.17";
+const AGENT_SDK_BUNDLE_HASH = "df47ed5db86eaaa2de8394c0db08335f368e8d620a898cc409765f4545eb3972";
 /**
 * Register the `@kici-dev/core/ts-loader-hook` oxc-transform ESM loader hook so
 * subsequent dynamic `import()` calls for `.ts` / `.tsx` files transform on the
@@ -2363,7 +3010,6 @@ async function extractStepsFromDynamicJob(workflow, dynamicIndex, jobName, event
 * runs without a preceding build (cache infrastructure unavailable, or a
 * build job that failed but left dynamic dispatch in flight).
 */
-init_download();
 init_dep_restore();
 const logger$1 = createLogger({ prefix: "source-restore" });
 async function extractSourceTarball(data, targetDir) {
@@ -2409,18 +3055,17 @@ async function restoreSource(workDir, sourceTarUrl) {
 init_download();
 const logger = createLogger({ prefix: "overlay-applier" });
 const IV_LENGTH = 12;
-const AUTH_TAG_LENGTH = 16;
 /**
 * Decrypt an encrypted buffer using AES-256-GCM.
 *
 * Wire format: [12-byte IV][16-byte auth tag][ciphertext]
 */
 function decryptBuffer(encrypted, aesKey) {
-	if (encrypted.length < IV_LENGTH + AUTH_TAG_LENGTH) throw new Error(`Tarball decryption failed: encrypted data too short (${encrypted.length} bytes, minimum ${IV_LENGTH + AUTH_TAG_LENGTH} bytes)`);
+	if (encrypted.length < 28) throw new Error(`Tarball decryption failed: encrypted data too short (${encrypted.length} bytes, minimum 28 bytes)`);
 	const iv = encrypted.subarray(0, IV_LENGTH);
-	const authTag = encrypted.subarray(IV_LENGTH, IV_LENGTH + AUTH_TAG_LENGTH);
-	const ciphertext = encrypted.subarray(IV_LENGTH + AUTH_TAG_LENGTH);
-	const decipher = crypto.createDecipheriv("aes-256-gcm", aesKey, iv);
+	const authTag = encrypted.subarray(IV_LENGTH, 28);
+	const ciphertext = encrypted.subarray(28);
+	const decipher = crypto$1.createDecipheriv("aes-256-gcm", aesKey, iv);
 	decipher.setAuthTag(authTag);
 	try {
 		return Buffer.concat([decipher.update(ciphertext), decipher.final()]);
@@ -2540,7 +3185,9 @@ async function applyOverlay(config) {
 * This file is compiled alongside the agent by rolldown (existing build), but
 * runs as a SEPARATE process spawned by the sandbox backend.
 */
+init_download();
 init_dep_restore();
+const AGENT_VERSION = "0.1.17";
 process.on("uncaughtException", (err) => {
 	process.stderr.write(`[workflow-runner] UNCAUGHT EXCEPTION: ${err.message}\n`);
 	if (err.stack) process.stderr.write(`[workflow-runner] Stack: ${err.stack}\n`);
@@ -2850,6 +3497,33 @@ function waitForApiResponse(requestId) {
 const pendingCacheResponses = /* @__PURE__ */ new Map();
 /** Default timeout for a cache request relay (matches the upload-URL request budget). */
 const CACHE_RESPONSE_TIMEOUT_MS = 3e4;
+/**
+* Pending promises for provenance.response messages from the agent.
+* Key: requestId (correlates provenance.request -> provenance.response).
+*/
+const pendingProvenanceResponses = /* @__PURE__ */ new Map();
+/** Wait for a provenance.response from the agent with the given requestId. */
+function waitForProvenanceResponse(requestId) {
+	return new Promise((resolve, reject) => {
+		const timer = setTimeout(() => {
+			pendingProvenanceResponses.delete(requestId);
+			reject(/* @__PURE__ */ new Error(`Provenance request timed out after ${CACHE_RESPONSE_TIMEOUT_MS}ms`));
+		}, CACHE_RESPONSE_TIMEOUT_MS);
+		pendingProvenanceResponses.set(requestId, {
+			resolve: (response) => {
+				clearTimeout(timer);
+				pendingProvenanceResponses.delete(requestId);
+				resolve(response);
+			},
+			reject: (err) => {
+				clearTimeout(timer);
+				pendingProvenanceResponses.delete(requestId);
+				reject(err);
+			},
+			timer
+		});
+	});
+}
 /** Wait for a cache.response from the agent with the given requestId. */
 function waitForCacheResponse(requestId) {
 	return new Promise((resolve, reject) => {
@@ -2873,6 +3547,68 @@ function waitForCacheResponse(requestId) {
 	});
 }
 /**
+* Pending promises for approval.resolved messages from the agent.
