@kici-dev/agent 0.1.20 → 0.1.22

package/dist/server.js

@@ -12,7 +12,7 @@ import winston from "winston";
 import { RingBuffer, addLogsToArchive, chunkBuffer, createHealthRoutes, createLogger, createMeter, createMetricsRoutes, deriveSharedSecret, getPrometheusExporter, getReconnectDelay, getRequestContext, guardStartup, initTelemetry, logger, normalizeLineEndings, redactConfig, requestContext, setServiceName, setupGracefulShutdown, sha256, sha256File, toErrorMessage, validateRequiredTools } from "@kici-dev/shared";
 import { z } from "zod";
 import { LOGGER_ENV_VARS, defineEnv, validateUnknownKiciVars } from "@kici-dev/shared/env";
-import { ALLOWED_SYSTEM_VARS, CacheRunEventType, CacheStepType, ExecutionJobStatus, ExecutionStepStatus, InitFailureCategory, KNOWN_ROLES, PROTOCOL_VERSION, SANDBOX_DEFAULT_VARS, WS_CLOSE_AGENT_AUTH_FAILED, WS_MAX_PAYLOAD_BYTES, applyIncludeExclude, deriveOsArchLabels, expandMatrix, heartbeatSchema, hostLabel, mergeAutoLabels, orchestratorToAgentMessageSchema, resolveRoleLabels, validateNoReservedLabels } from "@kici-dev/engine";
+import { ALLOWED_SYSTEM_VARS, CacheRunEventType, CacheStepType, ExecutionJobStatus, ExecutionStepStatus, InitFailureCategory, KNOWN_ROLES, PROTOCOL_VERSION, SANDBOX_DEFAULT_VARS, WS_CLOSE_AGENT_AUTH_FAILED, WS_MAX_PAYLOAD_BYTES, applyIncludeExclude, deriveOsArchLabels, expandMatrix, heartbeatSchema, hostLabel, mergeAutoLabels, orchestratorToAgentMessageSchema, parseHostPropertyAssignments, resolveRoleLabels, resolveWhenToRunOn, validateNoReservedLabels } from "@kici-dev/engine";
 import { execFile, execFileSync, execSync, fork, spawn } from "node:child_process";
 import WebSocket from "ws";
 import * as fs$2 from "node:fs";
@@ -66,6 +66,7 @@ const envDef = defineEnv({
 		orchestratorUrl: z.string().url().min(1, "KICI_ORCHESTRATOR_URL is required"),
 		agentId: z.string().optional(),
 		labels: z.string().default("").transform((s) => s.split(",").filter(Boolean)),
+		properties: z.string().default("").transform((s) => parseHostPropertyAssignments(s.split(",").filter(Boolean))),
 		roles: z.string().optional().transform((s) => {
 			if (s === void 0) return void 0;
 			if (s === "") return [];
@@ -101,16 +102,19 @@ const envDef = defineEnv({
 		scalerPendingDispatchTimeoutMs: z.coerce.number().default(6e4),
 		executionMode: ExecutionMode.optional(),
 		otelExporterOtlpEndpoint: z.string().optional(),
-		concurrencyWaitTimeoutMs: z.coerce.number().int().min(1e3).default(36e5)
+		concurrencyWaitTimeoutMs: z.coerce.number().int().min(1e3).default(36e5),
+		isOrchestratorHost: z.string().optional().transform((v) => v === "true")
 	}),
 	envMap: {
 		orchestratorUrl: "KICI_ORCHESTRATOR_URL",
 		agentId: "KICI_AGENT_ID",
 		labels: "KICI_LABELS",
+		properties: "KICI_PROPERTIES",
 		roles: "KICI_ROLES",
 		port: "KICI_PORT",
 		logLevel: "KICI_LOG_LEVEL",
 		agentToken: "KICI_AGENT_TOKEN",
+		isOrchestratorHost: "KICI_AGENT_IS_ORCHESTRATOR_HOST",
 		githubToken: "KICI_GITHUB_TOKEN",
 		maxLogSizeBytes: "KICI_MAX_LOG_SIZE_BYTES",
 		defaultStepTimeoutMs: "KICI_DEFAULT_STEP_TIMEOUT_MS",
@@ -134,6 +138,7 @@ const envDef = defineEnv({
 * - KICI_ORCHESTRATOR_URL (required)
 * - KICI_AGENT_ID (optional, auto-generated from hostname-uuid8)
 * - KICI_LABELS (comma-separated, e.g. "linux,docker"). Labels with 'kici-' prefix are reserved.
