@kici-dev/agent 0.1.21 → 0.1.22

package/dist/config.d.ts

@@ -44,6 +44,7 @@ declare const configSchema: z.ZodObject<{
     }>>;
     otelExporterOtlpEndpoint: z.ZodOptional<z.ZodString>;
     concurrencyWaitTimeoutMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    isOrchestratorHost: z.ZodPipe<z.ZodOptional<z.ZodString>, z.ZodTransform<boolean, string | undefined>>;
 }, z.core.$strip>;
 /**
  * App configuration type. Includes computed agentId when not provided.
@@ -75,6 +76,7 @@ export declare const envDef: import("@kici-dev/shared/env").DefineEnvResult<{
     scalerIdleTimeoutMs: number;
     scalerPendingDispatchTimeoutMs: number;
     concurrencyWaitTimeoutMs: number;
+    isOrchestratorHost: boolean;
     agentId?: string | undefined;
     agentToken?: string | undefined;
     githubToken?: string | undefined;

package/dist/execution/job-runner.d.ts

@@ -1,5 +1,6 @@
 import type { AgentToOrchestratorMessage, JobDispatch } from '@kici-dev/engine';
 import type { AppConfig } from '../config.js';
+import { buildNeedsContext } from '@kici-dev/sdk';
 import type { CacheRequestIpc, CacheResponseIpc, ProvenanceRequestIpc, ProvenanceResponseIpc, StepApprovalRequestIpc, StepApprovalResolvedIpc } from './sandbox/index.js';
 /**
  * Dependencies injected into JobRunner.
@@ -112,6 +113,15 @@ interface ActiveJob {
     completionPromise: Promise<void>;
     runId: string;
 }
+/**
+ * Build the result-aware `ctx.needs` for a dynamic eval from its frozen upstream
+ * snapshot. Returns undefined for an event-only generator (no snapshot).
+ */
+export declare function buildEvalNeedsContext(config: {
+    resultAware?: boolean;
+    declaredNeeds?: readonly unknown[];
+    upstreamSnapshot?: import('@kici-dev/engine').UpstreamSnapshot;
+}): ReturnType<typeof buildNeedsContext> | undefined;
 /**
  * Top-level job execution orchestrator for the agent.
  *

package/dist/execution/reboot.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Cross-OS host reboot for the workflow-level `restartHost()` step.
+ *
+ * The agent runs ON the host it executes jobs for, so a `restartHost()` step
+ * reboots that host. `rebootCommandFor` is the pure OS→command mapping (kept
+ * pure for unit-testing); `issueReboot` spawns it detached with a tiny grace so
+ * the job's final flush completes before the box goes down.
+ *
+ * Rebooting needs host privilege (root/admin). If the primitive is denied, the
+ * spawn fails and the caller clears the orchestrator's reboot-pending flag and
+ * surfaces the error — the deadline sweep is the backstop.
+ */
+/** The OS reboot primitive for a Node platform string. */
+export declare function rebootCommandFor(platform: NodeJS.Platform): {
+    cmd: string;
+    args: string[];
+};
+/**
+ * Issue the OS reboot detached. Resolves once the child has been spawned (the
+ * box is going down; there is nothing to await). Rejects synchronously if the
+ * spawn itself fails (e.g. the binary is missing). A privilege denial usually
+ * surfaces as a non-zero exit AFTER spawn — logged, not thrown, because by then
+ * the box may already be on its way down.
+ */
+export declare function issueReboot(platform?: NodeJS.Platform): Promise<void>;
+//# sourceMappingURL=reboot.d.ts.map

package/dist/execution/sandbox/ipc-protocol.d.ts

@@ -193,8 +193,13 @@ export interface StepApprovalRequestIpc {
     }>;
     /** Human label for the gate. */
     reason: string;
-    /** Per-gate timeout override (seconds) from the SDK `requireApproval.timeout`. */
+    /** Per-gate timeout override (seconds) from the SDK `approval.timeout`. */
     timeoutSeconds?: number;
+    /** Computed drift payload, present only for `when: 'drift'` gates. */
+    payload?: {
+        summaryMarkdown: string;
+        drift: unknown;
+    };
 }
 /** Which provenance upload operation to relay. */
 export type ProvenanceRequestOp = 'requestUploadUrl' | 'complete';
@@ -478,6 +483,10 @@ export interface JobExecutionRequest {
     branch?: string;
     /** Plain outputs from upstream jobs (keyed by job name, then by step name). For ctx.jobOutputs(). */
     upstreamJobOutputs?: Record<string, Record<string, unknown>>;
+    /** Terminal status of each upstream job (keyed by job name; per-child for fan-out). For ctx.needs.<job>.status. */
+    upstreamJobStatuses?: Record<string, import('@kici-dev/engine').ExecutionJobStatus>;
+    /** This job's declared upstream needs (normalized lock edges) used to shape ctx.needs for steps. */
+    jobNeeds?: readonly unknown[];
     /** Resolved private npm registries for `npm install` auth (token bytes already filled). */
     npmRegistries?: ReadonlyArray<{
         url: string;

