@kici-dev/agent 0.5.0 → 0.6.0

package/dist/server.js

@@ -1,6 +1,7 @@
 import { fileURLToPath as __cjs_fileURLToPath } from "node:url";
 import { dirname as __cjs_dirname } from "node:path";
-__cjs_dirname(__cjs_fileURLToPath(import.meta.url));
+const __filename = __cjs_fileURLToPath(import.meta.url);
+__cjs_dirname(__filename);
 import { createRequire, register } from "node:module";
 import crypto$1, { createCipheriv, createHash, createPublicKey, diffieHellman, generateKeyPairSync, hkdfSync, randomBytes, randomUUID } from "node:crypto";
 import * as os$1 from "node:os";
@@ -12,21 +13,23 @@ import winston from "winston";
 import { AgentDeliveryMode, AgentPlatform, RingBuffer, addLogsToArchive, chunkBuffer, createHealthRoutes, createLogger, createMeter, createMetricsRoutes, deriveSharedSecret, getPrometheusExporter, getReconnectDelay, getRequestContext, guardStartup, initTelemetry, kiciTmpBase, logger, normalizeLineEndings, redactConfig, requestContext, setServiceName, setupGracefulShutdown, sha256, sha256File, toErrorMessage, validateRequiredTools } from "@kici-dev/shared";
 import { z } from "zod";
 import { LOGGER_ENV_VARS, defineEnv, validateUnknownKiciVars } from "@kici-dev/shared/env";
-import { ALLOWED_SYSTEM_VARS, ArtifactCompleteAckOutcome, CacheRunEventType, CacheStepType, ExecutionJobStatus, ExecutionStepStatus, InitFailureCategory, KNOWN_ROLES, LogStream, MAX_MATRIX_MATERIALIZATION, MatrixShapeError, PROTOCOL_VERSION, SANDBOX_DEFAULT_VARS, WS_CLOSE_AGENT_AUTH_FAILED, WS_MAX_PAYLOAD_BYTES, applyIncludeExclude, buildTrustedPassthroughEnv, deriveOsArchLabels, expandMatrix, hasOrchAgentCapability, heartbeatSchema, hostLabel, matrixCombinationCount, mergeAutoLabels, orchestratorToAgentMessageSchema, parseHostPropertyAssignments, resolveRoleLabels, resolveWhenToRunOn, validateNoReservedLabels } from "@kici-dev/engine";
+import { ALLOWED_SYSTEM_VARS, ArtifactCompleteAckOutcome, CacheRunEventType, CacheStepType, ExecutionJobStatus, ExecutionStepStatus, InitFailureCategory, KNOWN_ROLES, LogStream, MAX_MATRIX_MATERIALIZATION, MatrixShapeError, PROTOCOL_VERSION, RuntimeFact, SANDBOX_DEFAULT_VARS, SetupStepType, WS_CLOSE_AGENT_AUTH_FAILED, WS_MAX_PAYLOAD_BYTES, applyIncludeExclude, buildTrustedPassthroughEnv, deriveOsArchLabels, expandMatrix, hasOrchAgentCapability, heartbeatSchema, hostLabel, matrixCombinationCount, mergeAutoLabels, orchestratorToAgentMessageSchema, parseHostPropertyAssignments, resolveRoleLabels, resolveWhenToRunOn, runtimeLabel, validateNoReservedLabels } from "@kici-dev/engine";
 import { execFile, execFileSync, execSync, fork, spawn } from "node:child_process";
-import WebSocket from "ws";
+import fsPromises, { access, chmod, lstat, mkdir, mkdtemp, readFile, readdir, realpath, rm, unlink, writeFile } from "node:fs/promises";
 import * as fs$1 from "node:fs";
 import fs, { createReadStream, createWriteStream, existsSync } from "node:fs";
+import path, { delimiter, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import WebSocket from "ws";
 import { ZipArchive } from "archiver";
-import path, { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { format, promisify } from "node:util";
 import { OTEL_DATA_POINT_TYPE, mapDataPointTypeToWireKind } from "@kici-dev/engine/metrics/metric-kind-compat";
 import { gcStaleTmpDirs } from "@kici-dev/core/tmp-gc";
-import fsPromises, { access, lstat, mkdir, readFile, readdir, realpath, unlink, writeFile } from "node:fs/promises";
 import { makeTempDir } from "@kici-dev/core/tmp";
 import Docker from "dockerode";
+import { GIT_CREDENTIAL_REQUEST_METHOD } from "@kici-dev/engine/protocol/messages/git-credential-relay";
+import { createServer } from "node:net";
 import { buildKiciApi, buildNeedsContext, createFilterContext, isDynamicGroupRef, isDynamicJobFn, isParallelGroup, isStaticArray, isStaticObject, setJobOutputsMap, setStepOutputsMap, setStepRefMap } from "@kici-dev/sdk";
 import { $ } from "zx";
 import { c, x } from "tar";
@@ -38,6 +41,7 @@ import { normalizeRunsOnToMatchers } from "@kici-dev/engine/labels/compile";
 import { PNPM_IGNORE_BUILD_GATE_ARG, PackageManager, YarnFlavor, detectPackageManagerFromManifests, detectYarnFlavor } from "@kici-dev/shared/package-manager";
 import { parse, stringify } from "yaml";
 import { createInterface } from "node:readline";
+import { RuntimeSubtree, ensureRuntimeVolume } from "@kici-dev/shared/container-runtime";
 var __defProp = Object.defineProperty;
 var __esmMin = (fn, res, err) => () => {
 	if (err) throw err[0];
@@ -57,13 +61,258 @@ var __exportAll = (all, no_symbols) => {
 	return target;
 };
 //#endregion
+//#region src/execution/image-build/build-engine.ts
+/**
+* Build a job's container image with the host's build CLI.
+*
+* The CLI is REQUIRED — there is deliberately no socket-API fallback. One build
+* path means one set of Dockerfile semantics: `.dockerignore`, BuildKit and
+* every directive behave as they do on the author's own machine, instead of
+* depending on which agent happened to pick the job up. A host without a CLI
+* cannot run a Dockerfile job, and says so in as many words.
+*/
+/** Is `bin` executable somewhere on `PATH`? */
+function binaryOnPath(bin) {
+	return (process.env.PATH ?? "").split(delimiter).filter(Boolean).some((dir) => existsSync(join(dir, bin)));
+}
+/**
+* The container socket the SANDBOX will use.
+*
+* Mirrors what dockerode's `new Docker()` resolves, and exists so build and run
+* provably agree. A host with both runtimes whose sandbox socket points at
+* podman would otherwise build with docker and then start the job container on
+* a daemon that has never heard of that image — a failure that surfaces as
+* "no such image" and names nothing.
+*/
+function sandboxSocketPath() {
+	return process.env.DOCKER_HOST ?? "/var/run/docker.sock";
+}
+function resolveBuildCli(args) {
+	const { configured } = args;
+	const onPath = args.onPath ?? binaryOnPath;
+	if (configured) {
+		if (!onPath(configured)) throw new Error(`KICI_CONTAINER_BUILD_CLI is set to '${configured}', but '${configured}' is not on PATH on this agent host.`);
+		return configured;
+	}
+	const found = CLI_PREFERENCE.find((bin) => onPath(bin));
+	if (!found) throw new Error("This job builds its container image from a Dockerfile, which needs a build CLI on the agent host. Neither 'docker' nor 'podman' is on PATH. Install one, or route the job to a pool whose hosts have one.");
+	return found;
+}
+/** Point the CLI at a specific daemon, in that CLI's own spelling. */
+function socketFlags(cli, socketPath) {
+	const url = socketPath.includes("://") ? socketPath : `unix://${socketPath}`;
+	return cli === ContainerBuildCli.enum.docker ? ["-H", url] : ["--url", url];
+}
+function buildArgv(args) {
+	const { cli, spec, socketPath } = args;
+	const argv = [];
+	if (socketPath) argv.push(...socketFlags(cli, socketPath));
+	argv.push("build", "-f", spec.dockerfilePath);
+	if (spec.target !== void 0) argv.push("--target", spec.target);
+	for (const [k, v] of Object.entries(spec.args)) argv.push("--build-arg", `${k}=${v}`);
+	for (const [k, v] of Object.entries(spec.labels)) argv.push("--label", `${k}=${v}`);
+	argv.push("-t", spec.tag);
+	argv.push(spec.contextDir);
+	return argv;
+}
+/**
+* Write `authconfig` into a throwaway config directory and return the env that
+* points the CLI at it.
+*
+* A throwaway directory rather than the host's own credential file: the build
+* runs on a shared agent host, and a job's registry token has no business being
+* written where the next job (or the operator) can read it.
+*/
+async function withTempAuth(cli, authconfig) {
+	const dir = await mkdtemp(join(tmpdir(), "kici-build-auth-"));
+	const encoded = Buffer.from(`${authconfig.username}:${authconfig.password}`).toString("base64");
+	const body = JSON.stringify({ auths: { [authconfig.serveraddress]: { auth: encoded } } });
+	if (cli === ContainerBuildCli.enum.docker) {
+		await writeFile(join(dir, "config.json"), body, { mode: 384 });
+		return {
+			env: { DOCKER_CONFIG: dir },
+			dispose: () => rm(dir, {
+				recursive: true,
+				force: true
+			})
+		};
+	}
+	const file = join(dir, "auth.json");
+	await writeFile(file, body, { mode: 384 });
+	return {
+		env: { REGISTRY_AUTH_FILE: file },
+		dispose: () => rm(dir, {
+			recursive: true,
+			force: true
+		})
+	};
+}
+/**
+* Split a chunk stream into whole lines, carrying the remainder between chunks.
+*
+* `flush` matters: a builder whose last line has no trailing newline — which is
+* exactly the shape of an error written just before exit — would otherwise leave
+* that line in the carry, and the one line the author most needs would be the
+* one that never reaches the run log.
+*/
+function makeLineSplitter(onLine) {
+	let carry = "";
+	return {
+		write: (chunk) => {
+			carry += chunk.toString("utf-8");
+			const lines = carry.split("\n");
+			carry = lines.pop() ?? "";
+			for (const line of lines) onLine(line);
+		},
+		flush: () => {
+			if (carry.length === 0) return;
+			onLine(carry);
+			carry = "";
+		}
+	};
+}
+/**
+* Run the build. Resolves when the image is tagged; rejects with the builder's
+* own last words otherwise.
+*
+* The rejection carries real output rather than an exit code because the author
+* is the one who has to act on it, and "exit 1" tells them nothing about which
+* `RUN` failed.
+*/
+async function buildJobImage(args) {
+	const { spec, cli, socketPath, authconfig, onLog, signal } = args;
+	if (signal?.aborted) throw signal.reason ?? /* @__PURE__ */ new Error("job image build aborted");
+	const auth = authconfig ? await withTempAuth(cli, authconfig) : void 0;
+	const argv = buildArgv({
+		cli,
+		spec,
+		...socketPath ? { socketPath } : {}
+	});
+	try {
+		await new Promise((resolvePromise, reject) => {
+			const child = spawn(cli, argv, {
+				env: {
+					...process.env,
+					...auth?.env ?? {}
+				},
+				stdio: [
+					"ignore",
+					"pipe",
+					"pipe"
+				]
+			});
+			const tail = [];
+			const record = (line) => {
+				onLog(line);
+				tail.push(line);
+				if (tail.length > FAILURE_TAIL_LINES) tail.shift();
+			};
+			const outSplitter = makeLineSplitter(record);
+			const errSplitter = makeLineSplitter(record);
+			child.stdout.on("data", outSplitter.write);
+			child.stderr.on("data", errSplitter.write);
+			const onAbort = () => child.kill("SIGKILL");
+			signal?.addEventListener("abort", onAbort, { once: true });
+			child.on("error", (err) => {
+				signal?.removeEventListener("abort", onAbort);
+				reject(/* @__PURE__ */ new Error(`failed to start '${cli} build': ${err.message}`));
+			});
+			child.on("close", (code) => {
+				signal?.removeEventListener("abort", onAbort);
+				outSplitter.flush();
+				errSplitter.flush();
+				if (code === 0) {
+					resolvePromise();
+					return;
+				}
+				const detail = tail.length > 0 ? `\n${tail.join("\n")}` : "";
+				reject(/* @__PURE__ */ new Error(`'${cli} build' failed for ${spec.dockerfilePath} (exit ${code ?? "signal"})${detail}`));
+			});
+		});
+	} finally {
+		await auth?.dispose();
+	}
+}
+var ContainerBuildCli, CLI_PREFERENCE, FAILURE_TAIL_LINES;
+var init_build_engine = __esmMin((() => {
+	ContainerBuildCli = z.enum(["docker", "podman"]);
+	CLI_PREFERENCE = [ContainerBuildCli.enum.docker, ContainerBuildCli.enum.podman];
+	FAILURE_TAIL_LINES = 20;
+}));
+//#endregion
 //#region src/config.ts
+init_build_engine();
 /** Execution mode for the agent's sandbox backend. Mirrors the runtime enum. */
 const ExecutionMode = z.enum([
 	"container",
 	"bare-metal",
 	"firecracker"
 ]);
+/** When the operator between-jobs reset command runs. */
+const BetweenJobsRunOn = z.enum(["always", "on-failure"]);
+const configSchema = z.object({
+	orchestratorUrl: z.string().url().min(1, "KICI_ORCHESTRATOR_URL is required"),
+	agentId: z.string().optional(),
+	labels: z.string().default("").transform((s) => s.split(",").filter(Boolean)),
+	properties: z.string().default("").transform((s) => parseHostPropertyAssignments(s.split(",").filter(Boolean))),
+	roles: z.string().optional().transform((s) => {
+		if (s === void 0) return void 0;
+		if (s === "") return [];
+		return s.split(",").filter(Boolean);
+	}).refine((roles) => {
+		if (roles === void 0) return true;
+		const validValues = [...KNOWN_ROLES, "all"];
+		return roles.every((r) => validValues.includes(r));
+	}, { message: `KICI_ROLES must contain only: ${[...KNOWN_ROLES, "all"].join(", ")}` }).transform((roles) => {
+		if (roles === void 0) return void 0;
+		if (roles.includes("all")) return void 0;
+		if (roles.length === 0) return [];
+		return roles.filter((r) => r !== "all");
+	}),
+	port: z.coerce.number().default(8080),
+	logLevel: z.enum([
+		"debug",
+		"info",
+		"warn",
+		"error"
+	]).default("info"),
+	agentToken: z.string().optional(),
+	githubToken: z.string().optional(),
+	maxLogSizeBytes: z.coerce.number().default(10485760),
+	defaultStepTimeoutMs: z.coerce.number().default(18e5),
+	dockerKeepFailed: z.string().default("false").transform((s) => s === "true"),
+	jobHeartbeatIntervalMs: z.coerce.number().default(6e4),
+	backpressureMode: z.enum(["pause", "drop"]).default("pause"),
+	agentPayloadDir: z.string().optional(),
+	agentCommand: z.string().optional(),
+	sandbox: z.string().default("false").transform((s) => s === "true"),
+	trustedEnv: z.string().default("false").transform((s) => s === "true"),
+	inPlace: z.string().default("false").transform((s) => s === "true"),
+	sandboxNetwork: z.enum(["isolated", "host"]).default("isolated"),
+	sandboxHardened: z.string().default("true").transform((s) => s !== "false"),
+	sandboxReadonlyRootfs: z.string().default("false").transform((s) => s === "true"),
+	sandboxUser: z.string().optional(),
+	sandboxPidsLimit: z.coerce.number().int().positive().default(512),
+	sandboxMemoryBytes: z.coerce.number().int().positive().default(2147483648),
+	sandboxNanoCpus: z.coerce.number().int().positive().default(2e9),
+	scalerManaged: z.string().optional().transform((s) => s === "1"),
+	jobImageAgent: z.string().optional().transform((s) => s === "1"),
+	runtimeImage: z.string().optional(),
+	runtimeNodeSource: z.string().optional(),
+	containerBuildCli: ContainerBuildCli.optional(),
+	scalerClaimCode: z.string().optional(),
+	scalerIdleTimeoutMs: z.coerce.number().default(5e3),
+	scalerPendingDispatchTimeoutMs: z.coerce.number().default(6e4),
+	executionMode: ExecutionMode.optional(),
+	otelExporterOtlpEndpoint: z.string().optional(),
+	concurrencyWaitTimeoutMs: z.coerce.number().int().min(1e3).default(36e5),
+	isOrchestratorHost: z.string().optional().transform((v) => v === "true"),
+	betweenJobsResetCommand: z.string().optional(),
+	betweenJobsResetTimeoutMs: z.coerce.number().int().positive().default(6e4),
+	betweenJobsResetRunOn: BetweenJobsRunOn.default("always"),
+	orphanCleanup: z.string().default("true").transform((s) => s !== "false"),
+	drainOnResetFailure: z.string().default("false").transform((s) => s === "true")
+});
 /**
 * Env-var definition for the agent. Exported so the docs generator and the
 * deploy-stg pre-validator can inspect / re-parse without round-tripping
@@ -71,59 +320,7 @@ const ExecutionMode = z.enum([
 */
 const envDef = defineEnv({
 	service: "agent",
-	schema: z.object({
-		orchestratorUrl: z.string().url().min(1, "KICI_ORCHESTRATOR_URL is required"),
-		agentId: z.string().optional(),
-		labels: z.string().default("").transform((s) => s.split(",").filter(Boolean)),
-		properties: z.string().default("").transform((s) => parseHostPropertyAssignments(s.split(",").filter(Boolean))),
-		roles: z.string().optional().transform((s) => {
-			if (s === void 0) return void 0;
-			if (s === "") return [];
-			return s.split(",").filter(Boolean);
-		}).refine((roles) => {
-			if (roles === void 0) return true;
-			const validValues = [...KNOWN_ROLES, "all"];
-			return roles.every((r) => validValues.includes(r));
-		}, { message: `KICI_ROLES must contain only: ${[...KNOWN_ROLES, "all"].join(", ")}` }).transform((roles) => {
-			if (roles === void 0) return void 0;
-			if (roles.includes("all")) return void 0;
-			if (roles.length === 0) return [];
-			return roles.filter((r) => r !== "all");
-		}),
-		port: z.coerce.number().default(8080),
-		logLevel: z.enum([
-			"debug",
-			"info",