+* - KICI_PROPERTIES (comma-separated key=value host-vars, e.g. "region=eu,cores=8,gpu=true"). Typed (bool/number/string), reported into the host roster.
 * - KICI_ROLES (comma-separated agent roles, e.g. "builder,init-runner". undefined=all, empty=execution-only)
 * - KICI_PORT (default: 8080)
 * - KICI_LOG_LEVEL (default: info)
@@ -177,6 +182,7 @@ function agentClientConnectionOptions(config) {
 		url: config.orchestratorUrl,
 		agentId: config.agentId,
 		labels: config.labels,
+		properties: config.properties,
 		scalerManaged: config.scalerManaged,
 		token: config.agentToken
 	};
@@ -282,7 +288,7 @@ var LogBuffer = class extends RingBuffer {
 };
 //#endregion
 //#region src/ws/orchestrator-client.ts
-const logger$11 = createLogger({ prefix: "orchestrator-client" });
+const logger$12 = createLogger({ prefix: "orchestrator-client" });
 /**
 * WebSocket client that connects the agent to the customer orchestrator.
 *
@@ -329,6 +335,7 @@ var OrchestratorClient = class OrchestratorClient {
 	url;
 	agentId;
 	labels;
+	properties;
 	onJobDispatch;
 	onJobCancel;
 	token;
@@ -356,6 +363,7 @@ var OrchestratorClient = class OrchestratorClient {
 		this.url = options.url;
 		this.agentId = options.agentId;
 		this.labels = options.labels;
+		this.properties = options.properties ?? {};
 		this.onJobDispatch = options.onJobDispatch;
 		this.onJobCancel = options.onJobCancel;
 		this.token = options.token;
@@ -397,7 +405,7 @@ var OrchestratorClient = class OrchestratorClient {
 	*/
 	connect() {
 		if (this._state !== "disconnected") {
-			logger$11.warn("connect() called while not disconnected", { state: this._state });
+			logger$12.warn("connect() called while not disconnected", { state: this._state });
 			return;
 		}
 		this.intentionalDisconnect = false;
@@ -748,7 +756,8 @@ var OrchestratorClient = class OrchestratorClient {
 				stepName: request.stepName,
 				clauses: request.clauses,
 				reason: request.reason,
-				...request.timeoutSeconds !== void 0 && { timeoutSeconds: request.timeoutSeconds }
+				...request.timeoutSeconds !== void 0 && { timeoutSeconds: request.timeoutSeconds },
+				...request.payload !== void 0 && { payload: request.payload }
 			});
 		});
 	}
@@ -834,7 +843,7 @@ var OrchestratorClient = class OrchestratorClient {
 				}
 			});
 		} catch (err) {
-			logger$11.error("Failed to create WebSocket", { error: toErrorMessage(err) });
+			logger$12.error("Failed to create WebSocket", { error: toErrorMessage(err) });
 			this._state = "disconnected";
 			this.scheduleReconnect();
 			return;
@@ -842,7 +851,7 @@ var OrchestratorClient = class OrchestratorClient {
 		this.ws.on("open", () => {
 			if (this.token) {
 				this._state = "authenticating";
-				logger$11.info("Connected to orchestrator, sending auth.request", {
+				logger$12.info("Connected to orchestrator, sending auth.request", {
 					url: this.url,
 					agentId: this.agentId
 				});
@@ -853,7 +862,7 @@ var OrchestratorClient = class OrchestratorClient {
 				}));
 			} else {
 				this._state = "registering";
-				logger$11.info("Connected to orchestrator, sending agent.register (no token)", {
+				logger$12.info("Connected to orchestrator, sending agent.register (no token)", {
 					url: this.url,
 					agentId: this.agentId
