@kici-dev/agent 0.1.26 → 0.2.0

package/dist/workflow-runner.js

@@ -1,16 +1,18 @@
-import { register } from "node:module";
+import { createRequire, register } from "node:module";
 import { createInterface } from "node:readline";
 import crypto$1, { createHash, randomUUID } from "node:crypto";
 import { existsSync } from "node:fs";
-import fsPromises, { access, cp, lstat, mkdir, mkdtemp, readFile, readdir, realpath, rename, rm, unlink, writeFile } from "node:fs/promises";
-import os, { homedir, tmpdir } from "node:os";
+import fsPromises, { access, cp, lstat, mkdir, readFile, readdir, realpath, rename, rm, unlink, writeFile } from "node:fs/promises";
+import { homedir, tmpdir } from "node:os";
 import path, { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { $ } from "zx";
 import { createLogger, deriveSharedSecret, initZx, normalizeLineEndings, sha256, sha256File, toErrorMessage } from "@kici-dev/shared";
-import { CacheOutcome, CacheStepType, CheckMode, CheckStepOutcome, ExecutionJobStatus, ExecutionStepStatus, StepConcurrencyKind, TimeoutReason } from "@kici-dev/engine";
-import { buildKiciApi, buildNeedsContext, createStepSecrets, evaluateRules, isDynamicJobFn, isParallelGroup, normalizeApproval, normalizeCacheSpecs, provenanceSubjectIsPath, resolveJobOutputs, resolveStepOutputs, setJobOutputsMap, setStepOutputsMap, setStepRefMap } from "@kici-dev/sdk";
+import { createTempScope, makeTempDir } from "@kici-dev/core/tmp";
+import { CacheOutcome, CacheStepType, CheckMode, CheckStepOutcome, ExecutionJobStatus, ExecutionStepStatus, LogStream, StepConcurrencyKind, TimeoutReason, artifactInvalidNameError, checkArtifactName } from "@kici-dev/engine";
+import { execFile, execFileSync } from "node:child_process";
+import { buildKiciApi, buildNeedsContext, createRuleContext, createStepSecrets, evaluateRules, isDynamicJobFn, isEventDefinition, isParallelGroup, normalizeApproval, normalizeCacheSpecs, provenanceSubjectIsPath, resolveJobOutputs, resolveStepOutputs, setJobOutputsMap, setStepOutputsMap, setStepRefMap } from "@kici-dev/sdk";
 import { OIDC_TOKEN_REQUEST_METHOD } from "@kici-dev/engine/protocol/messages/oidc-token-relay";
-import { computeBackoffDelay, sha256File as sha256File$1 } from "@kici-dev/core";
+import { HOME_ANCHOR, REPO_ANCHOR, computeBackoffDelay, sha256File as sha256File$1 } from "@kici-dev/core";
 import { calculateJwkThumbprint, decodeJwt, exportJWK, generateKeyPair } from "jose";
 import { IN_TOTO_PAYLOAD_TYPE, KICI_PROVENANCE_AUDIENCE, KICI_PROVENANCE_BUNDLE_MEDIA_TYPE } from "@kici-dev/engine/provenance/bundle";
 import { computeStatementHash } from "@kici-dev/engine/provenance/statement-hash";
@@ -25,7 +27,6 @@ import { fileURLToPath, pathToFileURL } from "node:url";
 import { c, x } from "tar";
 import { runIdempotentStep } from "@kici-dev/core/idempotency";
 import { AsyncLocalStorage } from "node:async_hooks";
-import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 import { PNPM_IGNORE_BUILD_GATE_ARG, PackageManager, YarnFlavor, detectPackageManagerFromManifests, detectYarnFlavor } from "@kici-dev/shared/package-manager";
 import { parse, stringify } from "yaml";
@@ -48,11 +49,307 @@ var __exportAll = (all, no_symbols) => {
 	return target;
 };
 //#endregion
+//#region src/execution/streaming-zx-log.ts
+/**
+* Shared factory for the zx `log` callback that streams a subprocess's
+* stdout/stderr into the captured/streamed run log, line by line, via `emit`.
+*
+* zx does NOT write child stdout/stderr to `process.stdout`; it pipes the
+* child stdio to an internal VoidStream and surfaces each chunk through the
+* shell's `log` callback as `{ kind: 'stdout' | 'stderr', data, verbose }`.
+* The `verbose` flag is zx's per-invocation quiet/verbose decision:
+*
+*   - stdout entries: `verbose = !piped && (snapshot.verbose && !snapshot.quiet)`
+*   - stderr entries: `verbose = !snapshot.quiet`
+*
+* so a step that opts into `$({ quiet: true })` (e.g. a `sops -d` decrypt of a
+* credential) produces `verbose: false` entries. This factory HONORS that flag
+* — it skips `verbose: false` entries — which is what makes `{ quiet: true }`
+* actually suppress sensitive output from the run log. Without the gate, a
+* decrypted-secret line leaks into the persisted/streamed log (zx's own default
+* log function gates on the same flag: `if (!entry.verbose) return`).
+*
+* IMPORTANT: the shell that installs this callback MUST be constructed with
+* `verbose: true`. With `verbose: true` zx flags ordinary (non-quiet)
+* subprocess output `verbose: true` (captured) and a `{ quiet: true }` call
+* `verbose: false` (suppressed). A `verbose: false` base would flag ordinary
+* output `verbose: false` too, and this gate would then drop every line.
+*
+* The returned callback owns one line buffer PER STREAM, so partial chunks are
+* coalesced into whole lines before `emit` is called. The buffers are separate
+* because the two streams are independent pipes: a stdout chunk ending mid-line
+* and a stderr chunk arriving next would otherwise concatenate into a single
+* spliced line attributed to whichever kind completed it.
+*
+* `emit` receives the originating stream alongside the line so a diagnostic
+* written to stderr stays distinguishable from ordinary progress output all the
+* way to the persisted run log.
+*/
+function makeStreamingZxLog(emit) {
+	const lineBufs = {
+		[LogStream.enum.stdout]: "",
+		[LogStream.enum.stderr]: ""
+	};
+	return (entry) => {
+		const e = entry;
+		if (e.kind !== "stdout" && e.kind !== "stderr") return;
+		if (!e.verbose) return;
+		const stream = e.kind === "stderr" ? LogStream.enum.stderr : LogStream.enum.stdout;
+		const text = typeof e.data === "string" ? e.data : String(e.data ?? "");
+		const lines = (lineBufs[stream] + text).split("\n");
+		lineBufs[stream] = lines.pop();
+		for (const line of lines) if (line) emit(line, stream);
+	};
+}
+//#endregion
+//#region src/checkout/ssh-auth.ts
+/**
+* Materialize an SSH private key (and optional pinned known_hosts) into a
+* tempdir and build the `GIT_SSH_COMMAND` that `git clone` needs.
+*
+* Permissions:
+*   - private key mode 0o600 (required by OpenSSH — refuses to use world-
+*     readable keys).
+*   - known_hosts mode 0o600.
+*   - tempdir mode 0o700.
+*
+* SSH flags composed:
+*   - `-i <keyfile>` — identity file.
+*   - `-o IdentitiesOnly=yes` — don't try other keys from ssh-agent / ~/.ssh.
+*   - `-o BatchMode=yes` — never prompt for passwords / passphrases.
+*   - host-key checking flags based on `hostKeyPolicy`.
+*/
+async function setupSshAuth(opts) {
+	if (opts.hostKeyPolicy === "pinned" && !opts.knownHosts) throw new Error("pinned hostKeyPolicy requires knownHosts content");
+	const { path: tempDir, cleanup } = await makeTempDir("ssh");
+	const keyPath = join(tempDir, "id");
+	await writeFile(keyPath, opts.privateKey.endsWith("\n") ? opts.privateKey : `${opts.privateKey}\n`, { mode: 384 });
+	const knownHostsPath = join(tempDir, "known_hosts");
+	await writeFile(knownHostsPath, opts.hostKeyPolicy === "pinned" ? opts.knownHosts : "", { mode: 384 });
+	const parts = [
+		"ssh",
+		"-i",
+		escapeShellArg(keyPath),
+		"-o",
+		"IdentitiesOnly=yes",
+		"-o",
+		"BatchMode=yes",
+		"-o",
+		`UserKnownHostsFile=${escapeShellArg(knownHostsPath)}`
+	];
+	if (opts.hostKeyPolicy === "pinned") parts.push("-o", "StrictHostKeyChecking=yes");
+	else parts.push("-o", "StrictHostKeyChecking=accept-new");
+	return {
+		gitSshCommand: parts.join(" "),
+		tempDir,
+		cleanup
+	};
+}
+/**
+* Quote a path for inclusion in `GIT_SSH_COMMAND`. We use single-quote
+* wrapping so backslashes and spaces survive git's shell-parse of the
+* command value.