-			"warn",
-			"error"
-		]).default("info"),
-		agentToken: z.string().optional(),
-		githubToken: z.string().optional(),
-		maxLogSizeBytes: z.coerce.number().default(10 * 1024 * 1024),
-		defaultStepTimeoutMs: z.coerce.number().default(1800 * 1e3),
-		dockerKeepFailed: z.string().default("false").transform((s) => s === "true"),
-		jobHeartbeatIntervalMs: z.coerce.number().default(6e4),
-		backpressureMode: z.enum(["pause", "drop"]).default("pause"),
-		agentPayloadDir: z.string().optional(),
-		agentCommand: z.string().optional(),
-		sandbox: z.string().default("false").transform((s) => s === "true"),
-		trustedEnv: z.string().default("false").transform((s) => s === "true"),
-		inPlace: z.string().default("false").transform((s) => s === "true"),
-		sandboxNetwork: z.enum(["isolated", "host"]).default("isolated"),
-		sandboxHardened: z.string().default("true").transform((s) => s !== "false"),
-		sandboxReadonlyRootfs: z.string().default("false").transform((s) => s === "true"),
-		sandboxUser: z.string().optional(),
-		sandboxPidsLimit: z.coerce.number().int().positive().default(512),
-		sandboxMemoryBytes: z.coerce.number().int().positive().default(2 * 1024 * 1024 * 1024),
-		sandboxNanoCpus: z.coerce.number().int().positive().default(2 * 1e9),
-		scalerManaged: z.string().optional().transform((s) => s === "1"),
-		scalerIdleTimeoutMs: z.coerce.number().default(5e3),
-		scalerPendingDispatchTimeoutMs: z.coerce.number().default(6e4),
-		executionMode: ExecutionMode.optional(),
-		otelExporterOtlpEndpoint: z.string().optional(),
-		concurrencyWaitTimeoutMs: z.coerce.number().int().min(1e3).default(36e5),
-		isOrchestratorHost: z.string().optional().transform((v) => v === "true")
-	}),
+	schema: configSchema,
 	envMap: {
 		orchestratorUrl: "KICI_ORCHESTRATOR_URL",
 		agentId: "KICI_AGENT_ID",
@@ -153,11 +350,21 @@ const envDef = defineEnv({
 		sandboxMemoryBytes: "KICI_SANDBOX_MEMORY_BYTES",
 		sandboxNanoCpus: "KICI_SANDBOX_NANO_CPUS",
 		scalerManaged: "KICI_SCALER_MANAGED",
+		jobImageAgent: "KICI_JOB_IMAGE_AGENT",
+		runtimeImage: "KICI_RUNTIME_IMAGE",
+		runtimeNodeSource: "KICI_RUNTIME_NODE_SOURCE",
+		containerBuildCli: "KICI_CONTAINER_BUILD_CLI",
+		scalerClaimCode: "KICI_SCALER_CLAIM_CODE",
 		scalerIdleTimeoutMs: "KICI_SCALER_IDLE_TIMEOUT",
 		scalerPendingDispatchTimeoutMs: "KICI_SCALER_PENDING_DISPATCH_TIMEOUT",
 		executionMode: "KICI_EXECUTION_MODE",
 		otelExporterOtlpEndpoint: "OTEL_EXPORTER_OTLP_ENDPOINT",
-		concurrencyWaitTimeoutMs: "KICI_CONCURRENCY_WAIT_TIMEOUT_MS"
+		concurrencyWaitTimeoutMs: "KICI_CONCURRENCY_WAIT_TIMEOUT_MS",
+		betweenJobsResetCommand: "KICI_AGENT_BETWEEN_JOBS_RESET_COMMAND",
+		betweenJobsResetTimeoutMs: "KICI_AGENT_BETWEEN_JOBS_RESET_TIMEOUT_MS",
+		betweenJobsResetRunOn: "KICI_AGENT_BETWEEN_JOBS_RESET_RUN_ON",
+		orphanCleanup: "KICI_AGENT_ORPHAN_CLEANUP",
+		drainOnResetFailure: "KICI_AGENT_DRAIN_ON_RESET_FAILURE"
 	}
 });
 /**
@@ -189,10 +396,16 @@ const envDef = defineEnv({
 * - KICI_SANDBOX_MEMORY_BYTES (default: 2 GiB) — memory cap in bytes for the job container cgroup
 * - KICI_SANDBOX_NANO_CPUS (default: 2 CPUs) — CPU cap in nano-CPUs for the job container cgroup
 * - KICI_SCALER_MANAGED (set to "1" by the orchestrator's auto-scaler — agent self-shuts down on idle)
+* - KICI_SCALER_CLAIM_CODE (optional single-use claim code the agent exchanges for its own ephemeral credentials before registering; ignored when KICI_AGENT_TOKEN is set)
 * - KICI_SCALER_IDLE_TIMEOUT (ms, default 5000) — how long a scaler-managed agent waits before shutdown after going idle
 * - KICI_SCALER_PENDING_DISPATCH_TIMEOUT (ms, default 60000) — extended idle window when register.ack signals a queued bound job
 * - KICI_EXECUTION_MODE (optional, options: container | bare-metal | firecracker) — override the runner's mode-pick logic
 * - KICI_CONCURRENCY_WAIT_TIMEOUT_MS (default: 3_600_000) — workflow-runner timeout when long-polling for a slot-release follow-up `concurrency.ack`
+* - KICI_AGENT_BETWEEN_JOBS_RESET_COMMAND (optional) — host-reset command run between jobs on a reused agent (fail-open)
+* - KICI_AGENT_BETWEEN_JOBS_RESET_TIMEOUT_MS (default: 60000) — reset command timeout
+* - KICI_AGENT_BETWEEN_JOBS_RESET_RUN_ON (default: always, options: always | on-failure) — when the reset command runs
+* - KICI_AGENT_ORPHAN_CLEANUP (default: true) — reap a finished job's leaked process tree (bare-metal); false = only signal the runner child
+* - KICI_AGENT_DRAIN_ON_RESET_FAILURE (default: false) — drain the agent after repeated consecutive reset failures
 */
 function loadConfig() {
 	const data = envDef.parse();
@@ -225,6 +438,68 @@ function agentClientConnectionOptions(config) {
 	};
 }
 //#endregion
+//#region src/execution/image-build/runtime-facts.ts
+/**
+* What this agent's own host can do with containers, discovered at startup.
+*
+* The orchestrator cannot answer this. An agent runs on its own machine, and
+* whether that machine has a container runtime is the agent's fact — probing
+* the orchestrator's filesystem answers a different question, and doing so once
+* stranded container jobs that had been running fine, because the probe and the
+* job ran in different places.
+*
+* Reported as `kici:runtime:*` labels, which the register-time scope gate
+* accepts unchallenged as self-reported facts. Deliberately NOT
+* `kici:capability:*` — that prefix grants a privilege and stays token-bound.
+*/
+/** Sockets a container runtime answers on, in the order the agent would use them. */
+function candidateSockets() {
+	const uid = typeof process.getuid === "function" ? process.getuid() : void 0;
+	const dockerHost = process.env.DOCKER_HOST?.replace(/^unix:\/\//, "");
+	return [
+		...dockerHost ? [{
+			fact: RuntimeFact.enum.docker,
+			path: dockerHost
+		}] : [],
+		{
+			fact: RuntimeFact.enum.docker,
+			path: "/var/run/docker.sock"
+		},
+		{
+			fact: RuntimeFact.enum.podman,
+			path: "/run/podman/podman.sock"
+		},
+		...uid !== void 0 ? [{
+			fact: RuntimeFact.enum.podman,
+			path: `/run/user/${uid}/podman/podman.sock`
+		}] : []
+	];
+}
+/** Is `bin` executable somewhere on PATH? */
+function onPath(bin) {
+	return (process.env.PATH ?? "").split(delimiter).filter(Boolean).some((dir) => existsSync(join(dir, bin)));
+}
+/**
+* Discover this host's runtime facts.
+*
+* Presence of the socket FILE, not a handshake: registration must not block on
+* a daemon that is slow or wedged, and a job that reaches a broken runtime
+* still fails with the runtime's own error. The label answers "is there a
+* runtime here at all", which is the routing question.
+*/
+function detectRuntimeFacts(deps = {}) {
+	const pathExists = deps.pathExists ?? existsSync;
+	const hasBinary = deps.binaryOnPath ?? onPath;
+	const facts = /* @__PURE__ */ new Set();
+	for (const { fact, path } of candidateSockets()) if (pathExists(path)) facts.add(fact);
+	if (hasBinary("docker") || hasBinary("podman")) facts.add(RuntimeFact.enum["container-build"]);
+	return [...facts];
+}
+/** The `kici:runtime:*` labels this host should register with. */
+function runtimeFactLabels(deps = {}) {
+	return detectRuntimeFacts(deps).map(runtimeLabel);
+}
+//#endregion
 //#region src/diagnostics/mini-bundle.ts
 /**
 * Agent fleet mini-bundle assembler.
@@ -325,7 +600,7 @@ var LogBuffer = class extends RingBuffer {
 };
 //#endregion
 //#region src/ws/orchestrator-client.ts
-const logger$13 = createLogger({ prefix: "orchestrator-client" });
+const logger$14 = createLogger({ prefix: "orchestrator-client" });
 /**
 * How long to wait for `artifacts.upload.complete.ack` before failing the step.
 *
@@ -381,6 +656,8 @@ var OrchestratorClient = class OrchestratorClient {
 	pendingEventEmitRequests = /* @__PURE__ */ new Map();
 	/** Pending agent.api.request calls awaiting orchestrator response. */
 	pendingApiRequests = /* @__PURE__ */ new Map();
+	/** Pending scaler.claim-credentials requests awaiting orchestrator response. */
+	pendingClaimCredentialsRequests = /* @__PURE__ */ new Map();
 	/** Pending user-cache restore/save requests awaiting orchestrator response. */
 	pendingUserCacheRequests = /* @__PURE__ */ new Map();
 	/** Pending user-artifact upload/download requests awaiting orchestrator response. */
@@ -419,6 +696,7 @@ var OrchestratorClient = class OrchestratorClient {
 	onJobDispatch;
 	onJobCancel;
 	token;
+	scalerClaimCode;
 	heartbeatIntervalMs;
 	maxReconnectDelayMs;
 	getInFlightJobs;
@@ -437,8 +715,23 @@ var OrchestratorClient = class OrchestratorClient {
 	* `pendingDispatch` is set by the orchestrator when a queued job has been
 	* pre-bound to this agent and the dispatch.job message is in flight. The
 	* agent must defer arming the short scaler-idle timer in this case.
+	*
+	* `warmPool` is set when this agent was pre-spawned to wait for work rather
+	* than for a specific queued job. The agent must arm no idle timer at all:
+	* the orchestrator's warm-pool reaper owns its lifetime.
 	*/
 	onRegistered = null;
+	/**
+	* Callback invoked when a self-bootstrap claim exchange fails permanently
+	* (invalid / expired / already-consumed claim code, or the exchange itself
+	* errored or timed out). Only ever fires in self-bootstrap mode
+	* (`scalerClaimCode` set, no static token) — a statically-tokened agent never
+	* runs the claim exchange. A one-shot self-bootstrap agent cannot make any
+	* further progress after this, so server.ts wires it to a non-zero graceful
+	* shutdown; without it the health HTTP server keeps the process alive and a
+	* GitHub Actions run hangs until the job timeout.
+	*/
+	onClaimFailedPermanently = null;
 	constructor(options) {
 		this.url = options.url;
 		this.agentId = options.agentId;
@@ -447,6 +740,7 @@ var OrchestratorClient = class OrchestratorClient {
 		this.onJobDispatch = options.onJobDispatch;
 		this.onJobCancel = options.onJobCancel;
 		this.token = options.token;
+		this.scalerClaimCode = options.scalerClaimCode;
 		this.heartbeatIntervalMs = options.heartbeatIntervalMs ?? 3e4;
 		this.maxReconnectDelayMs = options.maxReconnectDelayMs ?? 6e4;
 		this.getInFlightJobs = options.getInFlightJobs;
@@ -485,7 +779,7 @@ var OrchestratorClient = class OrchestratorClient {
 	*/
 	connect() {
 		if (this._state !== "disconnected") {
-			logger$13.warn("connect() called while not disconnected", { state: this._state });
+			logger$14.warn("connect() called while not disconnected", { state: this._state });
 			return;
 		}
 		this.intentionalDisconnect = false;
@@ -666,6 +960,39 @@ var OrchestratorClient = class OrchestratorClient {
 		});
 	}
 	/**
+	* Send a scaler.claim-credentials WS message and await the response.
+	*
+	* Used by a provisioning workflow (via `ctx.kici.scaler.claimAgentCredentials`)
+	* to exchange a single-use claim code — delivered on a `kici.scaler.scale-up`
+	* event — for freshly minted ephemeral agent credentials. The token rides the
+	* response only; it is never logged. Times out after 15 seconds (matching the
+	* generic agent-API request timeout).
+	*/
+	async sendClaimCredentials(claimCode) {
+		const requestId = randomUUID();
+		return new Promise((resolve, reject) => {
+			const timer = setTimeout(() => {
+				this.pendingClaimCredentialsRequests.delete(requestId);
+				reject(/* @__PURE__ */ new Error("scaler.claim-credentials timed out"));
+			}, 15e3);
+			this.pendingClaimCredentialsRequests.set(requestId, {
+				resolve: (response) => {
+					clearTimeout(timer);
+					resolve(response);
+				},
+				reject: (err) => {
+					clearTimeout(timer);
+					reject(err);
+				}
+			});
+			this.sendDirect({
+				type: "scaler.claim-credentials",
+				requestId,
+				claimCode
+			});
+		});
+	}
+	/**
 	* Build this agent's fleet mini-bundle and stream it back to the orchestrator
 	* as ordered fleet.bundle.chunk frames (the WS frame cap forbids one frame).
 	* On failure, sends a single fleet.bundle.error. Public for unit testing.
@@ -1049,42 +1376,24 @@ var OrchestratorClient = class OrchestratorClient {
 				}
 			});
 		} catch (err) {
-			logger$13.error("Failed to create WebSocket", { error: toErrorMessage(err) });
+			logger$14.error("Failed to create WebSocket", { error: toErrorMessage(err) });
 			this._state = "disconnected";
 			this.scheduleReconnect();
 			return;
 		}
 		this.ws.on("open", () => {
-			if (this.token) {
-				this._state = "authenticating";
-				logger$13.info("Connected to orchestrator, sending auth.request", {
-					url: this.url,
-					agentId: this.agentId
-				});
-				this.ws.send(JSON.stringify({
-					type: "auth.request",
-					token: this.token,
-					protocolVersion: PROTOCOL_VERSION
-				}));
-			} else {
-				this._state = "registering";
-				logger$13.info("Connected to orchestrator, sending agent.register (no token)", {
-					url: this.url,
-					agentId: this.agentId
-				});
-				this.sendAgentRegister();
-			}
+			this.onWsOpen();
 		});
 		this.ws.on("message", (data) => {
 			this.handleMessage(data);
 		});
 		this.ws.on("close", (code, reason) => {
-			logger$13.info("Orchestrator connection closed", {
+			logger$14.info("Orchestrator connection closed", {
 				code,
 				reason: reason.toString()
 			});
 			if (code === WS_CLOSE_AGENT_AUTH_FAILED) {
-				logger$13.error("Orchestrator closed with auth-failed code -- token is invalid or revoked. NOT retrying.", {
+				logger$14.error("Orchestrator closed with auth-failed code -- token is invalid or revoked. NOT retrying.", {
 					code,
 					reason: reason.toString()
 				});
@@ -1101,6 +1410,8 @@ var OrchestratorClient = class OrchestratorClient {
 			this.pendingEventEmitRequests.clear();
 			for (const [_id, pending] of this.pendingApiRequests) pending.reject(/* @__PURE__ */ new Error("WebSocket disconnected"));
 			this.pendingApiRequests.clear();
+			for (const [_id, pending] of this.pendingClaimCredentialsRequests) pending.reject(/* @__PURE__ */ new Error("WebSocket disconnected"));
+			this.pendingClaimCredentialsRequests.clear();
 			for (const [_id, pending] of this.pendingUserCacheRequests) pending.reject(/* @__PURE__ */ new Error("WebSocket disconnected"));
 			this.pendingUserCacheRequests.clear();
 			for (const [id, pending] of this.pendingUserArtifactRequests) {
@@ -1121,11 +1432,102 @@ var OrchestratorClient = class OrchestratorClient {
 			if (!this.intentionalDisconnect) this.scheduleReconnect();
 		});
 		this.ws.on("error", (err) => {
-			logger$13.error(`Orchestrator WebSocket error: ${err.message}`);
+			logger$14.error(`Orchestrator WebSocket error: ${err.message}`);
 			if (this.ws && this.ws.readyState === WebSocket.OPEN) this.ws.close();
 		});
 	}
 	/**
+	* WS-open handshake driver.
+	*
+	* Self-bootstrap runs first: when a `scalerClaimCode` is set and no static
+	* token is present, the client exchanges the single-use code for its own
+	* ephemeral credentials over `scaler.claim-credentials` — before any auth or
+	* register — and adopts the minted token, agentId, and labels. A rejected or
+	* expired code fails permanently (no reconnect), so a one-shot provisioning
+	* run exits visibly rather than looping.
+	*
+	* Then the normal handshake: with a token (static or just-minted) send
+	* `auth.request` and register after `auth.success`; without one, register
+	* directly (unauthenticated mode).
+	*/
+	async onWsOpen() {
+		if (this.scalerClaimCode && !this.token) {
+			if (!await this.performClaimExchange(this.scalerClaimCode)) return;
+		}
+		if (this.token) {
+			this._state = "authenticating";
+			logger$14.info("Connected to orchestrator, sending auth.request", {
+				url: this.url,
+				agentId: this.agentId
+			});
+			this.ws.send(JSON.stringify({
+				type: "auth.request",
+				token: this.token,
+				protocolVersion: PROTOCOL_VERSION
+			}));
+		} else {
+			this._state = "registering";
+			logger$14.info("Connected to orchestrator, sending agent.register (no token)", {
+				url: this.url,
+				agentId: this.agentId
+			});
+			this.sendAgentRegister();
+		}
+	}
+	/**
+	* Exchange the single-use claim code for ephemeral credentials, adopting the
+	* minted token / agentId / labels on success. Returns true when credentials
+	* were adopted; false when the claim failed permanently (the connection has
+	* already been torn down with no reconnect).