+* Key: requestId (correlates approval.request -> approval.resolved).
+*/
+const pendingApprovalResolutions = /* @__PURE__ */ new Map();
+/**
+* Hard ceiling on how long the runner blocks a step waiting for an approval
+* resolution. The orchestrator enforces the real (org-/SDK-configured) expiry
+* and sends `expired` when it lapses; this is a safety net well above any sane
+* approval window so the runner cannot hang forever if the resolution is lost.
+*/
+const APPROVAL_RESOLUTION_TIMEOUT_MS = 10080 * 60 * 1e3;
+/** Wait for an approval.resolved from the agent with the given requestId. */
+function waitForApprovalResolution(requestId) {
+	return new Promise((resolve) => {
+		const timer = setTimeout(() => {
+			pendingApprovalResolutions.delete(requestId);
+			resolve({
+				type: "approval.resolved",
+				requestId,
+				outcome: "expired"
+			});
+		}, APPROVAL_RESOLUTION_TIMEOUT_MS);
+		pendingApprovalResolutions.set(requestId, {
+			resolve: (response) => {
+				clearTimeout(timer);
+				pendingApprovalResolutions.delete(requestId);
+				resolve(response);
+			},
+			timer
+		});
+	});
+}
+/**
+* Build the `awaitStepApproval` callback the step loop uses to block on a
+* `requireApproval` step. Sends an `approval.request` IPC (relayed by the agent
+* over the WS as a `step.approval-request`) and awaits the matching
+* `approval.resolved`. A relay error is treated as a fail-closed reject.
+*/
+function buildAwaitStepApproval() {
+	return async (req) => {
+		const requestId = randomUUID();
+		sendMessage({
+			type: "approval.request",
+			requestId,
+			stepIndex: req.stepIndex,
+			stepName: req.stepName,
+			clauses: req.clauses,
+			reason: req.reason,
+			...req.timeoutSeconds !== void 0 && { timeoutSeconds: req.timeoutSeconds }
+		});
+		const resolution = await waitForApprovalResolution(requestId);
+		if (resolution.error) return {
+			outcome: "rejected",
+			reason: resolution.error
+		};
+		return {
+			outcome: resolution.outcome ?? "rejected",
+			...resolution.reason !== void 0 && { reason: resolution.reason }
+		};
+	};
+}
+/**
 * Build the {@link CacheTransport} the sandbox-side cache engine uses to reach
 * the orchestrator. Each method sends a `cache.request` IPC (relayed by the
 * agent over the WS as a `cache.user.*` message) and awaits the matching
@@ -2928,6 +3664,64 @@ function buildCacheTransport() {
 		}
 	};
 }
+/** Send a `provenance.request` IPC and await the matching `provenance.response`. */
+async function relayProvenanceIpc(request) {
+	const requestId = randomUUID();
+	sendMessage({
+		type: "provenance.request",
+		requestId,
+		...request
+	});
+	const response = await waitForProvenanceResponse(requestId);
+	if (response.error) throw new Error(`Provenance relay failed: ${response.error}`);
+	return response;
+}
+/**
+* Build the `ctx.attestProvenance` step helper. Resolves a `path` subject to a
+* SHA-256 digest, threads the identity token via the supplied OIDC getter, and
+* persists the bundle over the IPC -> WS provenance-upload relay.
+*/
+function buildAttestProvenanceFn(request, workDir, getIdToken) {
+	return async (opts) => {
+		const subject = provenanceSubjectIsPath(opts.subject) ? {
+			name: opts.subject.name,
+			digest: { sha256: await sha256File$1(join(workDir, opts.subject.path)) }
+		} : {
+			name: opts.subject.name,
+			digest: opts.subject.digest
+		};
+		const result = await attestProvenance({
+			getIdToken,
+			builderVersions: {
+				"kici-agent": AGENT_VERSION,
+				"kici-orchestrator": "unknown"
+			},
+			persist: async (bundle, subjectDigest) => {
+				const urlResponse = await relayProvenanceIpc({
+					op: "requestUploadUrl",
+					subjectDigest
+				});
+				if (!urlResponse.uploadUrl) throw new Error("Orchestrator returned no provenance upload URL");
+				await uploadToPresignedUrl(urlResponse.uploadUrl, Buffer.from(JSON.stringify(bundle)));
+				await relayProvenanceIpc({
+					op: "complete",
+					subjectDigest,
+					subjectName: subject.name,
+					mediaType: bundle.mediaType
+				});
+				return `provenance/${request.runId}/${request.jobId}/${subjectDigest}.kici.json`;
+			}
+		}, {
+			subject,
+			...opts.audience !== void 0 && { audience: opts.audience }
+		});
+		return {
+			storageKey: result.storageKey,
+			subjectDigest: result.subjectDigest,
+			bundleMediaType: result.bundle.mediaType
+		};
+	};
+}
 /**
 * Build the declarative-cache phase dependencies and run the job-level cache
 * restore (Phase 9b).