package/dist/execution/sandbox/step-loop.d.ts

@@ -90,11 +90,11 @@ export interface StepLoopOptions {
      */
     afterStepApplyEnvFiles?: () => Promise<void>;
     /**
-     * Block a `requireApproval` step pending an orchestrator-side approval hold.
-     * The runner sends the normalized requirement and awaits the resolution; the
-     * agent keeps job heartbeats flowing during the wait so the agent isn't
-     * reaped. Absent ⇒ approvals are not gated (CT / unit harnesses) and steps
-     * run unconditionally.
+     * Block an `approval` step (`when: 'always'`) pending an orchestrator-side
+     * approval hold. The runner sends the normalized requirement and awaits the
+     * resolution; the agent keeps job heartbeats flowing during the wait so the
+     * agent isn't reaped. Absent ⇒ approvals are not gated (CT / unit harnesses)
+     * and steps run unconditionally.
      */
     awaitStepApproval?: (req: {
         stepIndex: number;
@@ -107,6 +107,28 @@ export interface StepLoopOptions {
         reason: string;
         timeoutSeconds?: number;
     }) => Promise<StepApprovalResolution>;
+    /**
+     * Block an `approval: { when: 'drift' }` step mid-execution: after `check()`
+     * returns drift in apply mode, send a payload-bearing step-approval and await
+     * the resolution. The payload carries the computed drift (`summaryMarkdown` +
+     * structured `drift`) so the operator approves the actual diff. Absent ⇒ the
+     * drift gate is not enforced (CT / unit harnesses) and the step applies.
+     */
+    awaitStepApprovalWithPayload?: (req: {
+        stepIndex: number;
+        stepName: string;
+        clauses: Array<{
+            team: string;
+        } | {
+            user: string;
+        }>;
+        reason: string;
+        timeoutSeconds?: number;
+        payload: {
+            summaryMarkdown: string;
+            drift: unknown;
+        };
+    }) => Promise<StepApprovalResolution>;
 }
 /** Outcome of an awaited step-level approval hold. */
 export interface StepApprovalResolution {

package/dist/execution/sandbox/workflow-runner.d.ts

@@ -13,10 +13,21 @@
  * This file is compiled alongside the agent by rolldown (existing build), but
  * runs as a SEPARATE process spawned by the sandbox backend.
  */
+import { ExecutionJobStatus } from '@kici-dev/engine';
 import type { StepContext } from '@kici-dev/sdk';
+import type { NeedsContext } from '@kici-dev/sdk';
 import type { OutputsMap, StepRefMap, TrackedStepSecrets } from '@kici-dev/sdk';
 import type { RunnerToAgentMessage, JobExecutionRequest } from './ipc-protocol.js';
 import { LogMasker } from './log-masker.js';
+/**
+ * Build `ctx.needs` for a job's steps from the dispatch envelope. Reconstructs
+ * an {@link UpstreamSnapshot} from `upstreamJobOutputs` (flat per single job;
+ * `byMatrix` / `byHost` envelopes per fan-out) + `upstreamJobStatuses` (keyed by
+ * each upstream job/child name), then resolves the job's declared needs into the
+ * `{ result, status }` / ordered-array shape via the shared SDK builder. Returns
+ * undefined when the job declares no needs.
+ */
+export declare function buildStepNeedsContext(declaredNeeds: readonly unknown[] | undefined, upstreamJobOutputs: Record<string, Record<string, unknown>> | undefined, upstreamJobStatuses: Record<string, ExecutionJobStatus> | undefined): NeedsContext | undefined;
 /**
  * Create a StepContext natively inside the workflow runner.
  *

