@kici-dev/agent 0.1.23 → 0.1.24

package/dist/execution/cache/cache-phase.d.ts

@@ -10,20 +10,37 @@ export interface CachePhaseDeps {
     cache: CacheApi;
     /** Emit a runner→agent IPC message (the masked send). */
     sendIpc: (msg: RunnerToAgentMessage) => void;
-    /** Monotonic pseudo-step index allocator (continues after real steps + hooks). */
-    nextStepIndex: () => number;
+    /**
+     * Allocate the next cache pseudo-step index for `ownerStepIndex` (the real
+     * step the cache op belongs to, or {@link JOB_CACHE_OWNER} for job-level
+     * cache). Each owner draws from a disjoint block above every real-step and
+     * hook index, so two concurrently-running steps' cache pseudo-steps never
+     * collide.
+     */
+    nextStepIndex: (ownerStepIndex: number) => number;
 }
+/** Owner sentinel for job-level (not step-scoped) cache restore/save. */
+export declare const JOB_CACHE_OWNER = -1;
+/**
+ * Build the cache pseudo-step index allocator. Each owner (a real step index, or
+ * {@link JOB_CACHE_OWNER}) gets its own disjoint block of {@link CACHE_INDEX_BLOCK}
+ * indices, all above every real-step and hook index (`stepCount * 3 + 100`). A
+ * step's two-or-more cache pseudo-steps are a pure function of its own owner
+ * index, so concurrent children never collide. Under sequential execution the
+ * emitted indices stay above all real/hook indices exactly as before.
+ */
+export declare function createCacheStepIndexAllocator(stepCount: number): (ownerStepIndex: number) => number;
 /**
  * Restore every spec, surfacing each as a `cache:restore` pseudo-step. Returns
  * a map keyed by spec key recording whether the EXACT key hit (so the save
  * phase can skip a redundant save of an entry that already exists).
  */
-export declare function restoreCacheSpecs(specs: CacheSpec[], deps: CachePhaseDeps): Promise<Map<string, CacheRestoreOutcome>>;
+export declare function restoreCacheSpecs(specs: CacheSpec[], deps: CachePhaseDeps, ownerStepIndex: number): Promise<Map<string, CacheRestoreOutcome>>;
 /**
  * Save every spec whose EXACT key did not already hit on restore (immutable +
  * no redundant save), surfacing each as a `cache:save` pseudo-step. A spec
  * whose restore matched a different key via a `restoreKeys` prefix is still
  * saved under its exact key.
  */
-export declare function saveCacheSpecs(specs: CacheSpec[], restoreResults: Map<string, CacheRestoreOutcome>, deps: CachePhaseDeps): Promise<void>;
+export declare function saveCacheSpecs(specs: CacheSpec[], restoreResults: Map<string, CacheRestoreOutcome>, deps: CachePhaseDeps, ownerStepIndex: number): Promise<void>;
 //# sourceMappingURL=cache-phase.d.ts.map

package/dist/execution/cache/index.d.ts

@@ -5,5 +5,5 @@
  * `ctx.cache` API factory plus its transport interface.
  */
 export { createCacheApi, packCachePaths, extractCacheTarball, downloadAndExtractCache, resolveCachePath, type CacheTransport, type CacheRoots, } from './cache-engine.js';
-export { restoreCacheSpecs, saveCacheSpecs, type CachePhaseDeps, type CacheRestoreOutcome, } from './cache-phase.js';
+export { restoreCacheSpecs, saveCacheSpecs, createCacheStepIndexAllocator, JOB_CACHE_OWNER, type CachePhaseDeps, type CacheRestoreOutcome, } from './cache-phase.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/execution/init-runner.d.ts

@@ -5,7 +5,8 @@ import { type MatrixValues } from '@kici-dev/engine';
  * Only fields that were flagged as dynamic and successfully resolved are set.
  */
 export interface InitResult {
-    environmentName?: string;
+    /** Resolved bound-environment names, in merge order (one per `environments` element). */
+    environmentNames?: string[];
     env?: Record<string, string>;
     concurrencyGroup?: string;
     /**

package/dist/execution/sandbox/capture-context.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Run `fn` with `stepIndex` as the active console-capture attribution for the
+ * duration of its async execution (including everything it awaits).
+ */
+export declare function runInStepCapture<T>(stepIndex: number, fn: () => Promise<T>): Promise<T>;
+/**
+ * The step index whose run is currently on the async stack, or `-1` when no
+ * capture scope is active (workflow-level / between-steps output).
+ */
+export declare function currentCaptureStepIndex(): number;
+//# sourceMappingURL=capture-context.d.ts.map