+*/
+function escapeShellArg(value) {
+	return `'${value.replace(/'/g, "'\\''")}'`;
+}
+//#endregion
+//#region src/checkout/changed-files.ts
+const EMPTY_TREE_SHA = "4b825dc642cb6eb9a060e54bf8d69288fbee4904";
+const ZERO_SHA = /^0+$/;
+const MAX_DEEPEN = 4;
+const DEEPEN_STEP = 50;
+const BASE_GIT_ARGS = [
+	"-c",
+	"safe.directory=*",
+	"-c",
+	"core.quotePath=false"
+];
+/** Build the auth context for the fetches, mirroring git-clone.ts's auth. */
+async function buildAuthCtx(auth) {
+	if (!auth) return { args: [] };
+	if (auth.kind === "basic") {
+		const user = auth.user ?? "x-access-token";
+		return { args: ["-c", `http.extraHeader=Authorization: Basic ${Buffer.from(`${user}:${auth.secret}`).toString("base64")}`] };
+	}
+	const sshSetup = await setupSshAuth({
+		privateKey: auth.secret,
+		hostKeyPolicy: auth.sshHostKeyPolicy,
+		knownHosts: auth.sshKnownHostsPem
+	});
+	return {
+		args: [],
+		env: { GIT_SSH_COMMAND: sshSetup.gitSshCommand },
+		cleanup: () => sshSetup.cleanup()
+	};
+}
+function git(workDir, args, ctx) {
+	return execFileSync("git", [
+		...ctx.args,
+		...BASE_GIT_ARGS,
+		"-C",
+		workDir,
+		...args
+	], {
+		encoding: "utf8",
+		stdio: [
+			"ignore",
+			"pipe",
+			"pipe"
+		],
+		...ctx.env && { env: {
+			...process.env,
+			...ctx.env
+		} }
+	});
+}
+function tryGit(workDir, args, ctx) {
+	try {
+		git(workDir, args, ctx);
+		return true;
+	} catch {
+		return false;
+	}
+}
+function parseNameOnly(out) {
+	return out.split("\n").map((s) => s.replace(/\r$/, "")).filter((s) => s.length > 0);
+}
+/** Ensure `commitish` exists locally; fetch / deepen (bounded) if not. */
+function ensureCommit(workDir, commitish, ctx) {
+	if (tryGit(workDir, [
+		"cat-file",
+		"-e",
+		`${commitish}^{commit}`
+	], ctx)) return true;
+	if (tryGit(workDir, [
+		"fetch",
+		"--depth",
+		"1",
+		"origin",
+		commitish
+	], ctx)) {
+		if (tryGit(workDir, [
+			"cat-file",
+			"-e",
+			`${commitish}^{commit}`
+		], ctx)) return true;
+	}
+	for (let i = 0; i < MAX_DEEPEN; i++) {
+		if (!tryGit(workDir, [
+			"fetch",
+			`--deepen=${DEEPEN_STEP}`,
+			"origin"
+		], ctx)) break;
+		if (tryGit(workDir, [
+			"cat-file",
+			"-e",
+			`${commitish}^{commit}`
+		], ctx)) return true;
+	}
+	return false;
+}
+function pushDiff(workDir, before, ctx) {
+	const isZero = !before || ZERO_SHA.test(before);
+	const baseRef = isZero ? EMPTY_TREE_SHA : before;
+	if (!isZero && !ensureCommit(workDir, before, ctx)) return {
+		files: [],
+		status: "unavailable"
+	};
+	return {
+		files: parseNameOnly(git(workDir, [
+			"diff",
+			"--name-only",
+			baseRef,
+			"HEAD"
+		], ctx)),
+		status: "fetched"
+	};
+}
+function prDiff(workDir, base, ctx) {
+	const candidates = [
+		base,
+		`origin/${base}`,
+		"FETCH_HEAD"
+	];
+	const resolveBase = () => candidates.find((c) => tryGit(workDir, [
+		"rev-parse",
+		"--verify",
+		`${c}^{commit}`
+	], ctx));
+	let baseRef = resolveBase();
+	if (!baseRef) {
+		if (!ensureCommit(workDir, base, ctx)) return {
+			files: [],
+			status: "unavailable"
+		};
+		baseRef = resolveBase();
+	}
+	if (!baseRef) return {
+		files: [],
+		status: "unavailable"
+	};
+	for (let i = 0; i <= MAX_DEEPEN; i++) {
+		if (tryGit(workDir, [
+			"merge-base",
+			baseRef,
+			"HEAD"
+		], ctx)) return {
+			files: parseNameOnly(git(workDir, [
+				"diff",
+				"--name-only",
+				`${baseRef}...HEAD`
+			], ctx)),
+			status: "fetched"
+		};
+		if (!tryGit(workDir, [
+			"fetch",
+			`--deepen=${DEEPEN_STEP}`,
+			"origin"
+		], ctx)) break;
+	}
+	return {
+		files: [],
+		status: "unavailable"
+	};
+}
+/**
+* Compute the changed-files list from the agent's local clone (HEAD is the
+* checked-out head commit). Ground truth for job/step rule evaluation. `auth`
+* (the same credentials used for the clone) authenticates the deepen / fetch
+* calls so a private remote resolves. Returns `unavailable` for diff-less
+* events (schedule/tag/manual) or any git failure — never throws.
+*/
+async function computeChangedFiles(workDir, event, auth) {
+	let ctx;
+	try {
+		if (event.type !== "push" && event.type !== "pull_request") return {
+			files: [],
+			status: "unavailable"
+		};
+		ctx = await buildAuthCtx(auth);
+		if (event.type === "push") return pushDiff(workDir, event.payload?.before ?? "", ctx);
+		const base = event.baseBranch ?? event.targetBranch;
+		if (!base) return {
+			files: [],
+			status: "unavailable"
+		};
+		return prDiff(workDir, base, ctx);
+	} catch {
+		return {
+			files: [],
+			status: "unavailable"
+		};
+	} finally {
+		if (ctx?.cleanup) await ctx.cleanup().catch(() => {});
+	}
+}
+//#endregion
 //#region src/provenance/statement-builder.ts
 /**
 * Build a SLSA v1.0 in-toto provenance statement from the server-truth identity
 * token claims plus the caller-supplied subject. The build context comes
-* entirely from the JWT claims (Platform-minted, unforgeable), so the
+* entirely from the JWT claims (minted server-side by the orchestrator,
+* unforgeable), so the
 * statement's identity equals the token's identity by construction.
 */
 /**
@@ -384,7 +681,7 @@ async function excludeScratchFromGit(repoWorkDir) {
 		const suffix = existing.length === 0 || existing.endsWith("\n") ? "" : "\n";
 		await fsPromises.appendFile(excludePath, `${suffix}# kici: hide dep-restore scratch dirs from customer git status\n${SCRATCH_DIR_GIT_EXCLUDE_GLOB}\n`);
 	} catch (err) {
-		logger$4.warn("Failed to register scratch dir glob in .git/info/exclude", {
+		logger$5.warn("Failed to register scratch dir glob in .git/info/exclude", {
 			excludePath,
 			error: err instanceof Error ? err.message : String(err)
 		});
@@ -445,7 +742,7 @@ async function cleanupScratch(scratchDir) {
 			force: true
 		});
 	} catch (cleanupErr) {
-		logger$4.warn("Scratch dir cleanup failed (orphan left behind)", {
+		logger$5.warn("Scratch dir cleanup failed (orphan left behind)", {
 			scratchDir,
 			error: cleanupErr instanceof Error ? cleanupErr.message : String(cleanupErr)
 		});
@@ -470,7 +767,7 @@ async function cleanupScratch(scratchDir) {
 */
 async function restoreDeps(workDir, depsUrl, depsHash) {
 	depsUrl = resolveOrchestratorUrl(depsUrl);
-	logger$4.info("Downloading dependency tarball", { url: depsUrl });
+	logger$5.info("Downloading dependency tarball", { url: depsUrl });
 	const kiciDir = join(workDir, ".kici");
 	if (depsUrl.startsWith("file://")) {
 		const localPath = fileURLToPath(depsUrl);
@@ -484,7 +781,7 @@ async function restoreDeps(workDir, depsUrl, depsHash) {
 		await moveScratchIntoRepo(scratchDir, workDir);
 		await cleanupScratch(scratchDir);
 		const sizeMB = (data.length / (1024 * 1024)).toFixed(2);
-		logger$4.info("Dependencies restored from cache (file)", {
+		logger$5.info("Dependencies restored from cache (file)", {
 			sizeMB,
 			targetDir: workDir
 		});
@@ -493,7 +790,7 @@ async function restoreDeps(workDir, depsUrl, depsHash) {
 	if (!depsUrl.startsWith("http://") && !depsUrl.startsWith("https://")) throw new Error(`Unsupported deps URL scheme: ${depsUrl}`);
 	let lastError;
 	for (let attempt = 0; attempt <= 2; attempt++) {
-		if (attempt > 0) logger$4.warn("Retrying dep tarball download", {
+		if (attempt > 0) logger$5.warn("Retrying dep tarball download", {
 			attempt,
 			url: depsUrl
 		});
@@ -502,11 +799,11 @@ async function restoreDeps(workDir, depsUrl, depsHash) {
 			if (depsHash && hash !== depsHash) throw new Error(`Dep tarball hash mismatch: expected ${depsHash}, got ${hash}`);
 			await moveScratchIntoRepo(scratchDir, workDir);
 			await cleanupScratch(scratchDir);
-			logger$4.info("Dependencies restored from cache (stream)", { targetDir: workDir });
+			logger$5.info("Dependencies restored from cache (stream)", { targetDir: workDir });
 			return;
 		} catch (err) {
 			lastError = err instanceof Error ? err : new Error(String(err));
-			logger$4.warn("Dep tarball download failed", {
+			logger$5.warn("Dep tarball download failed", {
 				attempt,
 				error: lastError.message
 			});
@@ -514,9 +811,9 @@ async function restoreDeps(workDir, depsUrl, depsHash) {
 	}
 	throw new Error(`Dep tarball download failed after 3 attempts: ${lastError?.message}`);
 }
-var logger$4, DOWNLOAD_TIMEOUT_MS$2, SCRATCH_DIR_BASENAME_PREFIX, SCRATCH_DIR_GIT_EXCLUDE_GLOB;
+var logger$5, DOWNLOAD_TIMEOUT_MS$2, SCRATCH_DIR_BASENAME_PREFIX, SCRATCH_DIR_GIT_EXCLUDE_GLOB;
 var init_dep_restore = __esmMin((() => {
-	logger$4 = createLogger({ prefix: "dep-restore" });
+	logger$5 = createLogger({ prefix: "dep-restore" });
 	DOWNLOAD_TIMEOUT_MS$2 = 300 * 1e3;
 	SCRATCH_DIR_BASENAME_PREFIX = ".dep-restore-scratch-";
 	SCRATCH_DIR_GIT_EXCLUDE_GLOB = `.kici/${SCRATCH_DIR_BASENAME_PREFIX}*`;
@@ -621,13 +918,9 @@ init_download();
 * into place so a partial restore never leaves half-written paths in the live
 * tree (mirrors dep-restore).
 */
-const logger$3 = createLogger({ prefix: "cache-engine" });
+const logger$4 = createLogger({ prefix: "cache-engine" });
 /** Download timeout for a presigned cache GET: 5 minutes. */
 const DOWNLOAD_TIMEOUT_MS = 300 * 1e3;
-/** Anchor prefix for repo-root-relative cache entries inside the tar. */
-const REPO_ANCHOR = "__repo__";
-/** Anchor prefix for home-relative (`~`) cache entries inside the tar. */
-const HOME_ANCHOR = "__home__";
 /**
 * Resolve a cache path. `~`-prefixed -> home root; otherwise repo-root-relative.