package/dist/index.js

@@ -86,7 +86,8 @@ const envDef = defineEnv({
 		scalerPendingDispatchTimeoutMs: z.coerce.number().default(6e4),
 		executionMode: ExecutionMode.optional(),
 		otelExporterOtlpEndpoint: z.string().optional(),
-		concurrencyWaitTimeoutMs: z.coerce.number().int().min(1e3).default(36e5)
+		concurrencyWaitTimeoutMs: z.coerce.number().int().min(1e3).default(36e5),
+		isOrchestratorHost: z.string().optional().transform((v) => v === "true")
 	}),
 	envMap: {
 		orchestratorUrl: "KICI_ORCHESTRATOR_URL",
@@ -97,6 +98,7 @@ const envDef = defineEnv({
 		port: "KICI_PORT",
 		logLevel: "KICI_LOG_LEVEL",
 		agentToken: "KICI_AGENT_TOKEN",
+		isOrchestratorHost: "KICI_AGENT_IS_ORCHESTRATOR_HOST",
 		githubToken: "KICI_GITHUB_TOKEN",
 		maxLogSizeBytes: "KICI_MAX_LOG_SIZE_BYTES",
 		defaultStepTimeoutMs: "KICI_DEFAULT_STEP_TIMEOUT_MS",

package/dist/server.js

@@ -12,7 +12,7 @@ import winston from "winston";
 import { RingBuffer, addLogsToArchive, chunkBuffer, createHealthRoutes, createLogger, createMeter, createMetricsRoutes, deriveSharedSecret, getPrometheusExporter, getReconnectDelay, getRequestContext, guardStartup, initTelemetry, logger, normalizeLineEndings, redactConfig, requestContext, setServiceName, setupGracefulShutdown, sha256, sha256File, toErrorMessage, validateRequiredTools } from "@kici-dev/shared";
 import { z } from "zod";
 import { LOGGER_ENV_VARS, defineEnv, validateUnknownKiciVars } from "@kici-dev/shared/env";
-import { ALLOWED_SYSTEM_VARS, CacheRunEventType, CacheStepType, ExecutionJobStatus, ExecutionStepStatus, InitFailureCategory, KNOWN_ROLES, PROTOCOL_VERSION, SANDBOX_DEFAULT_VARS, WS_CLOSE_AGENT_AUTH_FAILED, WS_MAX_PAYLOAD_BYTES, applyIncludeExclude, deriveOsArchLabels, expandMatrix, heartbeatSchema, hostLabel, mergeAutoLabels, orchestratorToAgentMessageSchema, parseHostPropertyAssignments, resolveRoleLabels, validateNoReservedLabels } from "@kici-dev/engine";
+import { ALLOWED_SYSTEM_VARS, CacheRunEventType, CacheStepType, ExecutionJobStatus, ExecutionStepStatus, InitFailureCategory, KNOWN_ROLES, PROTOCOL_VERSION, SANDBOX_DEFAULT_VARS, WS_CLOSE_AGENT_AUTH_FAILED, WS_MAX_PAYLOAD_BYTES, applyIncludeExclude, deriveOsArchLabels, expandMatrix, heartbeatSchema, hostLabel, mergeAutoLabels, orchestratorToAgentMessageSchema, parseHostPropertyAssignments, resolveRoleLabels, resolveWhenToRunOn, validateNoReservedLabels } from "@kici-dev/engine";
 import { execFile, execFileSync, execSync, fork, spawn } from "node:child_process";
 import WebSocket from "ws";
 import * as fs$2 from "node:fs";
@@ -102,7 +102,8 @@ const envDef = defineEnv({
 		scalerPendingDispatchTimeoutMs: z.coerce.number().default(6e4),
 		executionMode: ExecutionMode.optional(),
 		otelExporterOtlpEndpoint: z.string().optional(),
-		concurrencyWaitTimeoutMs: z.coerce.number().int().min(1e3).default(36e5)
+		concurrencyWaitTimeoutMs: z.coerce.number().int().min(1e3).default(36e5),
+		isOrchestratorHost: z.string().optional().transform((v) => v === "true")
 	}),
 	envMap: {
 		orchestratorUrl: "KICI_ORCHESTRATOR_URL",
@@ -113,6 +114,7 @@ const envDef = defineEnv({
 		port: "KICI_PORT",
 		logLevel: "KICI_LOG_LEVEL",
 		agentToken: "KICI_AGENT_TOKEN",
+		isOrchestratorHost: "KICI_AGENT_IS_ORCHESTRATOR_HOST",
 		githubToken: "KICI_GITHUB_TOKEN",
 		maxLogSizeBytes: "KICI_MAX_LOG_SIZE_BYTES",
 		defaultStepTimeoutMs: "KICI_DEFAULT_STEP_TIMEOUT_MS",
@@ -286,7 +288,7 @@ var LogBuffer = class extends RingBuffer {
 };
 //#endregion
 //#region src/ws/orchestrator-client.ts
-const logger$11 = createLogger({ prefix: "orchestrator-client" });
+const logger$12 = createLogger({ prefix: "orchestrator-client" });
 /**
 * WebSocket client that connects the agent to the customer orchestrator.
 *