package/dist/execution/sandbox/ipc-protocol.d.ts

@@ -24,13 +24,27 @@ interface StepStartMessage {
     stepName: string;
     /** Distinguishes regular steps from hook executions (e.g., 'hook:onCancel', 'hook:cleanup'). Defaults to 'step'. */
     step_type?: string;
+    /**
+     * Initial state for the step. Defaults to `running`. A parallel-group child
+     * queued behind `maxParallel` is announced as `pending` before it acquires a
+     * slot; it later emits a second `step.start` with `running` when it launches.
+     */
+    state?: 'running' | 'pending';
+    /** Step concurrency role; absent means an ordinary sequential step. */
+    concurrencyKind?: string;
+    /** Parallel-group correlation id shared by a group's children (e.g. `g0`). */
+    groupId?: string;
 }
-/** A step has completed (success, failure, or a check-mode skip). */
+/** A step has completed (success, failure, check-mode skip, or fail-fast cancel). */
 interface StepCompleteMessage {
     type: 'step.complete';
     stepIndex: number;
-    status: 'success' | 'failed' | 'skipped';
+    status: 'success' | 'failed' | 'skipped' | 'cancelled';
     durationMs: number;
+    /** Step concurrency role; absent means an ordinary sequential step. */
+    concurrencyKind?: string;
+    /** Parallel-group correlation id shared by a group's children (e.g. `g0`). */
+    groupId?: string;
     error?: {
         message: string;
         exitCode?: number;
@@ -454,7 +468,7 @@ export interface JobExecutionRequest {
     provider?: string;
     /** Whether to checkout the repo (default: true). */
     checkout?: boolean;
-    /** Whether this job is part of a test run triggered by `kici test`. */
+    /** Whether this job is part of a developer-initiated run triggered by `kici run`. */
     isTestRun?: boolean;
     /**
      * Run mode for idempotent steps (`apply` | `check` | `check-fail-on-drift`).

package/dist/execution/sandbox/parallel-scheduler.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Concurrency-aware scheduler for `parallel()` step groups.
+ *
+ * A parallel group's children each run as their own observable step (own logs,
+ * status, timing, retry, cache, hooks — all task-scoped by the Phase 0 per-task
+ * isolation) through the same `runStepIteration` machinery the sequential loop
+ * uses. Children launch behind a `maxParallel` window (queued children report
+ * `pending`); the group joins at a barrier. On the first non-`continueOnError`
+ * child failure when `failFast`, every in-flight sibling's per-task abort
+ * controller is fired so its step race rejects and it is reported `cancelled`
+ * (which is NOT a failure).
+ */
+import { type StepLoopOptions, type StepNode } from './step-loop.js';
+import type { SandboxStepResult } from './types.js';
+type ParallelNode = Extract<StepNode, {
+    kind: 'parallel';
+}>;
+/** Outcome of running one parallel group. */
+export interface ParallelGroupOutcome {
+    /** True when at least one non-`continueOnError` child failed. */
+    failed: boolean;
+    /** Name of the first failing child (drives the job failure reason). */
+    failedStepName?: string;
+    /** Per-child results, in child array order. */
+    results: SandboxStepResult[];
+}
+/**
+ * Run a parallel group: launch children with a bounded-concurrency window, join
+ * at a barrier, and fail-fast-cancel in-flight siblings on the first hard
+ * failure.
+ */
+export declare function runParallelGroup(node: ParallelNode, opts: StepLoopOptions): Promise<ParallelGroupOutcome>;
+export {};
+//# sourceMappingURL=parallel-scheduler.d.ts.map