 * Rejects absolute paths and `..` escapes so a workflow cannot read or clobber
@@ -668,7 +961,7 @@ function anchorEntries(workDir, paths, roots) {
 */
 async function packCachePaths(workDir, paths, roots) {
 	const entries = anchorEntries(workDir, paths, roots);
-	const staging = await mkdtemp(join(tmpdir(), "kici-cache-pack-"));
+	const { path: staging, cleanup } = await makeTempDir("cache-pack");
 	try {
 		const topLevel = /* @__PURE__ */ new Set();
 		for (const e of entries) {
@@ -689,7 +982,7 @@ async function packCachePaths(workDir, paths, roots) {
 		for await (const chunk of stream) chunks.push(Buffer.from(chunk));
 		const tarball = Buffer.concat(chunks);
 		const hash = sha256(tarball);
-		logger$3.info("packed user cache", {
+		logger$4.info("packed user cache", {
 			sizeBytes: tarball.length,
 			hash: hash.slice(0, 12),
 			paths
@@ -699,10 +992,7 @@ async function packCachePaths(workDir, paths, roots) {
 			hash
 		};
 	} finally {
-		await rm(staging, {
-			recursive: true,
-			force: true
-		});
+		await cleanup();
 	}
 }
 /** Move the extracted `__repo__` / `__home__` groups from a scratch dir into place. */
@@ -738,17 +1028,14 @@ async function downloadAndExtractCache(url, workDir, expectedHash, roots) {
 		cb(null, chunk);
 	} });
 	await mkdir(workDir, { recursive: true });
-	const scratch = await mkdtemp(join(tmpdir(), "kici-cache-extract-"));
+	const { path: scratch, cleanup } = await makeTempDir("cache-extract");
 	try {
 		await pipeline(Readable.fromWeb(response.body), hashTransform, createGunzip(), x({ cwd: scratch }));
 		const digest = hash.digest("hex");
 		if (digest !== expectedHash) throw new Error(`Cache tarball checksum mismatch on download: expected ${expectedHash}, got ${digest}`);
 		await moveAnchoredGroups(scratch, workDir, home);
 	} finally {
-		await rm(scratch, {
-			recursive: true,
-			force: true
-		});
+		await cleanup();
 	}
 }
 /** Build the imperative `ctx.cache` API bound to a workDir + transport. */
@@ -758,7 +1045,7 @@ function createCacheApi(workDir, transport, roots) {
 			const r = await transport.restore(spec.key, spec.restoreKeys);
 			if (!r.hit || !r.downloadUrl || !r.tarHash) return { hit: false };
 			await downloadAndExtractCache(r.downloadUrl, workDir, r.tarHash, roots);
-			logger$3.info("user cache restored", {
+			logger$4.info("user cache restored", {
 				key: spec.key,
 				matchedKey: r.matchedKey
 			});
@@ -770,14 +1057,14 @@ function createCacheApi(workDir, transport, roots) {
 		async save(spec) {
 			const begin = await transport.beginSave(spec.key);
 			if (begin.skip || !begin.uploadUrl) {
-				logger$3.info("user cache save skipped (key exists)", { key: spec.key });
+				logger$4.info("user cache save skipped (key exists)", { key: spec.key });
 				return;
 			}
 			const { tarball, hash } = await packCachePaths(workDir, spec.paths, roots);
 			const { uploadToPresignedUrl } = await Promise.resolve().then(() => (init_download(), download_exports));
 			await uploadToPresignedUrl(begin.uploadUrl, tarball);
 			await transport.completeSave(spec.key, hash, tarball.length);
-			logger$3.info("user cache saved", {
+			logger$4.info("user cache saved", {
 				key: spec.key,
 				sizeBytes: tarball.length
 			});
@@ -902,6 +1189,98 @@ async function saveCacheSpecs(specs, restoreResults, deps, ownerStepIndex) {
 	}
 }
 //#endregion
+//#region src/execution/artifacts/artifact-engine.ts
+/**
+* User-facing artifacts engine (sandbox-side).
+*
+* Packs `ctx.artifacts.upload(name, paths)` into a gzip tarball and uploads it
+* under a run-scoped, named key; `ctx.artifacts.download(name, destDir)` streams
+* the tarball back with on-the-fly SHA-256 verification and extracts it. Reuses
+* the cache engine's pack/extract/anchor primitives (`packCachePaths`,
+* `downloadAndExtractCache`) — the tar layout, path-safety, and multi-root
+* anchoring are identical; only the addressing (named + immutable-per-run
+* instead of content-keyed) and the transport differ.
+*
+* Drives the orchestrator over an injected request-response transport
+* (IPC -> agent WS -> orchestrator); the agent never holds bucket credentials
+* (presigned URLs only). A rejected upload (duplicate name, size cap, run cap,
+* org quota) throws with the orchestrator's reason verbatim; a missing artifact
+* on download throws a clear not-found error. When the refusal is not an
+* enforcement gate — artifacts are unconfigured, the run is unresolvable, or the
+* store errored — the orchestrator sends a safe free-text detail that both paths
+* surface as `artifact "<name>": <detail>`, so a misconfiguration is never
+* mistaken for a quota rejection or a missing artifact.
+*
+* A name that violates the artifact-name contract is refused here, before the
+* wire, and rendered in that same `artifact "<name>": <detail>` shape from the
+* shared engine builder — so the author reads one sentence whether the sandbox
+* or the orchestrator caught it.
+*/
+const logger$3 = createLogger({ prefix: "artifact-engine" });
+/** Human-readable message for an upload rejection reason or internal-failure detail. */
+function rejectionMessage(name, reason, error) {
+	switch (reason) {
+		case "duplicate_name": return `artifact "${name}" already uploaded in this run (artifacts are immutable per run)`;
+		case "size_cap": return `artifact "${name}" exceeds the per-artifact size cap`;
+		case "run_cap": return `artifact "${name}" would exceed this run's artifact count cap`;
+		case "org_quota": return `artifact "${name}" would exceed the organization's artifact storage quota`;
+		default: return error ? `artifact "${name}": ${error}` : `artifact "${name}" upload was rejected`;
+	}
+}
+/**
+* Reject a name that violates the shared contract with the same sentence the
+* orchestrator would have produced.
+*
+* The `artifact "<name>": ` prefix is added here deliberately. On the
+* orchestrator path that prefix comes from {@link rejectionMessage}'s default
+* branch; the sandbox throws directly and bypasses it, so it has to supply the
+* prefix itself for the two paths to render one string.
+*/
+function assertArtifactName(name) {
+	const detail = checkArtifactName(name);
+	if (detail) throw new Error(`artifact "${name}": ${artifactInvalidNameError(detail)}`);
+}
+/** Build the imperative `ctx.artifacts` API bound to a workDir + transport. */
+function createArtifactsApi(workDir, transport, roots) {
+	return {
+		async upload(name, paths) {
+			assertArtifactName(name);
+			if (paths.length === 0) throw new Error(`artifact "${name}" upload requires at least one path`);
+			const { tarball, hash } = await packCachePaths(workDir, paths, roots);
+			const grant = await transport.beginUpload(name, tarball.length);
+			if (grant.outcome === "rejected" || !grant.uploadUrl || !grant.storageKey) throw new Error(rejectionMessage(name, grant.reason, grant.error));
+			const { uploadToPresignedUrl } = await Promise.resolve().then(() => (init_download(), download_exports));
+			await uploadToPresignedUrl(grant.uploadUrl, tarball);
+			await transport.completeUpload(name, tarball.length, hash, grant.storageKey);
+			logger$3.info("artifact uploaded", {
+				name,
+				sizeBytes: tarball.length,
+				sha256: hash.slice(0, 12)
+			});
+			return {
+				size: tarball.length,
+				sha256: hash
+			};
+		},
+		async download(name, destDir) {
+			assertArtifactName(name);
+			const lookup = await transport.download(name);
+			if (lookup.outcome === "not_found" || !lookup.downloadUrl || !lookup.sha256) throw new Error(lookup.error ? `artifact "${name}": ${lookup.error}` : `artifact "${name}" was not found in this run`);
+			const dest = destDir ?? workDir;
+			await downloadAndExtractCache(lookup.downloadUrl, dest, lookup.sha256, roots);
+			logger$3.info("artifact downloaded", {
+				name,
+				destDir: dest,
+				sizeBytes: lookup.sizeBytes
+			});
+			return {
+				size: lookup.sizeBytes ?? 0,
+				sha256: lookup.sha256
+			};
+		}
+	};
+}
+//#endregion
 //#region src/execution/sandbox/log-masker.ts
 /**
 * Secret value masking for log lines.
@@ -1060,7 +1439,7 @@ function parsePathFileContent(content) {
 }
 /** Create fresh, empty env + path files inside a private temp dir under `baseDir`. */
 async function createEnvFiles(baseDir) {
-	const dir = await mkdtemp(join(baseDir, "kici-env-"));
+	const { path: dir } = await makeTempDir("env", { base: baseDir });
 	const envFile = join(dir, "env");
 	const pathFile = join(dir, "path");
 	await writeFile(envFile, "");
@@ -1200,25 +1579,6 @@ async function executeHook(opts) {
 //#endregion
 //#region src/execution/rule-evaluator.ts
 initZx();
-/**
-* Create RuleContext for agent-side rule evaluation.
-*
-* @param event - Event payload from the dispatch message
-* @param changedFiles - List of files changed in this event
-* @param env - Merged environment variables
-* @param dispatchInputs - Operator dispatch inputs (`ctx.dispatchInputs`)
-* @param fanout - Fan-out position (`ctx.fanout`); undefined on a non-fan-out job
-*/
-function createRuleContext(event, changedFiles = [], env = {}, dispatchInputs = {}, fanout) {
-	return {
-		event,
-		changedFiles,
-		env,
-		dispatchInputs,
-		...fanout && { fanout },
-		$
-	};
-}
 //#endregion
 //#region src/execution/sandbox/parallel-scheduler.ts
 /**
@@ -1440,6 +1800,58 @@ async function runStepWithCheckMode(step, stepIndex, ctx, checkMode, sendFn, opt
 		...res.drift != null && { drift: res.drift }
 	};
 }
+/** Most characters of a failing step's error message that reach the run log. */
+const STEP_FAILURE_LOG_MAX_CHARS = 8192;
+/**
+* Emit a failing step's error message into the step's own log stream.
+*
+* A step failure is otherwise reported only on `step.complete` (which persists
+* to the step row), so a reader of the run log sees a step go red with nothing
+* explaining why. Subprocess wrappers routinely pack the real diagnosis —
+* captured stderr, exit code, kill signal — into the thrown error's message, so
+* that message is the diagnosis and it belongs in the log.
+*
+* Tagged `stderr`: it is a failure, not progress. Bounded to
+* {@link STEP_FAILURE_LOG_MAX_LINES} lines / {@link STEP_FAILURE_LOG_MAX_CHARS}
+* characters, because a wrapped process error can carry a subprocess's entire
+* output; what is dropped is stated in the log rather than silently cut. The
+* full untruncated message still travels on `step.complete`.
+*
+* Goes through the same `sendFn` as every other log line, so the runner's
+* secret masking applies exactly as it does to the step's ordinary output.
+*
+* One consequence to know: a `$({ quiet: true })` command's output is kept out
+* of the log by the `verbose` gate in `streaming-zx-log.ts`, but when such a
+* command FAILS, zx packs its captured output into the thrown error's message —
+* which this function then writes to the log. That text is already persisted
+* unmasked on `step.complete` (the step row the dashboard renders), so the copy
+* written here is the more protected of the two, and surfacing it is the whole
+* point: a quiet command that fails is exactly the failure an operator cannot
+* otherwise diagnose. Registered secret values are masked; anything the masker
+* has never been told about is not.
