@kici-dev/agent 0.1.23 → 0.1.25

package/dist/server.js

@@ -15,7 +15,7 @@ import { LOGGER_ENV_VARS, defineEnv, validateUnknownKiciVars } from "@kici-dev/s
 import { ALLOWED_SYSTEM_VARS, CacheRunEventType, CacheStepType, ExecutionJobStatus, ExecutionStepStatus, InitFailureCategory, KNOWN_ROLES, PROTOCOL_VERSION, SANDBOX_DEFAULT_VARS, WS_CLOSE_AGENT_AUTH_FAILED, WS_MAX_PAYLOAD_BYTES, applyIncludeExclude, deriveOsArchLabels, expandMatrix, heartbeatSchema, hostLabel, mergeAutoLabels, orchestratorToAgentMessageSchema, parseHostPropertyAssignments, resolveRoleLabels, resolveWhenToRunOn, validateNoReservedLabels } from "@kici-dev/engine";
 import { execFile, execFileSync, execSync, fork, spawn } from "node:child_process";
 import WebSocket from "ws";
-import * as fs$2 from "node:fs";
+import * as fs$1 from "node:fs";
 import fs, { existsSync } from "node:fs";
 import { ZipArchive } from "archiver";
 import path, { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
@@ -23,9 +23,9 @@ import { fileURLToPath, pathToFileURL } from "node:url";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { format, promisify } from "node:util";
 import { gcStaleTmpDirs } from "@kici-dev/core/tmp-gc";
-import fs$1, { access, lstat, mkdir, mkdtemp, readFile, readdir, realpath, rm, unlink, writeFile } from "node:fs/promises";
+import fsPromises, { access, lstat, mkdir, mkdtemp, readFile, readdir, realpath, rm, unlink, writeFile } from "node:fs/promises";
 import Docker from "dockerode";
-import { buildKiciApi, buildNeedsContext, isDynamicGroupRef, isDynamicJobFn, isStaticArray, isStaticObject } from "@kici-dev/sdk";
+import { buildKiciApi, buildNeedsContext, isDynamicGroupRef, isDynamicJobFn, isParallelGroup, isStaticArray, isStaticObject } from "@kici-dev/sdk";
 import { c, x } from "tar";
 import https from "node:https";
 import http from "node:http";
@@ -36,7 +36,14 @@ import { PNPM_IGNORE_BUILD_GATE_ARG, PackageManager, YarnFlavor, detectPackageMa
 import { parse, stringify } from "yaml";
 import { createInterface } from "node:readline";
 var __defProp = Object.defineProperty;
-var __esmMin = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
+var __esmMin = (fn, res, err) => () => {
+	if (err) throw err[0];
+	try {
+		return fn && (res = fn(fn = 0)), res;
+	} catch (e) {
+		throw err = [e], e;
+	}
+};
 var __exportAll = (all, no_symbols) => {
 	let target = {};
 	for (var name in all) __defProp(target, name, {
@@ -46,7 +53,6 @@ var __exportAll = (all, no_symbols) => {
 	if (!no_symbols) __defProp(target, Symbol.toStringTag, { value: "Module" });
 	return target;
 };
-import.meta.url;
 //#endregion
 //#region src/config.ts
 /** Execution mode for the agent's sandbox backend. Mirrors the runtime enum. */
@@ -222,7 +228,7 @@ async function buildAgentMiniBundle(opts) {
 		uptime: os$1.uptime()
 	}, null, 2), { name: "system/info.json" });
 	if (opts.metricsText) archive.append(opts.metricsText, { name: "system/metrics.txt" });
-	if (opts.logDir && fs$2.existsSync(opts.logDir)) await addLogsToArchive(archive, opts.logDir, opts.logWindowHours);
+	if (opts.logDir && fs$1.existsSync(opts.logDir)) await addLogsToArchive(archive, opts.logDir, opts.logWindowHours);
 	await archive.finalize();
 	await done;
 	return Buffer.concat(chunks);
@@ -722,6 +728,13 @@ var OrchestratorClient = class OrchestratorClient {
 				requestId: request.requestId
 			};
 		}
+		if (request.op === "defer") {
+			this.sendProvenanceUploadDefer(jobId, request);
+			return {
+				type: "provenance.response",
+				requestId: request.requestId
+			};
+		}
 		const uploadUrl = await this.requestProvenanceUploadUrl(jobId, request.subjectDigest);
 		return {
 			type: "provenance.response",
@@ -730,6 +743,25 @@ var OrchestratorClient = class OrchestratorClient {
 		};
 	}
 	/**
+	* Capture a frozen, DSSE-signed attestation for later minting (transient
+	* mint-failure path). Fire-and-forget: the orchestrator persists it into the
+	* deferred-attestation outbox and the job stays green.