package/dist/execution/sandbox/step-loop.d.ts

@@ -10,6 +10,36 @@ import { CheckMode } from '@kici-dev/engine';
 import type { RunnerToAgentMessage } from './ipc-protocol.js';
 import type { SandboxStepResult } from './types.js';
 import { type CachePhaseDeps } from '../cache/index.js';
+/**
+ * Thrown inside the step race when a step's own per-task abort controller fires
+ * (parallel fail-fast cancels an in-flight sibling). Distinguished from a
+ * timeout/job-deadline reject so the loop reports the step as `cancelled`
+ * (which is NOT a failure) rather than `failed`.
+ */
+export declare class StepCancelledError extends Error {
+    readonly name = "StepCancelledError";
+    constructor(stepName: string);
+}
+/**
+ * A node in the concurrency-aware step walk. A `sequential` node is one ordinary
+ * step; a `parallel` node is a `parallel()` group whose children each carry their
+ * own flat `stepIndex` (the group wrapper consumes no index).
+ */
+export type StepNode = {
+    kind: 'sequential';
+    step: Step;
+    stepIndex: number;
+} | {
+    kind: 'parallel';
+    groupId: string;
+    name: string;
+    failFast: boolean;
+    maxParallel?: number;
+    children: {
+        step: Step;
+        stepIndex: number;
+    }[];
+};
 /** Job-level hooks passed to the step loop. */
 export interface JobHooks {
     beforeStep?: HookInput;
@@ -21,7 +51,32 @@ export interface JobHooks {
 }
 /** Options for the step execution loop. */
 export interface StepLoopOptions {
+    /**
+     * Flat list of every executable step (sequential steps + parallel-group
+     * children inlined in flat-stepIndex order). `steps.length` is the flat step
+     * count used to derive hook pseudo-indices. The structural walk order (which
+     * entries are grouped) is carried separately by `stepNodes`.
+     */
     steps: Step[];
+    /**
+     * Structural walk order: sequential steps and parallel groups in array order.
+     * When present, the loop walks these nodes (dispatching parallel groups to the
+     * concurrency-aware scheduler); when absent, it walks `steps` sequentially with
+     * the array index as the stepIndex (unit-harness back-compat).
+     */
+    stepNodes?: StepNode[];
+    /**
+     * Abort the per-task controller for `stepIndex` (parallel fail-fast). Wired to
+     * the workflow-runner's `stepAbortControllers` map so an aborted sibling's
+     * `ctx.signal` fires and its step race rejects with {@link StepCancelledError}.
+     */
+    abortStep?: (stepIndex: number) => void;
+    /**
+     * Returns the per-task abort signal for `stepIndex` (the same controller
+     * `abortStep` triggers). The step race watches it so a fail-fast abort
+     * interrupts an in-flight step even if its body ignores `ctx.signal`.
+     */
+    getStepAbortSignal?: (stepIndex: number) => AbortSignal | undefined;
     /**
      * Run mode for idempotent steps. `apply` (default) converges; `check` /
      * `check-fail-on-drift` preview drift and never invoke a checked step's apply.
@@ -29,6 +84,12 @@ export interface StepLoopOptions {
     checkMode?: CheckMode;
     /** Factory that creates a StepContext for a given step index and name. */
     createStepContext: (stepIndex: number, stepName: string) => StepContext;
+    /**
+     * Run `fn` inside the step's console-capture scope so any console output it
+     * (or its hooks) produces attributes to `stepIndex`. Defaults to calling `fn`
+     * directly when absent (unit harnesses without capture wiring).
+     */
+    runWithStepCapture?: <T>(stepIndex: number, fn: () => Promise<T>) => Promise<T>;
     sendIpc: (msg: RunnerToAgentMessage) => void;
     defaultTimeoutMs: number;
     outputsMap: OutputsMap;
@@ -63,36 +124,38 @@ export interface StepLoopOptions {
     /** Job start time (epoch ms) for outcome metadata duration. */
     startTime?: number;
     /**
-     * Returns the secret key names accessed by the most recently created step context.
-     * Called after each step completes to include in step.complete IPC messages.
+     * Returns the secret key names accessed by the step context created for
+     * `stepIndex`. Called after each step completes to include in step.complete
+     * IPC messages.
      */
-    getSecretsAccessLog?: () => string[];
+    getSecretsAccessLog?: (stepIndex: number) => string[];
     /**
-     * Tear down per-step state created by the most recent `createStepContext`
-     * call. Invoked from the step-loop's `finally` after the step completes
+     * Tear down per-step state created by the `createStepContext` call for
+     * `stepIndex`. Invoked from the step-loop's `finally` after the step completes
      * (success, failure, rule-skip, or timeout) so resources like the
      * `ctx.secrets.mountFile` tmpdir get removed even on the failure paths.
      * Never throws -- errors are logged by the wired implementation.
      */
-    disposeStepResources?: () => Promise<void>;
+    disposeStepResources?: (stepIndex: number) => Promise<void>;
     /**
-     * Returns the IPC `step.secret_mount` records collected by the most
-     * recently created step context. Emitted on step completion so the
-     * orchestrator can persist the audit trail alongside `secretsAccessed`.
+     * Returns the IPC `step.secret_mount` records collected by the step context
+     * created for `stepIndex`. Emitted on step completion so the orchestrator can
+     * persist the audit trail alongside `secretsAccessed`.
      */
-    getSecretMountRecords?: () => StepSecretMountRecord[];
+    getSecretMountRecords?: (stepIndex: number) => StepSecretMountRecord[];
     /**
      * Before a step's run function executes, point KICI_ENV / KICI_PATH at fresh
-     * temp files for this step. Invoked once per executed step (NOT for rule-skipped
+     * temp files for this step (keyed by `stepIndex` so concurrent steps never
+     * share a delta file). Invoked once per executed step (NOT for rule-skipped
      * steps). The workflow-runner owns the file lifecycle.
      */
-    beforeStepEnvFiles?: () => Promise<void>;
+    beforeStepEnvFiles?: (stepIndex: number) => Promise<void>;
     /**
-     * After a step's run function completes (success OR failure), read the
-     * KICI_ENV / KICI_PATH files, apply the delta via applyEnvDelta, and truncate
-     * them for the next step. Never throws -- errors are logged by the wired impl.
+     * After a step's run function completes (success OR failure), read this
+     * step's KICI_ENV / KICI_PATH files, apply the delta via applyEnvDelta, and
+     * release them. Never throws -- errors are logged by the wired impl.
      */
-    afterStepApplyEnvFiles?: () => Promise<void>;
+    afterStepApplyEnvFiles?: (stepIndex: number) => Promise<void>;
     /**
      * Block an `approval` step (`when: 'always'`) pending an orchestrator-side
      * approval hold. The runner sends the normalized requirement and awaits the
@@ -145,6 +208,18 @@ interface StepLoopResult {
     stepResults: SandboxStepResult[];
     failureReason?: string;
 }
+/**
+ * Per-step iteration outcome returned by `runStepIteration`.
+ */
+export interface StepIterationOutcome {
+    /** The result to append to the running stepResults list. */
+    result: SandboxStepResult;
+    /** When true, the loop must break (failed step without continueOnError). */
+    shouldBreak: boolean;
+    /** Set when the step failed; carried into completion-hook outcome metadata. */
+    failedStepName?: string;
+}
+export declare function runStepIteration(step: Step, stepIndex: number, opts: StepLoopOptions): Promise<StepIterationOutcome>;
 /**
  * Execute the step loop with hook integration and step-level rule evaluation.
  *