+*/
+function emitStepFailureLog(stepName, stepIndex, message, sendFn) {
+	const prefix = `[kici] Step '${stepName}' failed: `;
+	const kept = (prefix + (message.length > 8192 ? message.slice(0, STEP_FAILURE_LOG_MAX_CHARS) : message)).split("\n").slice(0, 100);
+	for (const line of kept) if (line) sendFn({
+		type: "log.line",
+		stepIndex,
+		line,
+		stream: LogStream.enum.stderr
+	});
+	const emittedChars = Math.max(0, kept.join("\n").length - prefix.length);
+	const omittedChars = message.length - emittedChars;
+	if (omittedChars > 0) {
+		let omittedLines = 0;
+		for (let i = emittedChars; i < message.length; i++) if (message.charCodeAt(i) === 10) omittedLines++;
+		sendFn({
+			type: "log.line",
+			stepIndex,
+			line: `[kici] … error message truncated (${omittedLines} more line(s), ${omittedChars} more character(s)); see the step's recorded error for the full text`,
+			stream: LogStream.enum.stderr
+		});
+	}
+}
 /**
 * Execute a single step with timeout enforcement.
 *
@@ -1530,6 +1942,7 @@ async function executeStepInLoop(step, stepIndex, ctx, timeoutMs, sendFn, output
 		}
 		const exitCode = extractExitCode(e);
 		const signal = extractSignal(e);
+		emitStepFailureLog(step.name, stepIndex, error.message, sendFn);
 		const secretsAccessed = getSecretsAccessLog?.(stepIndex);
 		emitSecretMountEvents(getSecretMountRecords?.(stepIndex), stepIndex, sendFn);
 		sendFn({
@@ -1580,14 +1993,60 @@ function extractSignal(error) {
 	if (error && typeof error === "object" && "signal" in error && typeof error.signal === "string") return error.signal;
 }
 /**
-* Evaluate step-level rules. Returns a 'skipped' result + emits IPC when a rule
-* fails; returns null when the step should run normally.
+* Evaluate step-level rules. Returns null when the step should run normally.
+* Otherwise returns a terminal `StepIterationOutcome`:
+*
+* - a rule's `check()` **threw** (`evaluationError`) → FAIL the step (`failed`
+*   status + error surfaced, `shouldBreak: true`): the gate could not be
+*   evaluated, so silently skipping would be a false green.
+* - a rule cleanly returned `false` → clean skip (`skipped` status,
+*   `shouldBreak: false`), the loop continues to the next step (unchanged).
 */
 async function evaluateStepRulesAndMaybeSkip(step, stepIndex, opts) {
 	if (!step.rules || step.rules.length === 0) return null;
-	const ruleCtx = createRuleContext(opts.event, [], opts.env, opts.dispatchInputs ?? {}, opts.fanout);
+	const ev = opts.event;
+	const ruleCtx = createRuleContext({
+		event: opts.event,
+		changedFiles: ev.changedFiles,
+		changedFilesStatus: ev.changedFilesStatus,
+		env: opts.env,
+		dispatchInputs: opts.dispatchInputs ?? {},
+		fanout: opts.fanout
+	});
 	const ruleResult = await evaluateRules(step.rules, ruleCtx, step.name);
 	if (ruleResult.allPassed) return null;
+	if (ruleResult.evaluationError) {
+		const message = `rule '${ruleResult.evaluationError.label}' errored: ${ruleResult.evaluationError.message}`;
+		opts.sendIpc({
+			type: "step.start",
+			stepIndex,
+			stepName: step.name
+		});
+		opts.sendIpc({
+			type: "step.complete",
+			stepIndex,
+			status: ExecutionStepStatus.enum.failed,
+			durationMs: 0,
+			error: { message }
+		});
+		opts.sendIpc({
+			type: "log.line",
+			stepIndex,
+			line: `[kici] Step '${step.name}' failed: ${message}`,
+			stream: LogStream.enum.stderr
+		});
+		return {
+			result: {
+				name: step.name,
+				stepIndex,
+				status: ExecutionStepStatus.enum.failed,
+				durationMs: 0,
+				error: { message }
+			},
+			shouldBreak: true,
+			failedStepName: step.name
+		};
+	}
 	opts.sendIpc({
 		type: "step.start",
 		stepIndex,
@@ -1605,10 +2064,13 @@ async function evaluateStepRulesAndMaybeSkip(step, stepIndex, opts) {
 		line: `[kici] Step '${step.name}' skipped: rule '${ruleResult.results.find((r) => !r.passed)?.label}' did not pass`
 	});
 	return {
-		name: step.name,
-		stepIndex,
-		status: ExecutionStepStatus.enum.skipped,
-		durationMs: 0
+		result: {
+			name: step.name,
+			stepIndex,
+			status: ExecutionStepStatus.enum.skipped,
+			durationMs: 0
+		},
+		shouldBreak: false
 	};
 }
 /**
@@ -1658,7 +2120,8 @@ async function maybeGateStepApproval(step, stepIndex, opts) {
 	opts.sendIpc({
 		type: "log.line",
 		stepIndex,
-		line: `[kici] Step '${step.name}' ${why}.`
+		line: `[kici] Step '${step.name}' ${why}.`,
+		stream: LogStream.enum.stderr
 	});
 	await opts.disposeStepResources?.(stepIndex);
 	return {
@@ -1699,7 +2162,8 @@ async function runObserverHook(args) {
 	if (!hookResult.success) opts.sendIpc({
 		type: "log.line",
 		stepIndex,
-		line: `[kici] ${hookType} hook failed: ${hookResult.error} (continuing -- hooks are observers)`
+		line: `[kici] ${hookType} hook failed: ${hookResult.error} (continuing -- hooks are observers)`,
+		stream: LogStream.enum.stderr
 	});
 }
 /**
@@ -1739,20 +2203,18 @@ async function runStepWithRetry(step, stepIndex, ctx, timeoutMs, opts) {
 		opts.sendIpc({
 			type: "log.line",
 			stepIndex,
-			line: `[kici] Step '${step.name}' attempt ${n}/${max} failed: ${err.message}; retrying in ${delay}ms`
+			line: `[kici] Step '${step.name}' attempt ${n}/${max} failed: ${err.message}; retrying in ${delay}ms`,
+			stream: LogStream.enum.stderr
 		});
 		await new Promise((r) => setTimeout(r, delay));
 	}
 	return result;
 }
 async function runStepIteration(step, stepIndex, opts) {
-	const skippedResult = await evaluateStepRulesAndMaybeSkip(step, stepIndex, opts);
-	if (skippedResult) {
+	const ruleOutcome = await evaluateStepRulesAndMaybeSkip(step, stepIndex, opts);
+	if (ruleOutcome) {
 		await opts.disposeStepResources?.(stepIndex);
-		return {
-			result: skippedResult,
-			shouldBreak: false
-		};
+		return ruleOutcome;
 	}
 	const gate = await maybeGateStepApproval(step, stepIndex, opts);
 	if (gate) return gate;
@@ -2385,63 +2847,6 @@ function armJobDeadline(timeoutMs, onTimeout) {
 	return { clear: () => clearTimeout(timer) };
 }
 //#endregion
-//#region src/checkout/ssh-auth.ts
-/**
-* Materialize an SSH private key (and optional pinned known_hosts) into a
-* tempdir and build the `GIT_SSH_COMMAND` that `git clone` needs.
-*
-* Permissions:
-*   - private key mode 0o600 (required by OpenSSH — refuses to use world-
-*     readable keys).
-*   - known_hosts mode 0o600.
-*   - tempdir mode 0o700.
-*
-* SSH flags composed:
-*   - `-i <keyfile>` — identity file.
-*   - `-o IdentitiesOnly=yes` — don't try other keys from ssh-agent / ~/.ssh.
-*   - `-o BatchMode=yes` — never prompt for passwords / passphrases.
-*   - host-key checking flags based on `hostKeyPolicy`.
-*/
-async function setupSshAuth(opts) {
-	if (opts.hostKeyPolicy === "pinned" && !opts.knownHosts) throw new Error("pinned hostKeyPolicy requires knownHosts content");
-	const tempDir = await mkdtemp(join(tmpdir(), "kici-ssh-"));
-	const keyPath = join(tempDir, "id");
-	await writeFile(keyPath, opts.privateKey.endsWith("\n") ? opts.privateKey : `${opts.privateKey}\n`, { mode: 384 });
-	const knownHostsPath = join(tempDir, "known_hosts");
-	await writeFile(knownHostsPath, opts.hostKeyPolicy === "pinned" ? opts.knownHosts : "", { mode: 384 });
-	const parts = [
-		"ssh",
-		"-i",
-		escapeShellArg(keyPath),
-		"-o",
-		"IdentitiesOnly=yes",
-		"-o",
-		"BatchMode=yes",
-		"-o",
-		`UserKnownHostsFile=${escapeShellArg(knownHostsPath)}`
-	];
-	if (opts.hostKeyPolicy === "pinned") parts.push("-o", "StrictHostKeyChecking=yes");
-	else parts.push("-o", "StrictHostKeyChecking=accept-new");
-	return {
-		gitSshCommand: parts.join(" "),
-		tempDir,
-		async cleanup() {
-			await rm(tempDir, {
-				recursive: true,
-				force: true
-			});
-		}
-	};
-}
-/**
-* Quote a path for inclusion in `GIT_SSH_COMMAND`. We use single-quote
-* wrapping so backslashes and spaces survive git's shell-parse of the
-* command value.
-*/
-function escapeShellArg(value) {
-	return `'${value.replace(/'/g, "'\\''")}'`;
-}
-//#endregion
 //#region src/checkout/git-clone.ts
 /**
 * Strip auth credentials from git error messages to prevent token leakage.
@@ -2481,19 +2886,16 @@ async function gitClone(options) {
 	let needsCustomEnv = false;
 	let safeDirCleanup;
 	if (repoUrl.startsWith("file://")) {
-		const { mkdtemp, writeFile, rm } = await import("node:fs/promises");
-		const { tmpdir } = await import("node:os");
+		const { writeFile } = await import("node:fs/promises");
 		const path = await import("node:path");
-		const dir = await mkdtemp(path.join(tmpdir(), "kici-gitcfg-"));
+		const { makeTempDir } = await import("@kici-dev/core/tmp");
+		const { path: dir, cleanup } = await makeTempDir("gitcfg");
 		const cfgPath = path.join(dir, "config");
 		await writeFile(cfgPath, "[safe]\n	directory = *\n", { mode: 384 });
 		envEntries.GIT_CONFIG_GLOBAL = cfgPath;
 		needsCustomEnv = true;
 		safeDirCleanup = async () => {
-			await rm(dir, {
-				recursive: true,
-				force: true
-			}).catch(() => {});
+			await cleanup().catch(() => {});
 		};
 	}
 	let sshSetup;
@@ -2788,7 +3190,7 @@ async function applyYarnrcBerryConfig(args) {
 	const hasPrivateRegistry = registries.length > 0 || Object.keys(installEnvSecrets).length > 0;
 	const yarnrcPath = join(args.kiciDir, ".yarnrc.yml");
 	const { raw: original, doc } = await readOriginalYarnrc(yarnrcPath);
-	const cacheFolder = await mkdtemp(join(tmpdir(), "kici-yarn-berry-cache-"));
+	const { path: cacheFolder, cleanup: cleanupCache } = await makeTempDir("yarn-berry-cache");
 	const merged = {
 		...doc,
 		nodeLinker: "node-modules",
@@ -2825,10 +3227,7 @@ async function applyYarnrcBerryConfig(args) {
 			if (original === null) await unlink(yarnrcPath).catch(() => {});
 			else await writeFile(yarnrcPath, original, { encoding: "utf8" });
 		} catch {}
-		await rm(cacheFolder, {
-			recursive: true,
-			force: true
-		}).catch(() => {});
+		await cleanupCache().catch(() => {});
 	};
 	return {
 		extraEnv: {
@@ -3143,9 +3542,9 @@ async function detectKiciYarnFlavor(repoRoot, kiciDir) {
 * Install `.kici/` dependencies inline with the repo's package manager.