@@ -403,7 +405,7 @@ var OrchestratorClient = class OrchestratorClient {
 	*/
 	connect() {
 		if (this._state !== "disconnected") {
-			logger$11.warn("connect() called while not disconnected", { state: this._state });
+			logger$12.warn("connect() called while not disconnected", { state: this._state });
 			return;
 		}
 		this.intentionalDisconnect = false;
@@ -754,7 +756,8 @@ var OrchestratorClient = class OrchestratorClient {
 				stepName: request.stepName,
 				clauses: request.clauses,
 				reason: request.reason,
-				...request.timeoutSeconds !== void 0 && { timeoutSeconds: request.timeoutSeconds }
+				...request.timeoutSeconds !== void 0 && { timeoutSeconds: request.timeoutSeconds },
+				...request.payload !== void 0 && { payload: request.payload }
 			});
 		});
 	}
@@ -840,7 +843,7 @@ var OrchestratorClient = class OrchestratorClient {
 				}
 			});
 		} catch (err) {
-			logger$11.error("Failed to create WebSocket", { error: toErrorMessage(err) });
+			logger$12.error("Failed to create WebSocket", { error: toErrorMessage(err) });
 			this._state = "disconnected";
 			this.scheduleReconnect();
 			return;
@@ -848,7 +851,7 @@ var OrchestratorClient = class OrchestratorClient {
 		this.ws.on("open", () => {
 			if (this.token) {
 				this._state = "authenticating";
-				logger$11.info("Connected to orchestrator, sending auth.request", {
+				logger$12.info("Connected to orchestrator, sending auth.request", {
 					url: this.url,
 					agentId: this.agentId
 				});
@@ -859,7 +862,7 @@ var OrchestratorClient = class OrchestratorClient {
 				}));
 			} else {
 				this._state = "registering";
-				logger$11.info("Connected to orchestrator, sending agent.register (no token)", {
+				logger$12.info("Connected to orchestrator, sending agent.register (no token)", {
 					url: this.url,
 					agentId: this.agentId
 				});
@@ -870,12 +873,12 @@ var OrchestratorClient = class OrchestratorClient {
 			this.handleMessage(data);
 		});
 		this.ws.on("close", (code, reason) => {
-			logger$11.info("Orchestrator connection closed", {
+			logger$12.info("Orchestrator connection closed", {
 				code,
 				reason: reason.toString()
 			});
 			if (code === WS_CLOSE_AGENT_AUTH_FAILED) {
-				logger$11.error("Orchestrator closed with auth-failed code -- token is invalid or revoked. NOT retrying.", {
+				logger$12.error("Orchestrator closed with auth-failed code -- token is invalid or revoked. NOT retrying.", {
 					code,
 					reason: reason.toString()
 				});
@@ -901,7 +904,7 @@ var OrchestratorClient = class OrchestratorClient {
 			if (!this.intentionalDisconnect) this.scheduleReconnect();
 		});
 		this.ws.on("error", (err) => {
-			logger$11.error(`Orchestrator WebSocket error: ${err.message}`);
+			logger$12.error(`Orchestrator WebSocket error: ${err.message}`);
 			if (this.ws && this.ws.readyState === WebSocket.OPEN) this.ws.close();
 		});
 	}
@@ -910,7 +913,7 @@ var OrchestratorClient = class OrchestratorClient {
 		try {
 			raw = JSON.parse(data.toString());
 		} catch {
-			logger$11.warn("Malformed JSON received from orchestrator");
+			logger$12.warn("Malformed JSON received from orchestrator");
 			return;
 		}
 		const rawMsg = raw;
@@ -968,13 +971,13 @@ var OrchestratorClient = class OrchestratorClient {
 			switch (msg.type) {
 				case "auth.success":
 					if (this._state === "authenticating") {
-						logger$11.info("Authentication successful, sending agent.register", { connectionId: msg.connectionId });
+						logger$12.info("Authentication successful, sending agent.register", { connectionId: msg.connectionId });
 						this._state = "registering";
 						this.sendAgentRegister();
 					}
 					break;
 				case "auth.failure":