+	*/
+	sendProvenanceUploadDefer(jobId, request) {
+		this.sendDirect({
+			type: "provenance.upload.defer",
+			messageId: randomUUID(),
+			jobId,
+			subjectName: request.subjectName,
+			subjectDigest: request.subjectDigest,
+			audience: request.audience,
+			mediaType: request.mediaType,
+			statementHash: request.statementHash,
+			dsseEnvelope: request.dsseEnvelope,
+			publicKey: request.publicKey
+		});
+	}
+	/**
 	* Relay a step-level approval request to the orchestrator. Sends a
 	* `step.approval-request` WS message and resolves with the orchestrator's
 	* `step.approval-resolved` mapped onto the IPC response shape. No client-side
@@ -1310,14 +1342,14 @@ var init_console_capture = __esmMin((() => {
 init_console_capture();
 function safe(name, fallback = "unknown") {
 	switch (name) {
-		case "version": return "0.1.23";
-		case "buildCommit": return "4465935bb";
-		case "sdkVersion": return "0.1.23";
-		case "sdkBundleHash": return "3a83610d2d122b9f9b0f924b225a47050d0b35f00a8f3256a3e15f3ff3bf7ddc";
-		case "sharedVersion": return "0.1.23";
-		case "sharedBundleHash": return "991385c024392c395d3eb8a68946ef8ed3fcba96f2652f21c3164a54eafa1b1b";
-		case "engineVersion": return "0.1.23";
-		case "engineBundleHash": return "4a0566c709180a6a8744ff3281640e596b8e661ddceb81327cd37d232d9768d5";
+		case "version": return "0.1.25";
+		case "buildCommit": return "15e8e4155";
+		case "sdkVersion": return "0.1.25";
+		case "sdkBundleHash": return "e06bd1acf349ba365bdb357f3d865e0cbb4ad4604a0270b707a681a4f440954e";
+		case "sharedVersion": return "0.1.25";
+		case "sharedBundleHash": return "2394db0d8560b2cebf220c0e2d8993c75083aaf70a5917c35099b24feb3a22ba";
+		case "engineVersion": return "0.1.25";
+		case "engineBundleHash": return "c3320e812b8593d692f3fbf5eafe83507270028f7a1174c607881105dd702654";
 		default: return fallback;
 	}
 }
@@ -1951,7 +1983,7 @@ async function buildAssetDigestFromResolvedPaths(workDir, resolvedPaths) {
 	for (const rel of resolvedPaths) {
 		const abs = path.join(workDir, rel);
 		try {
-			const content = await fs$1.readFile(abs, "utf-8");
+			const content = await fsPromises.readFile(abs, "utf-8");
 			parts.push(`${rel}\n${content}`);
 		} catch {
 			parts.push(`${rel}\n`);
@@ -1976,7 +2008,7 @@ async function loadWorkflowSource(workDir, sourceFile, expectedContentHash, reso
 	ensureLoaderHookRegistered();
 	const filePath = path.join(workDir, sourceFile);
 	if (expectedContentHash) {
-		const rawSource = await fs$1.readFile(filePath, "utf-8");
+		const rawSource = await fsPromises.readFile(filePath, "utf-8");
 		let assetDigest;
 		if (resolvedHashFiles?.length) assetDigest = await buildAssetDigestFromResolvedPaths(workDir, resolvedHashFiles);
 		const actualHash = computeContentHash(rawSource, assetDigest);
@@ -2080,8 +2112,8 @@ async function extractStepsFromDynamicJob(workflow, dynamicIndex, jobName, event
 }
 var AGENT_SDK_VERSION, AGENT_SDK_BUNDLE_HASH, hookRegistered;
 var init_workflow_loader = __esmMin((() => {
-	AGENT_SDK_VERSION = "0.1.23";
-	AGENT_SDK_BUNDLE_HASH = "3a83610d2d122b9f9b0f924b225a47050d0b35f00a8f3256a3e15f3ff3bf7ddc";
+	AGENT_SDK_VERSION = "0.1.25";
+	AGENT_SDK_BUNDLE_HASH = "e06bd1acf349ba365bdb357f3d865e0cbb4ad4604a0270b707a681a4f440954e";
 	hookRegistered = false;
 }));
 //#endregion
@@ -2247,24 +2279,24 @@ function resolveOrchestratorUrl(url) {
 * have nothing to race; the defensive `rm` covers re-runs.