 *
 * Falls back to this when the dep cache is unavailable or a download fails.
-* The install runs with an isolated cache/store directory (created in
-* `os.tmpdir()`) to prevent cache poisoning between build jobs; the directory
-* is removed after installation.
+* The install runs with an isolated cache/store directory (allocated under the
+* global temp base, which honors `KICI_TMPDIR`) to prevent cache poisoning
+* between build jobs; the directory is removed after installation.
 *
 * If `opts.npmRegistries` / `opts.installEnvSecrets` is provided, a job-scoped
 * `.kici/.npmrc` overlay is synthesized for the install, restored in `finally`,
@@ -3234,7 +3633,7 @@ function envWithNodeOnPath(extraEnv, nodeDir) {
 /** Run `npm install` in `.kici/` with an isolated cache directory. */
 async function runNpmInstall(args) {
 	const { npmCliPath, nodeExe, nodeDir } = resolveNpm();
-	const cacheDir = await mkdtemp(join(tmpdir(), "kici-npm-cache-"));
+	const { path: cacheDir, cleanup } = await makeTempDir("npm-cache");
 	const env = envWithNodeOnPath(args.registryConfig.extraEnv, nodeDir);
 	const buildArgs = (...prefix) => {
 		const a = [
@@ -3259,10 +3658,7 @@ async function runNpmInstall(args) {
 			maxBuffer: INSTALL_MAX_BUFFER
 		});
 	} finally {
-		await rm(cacheDir, {
-			recursive: true,
-			force: true
-		}).catch(() => {});
+		await cleanup().catch(() => {});
 	}
 }
 /**
@@ -3276,7 +3672,7 @@ async function runNpmInstall(args) {
 async function runPnpmInstall(args) {
 	await assertPnpmAvailable();
 	const { nodeDir } = resolveNpm();
-	const storeDir = await mkdtemp(join(tmpdir(), "kici-pnpm-store-"));
+	const { path: storeDir, cleanup } = await makeTempDir("pnpm-store");
 	const env = envWithNodeOnPath(args.registryConfig.extraEnv, nodeDir);
 	const argv = [
 		"install",
@@ -3296,10 +3692,7 @@ async function runPnpmInstall(args) {
 			maxBuffer: INSTALL_MAX_BUFFER
 		});
 	} finally {
-		await rm(storeDir, {
-			recursive: true,
-			force: true
-		}).catch(() => {});
+		await cleanup().catch(() => {});
 	}
 }
 /** Pure: argv for `yarn install` with an isolated cache folder. */
@@ -3325,7 +3718,7 @@ function buildYarnInstallArgs(cacheDir, hasPrivateRegistry) {
 async function runYarnInstall(args) {
 	await assertYarnAvailable();
 	const { nodeDir } = resolveNpm();
-	const cacheDir = await mkdtemp(join(tmpdir(), "kici-yarn-cache-"));
+	const { path: cacheDir, cleanup } = await makeTempDir("yarn-cache");
 	const env = envWithNodeOnPath(args.registryConfig.extraEnv, nodeDir);
 	const argv = buildYarnInstallArgs(cacheDir, args.hasPrivateRegistry);
 	try {
@@ -3337,10 +3730,7 @@ async function runYarnInstall(args) {
 			maxBuffer: INSTALL_MAX_BUFFER
 		});
 	} finally {
-		await rm(cacheDir, {
-			recursive: true,
-			force: true
-		}).catch(() => {});
+		await cleanup().catch(() => {});
 	}
 }
 /** Pure: argv for a berry `yarn install`. Cache + linker live in .yarnrc.yml. */
@@ -3493,19 +3883,65 @@ function logSubprocessStreams(e, tokens) {
 * no Rolldown step at runtime. `@kici-dev/sdk` and host-repo deps resolve via
 * Node's normal ESM lookup against `.kici/node_modules/`.
 */
-const AGENT_SDK_VERSION = "0.1.26";
-const AGENT_SDK_BUNDLE_HASH = "e06bd1acf349ba365bdb357f3d865e0cbb4ad4604a0270b707a681a4f440954e";
 /**
-* Register the `@kici-dev/core/ts-loader-hook` oxc-transform ESM loader hook so
-* subsequent dynamic `import()` calls for `.ts` / `.tsx` files transform on the
-* fly. Idempotent at our level via the `hookRegistered` flag; Node also
-* tolerates repeated `register()` calls by stacking layers, but we avoid the
-* noise.
+* Resolve the `@kici-dev/sdk` instance the workflow module itself imports.
+*
+* The workflow's `.result` proxies read the module-global step-outputs map of
+* whichever SDK copy the workflow file resolves — which is generally a
+* different physical module than the agent's bundled SDK (the workflow is
+* imported from the cloned source tree and resolves its deps against that
+* tree's `node_modules`). Resolving via `createRequire(workflowFilePath)` walks
+* `node_modules` from the workflow file exactly the way the workflow's own
+* `import '@kici-dev/sdk'` does — including any hoisted copy — so the returned
+* setters mutate the SAME module-global map object the proxies read. Node caches
+* ESM modules by resolved URL, so importing that path yields the workflow's live
+* singleton, not a fresh copy.
+*
+* Falls back to the agent's bundled setters when resolution fails (mirrors
+* `resolveSdkSetters` in the compiler's test runner).
+*/
+async function resolveWorkflowSdkSetters(workflowFilePath) {
+	try {
+		const sdk = await import(pathToFileURL(createRequire(workflowFilePath).resolve("@kici-dev/sdk")).href);
+		if (typeof sdk.setStepOutputsMap === "function" && typeof sdk.setStepRefMap === "function" && typeof sdk.setJobOutputsMap === "function") return {
+			setStepOutputsMap: sdk.setStepOutputsMap,
+			setStepRefMap: sdk.setStepRefMap,
+			setJobOutputsMap: sdk.setJobOutputsMap
+		};
+	} catch {}
+	return {
+		setStepOutputsMap,
+		setStepRefMap,
+		setJobOutputsMap
+	};
+}
+const AGENT_SDK_VERSION = "0.2.0";
+const AGENT_SDK_BUNDLE_HASH = "fcd0a836aa1cb92debd93e0254450614d123b3748511aa4148d956fd72a7c29f";
+/**
+* Register the ESM loader hook that transforms `.ts` / `.tsx` files on the fly
+* for subsequent dynamic `import()` calls. Idempotent at our level via the
+* `hookRegistered` flag; Node also tolerates repeated `register()` calls by
+* stacking layers, but we avoid the noise.
+*
+* Two registration branches:
+*
+* - **Container path** — when `KICI_TS_LOADER_HOOK_PATH` is set (only
+*   `ContainerSandbox` sets it, pointing at a pure-JS hook bundle mounted into
+*   the job container), register that on-disk hook by absolute `file://` URL.
+*   `module.register` resolves the specifier on disk in a worker thread, so a
+*   bare package specifier would need a `node_modules` tree next to the runner
+*   bundle — which does not exist in a bare customer container. An absolute
+*   `file://` URL sidesteps resolution entirely.
+* - **Fork / firecracker path** — when the env var is unset, register the
+*   `@kici-dev/core/ts-loader-hook` oxc-transform hook by bare specifier,
+*   resolved via the workspace `node_modules` those sandboxes bind read-only.
 */
 let hookRegistered = false;
 function ensureLoaderHookRegistered() {
 	if (hookRegistered) return;
-	register("@kici-dev/core/ts-loader-hook", import.meta.url);
+	const hookPath = process.env.KICI_TS_LOADER_HOOK_PATH;
+	if (hookPath) register(pathToFileURL(hookPath).href, import.meta.url);
+	else register("@kici-dev/core/ts-loader-hook", import.meta.url);
 	hookRegistered = true;
 }
 /**
@@ -3560,7 +3996,10 @@ async function loadWorkflowSource(workDir, sourceFile, expectedContentHash, reso
 		const actualHash = computeContentHash(rawSource, assetDigest);
 		if (actualHash !== expectedContentHash) throw new Error(`Lock file is out of date: workflow source changed without regenerating kici.lock.json (expected contentHash ${expectedContentHash}, got ${actualHash}, agent baked @kici-dev/sdk@${AGENT_SDK_VERSION} bundleHash=${AGENT_SDK_BUNDLE_HASH}). Run 'kici compile' and commit the updated lock file.`);
 	}
-	return { module: await import(pathToFileURL(filePath).href + `?t=${Date.now()}`) };
+	return {
+		module: await import(pathToFileURL(filePath).href + `?t=${Date.now()}`),
+		sdkSetters: await resolveWorkflowSdkSetters(filePath)
+	};
 }
 /**
 * Type guard for Workflow shape (discriminant: `_tag === 'Workflow'`).
@@ -3757,7 +4196,7 @@ function decryptBuffer(encrypted, aesKey) {
 */
 async function applyOverlay(config) {
 	const { tarballUrl, cliPublicKey, orchestratorPrivateKey, repoDir } = config;
-	const tmpDir = await fsPromises.mkdtemp(path.join(os.tmpdir(), "kici-overlay-"));
+	const { path: tmpDir, cleanup } = await makeTempDir("overlay");
 	try {
 		logger.info("Downloading overlay tarball", { url: tarballUrl.replace(/\?.*$/, "?[redacted]") });
 		let encryptedData;
@@ -3831,10 +4270,7 @@ async function applyOverlay(config) {
 			verified: true
 		};
 	} finally {
-		await fsPromises.rm(tmpDir, {
-			recursive: true,
-			force: true
-		}).catch(() => {});
+		await cleanup().catch(() => {});
 	}
 }
 //#endregion
@@ -3856,7 +4292,7 @@ async function applyOverlay(config) {
 */
 init_download();
 init_dep_restore();
-const AGENT_VERSION = "0.1.26";
+const AGENT_VERSION = "0.2.0";
 process.on("uncaughtException", (err) => {
 	process.stderr.write(`[workflow-runner] UNCAUGHT EXCEPTION: ${err.message}\n`);
 	if (err.stack) process.stderr.write(`[workflow-runner] Stack: ${err.stack}\n`);
@@ -3943,7 +4379,8 @@ function installOutputCapture() {
 			for (const line of lines) if (line) captureSendFn({
 				type: "log.line",
 				stepIndex: stepIdx,
-				line
+				line,
+				stream: LogStream.enum.stderr
 			});
 		}
 		return origStderrWrite(chunk, encodingOrCb, cb);
@@ -4196,6 +4633,33 @@ function waitForProvenanceResponse(requestId) {
 		});
 	});
 }
+/**
+* Pending promises for artifacts.response messages from the agent.