+	*/
+	async performClaimExchange(claimCode) {
+		logger$14.info("Self-bootstrap: exchanging claim code for ephemeral credentials", {
+			url: this.url,
+			agentId: this.agentId
+		});
+		let response;
+		try {
+			response = await this.sendClaimCredentials(claimCode);
+		} catch (err) {
+			this.failClaimPermanently(`claim exchange failed: ${toErrorMessage(err)}`);
+			return false;
+		}
+		if (response.error || !response.credentials) {
+			this.failClaimPermanently(response.error ?? "orchestrator returned no credentials");
+			return false;
+		}
+		const { agentToken, agentId, labels } = response.credentials;
+		this.token = agentToken;
+		this.agentId = agentId;
+		this.labels = this.mergeClaimedLabels(labels);
+		logger$14.info("Self-bootstrap: adopted ephemeral credentials", { agentId });
+		return true;
+	}
+	/**
+	* Merge the claim-minted labels into the agent's own label set, deduped. The
+	* self-reported `kici:os:` / `kici:arch:` / `kici:host:` facts are derived at
+	* register time (`sendAgentRegister`), so they survive regardless.
+	*/
+	mergeClaimedLabels(claimed) {
+		return [.../* @__PURE__ */ new Set([...this.labels, ...claimed])];
+	}
+	/**
+	* Fail a self-bootstrap claim permanently, using the same no-reconnect
+	* mechanism as `auth.failure`: mark the auth context dead, suppress reconnect,
+	* and close the socket. A one-shot provisioning run then exits visibly.
+	*/
+	failClaimPermanently(reason) {
+		logger$14.error("Self-bootstrap claim exchange failed -- claim code is invalid or expired. NOT retrying.", { reason });
+		this.authFailed = true;
+		this.intentionalDisconnect = true;
+		if (this.ws) {
+			this.ws.close(1e3, "Claim failed");
+			this.ws = null;
+		}
+		this._state = "disconnected";
+		this.onClaimFailedPermanently?.(reason);
+	}
+	/**
 	* Resolve a pending user-artifact request from an `artifacts.upload.response`
 	* / `artifacts.download.response` WS message, mapping the wire fields onto the
 	* IPC response shape. No-op when no request is pending for the requestId.
@@ -1229,7 +1631,7 @@ var OrchestratorClient = class OrchestratorClient {
 			this.pendingUserArtifactRequests.set(record.messageId, record.pending);
 			this.resendableCompletes.set(record.messageId, record);
 			this.sendDirect(record.frame);
-			logger$13.info("Re-sent artifact upload-complete after reconnect", {
+			logger$14.info("Re-sent artifact upload-complete after reconnect", {
 				messageId: record.messageId,
 				attempt: record.attempts
 			});
@@ -1251,12 +1653,55 @@ var OrchestratorClient = class OrchestratorClient {
 		}
 		return false;
 	}
+	/**
+	* Resolve a pending scaler credential-claim request from its response
+	* message. Returns true when it handled the message. Extracted from
+	* handleMessage so that dispatcher stays under the function-length limit.
+	*/
+	handleClaimCredentialsResponse(rawMsg) {
+		if (rawMsg.type !== "scaler.claim-credentials.response") return false;
+		const pending = this.pendingClaimCredentialsRequests.get(rawMsg.requestId);
+		if (pending) {
+			this.pendingClaimCredentialsRequests.delete(rawMsg.requestId);
+			pending.resolve({
+				credentials: rawMsg.credentials,
+				error: rawMsg.error
+			});
+		}
+		return true;
+	}
+	/**
+	* Complete registration: adopt the orchestrator's negotiated capabilities,
+	* enter the `registered` state, flush everything parked while disconnected,
+	* and hand the ack's lifetime flags to `onRegistered`.
+	*/
+	handleRegisterAck(msg) {
+		logger$14.info("Registration acknowledged by orchestrator", {
+			agentId: msg.agentId,
+			labels: msg.labels,
+			scalerManaged: msg.scalerManaged,
+			pendingDispatch: msg.pendingDispatch ?? false,
+			warmPool: msg.warmPool ?? false
+		});
+		this.orchCapabilities = msg.capabilities;
+		this._state = "registered";
+		this.reconnectAttempts = 0;
+		this.startHeartbeat();
+		this.flushBuffer();
+		this.resendHeldCompletes();
+		this.onRegistered?.({
+			pendingDispatch: msg.pendingDispatch ?? false,
+			warmPool: msg.warmPool ?? false
+		});
+		if (msg.scalerManaged || this.scalerManaged) this.blockMmdsAccess();
+		this.sendConfigAck(msg.agentId);
+	}
 	handleMessage(data) {
 		let raw;
 		try {
 			raw = JSON.parse(data.toString());
 		} catch {
-			logger$13.warn("Malformed JSON received from orchestrator");
+			logger$14.warn("Malformed JSON received from orchestrator");
 			return;
 		}
 		const rawMsg = raw;
@@ -1281,6 +1726,7 @@ var OrchestratorClient = class OrchestratorClient {
 			}
 			return;
 		}
+		if (this.handleClaimCredentialsResponse(rawMsg)) return;
 		if (rawMsg.type === "agent.api.response") {
 			const pending = this.pendingApiRequests.get(rawMsg.requestId);
 			if (pending) {
@@ -1315,13 +1761,13 @@ var OrchestratorClient = class OrchestratorClient {
 			switch (msg.type) {
 				case "auth.success":
 					if (this._state === "authenticating") {
-						logger$13.info("Authentication successful, sending agent.register", { connectionId: msg.connectionId });
+						logger$14.info("Authentication successful, sending agent.register", { connectionId: msg.connectionId });
 						this._state = "registering";
 						this.sendAgentRegister();
 					}
 					break;
 				case "auth.failure":
-					logger$13.error("Authentication FAILED -- token is invalid or expired. NOT retrying.", { reason: msg.reason });
+					logger$14.error("Authentication FAILED -- token is invalid or expired. NOT retrying.", { reason: msg.reason });
 					this.authFailed = true;
 					this.intentionalDisconnect = true;
 					if (this.ws) {
@@ -1331,31 +1777,17 @@ var OrchestratorClient = class OrchestratorClient {
 					this._state = "disconnected";
 					break;
 				case "register.ack":
-					logger$13.info("Registration acknowledged by orchestrator", {
-						agentId: msg.agentId,
-						labels: msg.labels,
-						scalerManaged: msg.scalerManaged,
-						pendingDispatch: msg.pendingDispatch ?? false
-					});
-					this.orchCapabilities = msg.capabilities;
-					this._state = "registered";
-					this.reconnectAttempts = 0;
-					this.startHeartbeat();
-					this.flushBuffer();
-					this.resendHeldCompletes();
-					this.onRegistered?.({ pendingDispatch: msg.pendingDispatch ?? false });
-					if (msg.scalerManaged || this.scalerManaged) this.blockMmdsAccess();
-					this.sendConfigAck(msg.agentId);
+					this.handleRegisterAck(msg);
 					break;
 				case "job.dispatch":
-					logger$13.info("Job dispatch received", {
+					logger$14.info("Job dispatch received", {
 						runId: msg.runId,
 						jobId: msg.jobId
 					});
 					this.onJobDispatch(msg);
 					break;
 				case "job.cancel":
-					logger$13.info("Job cancel received", {
+					logger$14.info("Job cancel received", {
 						runId: msg.runId,
 						jobId: msg.jobId,
 						reason: msg.reason
@@ -1363,7 +1795,7 @@ var OrchestratorClient = class OrchestratorClient {
 					this.onJobCancel(msg);
 					break;
 				case "job.concurrency.ack": {
-					logger$13.info("Concurrency ack received", {
+					logger$14.info("Concurrency ack received", {
 						requestId: msg.requestId,
 						action: msg.action
 					});
@@ -1378,7 +1810,7 @@ var OrchestratorClient = class OrchestratorClient {
 					break;
 				}
 				case "step.approval-resolved": {
-					logger$13.info("Step approval resolved", {
+					logger$14.info("Step approval resolved", {
 						requestId: msg.requestId,
 						runId: msg.runId,
 						jobId: msg.jobId,
@@ -1398,17 +1830,16 @@ var OrchestratorClient = class OrchestratorClient {
 					break;
 				}
 				case "fleet.logs.request":
-					logger$13.info("Fleet log collection requested", {
+					logger$14.info("Fleet log collection requested", {
 						requestId: msg.requestId,
 						logWindowHours: msg.logWindowHours
 					});
 					this.streamFleetBundle(msg);
-					break;
 			}
 			return;
 		}
 		if (heartbeatSchema.safeParse(raw).success) return;
-		logger$13.warn("Invalid message from orchestrator", { errors: parsed.error.issues });
+		logger$14.warn("Invalid message from orchestrator", { errors: parsed.error.issues });
 	}
 	flushBuffer() {
 		const events = this.eventBuffer.flush();
@@ -1422,11 +1853,11 @@ var OrchestratorClient = class OrchestratorClient {
 		}
 		this.disconnectedAt = null;
 		if (events.length > 0) {
-			logger$13.info("Flushing event buffer", { count: events.length });
+			logger$14.info("Flushing event buffer", { count: events.length });
 			for (const msg of events) this.sendDirect(msg);
 		}
 		if (logLines.length > 0) {
-			logger$13.info("Flushing log buffer", { count: logLines.length });
+			logger$14.info("Flushing log buffer", { count: logLines.length });
 			for (let i = 0; i < logLines.length; i += OrchestratorClient.LOG_BATCH_SIZE) {
 				const batch = logLines.slice(i, i + OrchestratorClient.LOG_BATCH_SIZE);
 				this.sendAgentLogMessage(batch);
@@ -1479,14 +1910,14 @@ var OrchestratorClient = class OrchestratorClient {
 	*/
 	blockMmdsAccess() {
 		if (process.getuid?.() !== 0) {
-			logger$13.info("MMDS iptables block skipped (non-root) — network isolation handled by orchestrator");
+			logger$14.info("MMDS iptables block skipped (non-root) — network isolation handled by orchestrator");
 			return;
 		}
 		try {
 			execSync("iptables -A OUTPUT -d 169.254.169.254 -j DROP", { timeout: 5e3 });
-			logger$13.info("MMDS access blocked via iptables");
+			logger$14.info("MMDS access blocked via iptables");
 		} catch (err) {
-			logger$13.warn("Failed to block MMDS access via iptables", { error: toErrorMessage(err) });
+			logger$14.warn("Failed to block MMDS access via iptables", { error: toErrorMessage(err) });
 		}
 	}
 	/**
@@ -1500,7 +1931,7 @@ var OrchestratorClient = class OrchestratorClient {
 				messageId: `config-ack-${agentId}-${Date.now()}`,
 				agentId
 			}));
-			logger$13.info("Config ACK sent to orchestrator", { agentId });
+			logger$14.info("Config ACK sent to orchestrator", { agentId });
 		}
 	}
 	startHeartbeat() {
@@ -1527,6 +1958,7 @@ var OrchestratorClient = class OrchestratorClient {
 		const autoLabels = [
 			...deriveOsArchLabels(os.platform(), os.arch()),
 			hostLabel(os.hostname()),
+			...runtimeFactLabels(),
 			...resolveRoleLabels(this.roles)
 		];
 		const allLabels = mergeAutoLabels(this.labels, autoLabels);
@@ -1540,7 +1972,7 @@ var OrchestratorClient = class OrchestratorClient {
 			hostname: os.hostname(),
 			osRelease: os.release(),
 			osVersion: os.version(),
-			totalMemoryMb: Math.round(os.totalmem() / (1024 * 1024)),
+			totalMemoryMb: Math.round(os.totalmem() / 1048576),
 			cpuCount: os.cpus().length,
 			nodeVersion: process.versions.node,
 			...(() => {
@@ -1566,12 +1998,12 @@ var OrchestratorClient = class OrchestratorClient {
 	scheduleReconnect() {
 		this.cancelReconnect();
 		if (this.authFailed) {
-			logger$13.error("Not reconnecting: authentication permanently failed");
+			logger$14.error("Not reconnecting: authentication permanently failed");
 			return;
 		}
 		const delay = this.getReconnectDelay();
 		this.reconnectAttempts++;
-		logger$13.info("Scheduling reconnect", {
+		logger$14.info("Scheduling reconnect", {
 			attempt: this.reconnectAttempts,
 			delayMs: Math.round(delay)
 		});
@@ -1656,14 +2088,14 @@ var init_console_capture = __esmMin((() => {
 init_console_capture();
 function safe(name, fallback = "unknown") {
 	switch (name) {
-		case "version": return "0.5.0";
-		case "buildCommit": return "cb51c7d1e";
-		case "sdkVersion": return "0.5.0";
-		case "sdkBundleHash": return "5b85e7cffa4a08e39329ff80448a2744af8e5b5f9840ec3801fad45ed11a3de9";
-		case "sharedVersion": return "0.5.0";
-		case "sharedBundleHash": return "b6b6d1818d1fe648150422daf073dafc18b037404cacf82e0ec03b4a2863e4c4";
-		case "engineVersion": return "0.5.0";
-		case "engineBundleHash": return "35d174ce6f4748abffcad194b335b508cade5d1c8af16d9cd3bdcb744f38717e";
+		case "version": return "0.6.0";
+		case "buildCommit": return "e4a936029";
+		case "sdkVersion": return "0.6.0";
+		case "sdkBundleHash": return "22faf0da45de7c243ce87f80fd33ee51b1df52809fde457b16bb821678f65eb3";
+		case "sharedVersion": return "0.6.0";
+		case "sharedBundleHash": return "a79be949815735b9e36eecc716f7eb07aa36c7bffba62e798e7e19f31a474eff";
+		case "engineVersion": return "0.6.0";
+		case "engineBundleHash": return "e49533b19f122155b3a78d95d105f97da259c2a45dee579578324b0702c91708";
 		default: return fallback;
 	}
 }
@@ -1892,7 +2324,7 @@ init_npm_resolver();
 * even structurally matches the allocator pattern (`ledger` is a 6-char label
 * suffix), which a regex alone cannot distinguish.
 */
-const AGENT_TMP_GC_MAX_AGE_MS = 1440 * 60 * 1e3;
+const AGENT_TMP_GC_MAX_AGE_MS = 864e5;
 /**
 * Bare `kici-<6 chars>` workdirs and labeled `kici-<label>-<6 chars>`
 * allocator dirs. The optional label group makes both families eligible.
@@ -1948,7 +2380,7 @@ async function gcStaleAgentTmpDirs(base = kiciTmpBase()) {
 * spawn fails and the caller clears the orchestrator's reboot-pending flag and
 * surfaces the error — the deadline sweep is the backstop.
 */
-const logger$12 = createLogger({ prefix: "reboot" });
+const logger$13 = createLogger({ prefix: "reboot" });
 /** The OS reboot primitive for a Node platform string. */
 function rebootCommandFor(platform) {
 	switch (platform) {
@@ -1986,7 +2418,7 @@ function issueReboot(platform = process.platform) {
 				stdio: "ignore"
 			});
 			child.on("error", (err) => {
-				logger$12.error("Reboot command failed to spawn", {
+				logger$13.error("Reboot command failed to spawn", {
 					cmd,
 					args,
 					error: String(err)
@@ -1994,14 +2426,14 @@ function issueReboot(platform = process.platform) {
 				reject(err);
 			});
 			child.on("exit", (code) => {
-				if (code !== 0 && code !== null) logger$12.warn("Reboot command exited non-zero (privilege denied?)", {
+				if (code !== 0 && code !== null) logger$13.warn("Reboot command exited non-zero (privilege denied?)", {
 					cmd,
 					args,
 					code
 				});
 			});
 			child.unref();
-			logger$12.info("Issued host reboot", {
+			logger$13.info("Issued host reboot", {
 				cmd,
 				args
 			});
@@ -2012,8 +2444,18 @@ function issueReboot(platform = process.platform) {
 	});
 }
 //#endregion
+//#region src/idle-shutdown.ts
+function decideIdleShutdown(input) {
+	if (!input.scalerManaged || input.activeJobs > 0) return "none";
+	if (input.warmPool) return "warm";
+	if (input.pendingDispatch) return "pending-dispatch";
+	return "idle";
+}
+//#endregion
 //#region src/metrics/prometheus.ts
 var prometheus_exports = /* @__PURE__ */ __exportAll({
+	betweenJobsResetDurationSeconds: () => betweenJobsResetDurationSeconds,
+	betweenJobsResetTotal: () => betweenJobsResetTotal,
 	cloneDurationSeconds: () => cloneDurationSeconds,
 	connectionStatus: () => connectionStatus$1,
 	jobsActive: () => jobsActive$1,
@@ -2022,10 +2464,12 @@ var prometheus_exports = /* @__PURE__ */ __exportAll({
 	logBackpressureEventsTotal: () => logBackpressureEventsTotal,
 	logBytesTotal: () => logBytesTotal,
 	logLinesDroppedTotal: () => logLinesDroppedTotal,
+	orphanCleanupTotal: () => orphanCleanupTotal,
+	orphansReapedTotal: () => orphansReapedTotal,
 	stepDurationSeconds: () => stepDurationSeconds,
 	stepsTotal: () => stepsTotal
 });
-var meter, jobsTotal$1, jobsActive$1, stepsTotal, stepDurationSeconds, cloneDurationSeconds, logBytesTotal, logBackpressureEventsTotal, logLinesDroppedTotal, logBackpressureActive, connectionStatus$1;
+var meter, jobsTotal$1, jobsActive$1, stepsTotal, stepDurationSeconds, cloneDurationSeconds, logBytesTotal, logBackpressureEventsTotal, logLinesDroppedTotal, logBackpressureActive, connectionStatus$1, betweenJobsResetTotal, betweenJobsResetDurationSeconds, orphansReapedTotal, orphanCleanupTotal;
 var init_prometheus = __esmMin((() => {
 	meter = createMeter("kici-agent");
 	jobsTotal$1 = meter.createCounter("kici_agent_jobs_total", { description: "Total number of completed jobs" });
@@ -2060,6 +2504,20 @@ var init_prometheus = __esmMin((() => {
 	logLinesDroppedTotal = meter.createCounter("kici_agent_log_lines_dropped_total", { description: "Total log lines dropped due to backpressure" });
 	logBackpressureActive = meter.createUpDownCounter("kici_agent_log_backpressure_active", { description: "Current log-streamer backpressure state (0=normal, 1=active)" });
 	connectionStatus$1 = meter.createUpDownCounter("kici_agent_connection_status", { description: "Orchestrator WebSocket connection status (0=disconnected, 1=connected)" });
+	betweenJobsResetTotal = meter.createCounter("kici_agent_between_jobs_reset_total", { description: "Total operator between-jobs reset command invocations" });
+	betweenJobsResetDurationSeconds = meter.createHistogram("kici_agent_between_jobs_reset_duration_seconds", {
+		description: "Between-jobs reset command duration in seconds",
+		advice: { explicitBucketBoundaries: [
+			.1,
+			1,
+			5,
+			30,
+			60,
+			300
+		] }
+	});
+	orphansReapedTotal = meter.createCounter("kici_agent_orphans_reaped_total", { description: "Total processes killed by the between-jobs process-group reap" });
+	orphanCleanupTotal = meter.createCounter("kici_agent_orphan_cleanup_total", { description: "Total out-of-band declared-cleanup re-runs" });
 }));
 //#endregion
 //#region src/checkout/ssh-auth.ts
@@ -2083,9 +2541,11 @@ async function setupSshAuth(opts) {
 	if (opts.hostKeyPolicy === "pinned" && !opts.knownHosts) throw new Error("pinned hostKeyPolicy requires knownHosts content");
 	const { path: tempDir, cleanup } = await makeTempDir("ssh");
 	const keyPath = join(tempDir, "id");
-	await writeFile(keyPath, opts.privateKey.endsWith("\n") ? opts.privateKey : `${opts.privateKey}\n`, { mode: 384 });
+	const pem = opts.privateKey.endsWith("\n") ? opts.privateKey : `${opts.privateKey}\n`;
+	await writeFile(keyPath, pem, { mode: 384 });
 	const knownHostsPath = join(tempDir, "known_hosts");
-	await writeFile(knownHostsPath, opts.hostKeyPolicy === "pinned" ? opts.knownHosts : "", { mode: 384 });
+	const knownHostsBody = opts.hostKeyPolicy === "pinned" ? opts.knownHosts : "";
+	await writeFile(knownHostsPath, knownHostsBody, { mode: 384 });
 	const parts = [
 		"ssh",
 		"-i",
@@ -2117,6 +2577,37 @@ var init_ssh_auth = __esmMin((() => {}));
 //#endregion
 //#region src/checkout/git-clone.ts
 /**
+* Point a clone at the agent's credential helper.