 */
 async function moveScratchIntoRepo(scratchDir, workDir) {
-	for (const child of await fs$1.readdir(scratchDir)) if (child === ".kici") {
+	for (const child of await fsPromises.readdir(scratchDir)) if (child === ".kici") {
 		const kiciScratch = join(scratchDir, ".kici");
-		for (const sub of await fs$1.readdir(kiciScratch)) await moveInto(join(kiciScratch, sub), join(workDir, ".kici", sub));
+		for (const sub of await fsPromises.readdir(kiciScratch)) await moveInto(join(kiciScratch, sub), join(workDir, ".kici", sub));
 	} else await moveInto(join(scratchDir, child), join(workDir, child));
 }
 /** Move `src` to `dest`, creating the parent and clearing any stale dest. */
 async function moveInto(src, dest) {
 	await mkdir(dirname(dest), { recursive: true });
-	await fs$1.rm(dest, {
+	await fsPromises.rm(dest, {
 		recursive: true,
 		force: true
 	});
-	await fs$1.rename(src, dest);
+	await fsPromises.rename(src, dest);
 }
 /** Best-effort cleanup of a settled scratch dir; logs and continues on failure. */
 async function cleanupScratch(scratchDir) {
 	try {
-		await fs$1.rm(scratchDir, {
+		await fsPromises.rm(scratchDir, {
 			recursive: true,
 			force: true
 		});
@@ -2298,7 +2330,7 @@ async function restoreDeps(workDir, depsUrl, depsHash) {
 	const kiciDir = join(workDir, ".kici");
 	if (depsUrl.startsWith("file://")) {
 		const localPath = fileURLToPath(depsUrl);
-		const data = await fs$1.readFile(localPath);
+		const data = await fsPromises.readFile(localPath);
 		if (depsHash) {
 			const actualHash = computeHash(data);
 			if (actualHash !== depsHash) throw new Error(`Dep tarball hash mismatch: expected ${depsHash}, got ${actualHash}`);
@@ -2457,7 +2489,7 @@ async function restoreSource(workDir, sourceTarUrl) {
 	let data;
 	if (sourceTarUrl.startsWith("file://")) {
 		const localPath = fileURLToPath(sourceTarUrl);
-		data = await fs$1.readFile(localPath);
+		data = await fsPromises.readFile(localPath);
 	} else if (sourceTarUrl.startsWith("http://") || sourceTarUrl.startsWith("https://")) data = await downloadUrl(sourceTarUrl);
 	else throw new Error(`Unsupported source tarball URL scheme: ${sourceTarUrl}`);
 	await extractSourceTarball(data, workDir);
@@ -2548,9 +2580,16 @@ async function evaluateDynamicFields(workflow, jobName, event, flags, timeoutMs
 		if (job.include || job.exclude) combos = applyIncludeExclude(combos, job.include, job.exclude);
 		result.matrixValues = combos;
 	}
-	if (flags.dynamicEnvironment && typeof job.environment === "function") {
-		const value = await withTimeout(() => job.environment(event), timeoutMs, `dynamicEnvironment for job '${jobName}'`);
-		if (value !== void 0 && value !== null) result.environmentName = value;
+	if (flags.dynamicEnvironment) {
+		const envRefs = job.environments ?? (job.environment !== void 0 ? [job.environment] : void 0);
+		if (envRefs && envRefs.length > 0) {
+			const names = [];
+			for (const ref of envRefs) if (typeof ref === "function") {
+				const value = await withTimeout(() => ref(event), timeoutMs, `dynamicEnvironment for job '${jobName}'`);
+				if (value !== void 0 && value !== null) names.push(value);
+			} else if (typeof ref === "string") names.push(ref);
+			if (names.length > 0) result.environmentNames = names;
+		}
 	}
 	if (flags.dynamicEnv && typeof job.env === "function") {
 		const value = await withTimeout(() => job.env(event), timeoutMs, `dynamicEnv for job '${jobName}'`);
@@ -2658,37 +2697,53 @@ async function sshPush(reach, privateKey, localBytes, remotePath, opts = {}, dep
 /**
 * Start a per-call ephemeral ssh-agent, load the key via stdin (never a file),
 * run `body` with `SSH_AUTH_SOCK` in env, and kill the agent in `finally`.