package/dist/execution/sandbox/step-task-registry.d.ts

@@ -0,0 +1,26 @@
+import type { StepSecretMountRecord, TrackedStepSecrets } from '@kici-dev/sdk';
+/** Per-step secrets handle + its teardown closure, keyed by step index. */
+export interface StepTaskSlot {
+    secrets: TrackedStepSecrets;
+    dispose: () => Promise<void>;
+}
+/**
+ * Per-task replacement for the runner's former `currentStepSecrets` /
+ * `currentStepDispose` single-slots.
+ *
+ * The runner used to remember only the *most recent* step's secrets handle and
+ * dispose closure; the access-log / mount-record / dispose reader callbacks read
+ * that single slot. Under sequential execution that is correct (one step at a
+ * time), but two concurrently-running steps would clobber each other's
+ * secrets-audit trail. Keying every slot by the step's index keeps each step's
+ * audit trail and teardown isolated — sequential behavior is identical, Phase 1
+ * concurrency is correct.
+ */
+export declare class StepTaskRegistry {
+    #private;
+    set(stepIndex: number, slot: StepTaskSlot): void;
+    getAccessLog(stepIndex: number): string[];
+    getMountRecords(stepIndex: number): StepSecretMountRecord[];
+    dispose(stepIndex: number): Promise<void>;
+}
+//# sourceMappingURL=step-task-registry.d.ts.map

package/dist/execution/sandbox/types.d.ts

@@ -150,8 +150,8 @@ export interface SandboxStepResult {
     name: string;
     /** Zero-based index of the step within the job. */
     stepIndex: number;
-    /** Step execution status. */
-    status: 'success' | 'failed' | 'skipped';
+    /** Step execution status. `cancelled` = a parallel sibling fail-fast cancel. */
+    status: 'success' | 'failed' | 'skipped' | 'cancelled';
     /** Step duration in milliseconds. */
     durationMs: number;
     /** Error details when status is 'failed'. */