+*
+* Only the helper PATH is written — never a secret — which is what makes it
+* safe to persist in `.git/config`. `useHttpPath` makes git include
+* `path=owner/repo.git` in every credential query, without which the helper
+* could not tell one repository from another and a write grant could not be
+* confined to its own repo.
+*/
+function configureCredentialHelper(workDir, helperPath) {
+	execFileSync("git", [
+		"-C",
+		workDir,
+		"config",
+		"credential.helper",
+		helperPath
+	], {
+		stdio: "pipe",
+		timeout: 1e4
+	});
+	execFileSync("git", [
+		"-C",
+		workDir,
+		"config",
+		"credential.useHttpPath",
+		"true"
+	], {
+		stdio: "pipe",
+		timeout: 1e4
+	});
+}
+/**
 * Strip auth credentials from git error messages to prevent token leakage.
 * Node's execFileSync includes the full command line (including -c http.extraHeader
 * and GIT_SSH_COMMAND flags) in error messages, which would expose Base64-encoded
@@ -2143,7 +2634,7 @@ function redactSensitive(input) {
 * @throws Error if clone fails or SHA does not match
 */
 async function gitClone(options) {
-	const { repoUrl, ref, sha, workDir, token, gitAuth, depth = 1 } = options;
+	const { repoUrl, ref, sha, workDir, token, gitAuth, depth = 1, credentialHelperPath, sshCleanupRegistry } = options;
 	const auth = gitAuth ? gitAuth : token ? {
 		kind: "basic",
 		user: "x-access-token",
@@ -2197,6 +2688,7 @@ async function gitClone(options) {
 		} catch (err) {
 			throw sanitizeGitError(err);
 		}
+		if (credentialHelperPath) configureCredentialHelper(workDir, credentialHelperPath);
 		if (!sha || sha === "HEAD") return;
 		const envOpts = env ? { env } : {};
 		if (!execFileSync("git", [
@@ -2252,7 +2744,12 @@ async function gitClone(options) {
 			if (!recheckedSha.startsWith(sha)) throw new Error(`SHA mismatch: expected ${sha}, got ${recheckedSha}`);
 		}
 	} finally {
-		if (sshSetup) await sshSetup.cleanup().catch(() => {});
+		if (sshSetup) {
+			if (sshCleanupRegistry) {
+				const setup = sshSetup;
+				sshCleanupRegistry.defer(() => setup.cleanup().catch(() => {}));
+			} else await sshSetup.cleanup().catch(() => {});
+		}
 		if (safeDirCleanup) await safeDirCleanup();
 	}
 }
@@ -2260,6 +2757,408 @@ var init_git_clone = __esmMin((() => {
 	init_ssh_auth();
 }));
 //#endregion
+//#region src/checkout/clone-job-repos.ts
+/**
+* Clone a job's repositories — from the host or from inside the sandbox.
+*
+* This used to live only inside the workflow runner, which meant the clone
+* always happened wherever the runner ran: for a container job, inside the
+* customer's image, which therefore had to ship git. Extracting it lets the
+* AGENT clone on the host and copy the tree in, so the image needs no git —
+* and it puts clone-time credentials on the host, where the credential helper
+* already works, rather than needing a route into a container hardened with
+* `CapDrop: ALL`.
+*
+* Both callers run the SAME code: the runner keeps calling it for bare-metal
+* and for the legacy container path, and the agent calls it for a host-side
+* checkout. A second implementation would be two subtly different clones.
+*/
+/**
+* Clone whatever this job needs, or nothing.
+*
+* Three modes, unchanged from where this logic used to live: full-repo overlay
+* (no clone), global dual-clone (workflow repo + source repo), and the ordinary
+* single-repo clone.
+*/
+async function cloneJobRepos(request, dirs, deps) {
+	if (request.checkout === false) return;
+	const helper = request.credentialHelperPath ? { credentialHelperPath: request.credentialHelperPath } : {};
+	if (request.fullRepo) {
+		await mkdir(dirs.workDir, { recursive: true });
+		deps.log("Full-repo mode: skipping git clone (workspace from overlay tarball)");
+		return;
+	}
+	if (deps.isGlobal) {
+		await mkdir(dirs.workflowDir, { recursive: true });
+		await mkdir(dirs.sourceDir, { recursive: true });
+		const workflowAuth = request.workflowAuth ?? request.sourceAuth;
+		const sourceAuth = request.sourceAuth ?? request.workflowAuth;
+		deps.log(`Global workflow: cloning workflow repo ${request.workflowRepoUrl} ref=${request.workflowRef} into ${dirs.workflowDir}`);
+		await gitClone({
+			repoUrl: request.workflowRepoUrl,
+			ref: request.workflowRef ?? "",
+			sha: request.workflowSha ?? "",
+			workDir: dirs.workflowDir,
+			gitAuth: workflowAuth,
+			token: workflowAuth ? void 0 : request.token,
+			...helper
+		});
+		await deps.excludeScratchFromGit(dirs.workflowDir);
+		deps.log(`Global workflow: cloning source repo ${request.repoUrl} ref=${request.ref} into ${dirs.sourceDir}`);
+		await gitClone({
+			repoUrl: request.repoUrl,
+			ref: request.ref,
+			sha: request.sha,
+			workDir: dirs.sourceDir,
+			gitAuth: sourceAuth,
+			token: sourceAuth ? void 0 : request.token,
+			...helper
+		});
+		deps.log("Dual-clone complete");
+		return;
+	}
+	deps.log(`Cloning ${request.repoUrl} ref=${request.ref} into ${dirs.workDir}`);
+	await gitClone({
+		repoUrl: request.repoUrl,
+		ref: request.ref,
+		sha: request.sha,
+		workDir: dirs.workDir,
+		gitAuth: request.sourceAuth,
+		token: request.sourceAuth ? void 0 : request.token,
+		...helper
+	});
+	await deps.excludeScratchFromGit(dirs.workDir);
+	deps.log("Clone complete");
+}
+var init_clone_job_repos = __esmMin((() => {
+	init_git_clone();
+}));
+//#endregion
+//#region src/checkout/grant-table.ts
+/**
+* Live write grants for this job.
+*
+* `withWrite` adds a grant before running its callback and revokes it in a
+* `finally`; the TTL is a backstop so a step that crashes cannot leave one
+* standing. The credential helper consults this table to decide whether to ask
+* the broker for a read-only or an elevated credential.
+*
+* Scope note, stated because the name could mislead: a grant is scoped to a
+* REPOSITORY and a TIME WINDOW — not to a step. The agent forks one process per
+* job and `parallel()` runs its children inside that process, so a concurrent
+* sibling step can push to the same repository while a grant is live. It cannot
+* reach a different repository.
+*/
+/** Git presents paths as `/owner/repo.git`; callers use `owner/repo`. Compare one form. */
+function normalise(repoPath) {
+	return repoPath.replace(/^\/+/, "").replace(/\.git$/, "").toLowerCase();
+}
+var GrantTable;
+var init_grant_table = __esmMin((() => {
+	GrantTable = class {
+		grants = /* @__PURE__ */ new Map();
+		add(grant) {
+			const id = randomUUID();
+			this.grants.set(id, {
+				...grant,
+				repoPath: normalise(grant.repoPath)
+			});
+			return id;
+		}
+		revoke(grantId) {
+			this.grants.delete(grantId);
+		}
+		lookup(repoPath, now = Date.now()) {
+			const wanted = normalise(repoPath);
+			for (const [id, grant] of this.grants) {
+				if (grant.expiresAt <= now) {
+					this.grants.delete(id);
+					continue;
+				}
+				if (grant.repoPath === wanted) return grant;
+			}
+			return null;
+		}
+		/** Live grant count, after reaping expired entries. Test and diagnostics use. */
+		size(now = Date.now()) {
+			for (const [id, grant] of this.grants) if (grant.expiresAt <= now) this.grants.delete(id);
+			return this.grants.size;
+		}
+	};
+}));
+//#endregion
+//#region src/checkout/write-elevation.ts
+/** Requested entries the grant does not satisfy, as `key=value` strings. */
+function missingPermissions(requested, granted) {
+	return Object.entries(requested).filter(([key, value]) => granted[key] !== value).map(([key, value]) => `${key}=${value}`);
+}
+async function elevateForWrite(args) {
+	const { grant, expiresAt } = await args.request({
+		repository: args.repository,
+		permissions: args.permissions
+	});
+	if (grant.scoped) {
+		const missing = missingPermissions(args.permissions, grant.permissions);
+		if (missing.length > 0) throw new Error(`Cannot elevate '${args.repository}' for write: the app did not grant ${missing.join(", ")}. Grant the permission on the app installation, or request only what it holds.`);
+	}
+	const parsed = expiresAt ? Date.parse(expiresAt) : NaN;
+	const expiry = Number.isFinite(parsed) ? parsed : Date.now() + DEFAULT_GRANT_TTL_MS;
+	return {
+		grantId: args.grants.add({
+			repoPath: args.repository,
+			permissions: args.permissions,
+			expiresAt: expiry
+		}),
+		granted: grant
+	};
+}
+var DEFAULT_GRANT_TTL_MS;
+var init_write_elevation = __esmMin((() => {
+	DEFAULT_GRANT_TTL_MS = 36e5;
+}));
+//#endregion
+//#region src/checkout/credential-helper-host.ts
+/**
+* Host side of the git credential helper.
+*
+* Git spawns the helper as its own process, so it cannot call into the agent
+* directly. This module gives it a route: a per-job unix socket the agent
+* listens on, plus a tiny executable shim that connects to it and speaks git's
+* credential protocol on stdin/stdout.
+*
+* The shim is deliberately self-contained — no imports beyond `node:net` — so it
+* needs no module resolution, no bundle, and no dependency on where the agent
+* was installed. Its only job is to move bytes.
+*
+* Scope: this is the HOST path, which covers bare-metal jobs. A container job
+* clones and executes inside the container today and has no route to this
+* socket; that is fixed by the dual-mode container work, which moves the clone
+* to the host and injects `/opt/kici` read-only.
+*/
+/** The shim source. Kept inline so the helper has no build step of its own. */
+function shimSource(socketPath) {
+	return `#!/usr/bin/env node
+'use strict';
+const net = require('node:net');
+const op = process.argv[2];
+// We persist nothing, so 'store' and 'erase' have nothing to do. Exiting
+// non-zero here would break pushes that are otherwise working.
+if (op !== 'get') process.exit(0);
+let input = '';
+process.stdin.setEncoding('utf8');
+process.stdin.on('data', (c) => { input += c; });
+process.stdin.on('end', () => {
+  const query = {};
+  for (const line of input.split('\\n')) {
+    const eq = line.indexOf('=');
+    if (eq <= 0) continue;
+    const k = line.slice(0, eq);
+    if (k === 'protocol' || k === 'host' || k === 'path') query[k] = line.slice(eq + 1);
+  }
+  const sock = net.createConnection(${JSON.stringify(socketPath)});
+  let reply = '';
+  const bail = () => { try { sock.destroy(); } catch {} process.exit(0); };
+  sock.on('error', bail);
+  sock.on('connect', () => sock.end(JSON.stringify(query) + '\\n'));
+  sock.on('data', (d) => { reply += d.toString('utf8'); });
+  sock.on('close', () => {
+    let out = '';
+    try {
+      const parsed = JSON.parse(reply || 'null');
+      if (parsed && parsed.username) {
+        out = 'username=' + parsed.username + '\\npassword=' + parsed.password + '\\n';
+      }
+    } catch {
+      // An unparseable reply is a miss, not a crash: git falls through.
+    }
+    // Exit only once stdout has flushed. process.exit() truncates a pending
+    // pipe write, which silently produced an empty credential reply.
+    if (out === '') process.exit(0);
+    process.stdout.write(out, () => process.exit(0));
+  });
+});
+`;
+}
+/**
+* Start the per-job helper socket and materialize the shim.
+*
+* `answer` is the agent's resolver: it consults the grant table and asks the
+* orchestrator broker. Returning null means "no credential", which the shim
+* turns into an empty reply so git falls through to its own mechanisms.
+*/
+async function startCredentialHelperHost(args) {
+	await mkdir(args.dir, {
+		recursive: true,
+		mode: 448
+	});
+	const socketPath = join(args.dir, "git-credential.sock");
+	const helperPath = join(args.dir, "git-credential-kici.cjs");
+	await writeFile(helperPath, shimSource(socketPath), { mode: 448 });
+	await chmod(helperPath, 448);
+	const server = createServer({ allowHalfOpen: true }, (socket) => handleConnection(socket, args.answer));
+	await new Promise((resolve, reject) => {
+		server.once("error", reject);
+		server.listen(socketPath, () => {
+			server.removeListener("error", reject);
+			resolve();
+		});
+	});
+	return {
+		helperPath,
+		close: () => closeServer(server)
+	};
+}
+/** Read one newline-terminated query, answer it, close. */
+function handleConnection(socket, answer) {
+	let buf = "";
+	socket.setEncoding("utf8");
+	socket.on("error", () => {});
+	socket.on("data", (chunk) => {
+		buf += chunk;
+	});
+	socket.on("end", () => {
+		let query;
+		try {
+			query = JSON.parse(buf || "{}");
+		} catch {
+			socket.end("null\n");
+			return;
+		}
+		answer(query).then((result) => socket.end(JSON.stringify(result) + "\n"), () => socket.end("null\n"));
+	});
+}
+function closeServer(server) {
+	return new Promise((resolve) => server.close(() => resolve()));
+}
+var init_credential_helper_host = __esmMin((() => {}));
+//#endregion
+//#region src/checkout/job-git-credentials.ts
+/**
+* Per-job git credential plumbing.
+*
+* Owns the three things a job needs to authenticate git: the grant table, the
+* helper socket git talks to, and the relay to the orchestrator broker. Kept in
+* its own module so the job runner wires one object rather than three, and so
+* this logic is testable without standing up a job.
+*
+* Scope: this is the HOST path, which covers bare-metal jobs. A container job
+* clones and executes inside the container today and has no route to the
+* socket; that is fixed by the dual-mode container work, which moves the clone
+* to the host and injects `/opt/kici` read-only.
+*/
+/** `owner/repo.git` (or `/owner/repo`) as git spells it -> `owner/repo`. */
+function repositoryFromPath(path) {
+	return (path ?? "").replace(/^\/+/, "").replace(/\.git$/, "");
+}
+/**
+* Stand up git credentials for one job.
+*
+* `sendApiRequest` is the agent's existing orchestrator relay — the same one
+* `ctx.kici` uses — so this adds no new transport.
+*/
+async function startJobGitCredentials(args) {
+	const grants = new GrantTable();
+	/**
+	* Pick the credential a request should use.
+	*
+	* A per-call name wins; otherwise `default` from the job's declared map;
+	* otherwise undefined, which means the source credential — all a read needs.
+	* An unknown name throws rather than silently falling back, because using a
+	* different credential than the author named is the confusion the map exists
+	* to remove.