-					logger$11.error("Authentication FAILED -- token is invalid or expired. NOT retrying.", { reason: msg.reason });
+					logger$12.error("Authentication FAILED -- token is invalid or expired. NOT retrying.", { reason: msg.reason });
 					this.authFailed = true;
 					this.intentionalDisconnect = true;
 					if (this.ws) {
@@ -984,7 +987,7 @@ var OrchestratorClient = class OrchestratorClient {
 					this._state = "disconnected";
 					break;
 				case "register.ack":
-					logger$11.info("Registration acknowledged by orchestrator", {
+					logger$12.info("Registration acknowledged by orchestrator", {
 						agentId: msg.agentId,
 						labels: msg.labels,
 						scalerManaged: msg.scalerManaged,
@@ -999,14 +1002,14 @@ var OrchestratorClient = class OrchestratorClient {
 					this.sendConfigAck(msg.agentId);
 					break;
 				case "job.dispatch":
-					logger$11.info("Job dispatch received", {
+					logger$12.info("Job dispatch received", {
 						runId: msg.runId,
 						jobId: msg.jobId
 					});
 					this.onJobDispatch(msg);
 					break;
 				case "job.cancel":
-					logger$11.info("Job cancel received", {
+					logger$12.info("Job cancel received", {
 						runId: msg.runId,
 						jobId: msg.jobId,
 						reason: msg.reason
@@ -1014,7 +1017,7 @@ var OrchestratorClient = class OrchestratorClient {
 					this.onJobCancel(msg);
 					break;
 				case "job.concurrency.ack": {
-					logger$11.info("Concurrency ack received", {
+					logger$12.info("Concurrency ack received", {
 						requestId: msg.requestId,
 						action: msg.action
 					});
@@ -1029,7 +1032,7 @@ var OrchestratorClient = class OrchestratorClient {
 					break;
 				}
 				case "step.approval-resolved": {
-					logger$11.info("Step approval resolved", {
+					logger$12.info("Step approval resolved", {
 						requestId: msg.requestId,
 						runId: msg.runId,
 						jobId: msg.jobId,
@@ -1049,7 +1052,7 @@ var OrchestratorClient = class OrchestratorClient {
 					break;
 				}
 				case "fleet.logs.request":
-					logger$11.info("Fleet log collection requested", {
+					logger$12.info("Fleet log collection requested", {
 						requestId: msg.requestId,
 						logWindowHours: msg.logWindowHours
 					});
@@ -1059,7 +1062,7 @@ var OrchestratorClient = class OrchestratorClient {
 			return;
 		}
 		if (heartbeatSchema.safeParse(raw).success) return;
-		logger$11.warn("Invalid message from orchestrator", { errors: parsed.error.issues });
+		logger$12.warn("Invalid message from orchestrator", { errors: parsed.error.issues });
 	}
 	flushBuffer() {
 		const events = this.eventBuffer.flush();
@@ -1073,11 +1076,11 @@ var OrchestratorClient = class OrchestratorClient {
 		}
 		this.disconnectedAt = null;
 		if (events.length > 0) {
-			logger$11.info("Flushing event buffer", { count: events.length });
+			logger$12.info("Flushing event buffer", { count: events.length });
 			for (const msg of events) this.sendDirect(msg);
 		}
 		if (logLines.length > 0) {
-			logger$11.info("Flushing log buffer", { count: logLines.length });
+			logger$12.info("Flushing log buffer", { count: logLines.length });
 			for (let i = 0; i < logLines.length; i += OrchestratorClient.LOG_BATCH_SIZE) {
 				const batch = logLines.slice(i, i + OrchestratorClient.LOG_BATCH_SIZE);
 				this.sendAgentLogMessage(batch);
@@ -1130,14 +1133,14 @@ var OrchestratorClient = class OrchestratorClient {
 	*/
 	blockMmdsAccess() {
 		if (process.getuid?.() !== 0) {
-			logger$11.info("MMDS iptables block skipped (non-root) — network isolation handled by orchestrator");
+			logger$12.info("MMDS iptables block skipped (non-root) — network isolation handled by orchestrator");
 			return;
 		}
 		try {
 			execSync("iptables -A OUTPUT -d 169.254.169.254 -j DROP", { timeout: 5e3 });