package/dist/execution/sandbox/workflow-runner.d.ts

@@ -35,7 +35,7 @@ export declare function buildStepNeedsContext(declaredNeeds: readonly unknown[]
  * NOT serialized across the process boundary. This means zx $ runs natively
  * inside this process with full shell access.
  */
-export declare function createSandboxStepContext(workDir: string, stepIndex: number, stepName: string, request: JobExecutionRequest, maskedSendFn: (msg: RunnerToAgentMessage) => void, outputsMap: OutputsMap, refMap: StepRefMap, operatorSecretKeys: Set<string>, secretOutputs: Map<string, string>, jobOutputsMap: OutputsMap, secrets: TrackedStepSecrets, masker: LogMasker): StepContext;
+export declare function createSandboxStepContext(workDir: string, stepIndex: number, stepName: string, request: JobExecutionRequest, maskedSendFn: (msg: RunnerToAgentMessage) => void, outputsMap: OutputsMap, refMap: StepRefMap, operatorSecretKeys: Set<string>, secretOutputs: Map<string, string>, jobOutputsMap: OutputsMap, secrets: TrackedStepSecrets, masker: LogMasker, signal: AbortSignal): StepContext;
 /**
  * Derive the fan-out position (`ctx.fanout`) from a dispatch request. Returns
  * `undefined` for a non-fan-out job (no `fanoutTotal`), so `ctx.fanout` is only
@@ -44,4 +44,25 @@ export declare function createSandboxStepContext(workDir: string, stepIndex: num
 export declare function deriveFanout(request: JobExecutionRequest): FanoutPosition | undefined;
 /** Raw provider webhook body for ctx.rawPayload — nested in the envelope. */
 export declare function rawPayloadFromEvent(event: Record<string, unknown> | undefined): Record<string, unknown> | undefined;
+/**
+ * Build the step loop's KICI_ENV/KICI_PATH callbacks with a per-step delta-file
+ * pair (keyed by step index). `beforeStepEnvFiles(stepIndex)` lazily creates the
+ * step's pair and points the runner's process.env at it (each step's zx $
+ * snapshots process.env at context creation, which happens AFTER this
+ * before-hook, so the shell sees them; the pre-fork env allowlist does not
+ * re-filter runtime-set vars). `afterStepApplyEnvFiles(stepIndex)` applies that
+ * step's delta and releases the pair.
+ *
+ * Env-isolation contract: under sequential execution this is identical to a
+ * single shared pair truncated between steps — each step still sees only its own
+ * delta. The pair is now per-step so two concurrently-running steps cannot
+ * corrupt each other's delta file. `process.env.KICI_ENV` / `process.env.KICI_PATH`
+ * remain process-global, so Phase 1 forbids `setEnv` / `addPath` / `$KICI_ENV`
+ * writes inside `parallel()` children (compile-time validation); Phase 0 only
+ * makes the file pair per-task.
+ */
+export declare function buildStepEnvFileHooks(operatorSecretKeys: Set<string>, maskedSend: (msg: RunnerToAgentMessage) => void): {
+    beforeStepEnvFiles: (stepIndex: number) => Promise<void>;
+    afterStepApplyEnvFiles: (stepIndex: number) => Promise<void>;
+};
 //# sourceMappingURL=workflow-runner.d.ts.map