+* Key: requestId (correlates artifacts.request -> artifacts.response).
+*/
+const pendingArtifactResponses = /* @__PURE__ */ new Map();
+/** Wait for an artifacts.response from the agent with the given requestId. */
+function waitForArtifactResponse(requestId) {
+	return new Promise((resolve, reject) => {
+		const timer = setTimeout(() => {
+			pendingArtifactResponses.delete(requestId);
+			reject(/* @__PURE__ */ new Error(`Artifact request timed out after ${CACHE_RESPONSE_TIMEOUT_MS}ms`));
+		}, CACHE_RESPONSE_TIMEOUT_MS);
+		pendingArtifactResponses.set(requestId, {
+			resolve: (response) => {
+				clearTimeout(timer);
+				pendingArtifactResponses.delete(requestId);
+				resolve(response);
+			},
+			reject: (err) => {
+				clearTimeout(timer);
+				pendingArtifactResponses.delete(requestId);
+				reject(err);
+			},
+			timer
+		});
+	});
+}
 /** Wait for a cache.response from the agent with the given requestId. */
 function waitForCacheResponse(requestId) {
 	return new Promise((resolve, reject) => {
@@ -4350,6 +4814,68 @@ function buildCacheTransport() {
 		}
 	};
 }
+/**
+* Build the {@link ArtifactTransport} the sandbox-side artifacts engine uses to
+* reach the orchestrator. Each method sends an `artifacts.request` IPC (relayed
+* by the agent over the WS as an `artifacts.upload.*` / `artifacts.download.*`
+* message) and awaits the matching `artifacts.response`. Mirrors
+* {@link buildCacheTransport}.
+*/
+function buildArtifactTransport() {
+	return {
+		async beginUpload(name, declaredSizeBytes) {
+			const requestId = randomUUID();
+			sendMessage({
+				type: "artifacts.request",
+				requestId,
+				op: "beginUpload",
+				name,
+				declaredSizeBytes
+			});
+			const response = await waitForArtifactResponse(requestId);
+			if (response.error) throw new Error(`Artifact upload failed: ${response.error}`);
+			return {
+				outcome: response.uploadOutcome ?? "rejected",
+				...response.uploadUrl && { uploadUrl: response.uploadUrl },
+				...response.storageKey && { storageKey: response.storageKey },
+				...response.reason && { reason: response.reason },
+				...response.rejectionDetail && { error: response.rejectionDetail }
+			};
+		},
+		async completeUpload(name, sizeBytes, sha256, storageKey) {
+			const requestId = randomUUID();
+			sendMessage({
+				type: "artifacts.request",
+				requestId,
+				op: "completeUpload",
+				name,
+				sizeBytes,
+				sha256,
+				storageKey
+			});
+			const response = await waitForArtifactResponse(requestId);
+			if (response.error) throw new Error(`Artifact upload-complete failed: ${response.error}`);
+		},
+		async download(name) {
+			const requestId = randomUUID();
+			sendMessage({
+				type: "artifacts.request",
+				requestId,
+				op: "download",
+				name
+			});
+			const response = await waitForArtifactResponse(requestId);
+			if (response.error) throw new Error(`Artifact download failed: ${response.error}`);
+			return {
+				outcome: response.downloadOutcome ?? "not_found",
+				...response.downloadUrl && { downloadUrl: response.downloadUrl },
+				...response.sizeBytes !== void 0 && { sizeBytes: response.sizeBytes },
+				...response.sha256 && { sha256: response.sha256 },
+				...response.rejectionDetail && { error: response.rejectionDetail }
+			};
+		}
+	};
+}
 /** Send a `provenance.request` IPC and await the matching `provenance.response`. */
 async function relayProvenanceIpc(request) {
 	const requestId = randomUUID();
@@ -4505,6 +5031,9 @@ function dispatchAgentMessage(msg) {
 	} else if (msg.type === "provenance.response") {
 		const pending = pendingProvenanceResponses.get(msg.requestId);
 		if (pending) pending.resolve(msg);
+	} else if (msg.type === "artifacts.response") {
+		const pending = pendingArtifactResponses.get(msg.requestId);
+		if (pending) pending.resolve(msg);
 	} else if (msg.type === "approval.resolved") {
 		const pending = pendingApprovalResolutions.get(msg.requestId);
 		if (pending) pending.resolve(msg);
@@ -4649,13 +5178,13 @@ function envelopeChildOutputs(envelope) {
 */
 function buildStepSecrets(request, masker, onMaskerSecretsAdded) {
 	const mergedFlat = buildMergedFlatSecrets(request.secrets ?? {}, request.namespacedSecrets ?? {});
-	let stepTmpdir = null;
+	let stepTmpHandle = null;
 	const exposedEnvVars = /* @__PURE__ */ new Set();
 	let mountCounter = 0;
 	const env = process.env;
 	async function ensureTmpdir() {
-		if (stepTmpdir === null) stepTmpdir = await fsPromises.mkdtemp(join(tmpdir(), "kici-secret-files-"));
-		return stepTmpdir;
+		if (stepTmpHandle === null) stepTmpHandle = await makeTempDir("secret-files");
+		return stepTmpHandle.path;
 	}
 	return createStepSecrets(mergedFlat, env, request.secretMeta, {
 		host: {
@@ -4679,16 +5208,14 @@ function buildStepSecrets(request, masker, onMaskerSecretsAdded) {
 				delete process.env[envVar];
 			}
 			exposedEnvVars.clear();
-			if (stepTmpdir !== null) {
-				await fsPromises.rm(stepTmpdir, {
-					recursive: true,
-					force: true
-				});
-				stepTmpdir = null;
+			if (stepTmpHandle !== null) {
+				await stepTmpHandle.cleanup();
+				stepTmpHandle = null;
 			}
 		},
 		onDisposeError: (err) => {
-			origStderrWrite(`[workflow-runner] secret-file cleanup error: ${err instanceof Error ? err.message : String(err)}\n`);
+			const message = err instanceof Error ? err.message : String(err);
+			origStderrWrite(`[workflow-runner] secret-file cleanup error: ${message}\n`);
 		}
 	});
 }
@@ -4712,14 +5239,25 @@ function createSecretMasker(request) {
 * before spawning this process). This is the single shell-construction code
 * path shared by step execution (`createSandboxStepContext`) and the per-job
 * init phase (`runInitPhase`), so init commands run through the identical shell
-* steps use — same cwd, same env snapshot, same masked log streaming.
+* steps use — same cwd, same live sanitized env, same masked log streaming.
+*
+* The shell binds `process.env` by reference (not a copy), so a same-step
+* ctx.setEnv / ctx.addPath mutation — which applyEnvDelta writes to live
+* process.env — is visible to that step's own subprocesses, matching the
+* "visible to this step" SDK contract.
 *
 * Intercept zx subprocess output via the log callback: zx does NOT write child
 * stdout/stderr to process.stdout — it pipes to an internal VoidStream and only
-* calls $.log() with { kind: 'stdout'|'stderr' }. With verbose=false the default
-* log function skips stdout entirely, and with quiet=false it writes stderr to
-* process.stderr. We override the log function to capture both kinds directly
-* and send them as masked IPC log.line messages tagged with `stepIndex`.
+* calls $.log() with { kind: 'stdout'|'stderr', verbose }. We override the log
+* function (`makeStreamingZxLog`) to capture both kinds and send them as masked
+* IPC log.line messages tagged with `stepIndex`.
+*
+* The shell is built with `verbose: true` so ordinary subprocess output is
+* flagged `verbose: true` (captured) while a step that opts into
+* `$({ quiet: true })` — e.g. a `sops -d` credential decrypt — is flagged
+* `verbose: false` and dropped by `makeStreamingZxLog`. That gate is what keeps
+* a decrypted secret out of the streamed run log; a `verbose: false` base would
+* flag ordinary output `verbose: false` too and drop every line.
 *
 * IMPORTANT: The log function must be passed in the zx$() config, not set on the
 * returned function. zx$() returns a plain function (not the proxy $), so setting
@@ -4727,36 +5265,82 @@ function createSecretMasker(request) {
 * AsyncLocalStorage store that zx uses for ProcessPromise snapshots.
 */
 function buildSandboxShell(cwd, stepIndex, maskedSendFn) {
-	let zxLineBuf = "";
 	return $({
 		cwd,
-		env: { ...process.env },
-		verbose: false,
+		env: process.env,
+		verbose: true,
 		quiet: false,
-		log: ((entry) => {
-			if (entry.kind === "stdout" || entry.kind === "stderr") {
-				const text = typeof entry.data === "string" ? entry.data : String(entry.data ?? "");
-				zxLineBuf += text;
-				const lines = zxLineBuf.split("\n");
-				zxLineBuf = lines.pop();
-				for (const line of lines) if (line) maskedSendFn({
-					type: "log.line",
-					stepIndex,
-					line
-				});
-				return;
-			}
-		})
+		log: makeStreamingZxLog((line, stream) => maskedSendFn({
+			type: "log.line",
+			stepIndex,
+			line,
+			stream
+		}))
 	});
 }
 /**
+* Resolve the on-the-wire event name for `ctx.emit`. Accepts either an ad-hoc
+* event-name string or a `defineEvent()` definition object (passed by the typed
+* emit overload); a definition resolves to its `.name`, a string passes through.
+*/
+function resolveEmitEventName(nameOrDefinition) {
+	return isEventDefinition(nameOrDefinition) ? nameOrDefinition.name : nameOrDefinition;
+}
+/**
+* Sanitize a raw identifier into a valid temp label: lowercase, every
+* non-`[a-z0-9-]` char to `-`, falling back to `'step'` when the result is
+* empty. Applied to both the caller-supplied `ctx.mktemp(label)` and the
+* default step-id label so a friendly-but-irregular label never rejects at the
+* scope. Mirrors the SDK test builder's `sanitizeTempLabel`.