+	*/
+	const refFor = (name) => {
+		if (name === void 0) return args.credentials?.default;
+		const found = args.credentials?.[name];
+		if (!found) throw new Error(`Unknown git credential '${name}'. Declare it in the job's gitCredentials map. Known: ${Object.keys(args.credentials ?? {}).join(", ") || "(none)"}`);
+		return found;
+	};
+	const ask = async (repository, permissions, credentialName) => {
+		const ref = refFor(credentialName);
+		return await args.sendApiRequest(GIT_CREDENTIAL_REQUEST_METHOD, {
+			jobId: args.jobId,
+			repositories: [repository],
+			permissions,
+			...ref ? { ref } : {}
+		});
+	};
+	/** Answer one credential query from git, defaulting to read-only. */
+	const answer = async (query) => {
+		const repository = repositoryFromPath(query.path);
+		if (repository === "") return null;
+		const grant = grants.lookup(repository);
+		const permissions = grant ? grant.permissions : { contents: "read" };
+		const credential = await ask(repository, permissions);
+		if (!credential || credential.kind !== "basic") return null;
+		return {
+			username: credential.user ?? "x-access-token",
+			password: credential.secret
+		};
+	};
+	let host = await startCredentialHelperHost({
+		dir: args.dir,
+		answer
+	});
+	const onGitGrantRequest = async (request) => {
+		try {
+			if (request.op === "revoke") {
+				if (request.grantId) grants.revoke(request.grantId);
+				return {
+					type: "git.grant.response",
+					requestId: request.requestId
+				};
+			}
+			if (!request.repository) throw new Error("git.grant.request: elevate requires a repository");
+			const { grantId, granted } = await elevateForWrite({
+				repository: request.repository,
+				permissions: request.permissions ?? { contents: "write" },
+				grants,
+				request: async ({ repository, permissions }) => {
+					const result = await ask(repository, permissions, request.credentialName);
+					return {
+						grant: result.grant,
+						expiresAt: result.expiresAt
+					};
+				}
+			});
+			return {
+				type: "git.grant.response",
+				requestId: request.requestId,
+				grantId,
+				granted
+			};
+		} catch (err) {
+			return {
+				type: "git.grant.response",
+				requestId: request.requestId,
+				error: err instanceof Error ? err.message : String(err)
+			};
+		}
+	};
+	return {
+		helperPath: host.helperPath,
+		onGitGrantRequest,
+		withRef: (params) => {
+			const { credential, ...rest } = params;
+			const ref = refFor(typeof credential === "string" ? credential : void 0);
+			return ref ? {
+				...rest,
+				ref
+			} : rest;
+		},
+		close: async () => {
+			const open = host;
+			host = void 0;
+			if (open) await open.close();
+		}
+	};
+}
+var init_job_git_credentials = __esmMin((() => {
+	init_grant_table();
+	init_write_elevation();
+	init_credential_helper_host();
+}));
+//#endregion
 //#region src/checkout/changed-files.ts
 /** Build the auth context for the fetches, mirroring git-clone.ts's auth. */
 async function buildAuthCtx(auth) {
@@ -2521,7 +3420,8 @@ var workflow_loader_exports = /* @__PURE__ */ __exportAll({
 */
 async function resolveWorkflowSdkSetters(workflowFilePath) {
 	try {
-		const sdk = await import(pathToFileURL(createRequire(workflowFilePath).resolve("@kici-dev/sdk")).href);
+		const sdkEntry = createRequire(workflowFilePath).resolve("@kici-dev/sdk");
+		const sdk = await import(pathToFileURL(sdkEntry).href);
 		if (typeof sdk.setStepOutputsMap === "function" && typeof sdk.setStepRefMap === "function" && typeof sdk.setJobOutputsMap === "function") return {
 			setStepOutputsMap: sdk.setStepOutputsMap,
 			setStepRefMap: sdk.setStepRefMap,
@@ -2694,8 +3594,8 @@ async function extractStepsFromDynamicJob(workflow, dynamicIndex, jobName, event
 var AGENT_SDK_VERSION, AGENT_SDK_BUNDLE_HASH, hookRegistered;
 var init_workflow_loader = __esmMin((() => {
 	init_generator_context();
-	AGENT_SDK_VERSION = "0.5.0";
-	AGENT_SDK_BUNDLE_HASH = "5b85e7cffa4a08e39329ff80448a2744af8e5b5f9840ec3801fad45ed11a3de9";
+	AGENT_SDK_VERSION = "0.6.0";
+	AGENT_SDK_BUNDLE_HASH = "22faf0da45de7c243ce87f80fd33ee51b1df52809fde457b16bb821678f65eb3";
 	hookRegistered = false;
 }));
 //#endregion
@@ -2716,7 +3616,7 @@ var init_workflow_loader = __esmMin((() => {
 async function packKiciSource(workDir) {
 	const kiciDir = join(workDir, ".kici");
 	if (!existsSync(kiciDir)) throw new Error(`.kici/ not found at ${kiciDir}`);
-	logger$11.info("Packing .kici/ source tarball", { dir: workDir });
+	logger$12.info("Packing .kici/ source tarball", { dir: workDir });
 	const startTime = Date.now();
 	const stream = c({
 		gzip: true,
@@ -2730,7 +3630,7 @@ async function packKiciSource(workDir) {
 	const hash = sha256(tarball);
 	const sizeKB = (tarball.length / 1024).toFixed(2);
 	const durationMs = Date.now() - startTime;
-	logger$11.info(".kici/ source packed", {
+	logger$12.info(".kici/ source packed", {
 		sizeKB,
 		hash: hash.slice(0, 12),
 		durationMs
@@ -2740,9 +3640,9 @@ async function packKiciSource(workDir) {
 		hash
 	};
 }
-var logger$11;
+var logger$12;
 var init_source_packer = __esmMin((() => {
-	logger$11 = createLogger({ prefix: "source-packer" });
+	logger$12 = createLogger({ prefix: "source-packer" });
 }));
 //#endregion
 //#region src/execution/dep-restore.ts
@@ -2868,7 +3768,7 @@ async function excludeScratchFromGit(repoWorkDir) {
 		const suffix = existing.length === 0 || existing.endsWith("\n") ? "" : "\n";
 		await fsPromises.appendFile(excludePath, `${suffix}# kici: hide dep-restore scratch dirs from customer git status\n${SCRATCH_DIR_GIT_EXCLUDE_GLOB}\n`);
 	} catch (err) {
-		logger$10.warn("Failed to register scratch dir glob in .git/info/exclude", {
+		logger$11.warn("Failed to register scratch dir glob in .git/info/exclude", {
 			excludePath,
 			error: err instanceof Error ? err.message : String(err)
 		});
@@ -2929,7 +3829,7 @@ async function cleanupScratch(scratchDir) {
 			force: true
 		});
 	} catch (cleanupErr) {
-		logger$10.warn("Scratch dir cleanup failed (orphan left behind)", {
+		logger$11.warn("Scratch dir cleanup failed (orphan left behind)", {
 			scratchDir,
 			error: cleanupErr instanceof Error ? cleanupErr.message : String(cleanupErr)
 		});
@@ -2954,7 +3854,7 @@ async function cleanupScratch(scratchDir) {
 */
 async function restoreDeps(workDir, depsUrl, depsHash) {
 	depsUrl = resolveOrchestratorUrl(depsUrl);
-	logger$10.info("Downloading dependency tarball", { url: depsUrl });
+	logger$11.info("Downloading dependency tarball", { url: depsUrl });
 	const kiciDir = join(workDir, ".kici");
 	if (depsUrl.startsWith("file://")) {
 		const localPath = fileURLToPath(depsUrl);
@@ -2967,8 +3867,8 @@ async function restoreDeps(workDir, depsUrl, depsHash) {
 		await extractTarball(data, scratchDir);
 		await moveScratchIntoRepo(scratchDir, workDir);
 		await cleanupScratch(scratchDir);
-		const sizeMB = (data.length / (1024 * 1024)).toFixed(2);
-		logger$10.info("Dependencies restored from cache (file)", {
+		const sizeMB = (data.length / 1048576).toFixed(2);
+		logger$11.info("Dependencies restored from cache (file)", {
 			sizeMB,
 			targetDir: workDir
 		});
@@ -2977,7 +3877,7 @@ async function restoreDeps(workDir, depsUrl, depsHash) {
 	if (!depsUrl.startsWith("http://") && !depsUrl.startsWith("https://")) throw new Error(`Unsupported deps URL scheme: ${depsUrl}`);
 	let lastError;
 	for (let attempt = 0; attempt <= 2; attempt++) {
-		if (attempt > 0) logger$10.warn("Retrying dep tarball download", {
+		if (attempt > 0) logger$11.warn("Retrying dep tarball download", {
 			attempt,
 			url: depsUrl
 		});
@@ -2986,11 +3886,11 @@ async function restoreDeps(workDir, depsUrl, depsHash) {
 			if (depsHash && hash !== depsHash) throw new Error(`Dep tarball hash mismatch: expected ${depsHash}, got ${hash}`);
 			await moveScratchIntoRepo(scratchDir, workDir);
 			await cleanupScratch(scratchDir);
-			logger$10.info("Dependencies restored from cache (stream)", { targetDir: workDir });
+			logger$11.info("Dependencies restored from cache (stream)", { targetDir: workDir });
 			return;
 		} catch (err) {
 			lastError = err instanceof Error ? err : new Error(String(err));
-			logger$10.warn("Dep tarball download failed", {
+			logger$11.warn("Dep tarball download failed", {
 				attempt,
 				error: lastError.message
 			});
@@ -2998,10 +3898,10 @@ async function restoreDeps(workDir, depsUrl, depsHash) {
 	}
 	throw new Error(`Dep tarball download failed after 3 attempts: ${lastError?.message}`);
 }
-var logger$10, DOWNLOAD_TIMEOUT_MS$1, SCRATCH_DIR_BASENAME_PREFIX, SCRATCH_DIR_GIT_EXCLUDE_GLOB;
+var logger$11, DOWNLOAD_TIMEOUT_MS$1, SCRATCH_DIR_BASENAME_PREFIX, SCRATCH_DIR_GIT_EXCLUDE_GLOB;
 var init_dep_restore = __esmMin((() => {
-	logger$10 = createLogger({ prefix: "dep-restore" });
-	DOWNLOAD_TIMEOUT_MS$1 = 300 * 1e3;
+	logger$11 = createLogger({ prefix: "dep-restore" });
+	DOWNLOAD_TIMEOUT_MS$1 = 3e5;
 	SCRATCH_DIR_BASENAME_PREFIX = ".dep-restore-scratch-";
 	SCRATCH_DIR_GIT_EXCLUDE_GLOB = `.kici/${SCRATCH_DIR_BASENAME_PREFIX}*`;
 }));
@@ -3113,7 +4013,7 @@ async function uploadToPresignedUrl(url, data, opts) {
 	for (let attempt = 0; attempt <= 2; attempt++) {
 		if (attempt > 0) {
 			const delayMs = baseDelayMs * 2 ** (attempt - 1);
-			logger$9.warn("Retrying pre-signed upload", {
+			logger$10.warn("Retrying pre-signed upload", {
 				attempt,
 				delayMs,
 				error: lastError?.message
@@ -3130,12 +4030,12 @@ async function uploadToPresignedUrl(url, data, opts) {
 	}
 	throw new Error(`Pre-signed upload failed after 3 attempts: ${lastError?.message}`);
 }
-var logger$9, DOWNLOAD_TIMEOUT_MS, UPLOAD_TIMEOUT_MS, UPLOAD_RETRY_BASE_DELAY_MS, PresignedUploadHttpError;
+var logger$10, DOWNLOAD_TIMEOUT_MS, UPLOAD_TIMEOUT_MS, UPLOAD_RETRY_BASE_DELAY_MS, PresignedUploadHttpError;
 var init_download = __esmMin((() => {
 	init_dep_restore();
-	logger$9 = createLogger({ prefix: "agent:download" });
-	DOWNLOAD_TIMEOUT_MS = 300 * 1e3;
-	UPLOAD_TIMEOUT_MS = 300 * 1e3;
+	logger$10 = createLogger({ prefix: "agent:download" });
+	DOWNLOAD_TIMEOUT_MS = 3e5;
+	UPLOAD_TIMEOUT_MS = 3e5;
 	UPLOAD_RETRY_BASE_DELAY_MS = 500;
 	PresignedUploadHttpError = class extends Error {
 		statusCode;
@@ -3181,7 +4081,7 @@ async function extractSourceTarball(data, targetDir) {
 }
 async function restoreSource(workDir, sourceTarUrl) {
 	sourceTarUrl = resolveOrchestratorUrl(sourceTarUrl);
-	logger$8.info("Restoring .kici/ source from tarball", { sourceTarUrl });
+	logger$9.info("Restoring .kici/ source from tarball", { sourceTarUrl });
 	const startTime = Date.now();
 	let data;
 	if (sourceTarUrl.startsWith("file://")) {
@@ -3191,16 +4091,16 @@ async function restoreSource(workDir, sourceTarUrl) {
 	else throw new Error(`Unsupported source tarball URL scheme: ${sourceTarUrl}`);
 	await extractSourceTarball(data, workDir);
 	const durationMs = Date.now() - startTime;
-	logger$8.info(".kici/ source restored", {
+	logger$9.info(".kici/ source restored", {
 		sizeKB: (data.length / 1024).toFixed(2),
 		durationMs
 	});
 }
-var logger$8;
+var logger$9;
 var init_source_restore = __esmMin((() => {
 	init_download();
 	init_dep_restore();
-	logger$8 = createLogger({ prefix: "source-restore" });
+	logger$9 = createLogger({ prefix: "source-restore" });
 }));
 //#endregion
 //#region src/execution/timeout-util.ts
@@ -3692,9 +4592,7 @@ async function stageAgentPayload(reach, privateKey, opts, deps) {
 		case "ssh-push":
 			await stageSshPush(reach, privateKey, opts, extractDir, deps);
 			break;
-		case "s3-direct":
-			await stageS3Direct(reach, privateKey, opts.delivery.presignedUrl, opts.delivery.sha256, extractDir, deps);
-			break;
+		case "s3-direct": await stageS3Direct(reach, privateKey, opts.delivery.presignedUrl, opts.delivery.sha256, extractDir, deps);
 	}
 	return { launcherPath: path.posix.join(extractDir, "kici-agent") };
 }
@@ -4193,23 +5091,31 @@ var init_streaming_zx_log = __esmMin((() => {}));
 *
 * @param jobs - Jobs returned by a DynamicJobFn
 * @param ctx - Eval-time context used to resolve dynamic fields on generated jobs
+* @param seenNames - Optional accumulator of job names already emitted earlier
+*   in the same eval round; when supplied, a name already present throws and
+*   every generated name is added so later generators in the round see it
 * @returns Serialized LockJob array ready for orchestrator dispatch
 * @throws Error if validation fails (duplicates, limit exceeded) or if a user-supplied
 *   dynamic function throws / times out / returns an unsupported value
 */
-async function serializeJobsToLock(jobs, ctx, staticNames, allowedGroups) {
+async function serializeJobsToLock(jobs, ctx, staticNames, allowedGroups, seenNames) {
 	if (jobs.length > 100) throw new Error(`DynamicJobFn generated ${jobs.length} jobs, exceeding the limit of 100`);
 	const generatedNames = /* @__PURE__ */ new Set();
+	const roundNames = seenNames ?? /* @__PURE__ */ new Set();
 	for (const job of jobs) {
-		if (generatedNames.has(job.name)) throw new Error(`Duplicate job name '${job.name}' in DynamicJobFn output`);
+		if (roundNames.has(job.name)) throw new Error(`Duplicate job name '${job.name}' in dynamic job output`);
 		generatedNames.add(job.name);
+		roundNames.add(job.name);
 	}
 	const result = [];
 	for (const job of jobs) result.push(await serializeJob(job, generatedNames, ctx, staticNames ?? /* @__PURE__ */ new Set(), allowedGroups ?? /* @__PURE__ */ new Set()));
 	return result;
 }
 async function serializeJob(job, generatedNames, ctx, staticNames, allowedGroups) {
-	const { include: runsOn, exclude: excludeLabels } = normalizeRunsOnToMatchers(job.runsOn, `generated job '${job.name}' runsOn`);
+	const { include: runsOn, exclude: excludeLabels } = job.invoke && job.runsOn === void 0 ? {
+		include: [],
+		exclude: []
+	} : normalizeRunsOnToMatchers(job.runsOn, `generated job '${job.name}' runsOn`);
 	const envRefs = job.contexts ?? (job.context !== void 0 ? [job.context] : void 0);
 	let resolvedContexts;
 	if (envRefs !== void 0 && envRefs.length > 0) {
@@ -4242,7 +5148,7 @@ async function serializeJob(job, generatedNames, ctx, staticNames, allowedGroups
 	return {
 		_type: "static",
 		name: job.name,
-		runsOn,
+		...job.invoke && runsOn.length === 0 ? {} : { runsOn },
 		...excludeLabels.length > 0 ? { excludeLabels } : {},
 		needs: resolvedNeeds,
 		...dependsOnGroups.length > 0 ? { dependsOnGroups } : {},
@@ -4253,7 +5159,13 @@ async function serializeJob(job, generatedNames, ctx, staticNames, allowedGroups
 		...job.description ? { description: job.description } : {},
 		...resolvedContexts !== void 0 ? { contexts: resolvedContexts } : {},
 		...resolvedEnv !== void 0 ? { env: resolvedEnv } : {},
-		...resolvedConcurrencyGroup !== void 0 ? { concurrencyGroup: resolvedConcurrencyGroup } : {}
+		...resolvedConcurrencyGroup !== void 0 ? { concurrencyGroup: resolvedConcurrencyGroup } : {},
+		...job.invoke ? { invoke: {
+			event: job.invoke.event,
+			scope: job.invoke.scope,
+			...job.invoke.payload !== void 0 ? { payload: job.invoke.payload } : {},
+			...job.invoke.optional === true ? { optional: true } : {}
+		} } : {}
 	};
 }
 /**
@@ -4501,6 +5413,7 @@ async function generateDynamicJobs(workflow, shared) {
 		workflowName: workflow.name
 	};
 	const jobs = [];
+	const seenNames = /* @__PURE__ */ new Set();
 	for (const generator of generators) {
 		const generated = await generator(buildGeneratorContext({
 			workflowName: workflow.name,
@@ -4511,7 +5424,7 @@ async function generateDynamicJobs(workflow, shared) {
 			log: shared.log,
 			kici: shared.kici
 		}));
-		jobs.push(...await serializeJobsToLock(generated, serializerCtx));
+		jobs.push(...await serializeJobsToLock(generated, serializerCtx, void 0, void 0, seenNames));
 	}
 	return jobs;
 }
@@ -4591,10 +5504,10 @@ async function evaluateAllCandidates(shared, into, deadline) {
 */
 async function runGlobalEvalRound(args) {
 	const restoreEnv = applyGlobalWorkflowEnv(args.repos);
-	const shared = buildRoundState(args);
 	const settled = [];
 	let stopReason;
 	try {
+		const shared = buildRoundState(args);
 		await withTimeout(() => evaluateAllCandidates(shared, settled, Date.now() + args.roundTimeoutMs), args.roundTimeoutMs, `global eval round (${args.candidates.length} candidate(s))`);
 	} catch (error) {
 		stopReason = error instanceof Error ? error.message : String(error);
@@ -4627,7 +5540,7 @@ var init_global_eval_runner = __esmMin((() => {
 })), DEFAULT_MAX_LOG_SIZE_BYTES, DEFAULT_FLUSH_INTERVAL_MS, DEFAULT_FLUSH_LINE_THRESHOLD, PAUSE_SAFETY_TIMEOUT_MS, LogStreamer;
 var init_log_streamer = __esmMin((() => {
 	init_prometheus();
-	DEFAULT_MAX_LOG_SIZE_BYTES = 10 * 1024 * 1024;
+	DEFAULT_MAX_LOG_SIZE_BYTES = 10485760;
 	DEFAULT_FLUSH_INTERVAL_MS = 100;
 	DEFAULT_FLUSH_LINE_THRESHOLD = 50;
 	PAUSE_SAFETY_TIMEOUT_MS = 3e4;
@@ -4863,6 +5776,136 @@ var init_log_streamer = __esmMin((() => {
 	};
 }));
 //#endregion
+//#region src/execution/image-build/resolve-build-spec.ts
+/**
+* Turn a job's `container.dockerfile` into an absolute, checked build spec.