package/dist/server.js

@@ -25,7 +25,7 @@ import { format, promisify } from "node:util";
 import { gcStaleTmpDirs } from "@kici-dev/core/tmp-gc";
 import fs$1, { access, lstat, mkdir, mkdtemp, readFile, readdir, realpath, rm, unlink, writeFile } from "node:fs/promises";
 import Docker from "dockerode";
-import { buildKiciApi, buildNeedsContext, isDynamicGroupRef, isDynamicJobFn, isStaticArray, isStaticObject } from "@kici-dev/sdk";
+import { buildKiciApi, buildNeedsContext, isDynamicGroupRef, isDynamicJobFn, isParallelGroup, isStaticArray, isStaticObject } from "@kici-dev/sdk";
 import { c, x } from "tar";
 import https from "node:https";
 import http from "node:http";
@@ -1310,14 +1310,14 @@ var init_console_capture = __esmMin((() => {
 init_console_capture();
 function safe(name, fallback = "unknown") {
 	switch (name) {
-		case "version": return "0.1.23";
-		case "buildCommit": return "4465935bb";
-		case "sdkVersion": return "0.1.23";
-		case "sdkBundleHash": return "3a83610d2d122b9f9b0f924b225a47050d0b35f00a8f3256a3e15f3ff3bf7ddc";
-		case "sharedVersion": return "0.1.23";
-		case "sharedBundleHash": return "991385c024392c395d3eb8a68946ef8ed3fcba96f2652f21c3164a54eafa1b1b";
-		case "engineVersion": return "0.1.23";
-		case "engineBundleHash": return "4a0566c709180a6a8744ff3281640e596b8e661ddceb81327cd37d232d9768d5";
+		case "version": return "0.1.24";
+		case "buildCommit": return "73592f67f";
+		case "sdkVersion": return "0.1.24";
+		case "sdkBundleHash": return "031712cf8cd02f483365113aad7e946da982110d544b177eb05edcc0d4421253";
+		case "sharedVersion": return "0.1.24";
+		case "sharedBundleHash": return "b977224129c767c4851458a795fa470264b2fc51255baf06cf14640e29e2f44c";
+		case "engineVersion": return "0.1.24";
+		case "engineBundleHash": return "734acca885cd70eed07a1a9426b08c04c07a9bf99484c18100d3d797b3eb8f39";
 		default: return fallback;
 	}
 }
@@ -2080,8 +2080,8 @@ async function extractStepsFromDynamicJob(workflow, dynamicIndex, jobName, event
 }
 var AGENT_SDK_VERSION, AGENT_SDK_BUNDLE_HASH, hookRegistered;
 var init_workflow_loader = __esmMin((() => {
-	AGENT_SDK_VERSION = "0.1.23";
-	AGENT_SDK_BUNDLE_HASH = "3a83610d2d122b9f9b0f924b225a47050d0b35f00a8f3256a3e15f3ff3bf7ddc";
+	AGENT_SDK_VERSION = "0.1.24";
+	AGENT_SDK_BUNDLE_HASH = "031712cf8cd02f483365113aad7e946da982110d544b177eb05edcc0d4421253";
 	hookRegistered = false;
 }));
 //#endregion
@@ -2548,9 +2548,16 @@ async function evaluateDynamicFields(workflow, jobName, event, flags, timeoutMs
 		if (job.include || job.exclude) combos = applyIncludeExclude(combos, job.include, job.exclude);
 		result.matrixValues = combos;
 	}
-	if (flags.dynamicEnvironment && typeof job.environment === "function") {
-		const value = await withTimeout(() => job.environment(event), timeoutMs, `dynamicEnvironment for job '${jobName}'`);
-		if (value !== void 0 && value !== null) result.environmentName = value;
+	if (flags.dynamicEnvironment) {
+		const envRefs = job.environments ?? (job.environment !== void 0 ? [job.environment] : void 0);
+		if (envRefs && envRefs.length > 0) {
+			const names = [];
+			for (const ref of envRefs) if (typeof ref === "function") {
+				const value = await withTimeout(() => ref(event), timeoutMs, `dynamicEnvironment for job '${jobName}'`);
+				if (value !== void 0 && value !== null) names.push(value);
+			} else if (typeof ref === "string") names.push(ref);
+			if (names.length > 0) result.environmentNames = names;
+		}
 	}
 	if (flags.dynamicEnv && typeof job.env === "function") {
 		const value = await withTimeout(() => job.env(event), timeoutMs, `dynamicEnv for job '${jobName}'`);
@@ -2857,11 +2864,22 @@ async function serializeJobsToLock(jobs, ctx, staticNames, allowedGroups) {
 }
 async function serializeJob(job, generatedNames, ctx, staticNames, allowedGroups) {
 	const { include: runsOn, exclude: excludeLabels } = normalizeRunsOnToMatchers(job.runsOn, `generated job '${job.name}' runsOn`);
-	let resolvedEnvironment;
-	if (typeof job.environment === "function") {
-		const value = await withTimeout(() => job.environment(ctx.event), DYNAMIC_FIELD_TIMEOUT_MS, `dynamic environment for generated job '${job.name}'`);
-		if (value !== void 0 && value !== null) resolvedEnvironment = value;
-	} else if (typeof job.environment === "string") resolvedEnvironment = job.environment;
+	const envRefs = job.environments ?? (job.environment !== void 0 ? [job.environment] : void 0);