+*
+* The agent is bound to a socket inside a private `kici-bootstrap-ssh-*`
+* directory (`ssh-agent -a <dir>/agent.sock`) rather than the default
+* `/tmp/ssh-XXXX`. `ssh-agent` daemonizes into its own session, so it does NOT
+* die with this process — a SIGKILL of the agent (routine when an ephemeral
+* bring-up runner is torn down) skips the `finally` and orphans the daemon.
+* The namespaced socket path is how `kici-leak-sweep` reaps such orphans
+* precisely: it can distinguish a KiCI bring-up agent from an operator's login
+* agent, which a bare `/tmp/ssh-XXXX` socket cannot. The private dir is removed
+* in an outer `finally` so the normal path leaves nothing behind.
 */
 async function withEphemeralAgent(privateKey, spawnFn, body) {
 	const baseEnv = { ...process.env };
-	const start = await spawnFn("ssh-agent", ["-s"], { env: baseEnv });
-	if (start.exitCode !== 0) throw new Error(`ssh-agent start failed: exit ${start.exitCode}\n${start.stderr}`);
-	const sock = parseAgentSocket(start.stdout);
-	const pid = parseAgentPid(start.stdout);
-	const agentEnv = {
-		...baseEnv,
-		SSH_AUTH_SOCK: sock,
-		...pid ? { SSH_AGENT_PID: pid } : {},
-		SSH_ASKPASS: "/bin/false",
-		DISPLAY: ""
-	};
+	const agentDir = await mkdtemp(join(tmpdir(), "kici-bootstrap-ssh-"));
+	const sock = join(agentDir, "agent.sock");
 	try {
-		const add = await spawnFn("ssh-add", ["-"], {
-			env: agentEnv,
-			stdin: privateKey.endsWith("\n") ? privateKey : `${privateKey}\n`
-		});
-		if (add.exitCode !== 0) throw new Error(`ssh-add failed: exit ${add.exitCode}\n${add.stderr}`);
-		return await body(agentEnv);
+		const start = await spawnFn("ssh-agent", [
+			"-a",
+			sock,
+			"-s"
+		], { env: baseEnv });
+		if (start.exitCode !== 0) throw new Error(`ssh-agent start failed: exit ${start.exitCode}\n${start.stderr}`);
+		const pid = parseAgentPid(start.stdout);
+		const agentEnv = {
+			...baseEnv,
+			SSH_AUTH_SOCK: sock,
+			...pid ? { SSH_AGENT_PID: pid } : {},
+			SSH_ASKPASS: "/bin/false",
+			DISPLAY: ""
+		};
+		try {
+			const add = await spawnFn("ssh-add", ["-"], {
+				env: agentEnv,
+				stdin: privateKey.endsWith("\n") ? privateKey : `${privateKey}\n`
+			});
+			if (add.exitCode !== 0) throw new Error(`ssh-add failed: exit ${add.exitCode}\n${add.stderr}`);
+			return await body(agentEnv);
+		} finally {
+			await spawnFn("ssh-agent", ["-k"], { env: agentEnv }).catch(() => {});
+		}
 	} finally {
-		await spawnFn("ssh-agent", ["-k"], { env: agentEnv }).catch(() => {});
+		await rm(agentDir, {
+			recursive: true,
+			force: true
+		}).catch(() => {});
 	}
 }
-/** Extract `SSH_AUTH_SOCK=<path>;` from `ssh-agent -s` output. */
-function parseAgentSocket(out) {
-	const m = out.match(/SSH_AUTH_SOCK=([^;\n]+)/);
-	if (!m) throw new Error("ssh-agent -s did not emit SSH_AUTH_SOCK");
-	return m[1];
-}
 /** Extract `SSH_AGENT_PID=<n>;` from `ssh-agent -s` output (best-effort). */
 function parseAgentPid(out) {