+*/
+function sanitizeTempLabel(raw) {
+	const cleaned = raw.toLowerCase().replace(/[^a-z0-9-]/g, "-");
+	return cleaned.length > 0 ? cleaned : "step";
+}
+/**
+* Drain the job-scoped temp allocator once at job end.
+*
+* Called after the step loop and cancel-path hooks, immediately before the
+* terminal `job.complete` emit, so a single call reclaims every `ctx.mktemp` /
+* `ctx.mktempFile` allocation on success, failure, and cancel/timeout alike. A
+* cleanup failure must NEVER change the job's terminal status, so any error is
+* swallowed into `warn` rather than thrown out of `main()`.
+*/
+async function drainJobTempScope(scope, warn) {
+	try {
+		await scope.disposeAll();
+	} catch (err) {
+		warn(`job temp scope cleanup failed: ${toErrorMessage(err)}`);
+	}
+}
+/**
+* Job-end wrapper around {@link drainJobTempScope} that routes a cleanup
+* warning to the run log as a job-level (`stepIndex: -1`) line. Kept out of
+* `main()` so the single drain call site stays one line.
+*/
+async function drainJobTempScopeToLog(scope, send) {
+	await drainJobTempScope(scope, (message) => send({
+		type: "log.line",
+		stepIndex: -1,
+		line: `[kici] ${message}`
+	}));
+}
+/**
+* Map the step loop's terminal status onto the initial job-level status —
+* `success` iff every step succeeded, else `failed`. `main()` may override this
+* afterward for the cancel/timeout paths.
+*/
+function initialJobStatus(loopStatus) {
+	return loopStatus === ExecutionStepStatus.enum.success ? ExecutionJobStatus.enum.success : ExecutionJobStatus.enum.failed;
+}
+/**
 * Create a StepContext natively inside the workflow runner.
 *
 * The context is reconstructed from the environment and IPC request fields --
 * NOT serialized across the process boundary. This means zx $ runs natively
 * inside this process with full shell access.
 */
-function createSandboxStepContext(workDir, stepIndex, stepName, request, maskedSendFn, outputsMap, refMap, operatorSecretKeys, secretOutputs, jobOutputsMap, secrets, masker, signal) {
+function createSandboxStepContext(workDir, stepIndex, stepName, request, maskedSendFn, outputsMap, refMap, operatorSecretKeys, secretOutputs, jobOutputsMap, secrets, masker, signal, jobTempScope) {
 	const step$ = buildSandboxShell(workDir, stepIndex, maskedSendFn);
 	const log = createIpcLogger(stepIndex, stepName, maskedSendFn);
 	const rawPayload = rawPayloadFromEvent(request.event);
@@ -4800,9 +5384,11 @@ function createSandboxStepContext(workDir, stepIndex, stepName, request, maskedS
 			runsOn: request.runsOn
 		},
 		isTestRun: request.isTestRun ?? false,
-		environment: request.environment,
+		context: request.context,
 		cache: createCacheApi(workDir, buildCacheTransport()),
-		emit: async (eventName, payload, options) => {
+		artifacts: createArtifactsApi(workDir, buildArtifactTransport()),
+		emit: async (nameOrDefinition, payload, options) => {
+			const eventName = resolveEmitEventName(nameOrDefinition);
 			const reqId = randomUUID();
 			sendMessage({
 				type: "event.emit",
@@ -4824,6 +5410,8 @@ function createSandboxStepContext(workDir, stepIndex, stepName, request, maskedS
 		setSecretOutput: (key, value) => {
 			secretOutputs.set(key, value);
 		},
+		mktemp: (label) => jobTempScope.mktemp(sanitizeTempLabel(label ?? stepName)),
+		mktempFile: (label, opts) => jobTempScope.mktempFile(sanitizeTempLabel(label ?? stepName), opts),
 		kici,
 		attestProvenance: buildAttestProvenanceFn(request, workDir, (o) => kici.oidc.token(o)),
 		...rawPayload && { rawPayload },
@@ -5008,14 +5596,15 @@ async function applyOverlayIfRequested(request, workflowDir) {
 * Mirroring the `file://`-clone fix in checkout/git-clone.ts, we point
 * `GIT_CONFIG_GLOBAL` at a temp config carrying `safe.directory = *`. Setting it
 * on `process.env` here (before the step loop) means every step subprocess —
-* each zx `$` snapshots `process.env` at context creation — inherits it, so git
+* each zx `$` reads live `process.env` at spawn — inherits it, so git
 * works in steps exactly as it does locally. We also register the dep-restore
 * scratch-dir exclude now that a real `.git` exists in the workspace.
 */
 async function makeOverlayGitUsable(request, workspaceDir) {
 	if (!request.fullRepo) return;
 	if (!existsSync(join(workspaceDir, ".git"))) return;
-	const cfgPath = join(await fsPromises.mkdtemp(join(tmpdir(), "kici-gitcfg-")), "config");
+	const { path: cfgDir } = await makeTempDir("gitcfg");
+	const cfgPath = join(cfgDir, "config");
 	await fsPromises.writeFile(cfgPath, "[safe]\n	directory = *\n", { mode: 384 });
 	process.env.GIT_CONFIG_GLOBAL = cfgPath;
 	trace(`fullRepo git safe.directory configured via GIT_CONFIG_GLOBAL=${cfgPath}`);
@@ -5206,7 +5795,7 @@ async function evaluateConcurrencyGroupIfPresent(workflow, request) {
 				stepIndex: -1,
 				line: `[kici] Concurrency: queued${ack.reason ? ` (${ack.reason})` : ""}, waiting for slot to free`
 			});
-			const waitCapMs = Number.parseInt(process.env.KICI_CONCURRENCY_WAIT_TIMEOUT_MS ?? "", 10) || 36e5;
+			const waitCapMs = request.concurrencyWaitTimeoutMs ?? (Number.parseInt(process.env.KICI_CONCURRENCY_WAIT_TIMEOUT_MS ?? "", 10) || 36e5);
 			try {
 				ack = await waitForConcurrencyAck(waitCapMs);
 			} catch (waitErr) {
@@ -5395,6 +5984,46 @@ async function runCancelPathHooks(args) {
 	};
 }
 /**
+* Coerce one raw entry (bare function or Step) into a normalized Step, naming
+* anonymous steps `step-N` with a counter shared across the whole flattened
+* sequence (parallel children inline) — matching the compiler's transformSteps
+* enumeration so the flat-stepIndex invariant holds agent ↔ orchestrator.
+*
+* Unnamed steps are named by MUTATING the original object so the SDK's
+* late-bound `.result` proxy (which reads `step.name` at access time) resolves.
+* A step object reused twice in one pass gets a clone with a fresh name on the
+* repeat encounter — mirroring the compiler's per-occurrence naming so lock
+* parity holds; the original keeps its first binding.
+*/
+function coerceStep(stepOrFn, state) {
+	if (typeof stepOrFn === "function") {
+		state.counter++;
+		const name = `step-${state.counter}`;
+		state.refMap.set(stepOrFn, name);
+		return {
+			_tag: "Step",
+			name,
+			run: stepOrFn,
+			outputs: void 0
+		};
+	}
+	const s = stepOrFn;
+	if (!s.name) {
+		state.counter++;
+		s.name = `step-${state.counter}`;
+		state.autoNamed.add(s);
+		return s;
+	}
+	if (state.autoNamed.has(s)) {
+		state.counter++;
+		return {
+			...s,
+			name: `step-${state.counter}`
+		};
+	}
+	return s;
+}
+/**
 * Phase 5 — Extract steps for the requested job (re-evaluating the dynamic
 * factory when `dynamicSource` is set, otherwise looking up the static job)
 * and normalise the result into the `Step[]` shape the step loop consumes.
@@ -5410,30 +6039,13 @@ async function extractAndNormalizeSteps(workflow, request, apiTransport) {
 		driftDroppedJobs = dynamicResult.droppedJobs;
 		if (driftDroppedJobs.length > 0) trace(`Determinism drift: ${driftDroppedJobs.length} job(s) dropped: ${driftDroppedJobs.join(", ")}`);
 	} else rawSteps = extractSteps(workflow, request.jobName);
-	const refMap = /* @__PURE__ */ new WeakMap();
-	let stepCounter = 0;
-	const coerce = (stepOrFn) => {
-		if (typeof stepOrFn === "function") {
-			stepCounter++;
-			const name = `step-${stepCounter}`;
-			refMap.set(stepOrFn, name);
-			return {
-				_tag: "Step",
-				name,
-				run: stepOrFn,
-				outputs: void 0
-			};
-		}
-		const s = stepOrFn;
-		if (!s.name) {
-			stepCounter++;
-			return {
-				...s,
-				name: `step-${stepCounter}`
-			};
-		}
-		return s;
+	const coerceState = {
+		counter: 0,
+		refMap: /* @__PURE__ */ new WeakMap(),
+		autoNamed: /* @__PURE__ */ new WeakSet()
 	};
+	const refMap = coerceState.refMap;
+	const coerce = (stepOrFn) => coerceStep(stepOrFn, coerceState);
 	const normalizedSteps = [];
 	const nodes = [];
 	let flatIndex = 0;
@@ -5480,9 +6092,13 @@ async function extractAndNormalizeSteps(workflow, request, apiTransport) {
 * Phase 6 — Build the output infrastructure: the per-step operator-secret
 * key set (used for setEnv override protection), and the output / job-output
 * maps that back `.result` proxies and `ctx.outputsOf()` / `ctx.jobOutputs()`.
-* Sets the SDK module globals as a side effect.
+* Sets the SDK module globals as a side effect — on BOTH the agent's bundled
+* SDK and the workflow module's own SDK instance (`workflowSdkSetters`), with
+* the same map objects. The workflow's within-job `.result` proxies read that
+* instance's module-global step-outputs map, so wiring only the agent's bundled
+* SDK would leave the proxies reading an always-empty map.
 */
-function buildOutputInfrastructure(request, refMap) {
+function buildOutputInfrastructure(request, refMap, workflowSdkSetters) {
 	const operatorSecretKeys = /* @__PURE__ */ new Set();
 	if (request.secrets) for (const key of Object.keys(request.secrets)) operatorSecretKeys.add(key);
 	if (request.namespacedSecrets) for (const ctx of Object.values(request.namespacedSecrets)) for (const key of Object.keys(ctx)) operatorSecretKeys.add(key);
@@ -5490,9 +6106,12 @@ function buildOutputInfrastructure(request, refMap) {
 	const secretOutputs = /* @__PURE__ */ new Map();
 	setStepOutputsMap(outputsMap);
 	setStepRefMap(refMap);
+	workflowSdkSetters?.setStepOutputsMap(outputsMap);
+	workflowSdkSetters?.setStepRefMap(refMap);
 	const jobOutputsMap = /* @__PURE__ */ new Map();
 	if (request.upstreamJobOutputs) for (const [jobName, outputs] of Object.entries(request.upstreamJobOutputs)) jobOutputsMap.set(jobName, outputs);
 	setJobOutputsMap(jobOutputsMap);
+	workflowSdkSetters?.setJobOutputsMap(jobOutputsMap);
 	return {
 		operatorSecretKeys,
 		outputsMap,
@@ -5501,27 +6120,82 @@ function buildOutputInfrastructure(request, refMap) {
 	};
 }
 /**
-* Phase 7 — Evaluate job-level rules. When any rule fails, send a
-* `job.complete{success}` with all steps marked skipped and exit 0.