+	let resolvedEnvironments;
+	if (envRefs !== void 0 && envRefs.length > 0) {
+		const resolved = [];
+		for (const ref of envRefs) if (typeof ref === "function") {
+			const value = await withTimeout(() => ref(ctx.event), DYNAMIC_FIELD_TIMEOUT_MS, `dynamic environment for generated job '${job.name}'`);
+			if (value !== void 0 && value !== null) resolved.push({
+				value,
+				dynamic: false
+			});
+		} else if (typeof ref === "string") resolved.push({
+			value: ref,
+			dynamic: false
+		});
+		if (resolved.length > 0) resolvedEnvironments = resolved;
+	}
 	let resolvedEnv;
 	if (typeof job.env === "function") {
 		const value = await withTimeout(() => job.env(ctx.event), DYNAMIC_FIELD_TIMEOUT_MS, `dynamic env for generated job '${job.name}'`);
@@ -2887,7 +2905,7 @@ async function serializeJob(job, generatedNames, ctx, staticNames, allowedGroups
 		...job.include ? { include: job.include } : {},
 		...job.exclude ? { exclude: job.exclude } : {},
 		...job.description ? { description: job.description } : {},
-		...resolvedEnvironment !== void 0 ? { environment: resolvedEnvironment } : {},
+		...resolvedEnvironments !== void 0 ? { environments: resolvedEnvironments } : {},
 		...resolvedEnv !== void 0 ? { env: resolvedEnv } : {},
 		...resolvedConcurrencyGroup !== void 0 ? { concurrencyGroup: resolvedConcurrencyGroup } : {}
 	};
@@ -2945,26 +2963,41 @@ function resolveNeeds(needs, generatedNames, staticNames, allowedGroups) {
 * are loaded from the workflow bundle at execution time.
 */
 function serializeSteps(steps) {
-	return steps.map((stepOrFn, index) => {
-		if (typeof stepOrFn === "function") return {
-			name: `step-${index}`,
-			hasOutputs: false
-		};
-		const step = stepOrFn;
-		return {
-			name: step.name || `step-${index}`,
-			hasOutputs: !!step.outputs,
-			...step.continueOnError ? { continueOnError: true } : {},
-			...step.timeout ? { timeout: step.timeout } : {},
-			...step.retry ? { retry: {
-				maxAttempts: step.retry.maxAttempts,
-				delayMs: step.retry.delayMs,
-				backoff: step.retry.backoff,
-				maxDelayMs: step.retry.maxDelayMs
-			} } : {}
-		};
+	let flatIndex = 0;
+	return steps.map((entry) => {
+		if (isParallelGroup(entry)) {
+			const children = entry.steps.map((child) => serializeSequentialStep(child, flatIndex++));
+			return {
+				kind: "parallel",
+				name: entry.name ?? `parallel-${children[0]?.name ?? "group"}`,
+				failFast: entry.failFast,
+				...entry.maxParallel !== void 0 ? { maxParallel: entry.maxParallel } : {},
+				children
+			};
+		}
+		return serializeSequentialStep(entry, flatIndex++);
 	});
 }
+/** Serialize one sequential step (or bare function) to a flat `LockStep`. */
+function serializeSequentialStep(stepOrFn, index) {
+	if (typeof stepOrFn === "function") return {
+		name: `step-${index}`,
+		hasOutputs: false
+	};
+	const step = stepOrFn;
+	return {
+		name: step.name || `step-${index}`,
+		hasOutputs: !!step.outputs,
+		...step.continueOnError ? { continueOnError: true } : {},
+		...step.timeout ? { timeout: step.timeout } : {},
+		...step.retry ? { retry: {
+			maxAttempts: step.retry.maxAttempts,
+			delayMs: step.retry.delayMs,
+			backoff: step.retry.backoff,
+			maxDelayMs: step.retry.maxDelayMs
+		} } : {}
+	};
+}
 /**
 * Serialize matrix configuration. Static array/object matrices are embedded as-is;
 * dynamic matrix functions are invoked against the eval context (mirroring the
@@ -4883,10 +4916,17 @@ function relayChildIpcMessage(msg, dispatch, ctx) {
 		case "log.line":
 			ctx.execOptions.onLogLine(msg.stepIndex, msg.line);
 			return;
-		case "step.start":
+		case "step.start": {
 			ctx.stepNames.set(msg.stepIndex, msg.stepName);
-			ctx.execOptions.onStepStatus(msg.stepIndex, msg.stepName, ExecutionStepStatus.enum.running);
+			const startState = msg.state === "pending" ? ExecutionStepStatus.enum.pending : ExecutionStepStatus.enum.running;
+			const startData = {
+				...msg.concurrencyKind && { concurrencyKind: msg.concurrencyKind },
+				...msg.groupId && { groupId: msg.groupId }
+			};
+			if (Object.keys(startData).length > 0) ctx.execOptions.onStepStatus(msg.stepIndex, msg.stepName, startState, startData);
+			else ctx.execOptions.onStepStatus(msg.stepIndex, msg.stepName, startState);
 			return;
+		}
 		case "step.complete":
 			ctx.execOptions.onStepStatus(msg.stepIndex, ctx.stepNames.get(msg.stepIndex) ?? "", msg.status, {