 	return out.match(/SSH_AGENT_PID=([^;\n]+)/)?.[1];
@@ -2857,11 +2912,22 @@ async function serializeJobsToLock(jobs, ctx, staticNames, allowedGroups) {
 }
 async function serializeJob(job, generatedNames, ctx, staticNames, allowedGroups) {
 	const { include: runsOn, exclude: excludeLabels } = normalizeRunsOnToMatchers(job.runsOn, `generated job '${job.name}' runsOn`);
-	let resolvedEnvironment;
-	if (typeof job.environment === "function") {
-		const value = await withTimeout(() => job.environment(ctx.event), DYNAMIC_FIELD_TIMEOUT_MS, `dynamic environment for generated job '${job.name}'`);
-		if (value !== void 0 && value !== null) resolvedEnvironment = value;
-	} else if (typeof job.environment === "string") resolvedEnvironment = job.environment;
+	const envRefs = job.environments ?? (job.environment !== void 0 ? [job.environment] : void 0);
+	let resolvedEnvironments;
+	if (envRefs !== void 0 && envRefs.length > 0) {
+		const resolved = [];
+		for (const ref of envRefs) if (typeof ref === "function") {
+			const value = await withTimeout(() => ref(ctx.event), DYNAMIC_FIELD_TIMEOUT_MS, `dynamic environment for generated job '${job.name}'`);
+			if (value !== void 0 && value !== null) resolved.push({
+				value,
+				dynamic: false
+			});
+		} else if (typeof ref === "string") resolved.push({
+			value: ref,
+			dynamic: false
+		});
+		if (resolved.length > 0) resolvedEnvironments = resolved;
+	}
 	let resolvedEnv;
 	if (typeof job.env === "function") {
 		const value = await withTimeout(() => job.env(ctx.event), DYNAMIC_FIELD_TIMEOUT_MS, `dynamic env for generated job '${job.name}'`);
@@ -2887,7 +2953,7 @@ async function serializeJob(job, generatedNames, ctx, staticNames, allowedGroups
 		...job.include ? { include: job.include } : {},
 		...job.exclude ? { exclude: job.exclude } : {},
 		...job.description ? { description: job.description } : {},
-		...resolvedEnvironment !== void 0 ? { environment: resolvedEnvironment } : {},
+		...resolvedEnvironments !== void 0 ? { environments: resolvedEnvironments } : {},
 		...resolvedEnv !== void 0 ? { env: resolvedEnv } : {},
 		...resolvedConcurrencyGroup !== void 0 ? { concurrencyGroup: resolvedConcurrencyGroup } : {}
 	};
@@ -2903,7 +2969,7 @@ async function serializeJob(job, generatedNames, ctx, staticNames, allowedGroups
 */
 function resolveNeeds(needs, generatedNames, staticNames, allowedGroups) {
 	if (!needs || needs.length === 0) return [];
-	const allNames = new Set([...generatedNames, ...staticNames]);
+	const allNames = /* @__PURE__ */ new Set([...generatedNames, ...staticNames]);
 	return needs.map((dep) => {
 		if (typeof dep === "string") {
 			if (!allNames.has(dep)) throw new Error(`Job dependency '${dep}' not found in workflow jobs (checked: ${generatedNames.size} generated, ${staticNames.size} static)`);
@@ -2945,26 +3011,41 @@ function resolveNeeds(needs, generatedNames, staticNames, allowedGroups) {
 * are loaded from the workflow bundle at execution time.