-			logger$11.info("MMDS access blocked via iptables");
+			logger$12.info("MMDS access blocked via iptables");
 		} catch (err) {
-			logger$11.warn("Failed to block MMDS access via iptables", { error: toErrorMessage(err) });
+			logger$12.warn("Failed to block MMDS access via iptables", { error: toErrorMessage(err) });
 		}
 	}
 	/**
@@ -1151,7 +1154,7 @@ var OrchestratorClient = class OrchestratorClient {
 				messageId: `config-ack-${agentId}-${Date.now()}`,
 				agentId
 			}));
-			logger$11.info("Config ACK sent to orchestrator", { agentId });
+			logger$12.info("Config ACK sent to orchestrator", { agentId });
 		}
 	}
 	startHeartbeat() {
@@ -1217,12 +1220,12 @@ var OrchestratorClient = class OrchestratorClient {
 	scheduleReconnect() {
 		this.cancelReconnect();
 		if (this.authFailed) {
-			logger$11.error("Not reconnecting: authentication permanently failed");
+			logger$12.error("Not reconnecting: authentication permanently failed");
 			return;
 		}
 		const delay = this.getReconnectDelay();
 		this.reconnectAttempts++;
-		logger$11.info("Scheduling reconnect", {
+		logger$12.info("Scheduling reconnect", {
 			attempt: this.reconnectAttempts,
 			delayMs: Math.round(delay)
 		});
@@ -1307,14 +1310,14 @@ var init_console_capture = __esmMin((() => {
 init_console_capture();
 function safe(name, fallback = "unknown") {
 	switch (name) {
-		case "version": return "0.1.21";
-		case "buildCommit": return "8aeccc2c4";
-		case "sdkVersion": return "0.1.21";
-		case "sdkBundleHash": return "8308089347c304e41b457d3867b17bbff11d6b5cd9706b6823e7abdbd849f33f";
-		case "sharedVersion": return "0.1.21";
+		case "version": return "0.1.22";
+		case "buildCommit": return "5afd16303";
+		case "sdkVersion": return "0.1.22";
+		case "sdkBundleHash": return "4b26a42978f77e29db110d47523ec947d3d673c3109fc48141c1a62814bde7a1";
+		case "sharedVersion": return "0.1.22";
 		case "sharedBundleHash": return "991385c024392c395d3eb8a68946ef8ed3fcba96f2652f21c3164a54eafa1b1b";
-		case "engineVersion": return "0.1.21";
-		case "engineBundleHash": return "1b1f49acbbb66f045cfa8284406fce48de8975d9ec3a5685aff70313cd8232cc";
+		case "engineVersion": return "0.1.22";
+		case "engineBundleHash": return "ff74a3afb2b1db2870c03d47543642f64d04b660bebdcde6681f76d874f26757";
 		default: return fallback;
 	}
 }
@@ -1571,6 +1574,83 @@ async function gcStaleAgentTmpDirs(base = tmpdir()) {
 	})];
 }
 //#endregion
+//#region src/execution/reboot.ts
+/**
+* Cross-OS host reboot for the workflow-level `restartHost()` step.
+*
+* The agent runs ON the host it executes jobs for, so a `restartHost()` step
+* reboots that host. `rebootCommandFor` is the pure OS→command mapping (kept
+* pure for unit-testing); `issueReboot` spawns it detached with a tiny grace so
+* the job's final flush completes before the box goes down.
+*
+* Rebooting needs host privilege (root/admin). If the primitive is denied, the
+* spawn fails and the caller clears the orchestrator's reboot-pending flag and
+* surfaces the error — the deadline sweep is the backstop.
+*/
+const logger$11 = createLogger({ prefix: "reboot" });
+/** The OS reboot primitive for a Node platform string. */
+function rebootCommandFor(platform) {
+	switch (platform) {
+		case "darwin": return {
+			cmd: "shutdown",
+			args: ["-r", "now"]
+		};
+		case "win32": return {
+			cmd: "shutdown",
+			args: [
+				"/r",
+				"/t",
+				"0"
+			]
+		};
+		default: return {
+			cmd: "systemctl",
+			args: ["reboot"]
+		};
+	}
+}
+/**
+* Issue the OS reboot detached. Resolves once the child has been spawned (the
+* box is going down; there is nothing to await). Rejects synchronously if the
+* spawn itself fails (e.g. the binary is missing). A privilege denial usually