@@ -2985,6 +3779,12 @@ function dispatchAgentMessage(msg) {
 	} else if (msg.type === "cache.response") {
 		const pending = pendingCacheResponses.get(msg.requestId);
 		if (pending) pending.resolve(msg);
+	} else if (msg.type === "provenance.response") {
+		const pending = pendingProvenanceResponses.get(msg.requestId);
+		if (pending) pending.resolve(msg);
+	} else if (msg.type === "approval.resolved") {
+		const pending = pendingApprovalResolutions.get(msg.requestId);
+		if (pending) pending.resolve(msg);
 	}
 }
 if (isForkMode) process.on("message", (msg) => {
@@ -3163,10 +3963,22 @@ function buildSandboxShell(cwd, stepIndex, maskedSendFn) {
 * NOT serialized across the process boundary. This means zx $ runs natively
 * inside this process with full shell access.
 */
-function createSandboxStepContext(workDir, stepIndex, stepName, request, maskedSendFn, outputsMap, refMap, operatorSecretKeys, secretOutputs, jobOutputsMap, secrets) {
+function createSandboxStepContext(workDir, stepIndex, stepName, request, maskedSendFn, outputsMap, refMap, operatorSecretKeys, secretOutputs, jobOutputsMap, secrets, masker) {
 	const step$ = buildSandboxShell(workDir, stepIndex, maskedSendFn);
 	const log = createIpcLogger(stepIndex, stepName, maskedSendFn);
 	const rawPayload = rawPayloadFromEvent(request.event);
+	const kici = buildKiciApi(async (method, params) => {
+		const reqId = randomUUID();
+		sendMessage({
+			type: "agent.api.request",
+			requestId: reqId,
+			method,
+			params: params ?? {}
+		});
+		const result = await waitForApiResponse(reqId);
+		if (method === OIDC_TOKEN_REQUEST_METHOD && result && typeof result.token === "string") masker.registerSecrets({ __oidc_token__: result.token });
+		return result;
+	}, { jobId: request.jobId });
 	return {
 		$: step$,
 		log,
@@ -3218,18 +4030,11 @@ function createSandboxStepContext(workDir, stepIndex, stepName, request, maskedS
 		setSecretOutput: (key, value) => {
 			secretOutputs.set(key, value);
 		},
-		kici: buildKiciApi(async (method, params) => {
-			const reqId = randomUUID();
-			sendMessage({
-				type: "agent.api.request",
-				requestId: reqId,
-				method,
-				params: params ?? {}
-			});
-			return waitForApiResponse(reqId);
-		}),
+		kici,
+		attestProvenance: buildAttestProvenanceFn(request, workDir, (o) => kici.oidc.token(o)),
 		...rawPayload && { rawPayload },
-		...request.provider && { provider: request.provider }
+		...request.provider && { provider: request.provider },
+		...request.matrixValues && { matrix: request.matrixValues }
 	};
 }
 /** Raw provider webhook body for ctx.rawPayload — nested in the envelope. */
@@ -3372,6 +4177,31 @@ async function applyOverlayIfRequested(request, workflowDir) {
 	trace(`overlay applied: ${overlayResult.filesApplied} files, ${overlayResult.filesDeleted} deletions`);
 }
 /**
+* Phase 1c — Make git usable in a full-repo overlay workspace.
+*
+* `kici run remote` uploads the developer's working tree (including `.git`) as
+* a self-contained overlay; no clone happens, so the extracted `.git` directory
+* is owned by whatever UID wrote the tarball. Under rootless podman that UID may
+* not match the container UID, which trips git's "dubious ownership" /
+* `safe.directory` check and makes every step `git` command fail.
+*
+* Mirroring the `file://`-clone fix in checkout/git-clone.ts, we point
+* `GIT_CONFIG_GLOBAL` at a temp config carrying `safe.directory = *`. Setting it
+* on `process.env` here (before the step loop) means every step subprocess —
+* each zx `$` snapshots `process.env` at context creation — inherits it, so git
+* works in steps exactly as it does locally. We also register the dep-restore
+* scratch-dir exclude now that a real `.git` exists in the workspace.