+*
+* Pure on purpose. Every rule that decides what gets built — the anchoring, the
+* escape refusal, the tag shape — is decided here and unit-tested without a
+* container runtime anywhere near it. The half that needs a host lives in
+* `build-engine.ts`.
+*/
+/**
+* Anchor a repo-relative path under `workDir`, refusing anything that leaves it.
+*
+* The SDK already refused these at workflow-definition time. Refusing them AGAIN
+* here is the point rather than a duplication: a lock file is repo content, so a
+* hand-edited lock could carry `../../etc/shadow` and reach a build context that
+* the author never wrote.
+*/
+function anchor(workDir, p, field) {
+	if (isAbsolute(p)) throw new Error(`container.${field} must stay inside the repository (got: ${p})`);
+	const abs = resolve(workDir, p);
+	const rel = relative(workDir, abs);
+	if (rel.startsWith("..") || isAbsolute(rel)) throw new Error(`container.${field} must stay inside the repository (got: ${p})`);
+	return abs;
+}
+/**
+* Reduce a value to a container-runtime tag component.
+*
+* A job name is author-supplied and may carry spaces, slashes or parentheses,
+* none of which a tag accepts.
+*/
+function tagSafe(value, maxLength) {
+	const slug = value.replace(/[^A-Za-z0-9_.-]/g, "-").replace(/^[-.]+|[-.]+$/g, "");
+	return slug.length > 0 ? slug.slice(0, maxLength) : "job";
+}
+/**
+* Tag for a job's built image: a readable name, made unique by the job id.
+*
+* The job id is what guarantees uniqueness, and it is not decoration. The name
+* alone is truncated to fit a tag, and MATRIX LEGS of one job share a long
+* prefix and differ only in the suffix — `build (os=linux)` and
+* `build (os=darwin)` collide the moment the shared part exceeds the limit.
+* Two legs of one run on one host would then race for one tag, and a leg could
+* run its sibling's image.
+*/
+function buildTagFor(jobName, jobId) {
+	return `kici-build:${tagSafe(jobName, 48)}-${tagSafe(jobId, 12)}`;
+}
+/**
+* Resolve the build spec for a job, or `undefined` when the job builds nothing.
+*
+* `undefined` is the common case and is not a failure: a job with no container,
+* or one that names a finalized image, has nothing to build.
+*/
+function resolveJobImageBuildSpec(args) {
+	const { container, workDir, jobId, jobName } = args;
+	const fileExists = args.fileExists ?? existsSync;
+	if (!container || typeof container === "string") return void 0;
+	const { dockerfile } = container;
+	if (typeof dockerfile !== "string" || dockerfile.length === 0) return void 0;
+	const dockerfilePath = anchor(workDir, dockerfile, "dockerfile");
+	const contextDir = container.context === void 0 ? workDir : anchor(workDir, container.context, "context");
+	if (!fileExists(dockerfilePath)) throw new Error(`container.dockerfile '${dockerfile}' does not exist in the repository (looked at ${dockerfilePath})`);
+	return {
+		dockerfilePath,
+		contextDir,
+		...container.target !== void 0 ? { target: container.target } : {},
+		args: { ...container.args ?? {} },
+		tag: buildTagFor(jobName, jobId),
+		labels: {
+			"kici-managed": "true",
+			"kici-job-id": jobId
+		}
+	};
+}
+var init_resolve_build_spec = __esmMin((() => {}));
+//#endregion
+//#region src/execution/image-build/build-step.ts
+/**
+* Run a job's image build and render it as a step in the run.
+*
+* The build happens on the AGENT, before the sandbox exists, so it cannot use
+* the runner's IPC pseudo-step channel that the cache phase uses — that channel
+* belongs to a process which has not started yet. It uses the agent-side seam
+* the synthetic `build` / `init` / `global-eval` jobs already use: a step-status
+* pair plus a log streamer bound to a step index.
+*/
+/**
+* Build the job's image when it declared a Dockerfile, and return the tag the
+* sandbox should run.
+*
+* Returns `undefined` when there is nothing to build — a job with no container,
+* or one that names a finalized image. That is the common case and emits no
+* step at all: a run timeline should not grow an empty entry for work that did
+* not happen.
+*/
+async function runJobImageBuild(args) {
+	const { container, workDir, jobId, jobName, build, onLog, sendStepStatus } = args;
+	const spec = resolveJobImageBuildSpec({
+		container,
+		workDir,
+		jobId,
+		jobName,
+		...args.fileExists ? { fileExists: args.fileExists } : {}
+	});
+	if (!spec) return void 0;
+	const setup = { stepType: SetupStepType.enum["container:build"] };
+	sendStepStatus(CONTAINER_BUILD_STEP_NAME, ExecutionStepStatus.enum.running, setup);
+	onLog(`Building ${spec.tag} from ${spec.dockerfilePath}`);
+	try {
+		await build(spec, onLog);
+	} catch (err) {
+		const error = toErrorMessage(err);
+		onLog(`Build failed: ${error}`);
+		sendStepStatus(CONTAINER_BUILD_STEP_NAME, ExecutionStepStatus.enum.failed, {
+			...setup,
+			error
+		});
+		throw err;
+	}
+	onLog(`Built ${spec.tag}`);
+	sendStepStatus(CONTAINER_BUILD_STEP_NAME, ExecutionStepStatus.enum.success, setup);
+	return spec.tag;
+}
+var CONTAINER_BUILD_STEP_NAME, CONTAINER_BUILD_STEP_INDEX;
+var init_build_step = __esmMin((() => {
+	init_resolve_build_spec();
+	CONTAINER_BUILD_STEP_NAME = "container:build";
+	CONTAINER_BUILD_STEP_INDEX = 1e6;
+}));
+//#endregion
 //#region src/execution/overlay-applier.ts
 /**
 * Agent-side overlay application.
@@ -4910,7 +5953,7 @@ async function applyOverlay(config) {
 	const { tarballUrl, cliPublicKey, orchestratorPrivateKey, repoDir } = config;
 	const { path: tmpDir, cleanup } = await makeTempDir("overlay");
 	try {
-		logger$7.info("Downloading overlay tarball", { url: tarballUrl.replace(/\?.*$/, "?[redacted]") });
+		logger$8.info("Downloading overlay tarball", { url: tarballUrl.replace(/\?.*$/, "?[redacted]") });
 		let encryptedData;
 		try {
 			encryptedData = await downloadUrl(tarballUrl);
@@ -4918,9 +5961,10 @@ async function applyOverlay(config) {
 			throw new Error(`Overlay download failed from ${tarballUrl.replace(/\?.*$/, "?[redacted]")}: ${toErrorMessage(err)}`);
 		}
 		const cliPubKeyBuf = Buffer.from(cliPublicKey, "base64");
-		const aesKey = deriveSharedSecret(Buffer.from(orchestratorPrivateKey, "base64"), cliPubKeyBuf);
+		const orchPrivKeyBuf = Buffer.from(orchestratorPrivateKey, "base64");
+		const aesKey = deriveSharedSecret(orchPrivKeyBuf, cliPubKeyBuf);
 		const decryptedData = decryptBuffer(encryptedData, aesKey);
-		logger$7.info("Extracting overlay tarball", { size: decryptedData.length });
+		logger$8.info("Extracting overlay tarball", { size: decryptedData.length });
 		const extractDir = path.join(tmpDir, "extracted");
 		await fsPromises.mkdir(extractDir, { recursive: true });
 		try {
@@ -4969,10 +6013,10 @@ async function applyOverlay(config) {
 				await fsPromises.unlink(targetPath);
 				filesDeleted++;
 			} catch {
-				logger$7.debug("Deletion target not found, skipping", { file });
+				logger$8.debug("Deletion target not found, skipping", { file });
 			}
 		}
-		logger$7.info("Overlay applied successfully", {
+		logger$8.info("Overlay applied successfully", {
 			filesApplied,
 			filesDeleted
 		});
@@ -4985,10 +6029,10 @@ async function applyOverlay(config) {
 		await cleanup().catch(() => {});
 	}
 }
-var logger$7, IV_LENGTH$1, AUTH_TAG_LENGTH;
+var logger$8, IV_LENGTH$1, AUTH_TAG_LENGTH;
 var init_overlay_applier = __esmMin((() => {
 	init_download();
-	logger$7 = createLogger({ prefix: "overlay-applier" });
+	logger$8 = createLogger({ prefix: "overlay-applier" });
 	IV_LENGTH$1 = 12;
 	AUTH_TAG_LENGTH = 16;
 }));
@@ -5561,7 +6605,7 @@ async function installDeps(kiciDir, opts = {}) {
 	const repoRoot = opts.repoRoot ?? dirname(kiciDir);
 	const packageManager = await detectKiciPackageManager(repoRoot, kiciDir);
 	const yarnFlavor = packageManager === PackageManager.Yarn ? await detectKiciYarnFlavor(repoRoot, kiciDir) : YarnFlavor.Classic;
-	logger$6.info("Installing deps inline", {
+	logger$7.info("Installing deps inline", {
 		packageManager,
 		yarnFlavor,
 		dir: kiciDir
@@ -5619,7 +6663,7 @@ async function installDeps(kiciDir, opts = {}) {
 	if (packageManager === PackageManager.Yarn) await buildYarnWorkspaceClosure(repoRoot, kiciDir, yarnFlavor);
 	const durationMs = Date.now() - startTime;
 	process.stderr.write(`[dep-installer:trace] install complete: ${durationMs}ms\n`);
-	logger$6.info("Deps installed inline", {
+	logger$7.info("Deps installed inline", {
 		packageManager,
 		durationMs
 	});
@@ -5876,16 +6920,16 @@ function logSubprocessStreams(e, tokens) {
 	if (e && typeof e === "object" && "stdout" in e) process.stderr.write(`[dep-installer:trace] stdout: ${redactNpmOutput(String(e.stdout), tokens).slice(0, 500)}\n`);
 	if (e && typeof e === "object" && "stderr" in e) process.stderr.write(`[dep-installer:trace] stderr: ${redactNpmOutput(String(e.stderr), tokens).slice(0, 500)}\n`);
 }
-var logger$6, execFileAsync, INSTALL_TIMEOUT_MS, INSTALL_MAX_BUFFER;
+var logger$7, execFileAsync, INSTALL_TIMEOUT_MS, INSTALL_MAX_BUFFER;
 var init_dep_installer = __esmMin((() => {
 	init_npm_registry_config();
 	init_yarnrc_berry_config();
 	init_validate_kici_deps();
 	init_workspace_siblings();
-	logger$6 = createLogger({ prefix: "dep-installer" });
+	logger$7 = createLogger({ prefix: "dep-installer" });
 	execFileAsync = promisify(execFile);
 	INSTALL_TIMEOUT_MS = 6e5;
-	INSTALL_MAX_BUFFER = 128 * 1024 * 1024;
+	INSTALL_MAX_BUFFER = 134217728;
 }));
 //#endregion
 //#region src/execution/dep-packer.ts
@@ -5930,7 +6974,7 @@ async function packNodeModules(kiciDir) {
 	const nmRoot = packageManager === PackageManager.Yarn ? resolveYarnNodeModulesRoot(workDir, kiciDir) : join(kiciDir, "node_modules");
 	if (!existsSync(nmRoot)) throw new Error(`node_modules not found at ${nmRoot}`);
 	const entries = await closureEntries(workDir, kiciDir, packageManager);
-	logger$5.info("Packing dependency closure into tarball", {
+	logger$6.info("Packing dependency closure into tarball", {
 		dir: workDir,
 		packageManager,
 		entries
@@ -5945,8 +6989,8 @@ async function packNodeModules(kiciDir) {
 	for await (const chunk of stream) chunks.push(Buffer.from(chunk));
 	const tarball = Buffer.concat(chunks);
 	const hash = sha256(tarball);
-	const sizeMB = (tarball.length / (1024 * 1024)).toFixed(2);
-	logger$5.info("Dependency closure packed", {
+	const sizeMB = (tarball.length / 1048576).toFixed(2);
+	logger$6.info("Dependency closure packed", {
 		sizeMB,
 		hash: hash.slice(0, 12),
 		durationMs: Date.now() - startTime
@@ -5980,10 +7024,10 @@ async function closureEntries(workDir, kiciDir, packageManager) {
 	}
 	return [relative(workDir, join(kiciDir, "node_modules"))];
 }
-var logger$5;
+var logger$6;
 var init_dep_packer = __esmMin((() => {
 	init_workspace_siblings();
-	logger$5 = createLogger({ prefix: "dep-packer" });
+	logger$6 = createLogger({ prefix: "dep-packer" });
 }));
 //#endregion
 //#region src/execution/sandbox/env-sanitizer.ts
@@ -6086,12 +7130,14 @@ function encryptSecretOutputs(outputs, runPublicKeyBase64) {
 		format: "der"
 	});
 	const agentPublicKeyBase64 = Buffer.from(agentPublicKeyDer).toString("base64");
+	const runPublicKeyDer = Buffer.from(runPublicKeyBase64, "base64");
+	const runPublicKey = createPublicKey({
+		key: runPublicKeyDer,
+		format: "der",
+		type: "spki"
+	});
 	const sharedSecret = diffieHellman({
-		publicKey: createPublicKey({
-			key: Buffer.from(runPublicKeyBase64, "base64"),
-			format: "der",
-			type: "spki"
-		}),
+		publicKey: runPublicKey,
 		privateKey: agentPriv
 	});
 	const aesKey = Buffer.from(hkdfSync("sha256", sharedSecret, Buffer.alloc(0), HKDF_INFO, 32));
@@ -6128,13 +7174,43 @@ var init_secret_encryption = __esmMin((() => {
 * logic to avoid duplication.
 */
 /**
+* Best-effort SIGKILL/SIGTERM of an entire process group led by `pid`.
+* `process.kill(-pid, signal)` targets the group whose leader is `pid` (the
+* child was spawned `detached`, so its pid is its group id). Returns 1 when the
+* group was signalled, 0 when it was already gone (ESRCH) or the pid is invalid.
+* We cannot cheaply count members, so the caller treats a non-zero return as
+* "reap attempted".
+*/
+function killProcessGroup(pid, signal) {
+	if (pid === void 0 || !Number.isInteger(pid) || pid <= 1) return 0;
+	try {
+		process.kill(-pid, signal);
+		return 1;
+	} catch {
+		return 0;
+	}
+}
+/**
+* SIGTERM the job's process group, wait a short grace, then SIGKILL. No-op
+* (returns 0) when the child was not spawned detached or has no pid. Returns the
+* count of reap attempts that signalled a live group (0, 1, or 2).
+*/
+async function reapGroup(pid, detached, killFn = killProcessGroup, sleepMs = 2e3) {
+	if (!detached || pid === void 0) return 0;
+	const termed = killFn(pid, "SIGTERM");
+	if (termed === 0) return 0;
+	await new Promise((r) => setTimeout(r, sleepMs));
+	return termed + killFn(pid, "SIGKILL");
+}
+/**
 * Build a JobExecutionRequest from a JobDispatch.
 *
 * Maps orchestrator dispatch fields to the subset needed by the workflow runner.