 				});
@@ -864,12 +873,12 @@ var OrchestratorClient = class OrchestratorClient {
 			this.handleMessage(data);
 		});
 		this.ws.on("close", (code, reason) => {
-			logger$11.info("Orchestrator connection closed", {
+			logger$12.info("Orchestrator connection closed", {
 				code,
 				reason: reason.toString()
 			});
 			if (code === WS_CLOSE_AGENT_AUTH_FAILED) {
-				logger$11.error("Orchestrator closed with auth-failed code -- token is invalid or revoked. NOT retrying.", {
+				logger$12.error("Orchestrator closed with auth-failed code -- token is invalid or revoked. NOT retrying.", {
 					code,
 					reason: reason.toString()
 				});
@@ -895,7 +904,7 @@ var OrchestratorClient = class OrchestratorClient {
 			if (!this.intentionalDisconnect) this.scheduleReconnect();
 		});
 		this.ws.on("error", (err) => {
-			logger$11.error(`Orchestrator WebSocket error: ${err.message}`);
+			logger$12.error(`Orchestrator WebSocket error: ${err.message}`);
 			if (this.ws && this.ws.readyState === WebSocket.OPEN) this.ws.close();
 		});
 	}
@@ -904,7 +913,7 @@ var OrchestratorClient = class OrchestratorClient {
 		try {
 			raw = JSON.parse(data.toString());
 		} catch {
-			logger$11.warn("Malformed JSON received from orchestrator");
+			logger$12.warn("Malformed JSON received from orchestrator");
 			return;
 		}
 		const rawMsg = raw;
@@ -962,13 +971,13 @@ var OrchestratorClient = class OrchestratorClient {
 			switch (msg.type) {
 				case "auth.success":
 					if (this._state === "authenticating") {
-						logger$11.info("Authentication successful, sending agent.register", { connectionId: msg.connectionId });
+						logger$12.info("Authentication successful, sending agent.register", { connectionId: msg.connectionId });
 						this._state = "registering";
 						this.sendAgentRegister();
 					}
 					break;
 				case "auth.failure":
-					logger$11.error("Authentication FAILED -- token is invalid or expired. NOT retrying.", { reason: msg.reason });
+					logger$12.error("Authentication FAILED -- token is invalid or expired. NOT retrying.", { reason: msg.reason });
 					this.authFailed = true;
 					this.intentionalDisconnect = true;
 					if (this.ws) {
@@ -978,7 +987,7 @@ var OrchestratorClient = class OrchestratorClient {
 					this._state = "disconnected";
 					break;
 				case "register.ack":
-					logger$11.info("Registration acknowledged by orchestrator", {
+					logger$12.info("Registration acknowledged by orchestrator", {
 						agentId: msg.agentId,
 						labels: msg.labels,
 						scalerManaged: msg.scalerManaged,
@@ -993,14 +1002,14 @@ var OrchestratorClient = class OrchestratorClient {
 					this.sendConfigAck(msg.agentId);
 					break;
 				case "job.dispatch":
-					logger$11.info("Job dispatch received", {
+					logger$12.info("Job dispatch received", {
 						runId: msg.runId,
 						jobId: msg.jobId
 					});
 					this.onJobDispatch(msg);
 					break;
 				case "job.cancel":
-					logger$11.info("Job cancel received", {
+					logger$12.info("Job cancel received", {
 						runId: msg.runId,
 						jobId: msg.jobId,
 						reason: msg.reason
@@ -1008,7 +1017,7 @@ var OrchestratorClient = class OrchestratorClient {
 					this.onJobCancel(msg);
 					break;
 				case "job.concurrency.ack": {