+*/
+async function makeOverlayGitUsable(request, workspaceDir) {
+	if (!request.fullRepo) return;
+	if (!existsSync(join(workspaceDir, ".git"))) return;
+	const cfgPath = join(await fsPromises.mkdtemp(join(tmpdir(), "kici-gitcfg-")), "config");
+	await fsPromises.writeFile(cfgPath, "[safe]\n	directory = *\n", { mode: 384 });
+	process.env.GIT_CONFIG_GLOBAL = cfgPath;
+	trace(`fullRepo git safe.directory configured via GIT_CONFIG_GLOBAL=${cfgPath}`);
+	await excludeScratchFromGit(workspaceDir);
+}
+/**
 * Phase 2 — Restore deps from cache (with hash-mismatch hard-fail) OR fall
 * back to inline install. Skipped when `.kici/package.json` doesn't exist.
 * For global workflows deps come from the workflow repo (where `.kici/` lives).
@@ -3854,15 +4684,6 @@ function collectJobHooks(job) {
 	return jobHooks;
 }
 /**
-* Normalize `Job.init` (config | config[] | false | undefined) to an ordered
-* array of init specs. `false` is an explicit opt-out and `undefined` (no
-* config) both resolve to an empty list — the init phase is then a no-op.
-*/
-function resolveInitSpecs(job) {
-	if (!job || job.init === void 0 || job.init === false) return [];
-	return Array.isArray(job.init) ? [...job.init] : [job.init];
-}
-/**
 * Base stepIndex for the `init:<n>` pseudo-steps. The step loop reserves the
 * range starting at `steps.length` for hook pseudo-steps (`beforeStep` =
 * `steps.length + i*2`, `afterStep` = `steps.length + i*2 + 1`, and job-level
@@ -3938,7 +4759,16 @@ function buildStepEnvFileHooks(envFiles, operatorSecretKeys, maskedSend) {
 */
 async function runInitPhaseOrFailJob(args) {
 	const { job, stepCwd, envFiles, operatorSecretKeys, maskedSend } = args;
-	const initSpecs = resolveInitSpecs(job);
+	const directives = normalizeInitItems(job);
+	if (directives.length === 0) return;
+	const initSpecs = await expandInitDirectives(directives, {
+		cloneRoot: stepCwd,
+		log: (line) => maskedSend({
+			type: "log.line",
+			stepIndex: -1,
+			line
+		})
+	});
 	if (initSpecs.length === 0) return;
 	const initResult = await runInitPhase({
 		specs: initSpecs,
@@ -4013,6 +4843,7 @@ async function main() {
 	});
 	await cloneRepoIfRequested(request, workDir, workflowDir, sourceDir, isGlobal);
 	await applyOverlayIfRequested(request, workflowDir);
+	await makeOverlayGitUsable(request, workflowDir);
 	if (aborted) abortAndExit("aborted after clone");
 	await installDependenciesIfNeeded(workflowDir, request);
 	if (aborted) abortAndExit("aborted after deps");
@@ -4056,7 +4887,7 @@ async function main() {
 		const handle = buildStepSecrets(request, masker, () => {});
 		currentStepSecrets = handle.secrets;
 		currentStepDispose = handle.dispose;
-		const ctx = createSandboxStepContext(stepCwd, stepIndex, stepName, request, maskedSend, outputsMap, refMap, operatorSecretKeys, secretOutputs, jobOutputsMap, handle.secrets);
+		const ctx = createSandboxStepContext(stepCwd, stepIndex, stepName, request, maskedSend, outputsMap, refMap, operatorSecretKeys, secretOutputs, jobOutputsMap, handle.secrets, masker);
 		if (globalRepoInfo) {
 			ctx.workflowRepo = globalRepoInfo.workflowRepo;
 			ctx.sourceRepo = globalRepoInfo.sourceRepo;
@@ -4093,7 +4924,8 @@ async function main() {
 			if (disposeFn) await disposeFn();
 		},
 		beforeStepEnvFiles: stepEnvHooks.beforeStepEnvFiles,
-		afterStepApplyEnvFiles: stepEnvHooks.afterStepApplyEnvFiles
+		afterStepApplyEnvFiles: stepEnvHooks.afterStepApplyEnvFiles,
+		awaitStepApproval: buildAwaitStepApproval()
 	});
 	jobDeadline.clear();
 	await maybeSaveJobCache(jobCacheSpecs, jobCacheRestore, cachePhaseDeps, !aborted && loopResult.status === ExecutionStepStatus.enum.success);
@@ -4179,6 +5011,6 @@ main().catch((error) => {
 	setTimeout(() => process.exit(1), 100);
 });
 //#endregion
-export { rawPayloadFromEvent, resolveInitSpecs };
+export { createSandboxStepContext, rawPayloadFromEvent };
 
 //# sourceMappingURL=workflow-runner.js.map