-* Returns false when the caller should continue to step execution.
+* Resolve `event.changedFiles` for rule evaluation before job/step rules run.
+* Ground truth is the agent's own clone (`computeChangedFiles`); the
+* orchestrator's already-fetched list (status `'fetched'`) is a free fast-path.
+* Only runs when a rule could read `ctx.changedFiles` — rule-less jobs skip the
+* git cost. Diff-less events (schedule/tag/manual) resolve to `'unavailable'`.
 */
-async function maybeSkipJobOnRules(job, request, normalizedSteps) {
-	if (!job?.rules || job.rules.length === 0) return false;
-	const ruleCtx = createRuleContext(request.event ?? {}, [], process.env, request.dispatchInputs ?? {}, deriveFanout(request));
-	if ((await evaluateRules(job.rules, ruleCtx, request.jobName)).allPassed) return false;
+async function resolveChangedFilesForRules(request, workDir, hasRules) {
+	if (!hasRules) return;
+	request.event ??= {};
+	const ev = request.event;
+	if (ev.changedFilesStatus === "fetched") return;
+	const auth = request.sourceAuth ?? request.workflowAuth ?? (request.token ? {
+		kind: "basic",
+		user: "x-access-token",
+		secret: request.token
+	} : void 0);
+	const resolved = await computeChangedFiles(workDir, request.event, auth);
+	ev.changedFiles = resolved.files;
+	ev.changedFilesStatus = resolved.status;
+}
+/**
+* Decide the terminal `job.complete` for job-level rule evaluation, or `null`
+* when the job should proceed to step execution.
+*
+* - `allPassed` → `null` (run the steps).
+* - a rule's `check()` **threw** (`evaluationError`) → FAIL: the gate could not
+*   be evaluated, so treating "couldn't decide" as "don't run" would be a false
+*   green. Report `status: failed` with the error surfaced.
+* - a rule cleanly returned `false` → clean skip: `status: success` with every
+*   step marked skipped (a gate that evaluated and said "don't run").
+*
+* Pure and exported so the decision is unit-testable without `process.exit`.
+*/
+function buildJobRuleCompletion(ruleResult, normalizedSteps) {
+	if (ruleResult.allPassed) return null;
 	const skippedResults = normalizedSteps.map((s, i) => ({
 		name: s.name,
 		stepIndex: i,
 		status: ExecutionStepStatus.enum.skipped,
 		durationMs: 0
 	}));
-	flushOutputCapture();
-	capturePrepareActive = false;
-	sendMessage({
+	if (ruleResult.evaluationError) return {
+		type: "job.complete",
+		status: ExecutionJobStatus.enum.failed,
+		stepResults: skippedResults,
+		error: `rule '${ruleResult.evaluationError.label}' errored: ${ruleResult.evaluationError.message}`
+	};
+	return {
 		type: "job.complete",
 		status: ExecutionJobStatus.enum.success,
 		stepResults: skippedResults
+	};
+}
+/**
+* Phase 7 — Evaluate job-level rules. A clean rule failure sends
+* `job.complete{success}` with all steps skipped; a rule whose `check()` threw
+* sends `job.complete{failed}` with the error surfaced (never a silent
+* success-skip). Returns false when the caller should continue to step
+* execution.
+*/
+async function maybeSkipJobOnRules(job, request, normalizedSteps) {
+	if (!job?.rules || job.rules.length === 0) return false;
+	const ev = request.event ?? {};
+	const ruleCtx = createRuleContext({
+		event: request.event ?? {},
+		changedFiles: ev.changedFiles,
+		changedFilesStatus: ev.changedFilesStatus,
+		env: process.env,
+		dispatchInputs: request.dispatchInputs ?? {},
+		fanout: deriveFanout(request)
 	});
+	const completion = buildJobRuleCompletion(await evaluateRules(job.rules, ruleCtx, request.jobName), normalizedSteps);
+	if (!completion) return false;
+	flushOutputCapture();
+	capturePrepareActive = false;
+	sendMessage(completion);
 	process.exit(0);
 }
 /**
@@ -5571,8 +6245,8 @@ async function applyEnvFilesDelta(envFiles, operatorSecretKeys, maskedSend) {
 * Build the step loop's KICI_ENV/KICI_PATH callbacks with a per-step delta-file
 * pair (keyed by step index). `beforeStepEnvFiles(stepIndex)` lazily creates the
 * step's pair and points the runner's process.env at it (each step's zx $
-* snapshots process.env at context creation, which happens AFTER this
-* before-hook, so the shell sees them; the pre-fork env allowlist does not
+* reads live process.env at spawn, which happens AFTER this before-hook, so
+* the shell sees them; the pre-fork env allowlist does not
 * re-filter runtime-set vars). `afterStepApplyEnvFiles(stepIndex)` applies that
 * step's delta and releases the pair.
 *
@@ -5645,12 +6319,13 @@ async function runInitPhaseOrFailJob(args) {
 		})
 	});
 	if (initSpecs.length === 0) return;
+	const initCache = createCacheApi(stepCwd, buildCacheTransport());
 	const initResult = await runInitPhase({
 		specs: initSpecs,
 		shellFor: (_spec, i) => buildSandboxShell(stepCwd, INIT_STEP_INDEX_BASE + i, maskedSend),
 		sendIpc: maskedSend,
 		stepIndexBase: INIT_STEP_INDEX_BASE,
-		cache: createCacheApi(stepCwd, buildCacheTransport()),
+		cache: initCache,
 		env: {
 			beginCapture: async () => {
 				process.env.KICI_ENV = envFiles.envFile;
@@ -5723,7 +6398,8 @@ async function main() {
 	await installDependenciesIfNeeded(workflowDir, request);
 	if (aborted) abortAndExit("aborted after deps");
 	await restoreSourceTarballIfRequested(workflowDir, request);
-	const module = (await loadWorkflowModuleWithCapture(workflowDir, request, isGlobal, maskedSend)).module;
+	const loaded = await loadWorkflowModuleWithCapture(workflowDir, request, isGlobal, maskedSend);
+	const module = loaded.module;
 	const workflow = extractWorkflow(module, request.workflowName);
 	await evaluateConcurrencyGroupIfPresent(workflow, request);
 	const apiTransport = async (method, params) => {
@@ -5737,8 +6413,11 @@ async function main() {
 		return waitForApiResponse(reqId);
 	};
 	const { normalizedSteps, nodes, refMap, driftDroppedJobs } = await extractAndNormalizeSteps(workflow, request, apiTransport);
-	const { operatorSecretKeys, outputsMap, secretOutputs, jobOutputsMap } = buildOutputInfrastructure(request, refMap);
+	const { operatorSecretKeys, outputsMap, secretOutputs, jobOutputsMap } = buildOutputInfrastructure(request, refMap, loaded.sdkSetters);
 	const job = findJob(workflow, request.jobName);
+	const jobHasRules = (job?.rules?.length ?? 0) > 0;
+	const anyStepHasRules = normalizedSteps.some((s) => (s.rules?.length ?? 0) > 0);
+	await resolveChangedFilesForRules(request, sourceDir, jobHasRules || anyStepHasRules);
 	await maybeSkipJobOnRules(job, request, normalizedSteps);
 	if (aborted) abortAndExit("aborted after rules");
 	const jobHooks = collectJobHooks(job);
@@ -5756,6 +6435,7 @@ async function main() {
 	const { cachePhaseDeps, jobCacheSpecs, jobCacheRestore } = await setupJobCache(stepCwd, normalizedSteps.length, job?.cache, maskedSend);
 	const stepTasks = new StepTaskRegistry();
 	const stepAbortControllers = /* @__PURE__ */ new Map();
+	const jobTempScope = createTempScope();
 	const createStepCtxWithCapture = (stepIndex, stepName) => {
 		const stepAbort = new AbortController();
 		stepAbortControllers.set(stepIndex, stepAbort);
@@ -5769,7 +6449,7 @@ async function main() {
 			secrets: handle.secrets,
 			dispose: handle.dispose
 		});
-		const ctx = createSandboxStepContext(stepCwd, stepIndex, stepName, request, maskedSend, outputsMap, refMap, operatorSecretKeys, secretOutputs, jobOutputsMap, handle.secrets, masker, signal);
+		const ctx = createSandboxStepContext(stepCwd, stepIndex, stepName, request, maskedSend, outputsMap, refMap, operatorSecretKeys, secretOutputs, jobOutputsMap, handle.secrets, masker, signal, jobTempScope);
 		if (globalRepoInfo) {
 			ctx.workflowRepo = globalRepoInfo.workflowRepo;
 			ctx.sourceRepo = globalRepoInfo.sourceRepo;
@@ -5814,7 +6494,7 @@ async function main() {
 	});
 	jobDeadline.clear();
 	await maybeSaveJobCache(jobCacheSpecs, jobCacheRestore, cachePhaseDeps, !aborted && loopResult.status === ExecutionStepStatus.enum.success);
-	let finalStatus = loopResult.status === ExecutionStepStatus.enum.success ? ExecutionJobStatus.enum.success : ExecutionJobStatus.enum.failed;
+	let finalStatus = initialJobStatus(loopResult.status);
 	let cancelFailureReason;
 	if (aborted) {
 		const cancelResult = await runCancelPathHooks({
@@ -5835,6 +6515,7 @@ async function main() {
 		cancelFailureReason = cancelResult.cancelFailureReason;
 	}
 	if (jobTimedOut) finalStatus = ExecutionJobStatus.enum.failed;
+	await drainJobTempScopeToLog(jobTempScope, maskedSend);
 	emitJobComplete({
 		finalStatus,
 		loopResult,
@@ -5894,6 +6575,6 @@ main().catch((error) => {
 	setTimeout(() => process.exit(1), 100);
 });
 //#endregion
-export { buildStepEnvFileHooks, buildStepNeedsContext, createSandboxStepContext, deriveFanout, rawPayloadFromEvent };
+export { buildJobRuleCompletion, buildSandboxShell, buildStepEnvFileHooks, buildStepNeedsContext, coerceStep, createSandboxStepContext, deriveFanout, drainJobTempScope, rawPayloadFromEvent, resolveChangedFilesForRules, resolveEmitEventName, sanitizeTempLabel };
 
 //# sourceMappingURL=workflow-runner.js.map