-					logger$11.info("Concurrency ack received", {
+					logger$12.info("Concurrency ack received", {
 						requestId: msg.requestId,
 						action: msg.action
 					});
@@ -1023,7 +1032,7 @@ var OrchestratorClient = class OrchestratorClient {
 					break;
 				}
 				case "step.approval-resolved": {
-					logger$11.info("Step approval resolved", {
+					logger$12.info("Step approval resolved", {
 						requestId: msg.requestId,
 						runId: msg.runId,
 						jobId: msg.jobId,
@@ -1043,7 +1052,7 @@ var OrchestratorClient = class OrchestratorClient {
 					break;
 				}
 				case "fleet.logs.request":
-					logger$11.info("Fleet log collection requested", {
+					logger$12.info("Fleet log collection requested", {
 						requestId: msg.requestId,
 						logWindowHours: msg.logWindowHours
 					});
@@ -1053,7 +1062,7 @@ var OrchestratorClient = class OrchestratorClient {
 			return;
 		}
 		if (heartbeatSchema.safeParse(raw).success) return;
-		logger$11.warn("Invalid message from orchestrator", { errors: parsed.error.issues });
+		logger$12.warn("Invalid message from orchestrator", { errors: parsed.error.issues });
 	}
 	flushBuffer() {
 		const events = this.eventBuffer.flush();
@@ -1067,11 +1076,11 @@ var OrchestratorClient = class OrchestratorClient {
 		}
 		this.disconnectedAt = null;
 		if (events.length > 0) {
-			logger$11.info("Flushing event buffer", { count: events.length });
+			logger$12.info("Flushing event buffer", { count: events.length });
 			for (const msg of events) this.sendDirect(msg);
 		}
 		if (logLines.length > 0) {
-			logger$11.info("Flushing log buffer", { count: logLines.length });
+			logger$12.info("Flushing log buffer", { count: logLines.length });
 			for (let i = 0; i < logLines.length; i += OrchestratorClient.LOG_BATCH_SIZE) {
 				const batch = logLines.slice(i, i + OrchestratorClient.LOG_BATCH_SIZE);
 				this.sendAgentLogMessage(batch);
@@ -1124,14 +1133,14 @@ var OrchestratorClient = class OrchestratorClient {
 	*/
 	blockMmdsAccess() {
 		if (process.getuid?.() !== 0) {
-			logger$11.info("MMDS iptables block skipped (non-root) — network isolation handled by orchestrator");
+			logger$12.info("MMDS iptables block skipped (non-root) — network isolation handled by orchestrator");
 			return;
 		}
 		try {
 			execSync("iptables -A OUTPUT -d 169.254.169.254 -j DROP", { timeout: 5e3 });
-			logger$11.info("MMDS access blocked via iptables");
+			logger$12.info("MMDS access blocked via iptables");
 		} catch (err) {
-			logger$11.warn("Failed to block MMDS access via iptables", { error: toErrorMessage(err) });
+			logger$12.warn("Failed to block MMDS access via iptables", { error: toErrorMessage(err) });
 		}
 	}
 	/**
@@ -1145,7 +1154,7 @@ var OrchestratorClient = class OrchestratorClient {
 				messageId: `config-ack-${agentId}-${Date.now()}`,
 				agentId
 			}));
-			logger$11.info("Config ACK sent to orchestrator", { agentId });
+			logger$12.info("Config ACK sent to orchestrator", { agentId });
 		}
 	}
 	startHeartbeat() {
@@ -1205,17 +1214,18 @@ var OrchestratorClient = class OrchestratorClient {
 			})()
 		};
 		if (inFlightJobs.length > 0) msg.inFlightJobs = inFlightJobs;
+		if (Object.keys(this.properties).length > 0) msg.properties = this.properties;