 */
-function buildRequest(dispatch, workDir) {
+function buildRequest(dispatch, workDir, extra) {
 	const jobConfig = dispatch.jobConfig;
 	return {
+		...extra?.cleanupOnly ? { cleanupOnly: true } : {},
 		runId: dispatch.runId,
 		jobId: dispatch.jobId,
 		workDir,
@@ -6144,6 +7220,7 @@ function buildRequest(dispatch, workDir) {
 		token: dispatch.token,
 		sourceAuth: dispatch.sourceAuth,
 		workflowAuth: dispatch.workflowAuth,
+		...extra?.credentialHelperPath ? { credentialHelperPath: extra.credentialHelperPath } : {},
 		sourceTarUrl: dispatch.sourceTarUrl,
 		sourceTarHash: dispatch.sourceTarHash,
 		depsUrl: dispatch.depsUrl,
@@ -6190,6 +7267,7 @@ function buildRequest(dispatch, workDir) {
 		upstreamJobOutputs: dispatch.upstreamJobOutputs,
 		upstreamJobStatuses: dispatch.upstreamJobStatuses,
 		jobNeeds: jobConfig.needs,
+		upstreamInvokeResults: dispatch.upstreamInvokeResults,
 		npmRegistries: dispatch.npmRegistries,
 		installEnvSecrets: dispatch.installEnvSecrets,
 		jobIdShort: dispatch.jobId.slice(0, 8),
@@ -6328,20 +7406,22 @@ function fileCloneSourceBinds(repoUrl) {
 function spawnRunnerChild(options, sanitizedEnv, effectiveWorkDir) {
 	const { runnerPath, useBwrap = false, networkIsolation = false, extraReadOnlyBinds = [] } = options;
 	let child;
-	if (useBwrap) child = spawn("bwrap", [
-		...buildBwrapArgs(effectiveWorkDir, process.execPath, networkIsolation, runnerPath, extraReadOnlyBinds),
-		process.execPath,
-		runnerPath
-	], {
-		env: sanitizedEnv,
-		stdio: [
-			"pipe",
-			"pipe",
-			"pipe",
-			"ipc"
-		]
-	});
-	else child = fork(runnerPath, [], {
+	if (useBwrap) {
+		const bwrapArgs = buildBwrapArgs(effectiveWorkDir, process.execPath, networkIsolation, runnerPath, extraReadOnlyBinds);
+		child = spawn("bwrap", [
+			...bwrapArgs,
+			process.execPath,
+			runnerPath
+		], {
+			env: sanitizedEnv,
+			stdio: [
+				"pipe",
+				"pipe",
+				"pipe",
+				"ipc"
+			]
+		});
+	} else child = fork(runnerPath, [], {
 		env: sanitizedEnv,
 		stdio: [
 			"pipe",
@@ -6349,7 +7429,8 @@ function spawnRunnerChild(options, sanitizedEnv, effectiveWorkDir) {
 			"pipe",
 			"ipc"
 		],
-		cwd: effectiveWorkDir || void 0
+		cwd: effectiveWorkDir || void 0,
+		detached: options.detachProcessGroup === true
 	});
 	return {
 		child,
@@ -6450,6 +7531,24 @@ function relayCacheRequest$1(msg, ctx) {
 		error: toErrorMessage(err)
 	}));
 }
+/** Relay `git.grant.request` to the agent's grant table and pipe the response
+*  (or an error response, or a "not configured" response when the callback
+*  isn't wired) back into the sandbox runner. */
+function relayGitGrantRequest$1(msg, ctx) {
+	if (!ctx.execOptions.onGitGrantRequest) {
+		safeSendToChild(ctx.child, {
+			type: "git.grant.response",
+			requestId: msg.requestId,
+			error: "Git credentials are not available in this agent configuration"
+		});
+		return;
+	}
+	ctx.execOptions.onGitGrantRequest(msg).then((response) => safeSendToChild(ctx.child, response), (err) => safeSendToChild(ctx.child, {
+		type: "git.grant.response",
+		requestId: msg.requestId,
+		error: toErrorMessage(err)
+	}));
+}
 /** Relay `provenance.request` and pipe the orchestrator response (or an error
 *  response, or a "not configured" response when the callback isn't wired) back
 *  into the sandbox runner. */
@@ -6536,7 +7635,10 @@ function relayChildIpcMessage(msg, dispatch, ctx) {
 		case "ready":
 			safeSendToChild(ctx.child, {
 				type: "execute",
-				request: buildRequest(dispatch, ctx.effectiveWorkDir)
+				request: buildRequest(dispatch, ctx.effectiveWorkDir, {
+					cleanupOnly: ctx.cleanupOnly,
+					credentialHelperPath: ctx.execOptions.credentialHelperPath
+				})
 			});
 			return;
 		case "log.line":
@@ -6585,6 +7687,9 @@ function relayChildIpcMessage(msg, dispatch, ctx) {
 		case "agent.api.request":
 			relayAgentApiRequest(msg, ctx);
 			return;
+		case "git.grant.request":
+			relayGitGrantRequest$1(msg, ctx);
+			return;
 		case "cache.request":
 			relayCacheRequest$1(msg, ctx);
 			return;
@@ -6597,6 +7702,12 @@ function relayChildIpcMessage(msg, dispatch, ctx) {
 		case "approval.request":
 			relayApprovalRequest$1(msg, ctx);
 			return;
+		case "hooks-declared":
+			ctx.state.declaresCleanup = msg.declaresCleanup;
+			return;
+		case "completion-hooks-done":
+			ctx.state.completionHooksRan = true;
+			return;
 		case "job.complete":
 			handleJobComplete(msg, dispatch, ctx);
 			return;
@@ -6624,7 +7735,7 @@ function handleChildExitWithoutCompletion(code, signal, ctx) {
 /** Build the cancel function (state machine: running → cancelling →
 *  force_killing). The caller is responsible for surfacing it to the
 *  ForkRunnerHandle via the closure. */
-function buildCancelFn(child, ctx, defaultGracePeriodMs, agentMaxGracePeriodMs) {
+function buildCancelFn(child, ctx, defaultGracePeriodMs, agentMaxGracePeriodMs, detached) {
 	const doForceCancel = () => {
 		ctx.state.forkState = "force_killing";
 		safeSendToChild(child, {
@@ -6634,6 +7745,7 @@ function buildCancelFn(child, ctx, defaultGracePeriodMs, agentMaxGracePeriodMs)
 		try {
 			child.kill("SIGKILL");
 		} catch {}
+		if (detached) killProcessGroup(child.pid, "SIGKILL");
 		clearAllCancelTimers(ctx);
 	};
 	return (force, gracePeriodMs) => {
@@ -6686,16 +7798,23 @@ function createForkRunner(options, execOptions) {
 			}),
 			abort: async () => {},
 			kill: noopFn,
-			cancel: noopFn
+			cancel: noopFn,
+			detached: false,
+			completionHooksRan: false,
+			declaresCleanup: false,
+			reap: async () => 0
 		};
 	}
 	const stderrLines = setupChildStdioCapture(child);
 	const defaultGracePeriodMs = 3e4;
 	const agentMaxGracePeriodMs = options.maxGracePeriodMs ?? defaultGracePeriodMs;
 	const cancelTimers = [];
+	const detached = options.detachProcessGroup === true;
 	const sharedState = {
 		forkState: "running",
-		jobCompleted: false
+		jobCompleted: false,
+		completionHooksRan: false,
+		declaresCleanup: false
 	};
 	let cancelFn = () => {};
 	const result = new Promise((resolve) => {
@@ -6708,10 +7827,11 @@ function createForkRunner(options, execOptions) {
 			resolve,
 			cancelTimers,
 			state: sharedState,
-			stderrLines
+			stderrLines,
+			cleanupOnly: options.cleanupOnly === true
 		};
 		process.stderr.write(`[fork-runner] Child process spawned: pid=${child.pid}, runner=${options.runnerPath}, cwd=${effectiveWorkDir}\n`);
-		cancelFn = buildCancelFn(child, ctx, defaultGracePeriodMs, agentMaxGracePeriodMs);
+		cancelFn = buildCancelFn(child, ctx, defaultGracePeriodMs, agentMaxGracePeriodMs, detached);
 		child.on("message", (msg) => relayChildIpcMessage(msg, dispatch, ctx));
 		child.on("exit", (code, signal) => handleChildExitWithoutCompletion(code, signal, ctx));
 		child.on("error", (err) => {
@@ -6742,7 +7862,15 @@ function createForkRunner(options, execOptions) {
 			for (const timer of cancelTimers) clearTimeout(timer);
 			cancelTimers.length = 0;
 		},
-		cancel: (force, gracePeriodMs) => cancelFn(force, gracePeriodMs)
+		cancel: (force, gracePeriodMs) => cancelFn(force, gracePeriodMs),
+		detached,
+		get completionHooksRan() {
+			return sharedState.completionHooksRan;
+		},
+		get declaresCleanup() {
+			return sharedState.declaresCleanup;
+		},
+		reap: () => reapGroup(child.pid, detached)
 	};
 }
 var init_fork_runner = __esmMin((() => {
@@ -6767,22 +7895,25 @@ var init_fork_runner = __esmMin((() => {
 * network access. This mode provides credential isolation only and should
 * be used in trusted environments.
 */
-var logger$4, BareMetalSandbox;
+var logger$5, BareMetalSandbox;
 var init_bare_metal_sandbox = __esmMin((() => {
 	init_fork_runner();
-	logger$4 = createLogger({ prefix: "bare-metal-sandbox" });
+	logger$5 = createLogger({ prefix: "bare-metal-sandbox" });
 	BareMetalSandbox = class {
 		runnerPath;
 		useBwrap;
 		sandboxNetwork;
 		env;
+		orphanCleanup;
 		runner = null;
 		workDir;
+		lastOptions = null;
 		constructor(options) {
 			this.runnerPath = options.runnerPath;
 			this.useBwrap = options.sandbox;
 			this.sandboxNetwork = options.sandboxNetwork ?? "isolated";
 			this.env = options.env;
+			this.orphanCleanup = options.orphanCleanup ?? true;
 		}
 		/**
 		* Validate that the runner path exists and bwrap is available (if needed).
@@ -6797,25 +7928,27 @@ var init_bare_metal_sandbox = __esmMin((() => {
 			if (this.useBwrap) try {
 				const { execSync } = await import("node:child_process");
 				execSync("which bwrap", { stdio: "ignore" });
-				if (this.sandboxNetwork === "isolated") logger$4.info("Bubblewrap (bwrap) sandbox enabled with network isolation (--unshare-net)");
-				else logger$4.info("Bubblewrap (bwrap) sandbox enabled with host network (KICI_SANDBOX_NETWORK=host)");
+				if (this.sandboxNetwork === "isolated") logger$5.info("Bubblewrap (bwrap) sandbox enabled with network isolation (--unshare-net)");
+				else logger$5.info("Bubblewrap (bwrap) sandbox enabled with host network (KICI_SANDBOX_NETWORK=host)");
 			} catch {
 				throw new Error("Bubblewrap (bwrap) not found. Install bubblewrap or set sandbox=false. On Debian/Ubuntu: apt install bubblewrap");
 			}
-			else logger$4.warn("Bare-metal without sandbox provides limited isolation. Only environment sanitization is active. Enable sandbox=true with bubblewrap for PID/IPC/filesystem namespace isolation.");
+			else logger$5.warn("Bare-metal without sandbox provides limited isolation. Only environment sanitization is active. Enable sandbox=true with bubblewrap for PID/IPC/filesystem namespace isolation.");
 		}
 		/**
 		* Execute a job by forking the workflow runner with sanitized environment.
 		*/
 		async executeJob(options) {
 			const extraReadOnlyBinds = this.useBwrap ? fileCloneSourceBinds(options.dispatch.repoUrl) : [];
+			this.lastOptions = options;
 			this.runner = createForkRunner({
 				runnerPath: this.runnerPath,
 				env: this.env,
 				useBwrap: this.useBwrap,
 				workDir: this.workDir,
 				networkIsolation: this.useBwrap && this.sandboxNetwork === "isolated",
-				extraReadOnlyBinds
+				extraReadOnlyBinds,
+				detachProcessGroup: this.orphanCleanup && !this.useBwrap
 			}, options);
 			return this.runner.result;
 		}
@@ -6828,13 +7961,53 @@ var init_bare_metal_sandbox = __esmMin((() => {
 			if (this.runner) await this.runner.abort();
 		}
 		/**
-		* Clean up the child process if still running.
+		* Clean up the child process if still running. The handle reference is kept
+		* (not nulled) so the between-jobs phase can still read `completionHooksRan` /
+		* `declaresCleanup` and reap the process group after teardown — the group
+		* survives the single child's death. The next `executeJob` overwrites it.
 		*/
 		async teardown() {
-			if (this.runner) {
-				this.runner.kill();
-				this.runner = null;
-			}
+			if (this.runner) this.runner.kill();
+		}
+		/** Whether the runner signalled its completion hooks ran. */
+		get completionHooksRan() {
+			return this.runner?.completionHooksRan ?? true;
+		}
+		/** Whether the job declared an onFailure / cleanup hook. */
+		get declaresCleanup() {
+			return this.runner?.declaresCleanup ?? false;
+		}
+		/** Reap the finished job's process group. */
+		async reap() {
+			return this.runner?.reap() ?? 0;
+		}
+		/**
+		* Re-run the finished job's declared cleanup / onFailure hooks against the
+		* preserved workdir, in a fresh cleanup-only child. Reuses the last job's
+		* dispatch + orchestrator relays but suppresses step/log callbacks (the
+		* original job already reported and its log streamers are gone). Rejects when
+		* the cleanup-only child fails so the caller can time it out.
+		*/
+		async runCleanupOnly(workDir, signal) {
+			const opts = this.lastOptions;
+			if (!opts) return;
+			const handle = createForkRunner({
+				runnerPath: this.runnerPath,
+				env: this.env,
+				useBwrap: this.useBwrap,
+				workDir,
+				networkIsolation: this.useBwrap && this.sandboxNetwork === "isolated",
+				cleanupOnly: true,
+				maxGracePeriodMs: 5e3
+			}, {
+				...opts,
+				signal,
+				onStepStatus: () => {},
+				onLogLine: () => {}
+			});
+			const result = await handle.result;
+			handle.kill();
+			if (result.status !== ExecutionJobStatus.enum.success) throw new Error(result.error ?? `cleanup-only re-run did not succeed (${result.status})`);
 		}
 	};
 }));
@@ -6895,6 +8068,77 @@ var init_firecracker_sandbox = __esmMin((() => {
 	};
 }));
 //#endregion
+//#region src/execution/sandbox/kici-runtime.ts
+/**
+* Launch the runner with the injected node, never the image's own.
+*
+* The customer image is not required to ship Node, so a bare `node` would
+* resolve to nothing (or, worse, to an unrelated build).
+*/
+function runnerLaunchArgv(runnerMountPath) {
+	return [KICI_RUNTIME_NODE, runnerMountPath];
+}
+var KICI_RUNTIME_MOUNT, KICI_RUNTIME_NODE_DIR, KICI_RUNTIME_NODE;
+var init_kici_runtime = __esmMin((() => {
+	KICI_RUNTIME_MOUNT = "/opt/kici";
+	KICI_RUNTIME_NODE_DIR = `${KICI_RUNTIME_MOUNT}/node`;
+	KICI_RUNTIME_NODE = `${KICI_RUNTIME_NODE_DIR}/bin/node`;
+}));
+//#endregion
+//#region src/execution/sandbox/image-preflight.ts
+/**
+* Classify an image from the subset of {@link PROBE_PATHS} that exist in it.
+*
+* Pure, so the decision table is testable without a container runtime.
+*/
+function classifyImageLibc(presentPaths) {
+	const present = new Set(presentPaths);
+	const hasMusl = MUSL_LOADERS.some((p) => present.has(p));
+	const hasGlibc = GLIBC_LOADERS.some((p) => present.has(p));
+	if (hasMusl) return "musl";
+	if (!hasGlibc) return "static";
+	return present.has(SHELL) ? "glibc" : "no-shell";
+}
+function rejection(image, libc) {
+	switch (libc) {
+		case "musl": return `image '${image}' uses musl libc; the musl runtime variant is not enabled (glibc images only in this version). Use a glibc image — for example the '-slim' rather than the '-alpine' tag.`;
+		case "static": return `image '${image}' has no dynamic loader; container jobs require a glibc image with ${SHELL}.`;
+		case "no-shell": return `image '${image}' has no ${SHELL}; container jobs require a shell for step commands.`;
+	}
+}
+/**
+* Throw unless `image` can host the injected runtime.
+*
+* Stats the probe paths through a created-but-never-started container, so a
+* shell-less or musl image is diagnosed without executing anything in it —
+* running a probe command would fail for the very reason we are testing for.
+*/
+async function assertImageRunnable(docker, image) {
+	const container = await docker.createContainer({ Image: image });
+	try {
+		const present = [];
+		for (const path of PROBE_PATHS) try {
+			await container.infoArchive({ path });
+			present.push(path);
+		} catch {}
+		const libc = classifyImageLibc(present);
+		if (libc !== "glibc") throw new Error(rejection(image, libc));
+	} finally {
+		await container.remove({ force: true }).catch(() => void 0);
+	}
+}
+var MUSL_LOADERS, GLIBC_LOADERS, SHELL, PROBE_PATHS;
+var init_image_preflight = __esmMin((() => {
+	MUSL_LOADERS = ["/lib/ld-musl-x86_64.so.1", "/lib/ld-musl-aarch64.so.1"];
+	GLIBC_LOADERS = ["/lib64/ld-linux-x86-64.so.2", "/lib/ld-linux-aarch64.so.1"];
+	SHELL = "/bin/sh";
+	PROBE_PATHS = [
+		...GLIBC_LOADERS,
+		...MUSL_LOADERS,
+		SHELL
+	];
+}));
+//#endregion
 //#region src/execution/sandbox/container-hardening.ts
 /**
 * Build the hardened HostConfig fragment for a job sandbox container.
@@ -6947,8 +8191,11 @@ var init_container_hardening = __esmMin((() => {
 * - Agent-internal credentials (KICI_*, KICI_DATABASE_URL, etc.) NEVER enter the container
 * - IPC uses demuxed Docker stream with JSON-line parsing on stdout
 *
-* The container image MUST have Node.js installed (a kici/runner base image
-* is deferred -- for now this is a documented requirement).
+* The container image does NOT need Node.js or git. KiCI provisions its own
+* runtime — a pinned, official glibc-2.17 Node plus the runner bundle, mounted
+* read-only at /opt/kici — and launches the runner with THAT node. The image
+* needs only a glibc and a shell, which the preflight asserts before the
+* container is created.
 */
 /**
 * Relay event.emit from the container runner to the orchestrator via
@@ -7048,6 +8295,30 @@ function relayCacheRequest(stream, options, cacheMsg) {
 	}));
 }
 /**
+* Relay git.grant.request from the container runner to the agent's grant table
+* via options.onGitGrantRequest, then write the response back through `stream`.
+*/
+function relayGitGrantRequest(stream, options, grantMsg) {
+	const writeResponse = (response) => {
+		try {
+			stream.write(JSON.stringify(response) + "\n");
+		} catch {}
+	};
+	if (!options.onGitGrantRequest) {
+		writeResponse({
+			type: "git.grant.response",
+			requestId: grantMsg.requestId,
+			error: "Git credentials are not available in this agent configuration"
+		});
+		return;
+	}
+	options.onGitGrantRequest(grantMsg).then((response) => writeResponse(response), (err) => writeResponse({
+		type: "git.grant.response",
+		requestId: grantMsg.requestId,
+		error: toErrorMessage(err)
+	}));
+}
+/**
 * Relay provenance.request from the container runner to the orchestrator via
 * options.onProvenanceRequest, then write the response back through `stream`.