 				durationMs: msg.durationMs,
@@ -4896,6 +4936,8 @@ function relayChildIpcMessage(msg, dispatch, ctx) {
 				...msg.checkOutcome !== void 0 && { checkOutcome: msg.checkOutcome },
 				...msg.driftSummary !== void 0 && { driftSummary: msg.driftSummary },
 				...msg.drift !== void 0 && { drift: msg.drift },
+				...msg.concurrencyKind && { concurrencyKind: msg.concurrencyKind },
+				...msg.groupId && { groupId: msg.groupId },
 				...msg.data && msg.data
 			});
 			return;
@@ -5609,10 +5651,17 @@ var init_container_sandbox = __esmMin((() => {
 				case "ready":
 					this.sendExecuteRequest(stream, options);
 					return false;
-				case "step.start":
+				case "step.start": {
 					stepNames.set(msg.stepIndex, msg.stepName);
-					options.onStepStatus(msg.stepIndex, msg.stepName, ExecutionStepStatus.enum.running);
+					const startState = msg.state === "pending" ? ExecutionStepStatus.enum.pending : ExecutionStepStatus.enum.running;
+					const startData = {
+						...msg.concurrencyKind && { concurrencyKind: msg.concurrencyKind },
+						...msg.groupId && { groupId: msg.groupId }
+					};
+					if (Object.keys(startData).length > 0) options.onStepStatus(msg.stepIndex, msg.stepName, startState, startData);
+					else options.onStepStatus(msg.stepIndex, msg.stepName, startState);
 					return false;
+				}
 				case "step.complete": {
 					const name = stepNames.get(msg.stepIndex) ?? `step-${msg.stepIndex}`;
 					options.onStepStatus(msg.stepIndex, name, msg.status, {
@@ -5623,6 +5672,8 @@ var init_container_sandbox = __esmMin((() => {
 						...msg.checkOutcome !== void 0 && { checkOutcome: msg.checkOutcome },
 						...msg.driftSummary !== void 0 && { driftSummary: msg.driftSummary },
 						...msg.drift !== void 0 && { drift: msg.drift },
+						...msg.concurrencyKind && { concurrencyKind: msg.concurrencyKind },
+						...msg.groupId && { groupId: msg.groupId },
 						...msg.data && msg.data
 					});
 					stepResults.push({
@@ -6494,7 +6545,7 @@ var init_job_runner = __esmMin((() => {
 				});
 				logger$2.info("Init job completed successfully", {
 					jobId,
-					hasEnvironment: initResult.environmentName !== void 0,
+					hasEnvironment: initResult.environmentNames !== void 0,
 					hasEnv: initResult.env !== void 0,
 					hasConcurrencyGroup: initResult.concurrencyGroup !== void 0
 				});
@@ -6801,7 +6852,9 @@ var init_job_runner = __esmMin((() => {
 		*/
 		sendStepStatus(dispatch, stepIndex, stepName, state, data, logBytesStreamed) {
 			const secretsAccessed = data?.secretsAccessed;
-			const { secretsAccessed: _, ...restData } = data ?? {};
+			const concurrencyKind = data?.concurrencyKind;
+			const groupId = data?.groupId;
+			const { secretsAccessed: _s, concurrencyKind: _c, groupId: _g, ...restData } = data ?? {};
 			const hasRestData = Object.keys(restData).length > 0;
 			this.sendDirect({
 				type: "step.status",
@@ -6814,6 +6867,8 @@ var init_job_runner = __esmMin((() => {
 				timestamp: Date.now(),
 				...hasRestData && { data: restData },
 				...secretsAccessed !== void 0 && { secretsAccessed },
+				...concurrencyKind !== void 0 && { concurrencyKind },
+				...groupId !== void 0 && { groupId },
 				...logBytesStreamed !== void 0 && { logBytesStreamed }
 			});
 		}
@@ -6841,14 +6896,14 @@ var init_job_runner = __esmMin((() => {
 */
 init_console_capture();
 init_npm_resolver();
-const AGENT_VERSION = "0.1.23";
-const BUILD_COMMIT = "4465935bb";
-const SDK_VERSION = "0.1.23";
-const SDK_BUNDLE_HASH = "3a83610d2d122b9f9b0f924b225a47050d0b35f00a8f3256a3e15f3ff3bf7ddc";
-const SHARED_VERSION = "0.1.23";
-const SHARED_BUNDLE_HASH = "991385c024392c395d3eb8a68946ef8ed3fcba96f2652f21c3164a54eafa1b1b";
-const ENGINE_VERSION = "0.1.23";
-const ENGINE_BUNDLE_HASH = "4a0566c709180a6a8744ff3281640e596b8e661ddceb81327cd37d232d9768d5";
+const AGENT_VERSION = "0.1.24";
+const BUILD_COMMIT = "73592f67f";
+const SDK_VERSION = "0.1.24";
+const SDK_BUNDLE_HASH = "031712cf8cd02f483365113aad7e946da982110d544b177eb05edcc0d4421253";
+const SHARED_VERSION = "0.1.24";
+const SHARED_BUNDLE_HASH = "b977224129c767c4851458a795fa470264b2fc51255baf06cf14640e29e2f44c";
+const ENGINE_VERSION = "0.1.24";
+const ENGINE_BUNDLE_HASH = "734acca885cd70eed07a1a9426b08c04c07a9bf99484c18100d3d797b3eb8f39";
 initTelemetry({
 	serviceName: "kici-agent",
 	otlpEndpoint: process.env.OTEL_EXPORTER_OTLP_ENDPOINT