 		this.ws.send(JSON.stringify(msg));
 	}
 	scheduleReconnect() {
 		this.cancelReconnect();
 		if (this.authFailed) {
-			logger$11.error("Not reconnecting: authentication permanently failed");
+			logger$12.error("Not reconnecting: authentication permanently failed");
 			return;
 		}
 		const delay = this.getReconnectDelay();
 		this.reconnectAttempts++;
-		logger$11.info("Scheduling reconnect", {
+		logger$12.info("Scheduling reconnect", {
 			attempt: this.reconnectAttempts,
 			delayMs: Math.round(delay)
 		});
@@ -1300,14 +1310,14 @@ var init_console_capture = __esmMin((() => {
 init_console_capture();
 function safe(name, fallback = "unknown") {
 	switch (name) {
-		case "version": return "0.1.20";
-		case "buildCommit": return "f12ea0665";
-		case "sdkVersion": return "0.1.20";
-		case "sdkBundleHash": return "8308089347c304e41b457d3867b17bbff11d6b5cd9706b6823e7abdbd849f33f";
-		case "sharedVersion": return "0.1.20";
-		case "sharedBundleHash": return "5f2c220f24d166b0f13d0620a2e80d19689ac8b683a12154daef44e938fd46a7";
-		case "engineVersion": return "0.1.20";
-		case "engineBundleHash": return "79ce14640d1798eaaa7cb3aa6c4bc325da3bff1e9f4716936e19614eabb1d858";
+		case "version": return "0.1.22";
+		case "buildCommit": return "5afd16303";
+		case "sdkVersion": return "0.1.22";
+		case "sdkBundleHash": return "4b26a42978f77e29db110d47523ec947d3d673c3109fc48141c1a62814bde7a1";
+		case "sharedVersion": return "0.1.22";
+		case "sharedBundleHash": return "991385c024392c395d3eb8a68946ef8ed3fcba96f2652f21c3164a54eafa1b1b";
+		case "engineVersion": return "0.1.22";
+		case "engineBundleHash": return "ff74a3afb2b1db2870c03d47543642f64d04b660bebdcde6681f76d874f26757";
 		default: return fallback;
 	}
 }
@@ -1564,6 +1574,83 @@ async function gcStaleAgentTmpDirs(base = tmpdir()) {
 	})];
 }
 //#endregion
+//#region src/execution/reboot.ts
+/**
+* Cross-OS host reboot for the workflow-level `restartHost()` step.
+*
+* The agent runs ON the host it executes jobs for, so a `restartHost()` step
+* reboots that host. `rebootCommandFor` is the pure OS→command mapping (kept
+* pure for unit-testing); `issueReboot` spawns it detached with a tiny grace so
+* the job's final flush completes before the box goes down.
+*
+* Rebooting needs host privilege (root/admin). If the primitive is denied, the
+* spawn fails and the caller clears the orchestrator's reboot-pending flag and
+* surfaces the error — the deadline sweep is the backstop.
+*/
+const logger$11 = createLogger({ prefix: "reboot" });
+/** The OS reboot primitive for a Node platform string. */
+function rebootCommandFor(platform) {
+	switch (platform) {
+		case "darwin": return {
+			cmd: "shutdown",
+			args: ["-r", "now"]
+		};
+		case "win32": return {
+			cmd: "shutdown",
+			args: [
+				"/r",
+				"/t",
+				"0"
+			]
+		};
+		default: return {
+			cmd: "systemctl",
+			args: ["reboot"]
+		};
+	}
+}
+/**
+* Issue the OS reboot detached. Resolves once the child has been spawned (the
+* box is going down; there is nothing to await). Rejects synchronously if the
+* spawn itself fails (e.g. the binary is missing). A privilege denial usually
+* surfaces as a non-zero exit AFTER spawn — logged, not thrown, because by then
+* the box may already be on its way down.