 */
 function serializeSteps(steps) {
-	return steps.map((stepOrFn, index) => {
-		if (typeof stepOrFn === "function") return {
-			name: `step-${index}`,
-			hasOutputs: false
-		};
-		const step = stepOrFn;
-		return {
-			name: step.name || `step-${index}`,
-			hasOutputs: !!step.outputs,
-			...step.continueOnError ? { continueOnError: true } : {},
-			...step.timeout ? { timeout: step.timeout } : {},
-			...step.retry ? { retry: {
-				maxAttempts: step.retry.maxAttempts,
-				delayMs: step.retry.delayMs,
-				backoff: step.retry.backoff,
-				maxDelayMs: step.retry.maxDelayMs
-			} } : {}
-		};
+	let flatIndex = 0;
+	return steps.map((entry) => {
+		if (isParallelGroup(entry)) {
+			const children = entry.steps.map((child) => serializeSequentialStep(child, flatIndex++));
+			return {
+				kind: "parallel",
+				name: entry.name ?? `parallel-${children[0]?.name ?? "group"}`,
+				failFast: entry.failFast,
+				...entry.maxParallel !== void 0 ? { maxParallel: entry.maxParallel } : {},
+				children
+			};
+		}
+		return serializeSequentialStep(entry, flatIndex++);
 	});
 }
+/** Serialize one sequential step (or bare function) to a flat `LockStep`. */
+function serializeSequentialStep(stepOrFn, index) {
+	if (typeof stepOrFn === "function") return {
+		name: `step-${index}`,
+		hasOutputs: false
+	};
+	const step = stepOrFn;
+	return {
+		name: step.name || `step-${index}`,
+		hasOutputs: !!step.outputs,
+		...step.continueOnError ? { continueOnError: true } : {},
+		...step.timeout ? { timeout: step.timeout } : {},
+		...step.retry ? { retry: {
+			maxAttempts: step.retry.maxAttempts,
+			delayMs: step.retry.delayMs,
+			backoff: step.retry.backoff,
+			maxDelayMs: step.retry.maxDelayMs
+		} } : {}
+	};
+}
 /**
 * Serialize matrix configuration. Static array/object matrices are embedded as-is;
 * dynamic matrix functions are invoked against the eval context (mirroring the
@@ -3285,7 +3366,7 @@ function decryptBuffer(encrypted, aesKey) {
 */
 async function applyOverlay(config) {
 	const { tarballUrl, cliPublicKey, orchestratorPrivateKey, repoDir } = config;
-	const tmpDir = await fs$1.mkdtemp(path.join(os.tmpdir(), "kici-overlay-"));
+	const tmpDir = await fsPromises.mkdtemp(path.join(os.tmpdir(), "kici-overlay-"));
 	try {
 		logger$7.info("Downloading overlay tarball", { url: tarballUrl.replace(/\?.*$/, "?[redacted]") });
 		let encryptedData;
@@ -3299,7 +3380,7 @@ async function applyOverlay(config) {
 		const decryptedData = decryptBuffer(encryptedData, aesKey);
 		logger$7.info("Extracting overlay tarball", { size: decryptedData.length });
 		const extractDir = path.join(tmpDir, "extracted");
-		await fs$1.mkdir(extractDir, { recursive: true });
+		await fsPromises.mkdir(extractDir, { recursive: true });
 		try {
 			const readable = Readable.from(decryptedData);
 			await new Promise((resolve, reject) => {
@@ -3314,7 +3395,7 @@ async function applyOverlay(config) {
 		const manifestPath = path.join(extractDir, ".kici-overlay-tmp", "manifest.json");
 		let manifestContent;
 		try {
-			manifestContent = await fs$1.readFile(manifestPath, "utf-8");
+			manifestContent = await fsPromises.readFile(manifestPath, "utf-8");
 		} catch {
 			throw new Error("Overlay manifest not found: expected .kici-overlay-tmp/manifest.json in tarball");
 		}
@@ -3335,15 +3416,15 @@ async function applyOverlay(config) {
 		for (const file of checksumFiles) {
 			const srcPath = path.join(extractDir, file);
 			const destPath = path.join(repoDir, file);