+* surfaces as a non-zero exit AFTER spawn — logged, not thrown, because by then
+* the box may already be on its way down.
+*/
+function issueReboot(platform = process.platform) {
+	const { cmd, args } = rebootCommandFor(platform);
+	return new Promise((resolve, reject) => {
+		try {
+			const child = spawn(cmd, args, {
+				detached: true,
+				stdio: "ignore"
+			});
+			child.on("error", (err) => {
+				logger$11.error("Reboot command failed to spawn", {
+					cmd,
+					args,
+					error: String(err)
+				});
+				reject(err);
+			});
+			child.on("exit", (code) => {
+				if (code !== 0 && code !== null) logger$11.warn("Reboot command exited non-zero (privilege denied?)", {
+					cmd,
+					args,
+					code
+				});
+			});
+			child.unref();
+			logger$11.info("Issued host reboot", {
+				cmd,
+				args
+			});
+			setImmediate(resolve);
+		} catch (err) {
+			reject(err);
+		}
+	});
+}
+//#endregion
 //#region src/metrics/prometheus.ts
 var prometheus_exports = /* @__PURE__ */ __exportAll({
 	cloneDurationSeconds: () => cloneDurationSeconds,
@@ -2000,8 +2080,8 @@ async function extractStepsFromDynamicJob(workflow, dynamicIndex, jobName, event
 }
 var AGENT_SDK_VERSION, AGENT_SDK_BUNDLE_HASH, hookRegistered;
 var init_workflow_loader = __esmMin((() => {
-	AGENT_SDK_VERSION = "0.1.21";
-	AGENT_SDK_BUNDLE_HASH = "8308089347c304e41b457d3867b17bbff11d6b5cd9706b6823e7abdbd849f33f";
+	AGENT_SDK_VERSION = "0.1.22";
+	AGENT_SDK_BUNDLE_HASH = "4b26a42978f77e29db110d47523ec947d3d673c3109fc48141c1a62814bde7a1";
 	hookRegistered = false;
 }));
 //#endregion
@@ -2550,7 +2630,8 @@ async function serializeJob(job, generatedNames, ctx, staticNames, allowedGroups
 * Validates against generatedNames union staticNames union allowedGroups.
 *
 * Returns the lock file representation: strings for concrete refs,
-* NeedsEntry for { name, ifFailed }, NeedsGroupEntry for group refs.
+* NeedsEntry for { name, when }, NeedsGroupEntry for group refs (each `when`
+* normalized to a runOn status-set).
 */
 function resolveNeeds(needs, generatedNames, staticNames, allowedGroups) {
 	if (!needs || needs.length === 0) return [];
@@ -2565,7 +2646,7 @@ function resolveNeeds(needs, generatedNames, staticNames, allowedGroups) {
 			if (!allowedGroups.has(groupRef.group)) throw new Error(`Dynamic group '${groupRef.group}' not found in workflow (available groups: ${[...allowedGroups].join(", ") || "none"})`);
 			return {
 				group: groupRef.group,
-				ifFailed: groupRef.ifFailed ?? "skip"
+				runOn: resolveWhenToRunOn(groupRef.when)
 			};
 		}
 		if (typeof dep === "object" && dep !== null && "group" in dep) {
@@ -2573,7 +2654,7 @@ function resolveNeeds(needs, generatedNames, staticNames, allowedGroups) {
 			if (!allowedGroups.has(groupDep.group)) throw new Error(`Dynamic group '${groupDep.group}' not found in workflow (available groups: ${[...allowedGroups].join(", ") || "none"})`);
 			return {
 				group: groupDep.group,
-				ifFailed: groupDep.ifFailed ?? "skip"
+				runOn: resolveWhenToRunOn(groupDep.when)
 			};
 		}
 		if (typeof dep === "object" && dep !== null && "name" in dep && !("steps" in dep)) {
@@ -2581,7 +2662,7 @@ function resolveNeeds(needs, generatedNames, staticNames, allowedGroups) {
 			if (!allNames.has(namedDep.name)) throw new Error(`Job dependency '${namedDep.name}' not found in workflow jobs (checked: ${generatedNames.size} generated, ${staticNames.size} static)`);
 			return {
 				name: namedDep.name,
-				ifFailed: namedDep.ifFailed ?? "skip"
+				runOn: resolveWhenToRunOn(namedDep.when)
 			};
 		}
 		if (isDynamicJobFn(dep)) throw new Error("Job dependency cannot be a DynamicJobFn");
@@ -4212,6 +4293,8 @@ function buildRequest(dispatch, workDir) {
 		concurrencyEvaluationTimeoutMs: jobConfig.concurrencyEvaluationTimeoutMs,