+*/
+function issueReboot(platform = process.platform) {
+	const { cmd, args } = rebootCommandFor(platform);
+	return new Promise((resolve, reject) => {
+		try {
+			const child = spawn(cmd, args, {
+				detached: true,
+				stdio: "ignore"
+			});
+			child.on("error", (err) => {
+				logger$11.error("Reboot command failed to spawn", {
+					cmd,
+					args,
+					error: String(err)
+				});
+				reject(err);
+			});
+			child.on("exit", (code) => {
+				if (code !== 0 && code !== null) logger$11.warn("Reboot command exited non-zero (privilege denied?)", {
+					cmd,
+					args,
+					code
+				});
+			});
+			child.unref();
+			logger$11.info("Issued host reboot", {
+				cmd,
+				args
+			});
+			setImmediate(resolve);
+		} catch (err) {
+			reject(err);
+		}
+	});
+}
+//#endregion
 //#region src/metrics/prometheus.ts
 var prometheus_exports = /* @__PURE__ */ __exportAll({
 	cloneDurationSeconds: () => cloneDurationSeconds,
@@ -1993,8 +2080,8 @@ async function extractStepsFromDynamicJob(workflow, dynamicIndex, jobName, event
 }
 var AGENT_SDK_VERSION, AGENT_SDK_BUNDLE_HASH, hookRegistered;
 var init_workflow_loader = __esmMin((() => {
-	AGENT_SDK_VERSION = "0.1.20";
-	AGENT_SDK_BUNDLE_HASH = "8308089347c304e41b457d3867b17bbff11d6b5cd9706b6823e7abdbd849f33f";
+	AGENT_SDK_VERSION = "0.1.22";
+	AGENT_SDK_BUNDLE_HASH = "4b26a42978f77e29db110d47523ec947d3d673c3109fc48141c1a62814bde7a1";
 	hookRegistered = false;
 }));
 //#endregion
@@ -2543,7 +2630,8 @@ async function serializeJob(job, generatedNames, ctx, staticNames, allowedGroups
 * Validates against generatedNames union staticNames union allowedGroups.
 *
 * Returns the lock file representation: strings for concrete refs,
-* NeedsEntry for { name, ifFailed }, NeedsGroupEntry for group refs.
+* NeedsEntry for { name, when }, NeedsGroupEntry for group refs (each `when`
+* normalized to a runOn status-set).
 */
 function resolveNeeds(needs, generatedNames, staticNames, allowedGroups) {
 	if (!needs || needs.length === 0) return [];
@@ -2558,7 +2646,7 @@ function resolveNeeds(needs, generatedNames, staticNames, allowedGroups) {
 			if (!allowedGroups.has(groupRef.group)) throw new Error(`Dynamic group '${groupRef.group}' not found in workflow (available groups: ${[...allowedGroups].join(", ") || "none"})`);
 			return {
 				group: groupRef.group,
-				ifFailed: groupRef.ifFailed ?? "skip"
+				runOn: resolveWhenToRunOn(groupRef.when)
 			};
 		}
 		if (typeof dep === "object" && dep !== null && "group" in dep) {
@@ -2566,7 +2654,7 @@ function resolveNeeds(needs, generatedNames, staticNames, allowedGroups) {
 			if (!allowedGroups.has(groupDep.group)) throw new Error(`Dynamic group '${groupDep.group}' not found in workflow (available groups: ${[...allowedGroups].join(", ") || "none"})`);
 			return {
 				group: groupDep.group,
-				ifFailed: groupDep.ifFailed ?? "skip"
+				runOn: resolveWhenToRunOn(groupDep.when)
 			};
 		}
 		if (typeof dep === "object" && dep !== null && "name" in dep && !("steps" in dep)) {
@@ -2574,7 +2662,7 @@ function resolveNeeds(needs, generatedNames, staticNames, allowedGroups) {
 			if (!allNames.has(namedDep.name)) throw new Error(`Job dependency '${namedDep.name}' not found in workflow jobs (checked: ${generatedNames.size} generated, ${staticNames.size} static)`);
 			return {
 				name: namedDep.name,
-				ifFailed: namedDep.ifFailed ?? "skip"