-			await fs$1.mkdir(path.dirname(destPath), { recursive: true });
-			await fs$1.copyFile(srcPath, destPath);
+			await fsPromises.mkdir(path.dirname(destPath), { recursive: true });
+			await fsPromises.copyFile(srcPath, destPath);
 			filesApplied++;
 		}
 		let filesDeleted = 0;
 		for (const file of manifest.deletions) {
 			const targetPath = path.join(repoDir, file);
 			try {
-				await fs$1.unlink(targetPath);
+				await fsPromises.unlink(targetPath);
 				filesDeleted++;
 			} catch {
 				logger$7.debug("Deletion target not found, skipping", { file });
@@ -3359,7 +3440,7 @@ async function applyOverlay(config) {
 			verified: true
 		};
 	} finally {
-		await fs$1.rm(tmpDir, {
+		await fsPromises.rm(tmpDir, {
 			recursive: true,
 			force: true
 		}).catch(() => {});
@@ -4883,10 +4964,17 @@ function relayChildIpcMessage(msg, dispatch, ctx) {
 		case "log.line":
 			ctx.execOptions.onLogLine(msg.stepIndex, msg.line);
 			return;
-		case "step.start":
+		case "step.start": {
 			ctx.stepNames.set(msg.stepIndex, msg.stepName);
-			ctx.execOptions.onStepStatus(msg.stepIndex, msg.stepName, ExecutionStepStatus.enum.running);
+			const startState = msg.state === "pending" ? ExecutionStepStatus.enum.pending : ExecutionStepStatus.enum.running;
+			const startData = {
+				...msg.concurrencyKind && { concurrencyKind: msg.concurrencyKind },
+				...msg.groupId && { groupId: msg.groupId }
+			};
+			if (Object.keys(startData).length > 0) ctx.execOptions.onStepStatus(msg.stepIndex, msg.stepName, startState, startData);
+			else ctx.execOptions.onStepStatus(msg.stepIndex, msg.stepName, startState);
 			return;
+		}
 		case "step.complete":
 			ctx.execOptions.onStepStatus(msg.stepIndex, ctx.stepNames.get(msg.stepIndex) ?? "", msg.status, {
 				durationMs: msg.durationMs,
@@ -4896,6 +4984,8 @@ function relayChildIpcMessage(msg, dispatch, ctx) {
 				...msg.checkOutcome !== void 0 && { checkOutcome: msg.checkOutcome },
 				...msg.driftSummary !== void 0 && { driftSummary: msg.driftSummary },
 				...msg.drift !== void 0 && { drift: msg.drift },
+				...msg.concurrencyKind && { concurrencyKind: msg.concurrencyKind },
+				...msg.groupId && { groupId: msg.groupId },
 				...msg.data && msg.data
 			});
 			return;
@@ -5609,10 +5699,17 @@ var init_container_sandbox = __esmMin((() => {
 				case "ready":
 					this.sendExecuteRequest(stream, options);
 					return false;
-				case "step.start":
+				case "step.start": {
 					stepNames.set(msg.stepIndex, msg.stepName);
-					options.onStepStatus(msg.stepIndex, msg.stepName, ExecutionStepStatus.enum.running);
+					const startState = msg.state === "pending" ? ExecutionStepStatus.enum.pending : ExecutionStepStatus.enum.running;
+					const startData = {
+						...msg.concurrencyKind && { concurrencyKind: msg.concurrencyKind },
+						...msg.groupId && { groupId: msg.groupId }
+					};
+					if (Object.keys(startData).length > 0) options.onStepStatus(msg.stepIndex, msg.stepName, startState, startData);
+					else options.onStepStatus(msg.stepIndex, msg.stepName, startState);
 					return false;
+				}
 				case "step.complete": {
 					const name = stepNames.get(msg.stepIndex) ?? `step-${msg.stepIndex}`;
 					options.onStepStatus(msg.stepIndex, name, msg.status, {
@@ -5623,6 +5720,8 @@ var init_container_sandbox = __esmMin((() => {
 						...msg.checkOutcome !== void 0 && { checkOutcome: msg.checkOutcome },
 						...msg.driftSummary !== void 0 && { driftSummary: msg.driftSummary },