 		branch: dispatch.ref,
 		upstreamJobOutputs: dispatch.upstreamJobOutputs,
+		upstreamJobStatuses: dispatch.upstreamJobStatuses,
+		jobNeeds: jobConfig.needs,
 		npmRegistries: dispatch.npmRegistries,
 		installEnvSecrets: dispatch.installEnvSecrets,
 		jobIdShort: dispatch.jobId.slice(0, 8),
@@ -5394,7 +5477,10 @@ var init_sandbox = __esmMin((() => {
 }));
 //#endregion
 //#region src/execution/job-runner.ts
-var job_runner_exports = /* @__PURE__ */ __exportAll({ JobRunner: () => JobRunner$1 });
+var job_runner_exports = /* @__PURE__ */ __exportAll({
+	JobRunner: () => JobRunner$1,
+	buildEvalNeedsContext: () => buildEvalNeedsContext
+});
 /**
 * Check if a file exists at the given path.
 */
@@ -6425,14 +6511,14 @@ var init_job_runner = __esmMin((() => {
 */
 init_console_capture();
 init_npm_resolver();
-const AGENT_VERSION = "0.1.21";
-const BUILD_COMMIT = "8aeccc2c4";
-const SDK_VERSION = "0.1.21";
-const SDK_BUNDLE_HASH = "8308089347c304e41b457d3867b17bbff11d6b5cd9706b6823e7abdbd849f33f";
-const SHARED_VERSION = "0.1.21";
+const AGENT_VERSION = "0.1.22";
+const BUILD_COMMIT = "5afd16303";
+const SDK_VERSION = "0.1.22";
+const SDK_BUNDLE_HASH = "4b26a42978f77e29db110d47523ec947d3d673c3109fc48141c1a62814bde7a1";
+const SHARED_VERSION = "0.1.22";
 const SHARED_BUNDLE_HASH = "991385c024392c395d3eb8a68946ef8ed3fcba96f2652f21c3164a54eafa1b1b";
-const ENGINE_VERSION = "0.1.21";
-const ENGINE_BUNDLE_HASH = "1b1f49acbbb66f045cfa8284406fce48de8975d9ec3a5685aff70313cd8232cc";
+const ENGINE_VERSION = "0.1.22";
+const ENGINE_BUNDLE_HASH = "ff74a3afb2b1db2870c03d47543642f64d04b660bebdcde6681f76d874f26757";
 initTelemetry({
 	serviceName: "kici-agent",
 	otlpEndpoint: process.env.OTEL_EXPORTER_OTLP_ENDPOINT
@@ -6498,6 +6584,7 @@ await guardStartup(logger$1, async () => {
 	}
 	let isDraining = false;
 	let idleShutdownTimer;
+	let rebootIntent = false;
 	let client;
 	const jobRunner = new JobRunner({
 		send: (msg) => client.send(msg),
@@ -6511,7 +6598,15 @@ await guardStartup(logger$1, async () => {
 		sendJobContext: (runId, jobId, context) => client.sendJobContext(runId, jobId, context),
 		sendRunEvent: (runId, eventType, opts) => client.sendRunEvent(runId, eventType, opts),
 		sendConcurrencyReport: (runId, jobId, group) => client.sendConcurrencyReport(runId, jobId, group),
-		sendApiRequest: (method, params) => client.sendApiRequest(method, params ?? {}),
+		sendApiRequest: async (method, params) => {
+			if (method === "host.requestReboot") {
+				if (config.isOrchestratorHost) throw new Error("refusing to reboot the orchestrator host");
+				const result = await client.sendApiRequest(method, params ?? {});
+				rebootIntent = true;
+				return result;
+			}
+			return client.sendApiRequest(method, params ?? {});
+		},
 		requestUserCache: (jobId, request) => client.requestUserCache(jobId, request),
 		relayProvenance: (jobId, request) => client.relayProvenance(jobId, request),
 		sendStepApproval: (runId, jobId, request) => client.sendStepApproval(runId, jobId, request)
@@ -6600,6 +6695,13 @@ await guardStartup(logger$1, async () => {
 					jobsActive.add(-1);
 					metricsReporter.collectAndSend().catch(() => {});
 					sendAgentStatus();
+					if (rebootIntent) {
+						rebootIntent = false;
+						issueReboot().catch((err) => {
+							logger$1.error("Host reboot failed; cancelling reboot-pending flag", { error: toErrorMessage(err) });
+							client.sendApiRequest("host.cancelReboot", {}).catch(() => {});
+						});
+					}
 					if (config.scalerManaged && jobRunner.activeJobs.size === 0) {
 						if (client.state !== "registered") {
 							logger$1.info("Scaler-managed agent idle but disconnected, deferring shutdown until reconnected");