+				runOn: resolveWhenToRunOn(namedDep.when)
 			};
 		}
 		if (isDynamicJobFn(dep)) throw new Error("Job dependency cannot be a DynamicJobFn");
@@ -4188,6 +4276,7 @@ function buildRequest(dispatch, workDir) {
 		checkout: jobConfig.checkout ?? true,
 		isTestRun: jobConfig.isTestRun ?? false,
 		fullRepo: jobConfig.fullRepo ?? false,
+		checkMode: jobConfig.checkMode,
 		tarballUrl: jobConfig.tarballUrl,
 		cliPublicKey: jobConfig.cliPublicKey,
 		orchestratorPrivateKey: jobConfig.orchestratorPrivateKey,
@@ -4204,6 +4293,8 @@ function buildRequest(dispatch, workDir) {
 		concurrencyEvaluationTimeoutMs: jobConfig.concurrencyEvaluationTimeoutMs,
 		branch: dispatch.ref,
 		upstreamJobOutputs: dispatch.upstreamJobOutputs,
+		upstreamJobStatuses: dispatch.upstreamJobStatuses,
+		jobNeeds: jobConfig.needs,
 		npmRegistries: dispatch.npmRegistries,
 		installEnvSecrets: dispatch.installEnvSecrets,
 		jobIdShort: dispatch.jobId.slice(0, 8),
@@ -4525,6 +4616,9 @@ function relayChildIpcMessage(msg, dispatch, ctx) {
 				...msg.error && { error: msg.error },
 				...msg.secretsAccessed && { secretsAccessed: msg.secretsAccessed },
 				...msg.step_type && { step_type: msg.step_type },
+				...msg.checkOutcome !== void 0 && { checkOutcome: msg.checkOutcome },
+				...msg.driftSummary !== void 0 && { driftSummary: msg.driftSummary },
+				...msg.drift !== void 0 && { drift: msg.drift },
 				...msg.data && msg.data
 			});
 			return;
@@ -5249,6 +5343,9 @@ var init_container_sandbox = __esmMin((() => {
 						...msg.error && { error: msg.error },
 						...msg.secretsAccessed && { secretsAccessed: msg.secretsAccessed },
 						...msg.step_type && { step_type: msg.step_type },
+						...msg.checkOutcome !== void 0 && { checkOutcome: msg.checkOutcome },
+						...msg.driftSummary !== void 0 && { driftSummary: msg.driftSummary },
+						...msg.drift !== void 0 && { drift: msg.drift },
 						...msg.data && msg.data
 					});
 					stepResults.push({
@@ -5380,7 +5477,10 @@ var init_sandbox = __esmMin((() => {
 }));
 //#endregion
 //#region src/execution/job-runner.ts
-var job_runner_exports = /* @__PURE__ */ __exportAll({ JobRunner: () => JobRunner$1 });
+var job_runner_exports = /* @__PURE__ */ __exportAll({
+	JobRunner: () => JobRunner$1,
+	buildEvalNeedsContext: () => buildEvalNeedsContext
+});
 /**
 * Check if a file exists at the given path.
 */
@@ -5764,12 +5864,17 @@ var init_job_runner = __esmMin((() => {
 				stepsTotal.add(1, { status: stepResult.status });
 				if (stepResult.durationMs > 0) stepDurationSeconds.record(stepResult.durationMs / 1e3);
 			}
-			if (result.status === ExecutionJobStatus.enum.failed) logger$2.error("Sandbox returned failed result", {
-				durationMs: result.durationMs,
-				stepCount: result.stepResults.length,
-				steps: result.stepResults.map((r) => `${r.name}:${r.status}`).join(","),
-				logStreamerKeys: [...logStreamers.keys()].join(",")
-			});
+			if (result.status === ExecutionJobStatus.enum.failed) {
+				const stepErrors = result.stepResults.filter((r) => r.error).map((r) => `${r.name}: ${r.error.message}`).join(" | ");
+				logger$2.error("Sandbox returned failed result", {
+					durationMs: result.durationMs,
+					stepCount: result.stepResults.length,
+					steps: result.stepResults.map((r) => `${r.name}:${r.status}`).join(","),
+					logStreamerKeys: [...logStreamers.keys()].join(","),