 						...msg.drift !== void 0 && { drift: msg.drift },
+						...msg.concurrencyKind && { concurrencyKind: msg.concurrencyKind },
+						...msg.groupId && { groupId: msg.groupId },
 						...msg.data && msg.data
 					});
 					stepResults.push({
@@ -5763,7 +5862,7 @@ var job_runner_exports = /* @__PURE__ */ __exportAll({
 */
 async function fileExists(p) {
 	try {
-		await fs$1.access(p);
+		await fsPromises.access(p);
 		return true;
 	} catch {
 		return false;
@@ -5879,11 +5978,11 @@ var init_job_runner = __esmMin((() => {
 		async execute(dispatch) {
 			const { runId: _runId, jobId, jobConfig: _jobConfig } = dispatch;
 			const abortController = new AbortController();
-			const workDir = await fs$1.mkdtemp(join(tmpdir(), "kici-"));
+			const workDir = await fsPromises.mkdtemp(join(tmpdir(), "kici-"));
 			const completionPromise = this.runJob(dispatch, workDir, abortController).finally(async () => {
 				this.activeJobs.delete(jobId);
 				this.activeSandbox = null;
-				await fs$1.rm(workDir, {
+				await fsPromises.rm(workDir, {
 					recursive: true,
 					force: true
 				}).catch(() => {});
@@ -6494,7 +6593,7 @@ var init_job_runner = __esmMin((() => {
 				});
 				logger$2.info("Init job completed successfully", {
 					jobId,
-					hasEnvironment: initResult.environmentName !== void 0,
+					hasEnvironment: initResult.environmentNames !== void 0,
 					hasEnv: initResult.env !== void 0,
 					hasConcurrencyGroup: initResult.concurrencyGroup !== void 0
 				});
@@ -6801,7 +6900,9 @@ var init_job_runner = __esmMin((() => {
 		*/
 		sendStepStatus(dispatch, stepIndex, stepName, state, data, logBytesStreamed) {
 			const secretsAccessed = data?.secretsAccessed;
-			const { secretsAccessed: _, ...restData } = data ?? {};
+			const concurrencyKind = data?.concurrencyKind;
+			const groupId = data?.groupId;
+			const { secretsAccessed: _s, concurrencyKind: _c, groupId: _g, ...restData } = data ?? {};
 			const hasRestData = Object.keys(restData).length > 0;
 			this.sendDirect({
 				type: "step.status",
@@ -6814,6 +6915,8 @@ var init_job_runner = __esmMin((() => {
 				timestamp: Date.now(),
 				...hasRestData && { data: restData },
 				...secretsAccessed !== void 0 && { secretsAccessed },
+				...concurrencyKind !== void 0 && { concurrencyKind },
+				...groupId !== void 0 && { groupId },
 				...logBytesStreamed !== void 0 && { logBytesStreamed }
 			});
 		}
@@ -6841,14 +6944,14 @@ var init_job_runner = __esmMin((() => {
 */
 init_console_capture();
 init_npm_resolver();
-const AGENT_VERSION = "0.1.23";
-const BUILD_COMMIT = "4465935bb";
-const SDK_VERSION = "0.1.23";
-const SDK_BUNDLE_HASH = "3a83610d2d122b9f9b0f924b225a47050d0b35f00a8f3256a3e15f3ff3bf7ddc";
-const SHARED_VERSION = "0.1.23";
-const SHARED_BUNDLE_HASH = "991385c024392c395d3eb8a68946ef8ed3fcba96f2652f21c3164a54eafa1b1b";
-const ENGINE_VERSION = "0.1.23";
-const ENGINE_BUNDLE_HASH = "4a0566c709180a6a8744ff3281640e596b8e661ddceb81327cd37d232d9768d5";
+const AGENT_VERSION = "0.1.25";
+const BUILD_COMMIT = "15e8e4155";
+const SDK_VERSION = "0.1.25";
+const SDK_BUNDLE_HASH = "e06bd1acf349ba365bdb357f3d865e0cbb4ad4604a0270b707a681a4f440954e";
+const SHARED_VERSION = "0.1.25";
+const SHARED_BUNDLE_HASH = "2394db0d8560b2cebf220c0e2d8993c75083aaf70a5917c35099b24feb3a22ba";
+const ENGINE_VERSION = "0.1.25";
+const ENGINE_BUNDLE_HASH = "c3320e812b8593d692f3fbf5eafe83507270028f7a1174c607881105dd702654";
 initTelemetry({
 	serviceName: "kici-agent",
 	otlpEndpoint: process.env.OTEL_EXPORTER_OTLP_ENDPOINT