+					...result.error && { error: result.error },
+					...stepErrors && { stepErrors }
+				});
+			}
 			this.sendJobStatus(dispatch, result.status, {
 				durationMs: result.durationMs,
 				...result.error && { error: result.error },
@@ -6406,14 +6511,14 @@ var init_job_runner = __esmMin((() => {
 */
 init_console_capture();
 init_npm_resolver();
-const AGENT_VERSION = "0.1.20";
-const BUILD_COMMIT = "f12ea0665";
-const SDK_VERSION = "0.1.20";
-const SDK_BUNDLE_HASH = "8308089347c304e41b457d3867b17bbff11d6b5cd9706b6823e7abdbd849f33f";
-const SHARED_VERSION = "0.1.20";
-const SHARED_BUNDLE_HASH = "5f2c220f24d166b0f13d0620a2e80d19689ac8b683a12154daef44e938fd46a7";
-const ENGINE_VERSION = "0.1.20";
-const ENGINE_BUNDLE_HASH = "79ce14640d1798eaaa7cb3aa6c4bc325da3bff1e9f4716936e19614eabb1d858";
+const AGENT_VERSION = "0.1.22";
+const BUILD_COMMIT = "5afd16303";
+const SDK_VERSION = "0.1.22";
+const SDK_BUNDLE_HASH = "4b26a42978f77e29db110d47523ec947d3d673c3109fc48141c1a62814bde7a1";
+const SHARED_VERSION = "0.1.22";
+const SHARED_BUNDLE_HASH = "991385c024392c395d3eb8a68946ef8ed3fcba96f2652f21c3164a54eafa1b1b";
+const ENGINE_VERSION = "0.1.22";
+const ENGINE_BUNDLE_HASH = "ff74a3afb2b1db2870c03d47543642f64d04b660bebdcde6681f76d874f26757";
 initTelemetry({
 	serviceName: "kici-agent",
 	otlpEndpoint: process.env.OTEL_EXPORTER_OTLP_ENDPOINT
@@ -6479,6 +6584,7 @@ await guardStartup(logger$1, async () => {
 	}
 	let isDraining = false;
 	let idleShutdownTimer;
+	let rebootIntent = false;
 	let client;
 	const jobRunner = new JobRunner({
 		send: (msg) => client.send(msg),
@@ -6492,7 +6598,15 @@ await guardStartup(logger$1, async () => {
 		sendJobContext: (runId, jobId, context) => client.sendJobContext(runId, jobId, context),
 		sendRunEvent: (runId, eventType, opts) => client.sendRunEvent(runId, eventType, opts),
 		sendConcurrencyReport: (runId, jobId, group) => client.sendConcurrencyReport(runId, jobId, group),
-		sendApiRequest: (method, params) => client.sendApiRequest(method, params ?? {}),
+		sendApiRequest: async (method, params) => {
+			if (method === "host.requestReboot") {
+				if (config.isOrchestratorHost) throw new Error("refusing to reboot the orchestrator host");
+				const result = await client.sendApiRequest(method, params ?? {});
+				rebootIntent = true;
+				return result;
+			}
+			return client.sendApiRequest(method, params ?? {});
+		},
 		requestUserCache: (jobId, request) => client.requestUserCache(jobId, request),
 		relayProvenance: (jobId, request) => client.relayProvenance(jobId, request),
 		sendStepApproval: (runId, jobId, request) => client.sendStepApproval(runId, jobId, request)
@@ -6581,6 +6695,13 @@ await guardStartup(logger$1, async () => {
 					jobsActive.add(-1);
 					metricsReporter.collectAndSend().catch(() => {});
 					sendAgentStatus();
+					if (rebootIntent) {
+						rebootIntent = false;
+						issueReboot().catch((err) => {
+							logger$1.error("Host reboot failed; cancelling reboot-pending flag", { error: toErrorMessage(err) });
+							client.sendApiRequest("host.cancelReboot", {}).catch(() => {});
+						});
+					}
 					if (config.scalerManaged && jobRunner.activeJobs.size === 0) {
 						if (client.state !== "registered") {
 							logger$1.info("Scaler-managed agent idle but disconnected, deferring shutdown until reconnected");