 * If the agent doesn't expose a provenance relay, write a structured error so
@@ -7140,15 +8411,17 @@ function applyJobComplete(msg, stepResults, state, options) {
 	if (msg.secretOutputs && options.dispatch.runPublicKey) try {
 		state.encryptedSecretOutputs = encryptSecretOutputs(msg.secretOutputs, options.dispatch.runPublicKey);
 	} catch (err) {
-		logger$3.warn("Failed to encrypt secret outputs", { error: toErrorMessage(err) });
+		logger$4.warn("Failed to encrypt secret outputs", { error: toErrorMessage(err) });
 	}
 }
-var logger$3, MAX_STDERR_LINES, ABORT_GRACE_MS, CONTAINER_STOP_TIMEOUT, HOOK_MOUNT_PATH, INTERNAL_ENV, ContainerSandbox;
+var logger$4, MAX_STDERR_LINES, ABORT_GRACE_MS, CONTAINER_STOP_TIMEOUT, HOOK_MOUNT_PATH, INTERNAL_ENV, ContainerSandbox;
 var init_container_sandbox = __esmMin((() => {
 	init_fork_runner();
+	init_kici_runtime();
+	init_image_preflight();
 	init_secret_encryption();
 	init_container_hardening();
-	logger$3 = createLogger({ prefix: "container-sandbox" });
+	logger$4 = createLogger({ prefix: "container-sandbox" });
 	MAX_STDERR_LINES = 20;
 	ABORT_GRACE_MS = 1e4;
 	CONTAINER_STOP_TIMEOUT = 10;
@@ -7158,6 +8431,17 @@ var init_container_sandbox = __esmMin((() => {
 		docker;
 		image;
 		runnerPath;
+		runtimeNodePath;
+		runtimeImage;
+		buildTag;
+		/**
+		* The runtime actually injected into this job's container — the configured
+		* path, or the volume materialized during setup. Resolved once in setup()
+		* because materialization needs the container runtime, and read by both the
+		* bind list and the runner launch.
+		*/
+		resolvedRuntimeNode;
+		registryAuth;
 		runnerMountPath;
 		/** Host path to the pure-JS container loader-hook bundle (bind-mounted :ro). */
 		hookHostPath;
@@ -7179,6 +8463,10 @@ var init_container_sandbox = __esmMin((() => {
 			this.docker = options.docker;
 			this.image = options.image;
 			this.runnerPath = options.runnerPath;
+			this.runtimeNodePath = options.runtimeNodePath;
+			this.runtimeImage = options.runtimeImage;
+			this.buildTag = options.buildTag;
+			this.registryAuth = options.registryAuth;
 			this.runnerMountPath = options.runnerMountPath ?? "/opt/kici/workflow-runner.js";
 			this.hookHostPath = options.hookPath ?? join(dirname(options.runnerPath), "container-ts-loader-hook.js");
 			this.env = options.env;
@@ -7202,17 +8490,44 @@ var init_container_sandbox = __esmMin((() => {
 				await this.docker.getImage(this.image).inspect();
 				return;
 			} catch {}
-			logger$3.info("Pulling sandbox image (not present locally)", { image: this.image });
-			const stream = await this.docker.pull(this.image);
+			logger$4.info("Pulling sandbox image (not present locally)", {
+				image: this.image,
+				authenticated: this.registryAuth !== void 0
+			});
+			const stream = await this.docker.pull(this.image, this.registryAuth ? { authconfig: this.registryAuth } : {});
 			await new Promise((resolve, reject) => {
 				this.docker.modem.followProgress(stream, (err) => err ? reject(err) : resolve());
 			});
-			logger$3.info("Sandbox image pulled", { image: this.image });
+			logger$4.info("Sandbox image pulled", { image: this.image });
+		}
+		/**
+		* Resolve the Node tree to inject into the job container, materializing it
+		* when only an image was configured.
+		*
+		* A configured path wins: a caller that already provisioned the tree should
+		* not pay a copy to arrive at the same one. Returning `undefined` is a real
+		* outcome, not a failure — an agent with no runtime source runs the job on
+		* the image's own `node`, which is what a `node:*` image was always doing.
+		*
+		* A materialization that FAILS is not softened into that outcome. Continuing
+		* would start the job against an image the operator never claimed ships Node,
+		* and the resulting "node: not found" says nothing about the runtime that was
+		* supposed to be there.
+		*/
+		async resolveRuntimeNode() {
+			if (this.runtimeNodePath) return this.runtimeNodePath;
+			if (!this.runtimeImage) return void 0;
+			return await ensureRuntimeVolume({
+				docker: this.docker,
+				agentImage: this.runtimeImage,
+				subtree: RuntimeSubtree.enum.node,
+				onProgress: (message) => logger$4.info(message, { jobId: this.jobId })
+			});
 		}
 		async setup(options) {
 			this.containerName = `kici-sandbox-${this.jobId}-${Date.now()}`;
 			const envArray = [...Object.entries(this.env).map(([k, v]) => `${k}=${v}`), ...INTERNAL_ENV];
-			logger$3.info("Creating sandbox container", {
+			logger$4.info("Creating sandbox container", {
 				name: this.containerName,
 				image: this.image,
 				workDir: options.workDir
@@ -7222,8 +8537,10 @@ var init_container_sandbox = __esmMin((() => {
 				user: void 0
 			};
 			this.resolvedUser = hardened.user;
+			this.resolvedRuntimeNode = await this.resolveRuntimeNode();
 			const binds = this.buildBinds(options, hardened.hostConfig);
 			await this.ensureImagePresent();
+			if (this.resolvedRuntimeNode) await assertImageRunnable(this.docker, this.image);
 			this.container = await this.docker.createContainer({
 				Image: this.image,
 				name: this.containerName,
@@ -7242,10 +8559,42 @@ var init_container_sandbox = __esmMin((() => {
 				}
 			});
 			await this.container.start();
-			logger$3.info("Sandbox container started", {
+			logger$4.info("Sandbox container started", {
 				name: this.containerName,
 				containerId: this.container.id.slice(0, 12)
 			});
+			if (options.workspaceFromHost) await this.copyWorkspaceIn(options.workDir);
+		}
+		/**
+		* Populate the container's `/workspace` volume from the host working tree.
+		*
+		* `/workspace` is a container-owned anonymous volume rather than a host bind,
+		* which is what dissolves the host-uid vs container-uid conflict once
+		* `CapDrop: ['ALL']` removes CAP_DAC_OVERRIDE — so the tree is streamed in as
+		* a tar rather than mounted.
+		*
+		* A failure here is fatal on purpose. Swallowing it would start the job
+		* against an EMPTY workspace, which surfaces as a baffling "file not found"
+		* in whichever step happens to touch the repo first.
+		*/
+		async copyWorkspaceIn(workDir) {
+			const started = Date.now();
+			try {
+				const stream = c({
+					cwd: workDir,
+					portable: true
+				}, ["."]);
+				const streamFailed = new Promise((_, reject) => {
+					stream.on("error", reject);
+				});
+				await Promise.race([this.container.putArchive(stream, { path: "/workspace" }), streamFailed]);
+			} catch (err) {
+				throw new Error(`Failed to copy the host workspace into the sandbox container: ${err instanceof Error ? err.message : String(err)}`);
+			}
+			logger$4.info("Copied host workspace into sandbox", {
+				name: this.containerName,
+				durationMs: Date.now() - started
+			});
 		}
 		/**
 		* Build the container's read-only bind list.
@@ -7271,6 +8620,7 @@ var init_container_sandbox = __esmMin((() => {
 		*/
 		buildBinds(options, hostConfig) {
 			const binds = [`${this.runnerPath}:${this.runnerMountPath}:ro`, `${this.hookHostPath}:${HOOK_MOUNT_PATH}:ro`];
+			if (this.resolvedRuntimeNode) binds.push(`${this.resolvedRuntimeNode}:${KICI_RUNTIME_NODE_DIR}:ro`);
 			for (const dir of options.extraReadOnlyBinds ?? []) if (dir) binds.push(`${dir}:${dir}:ro`);
 			if (hostConfig.NetworkMode === "host") {
 				for (const nssFile of ["/etc/hosts", "/etc/nsswitch.conf"]) if (existsSync(nssFile)) binds.push(`${nssFile}:${nssFile}:ro`);
@@ -7285,7 +8635,7 @@ var init_container_sandbox = __esmMin((() => {
 			try {
 				outcome = await this.awaitJobCompletion(streamCtx, options);
 			} catch (err) {
-				logger$3.error("Job execution error", {
+				logger$4.error("Job execution error", {
 					error: toErrorMessage(err),
 					stderrTail: streamCtx.stderrLines.slice(-5).join("\n")
 				});
@@ -7310,7 +8660,7 @@ var init_container_sandbox = __esmMin((() => {
 		async attachExecStream(options) {
 			const execEnv = [...Object.entries(this.env).map(([k, v]) => `${k}=${v}`), ...INTERNAL_ENV];
 			const stream = await (await this.container.exec({
-				Cmd: ["node", this.runnerMountPath],
+				Cmd: this.resolvedRuntimeNode ? runnerLaunchArgv(this.runnerMountPath) : ["node", this.runnerMountPath],
 				AttachStdin: true,
 				AttachStdout: true,
 				AttachStderr: true,
@@ -7336,7 +8686,7 @@ var init_container_sandbox = __esmMin((() => {
 			});
 			const abortHandler = () => {
 				this.handleAbort().catch((err) => {
-					logger$3.warn("Error during abort", { error: toErrorMessage(err) });
+					logger$4.warn("Error during abort", { error: toErrorMessage(err) });
 				});
 			};
 			options.signal.addEventListener("abort", abortHandler, { once: true });
@@ -7373,7 +8723,7 @@ var init_container_sandbox = __esmMin((() => {
 					try {
 						msg = JSON.parse(line);
 					} catch {
-						logger$3.warn("Non-JSON output from runner", { line: line.slice(0, 200) });
+						logger$4.warn("Non-JSON output from runner", { line: line.slice(0, 200) });
 						return;
 					}
 					if (this.dispatchRunnerMessage(msg, stream, options, stepNames, stepResults, state)) resolve({
@@ -7467,6 +8817,9 @@ var init_container_sandbox = __esmMin((() => {
 				case "agent.api.request":
 					relayApiRequest(stream, options, msg);
 					return false;
+				case "git.grant.request":
+					relayGitGrantRequest(stream, options, msg);
+					return false;
 				case "cache.request":
 					relayCacheRequest(stream, options, msg);
 					return false;
@@ -7482,8 +8835,10 @@ var init_container_sandbox = __esmMin((() => {
 				case "job.complete":
 					applyJobComplete(msg, stepResults, state, options);
 					return true;
+				case "hooks-declared":
+				case "completion-hooks-done": return false;
 				default:
-					logger$3.warn("Unrecognized IPC message from container runner", { type: msg.type });
+					logger$4.warn("Unrecognized IPC message from container runner", { type: msg.type });
 					return false;
 			}
 		}
@@ -7507,17 +8862,33 @@ var init_container_sandbox = __esmMin((() => {
 		async abort() {
 			await this.handleAbort();
 		}
+		/**
+		* Drop the tag a `container.dockerfile` build produced.
+		*
+		* Best-effort: teardown must not fail a job that already finished. The LAYER
+		* cache — the thing that makes the next build fast — is not a tag and is
+		* untouched by this.
+		*/
+		async reclaimBuiltImage() {
+			if (!this.buildTag) return;
+			try {
+				await this.docker.getImage(this.buildTag).remove({ force: true });
+			} catch {}
+		}
 		async teardown() {
-			if (!this.container) return;
+			if (!this.container) {
+				await this.reclaimBuiltImage();
+				return;
+			}
 			if (this.keepFailed && this.jobFailed) {
-				logger$3.info("Keeping failed container for debugging", {
+				logger$4.info("Keeping failed container for debugging", {
 					name: this.containerName,
 					containerId: this.container.id.slice(0, 12)
 				});
 				this.container = null;
 				return;
 			}
-			logger$3.info("Tearing down sandbox container", { name: this.containerName });
+			logger$4.info("Tearing down sandbox container", { name: this.containerName });
 			try {
 				await this.container.stop({ t: CONTAINER_STOP_TIMEOUT });
 			} catch {}
@@ -7527,6 +8898,7 @@ var init_container_sandbox = __esmMin((() => {
 					v: true
 				});
 			} catch {}
+			await this.reclaimBuiltImage();
 			this.container = null;
 		}
 		/**
@@ -7551,7 +8923,7 @@ var init_container_sandbox = __esmMin((() => {
 		*/
 		async handleAbort() {
 			if (!this.execStream && !this.container) return;
-			logger$3.info("Aborting sandbox execution", { name: this.containerName });
+			logger$4.info("Aborting sandbox execution", { name: this.containerName });
 			if (this.execStream) try {
 				this.execStream.write(JSON.stringify({ type: "abort" }) + "\n");
 			} catch {}
@@ -7823,6 +9195,7 @@ function resolveRunnerBundlePath(runnerPath) {
 * 4. Default -> 'bare-metal'
 */
 function determineExecutionMode(jobConfig, agentConfig) {
+	if (agentConfig.jobImageAgent) return "bare-metal";
 	if (jobConfig.container) return "container";
 	if (agentConfig.executionMode) return agentConfig.executionMode;
 	if (agentConfig.scalerManaged) return "firecracker";
@@ -7863,9 +9236,11 @@ async function resolveJobWorkDir(inPlace, repoUrl) {
 		inPlace: false
 	};
 }
-var logger$2, DEFAULT_GLOBAL_EVAL_ROUND_TIMEOUT_MS, DEFAULT_GLOBAL_EVAL_CANDIDATE_TIMEOUT_MS, FILTER_SOURCE_DIRNAME, JobRunner$1;
+var logger$3, DEFAULT_GLOBAL_EVAL_ROUND_TIMEOUT_MS, DEFAULT_GLOBAL_EVAL_CANDIDATE_TIMEOUT_MS, FILTER_SOURCE_DIRNAME, JobRunner$1;
 var init_job_runner = __esmMin((() => {
 	init_git_clone();
+	init_clone_job_repos();
+	init_job_git_credentials();
 	init_changed_files();
 	init_workflow_loader();
 	init_source_packer();
@@ -7882,6 +9257,8 @@ var init_job_runner = __esmMin((() => {
 	init_global_workflow_env();
 	init_global_eval_runner();
 	init_log_streamer();
+	init_build_step();
+	init_build_engine();
 	init_overlay_applier();
 	init_dep_installer();
 	init_dep_restore();
@@ -7889,7 +9266,7 @@ var init_job_runner = __esmMin((() => {
 	init_download();
 	init_sandbox();
 	init_prometheus();
-	logger$2 = createLogger({ prefix: "job-runner" });
+	logger$3 = createLogger({ prefix: "job-runner" });
 	DEFAULT_GLOBAL_EVAL_ROUND_TIMEOUT_MS = 12e4;
 	DEFAULT_GLOBAL_EVAL_CANDIDATE_TIMEOUT_MS = 2e4;
 	FILTER_SOURCE_DIRNAME = "__kici_filter_source__";
@@ -7905,6 +9282,8 @@ var init_job_runner = __esmMin((() => {
 		_sendRunEvent;
 		_sendConcurrencyReport;
 		_sendApiRequest;
+		/** Live git credentials per job, so the sandbox can reach the grant table. */
+		jobGitCredentials = /* @__PURE__ */ new Map();
 		_requestUserCache;
 		_relayProvenance;
 		_requestUserArtifact;
@@ -7913,9 +9292,19 @@ var init_job_runner = __esmMin((() => {
 		activeJobs = /* @__PURE__ */ new Map();
 		/** Active sandbox for the current job (used for abort). */
 		activeSandbox = null;
+		/** Supervisor-owned between-jobs phase (reap / cleanup re-run / reset). */
+		betweenJobsController;
+		/**
+		* Facts about the just-finished standard job, captured before sandbox
+		* teardown so the between-jobs controller (run in `execute`'s `.finally`) can
+		* reach them. Null for special job types (init / build / dynamic), which run
+		* no sandbox — the controller then only deletes the workdir and resets.
+		*/
+		betweenJobsFacts = null;
 		constructor(deps) {
 			this.send = deps.send;
 			this.config = deps.config;
+			this.betweenJobsController = deps.betweenJobsController;
 			this.requestUploadUrl = deps.requestUploadUrl;
 			this.sendUploadComplete = deps.sendUploadComplete;
 			this.sendEventEmit = deps.sendEventEmit;
@@ -7941,10 +9330,16 @@ var init_job_runner = __esmMin((() => {
 			const abortController = new AbortController();
 			const { workDir, cleanup, inPlace } = await resolveJobWorkDir(this.config.inPlace, dispatch.repoUrl);
 			if (inPlace) dispatch.jobConfig.checkout = false;
+			this.betweenJobsFacts = null;
+			const gitCredentials = await this.startGitCredentials(jobId, dispatch.jobConfig);
 			const completionPromise = this.runJob(dispatch, workDir, abortController).finally(async () => {
+				const facts = this.betweenJobsFacts;
 				this.activeJobs.delete(jobId);
 				this.activeSandbox = null;
-				await cleanup();
+				this.betweenJobsFacts = null;
+				this.jobGitCredentials.delete(jobId);
+				await gitCredentials?.close().catch(() => {});
+				await this.runBetweenJobsPhase(facts, workDir, cleanup);
 			});
 			this.activeJobs.set(jobId, {
 				abortController,
@@ -7954,6 +9349,63 @@ var init_job_runner = __esmMin((() => {
 			return completionPromise;
 		}
 		/**
+		* Stand up per-job git credentials, or `undefined` when the agent has no
+		* orchestrator relay (unit harnesses, offline local runs).
+		*
+		* A failure here must not fail the job: without a helper, git falls back to
+		* its own mechanisms exactly as it did before this existed. The job simply
+		* cannot push.
+		*/
+		async startGitCredentials(jobId, jobConfig) {
+			if (!this._sendApiRequest) return void 0;
+			try {
+				const { path: dir } = await makeTempDir(`gitcred-${jobId}`);
+				const credentials = await startJobGitCredentials({
+					jobId,
+					dir,
+					sendApiRequest: this._sendApiRequest,
+					credentials: jobConfig.gitCredentials
+				});
+				this.jobGitCredentials.set(jobId, credentials);
+				return credentials;
+			} catch (err) {
+				logger$3.warn("Could not start git credentials for job; git push will not work", {
+					jobId,
+					error: toErrorMessage(err)
+				});
+				return;
+			}
+		}
+		/**
+		* Run the supervisor-owned between-jobs phase after a job finishes. Delegates
+		* to the injected `BetweenJobsController` (out-of-band cleanup → reap →
+		* workdir delete → operator reset) with facts captured before sandbox
+		* teardown. When no controller is wired (unit harnesses) it just deletes the
+		* workdir, preserving the historical behavior. Never throws.
+		*/
+		async runBetweenJobsPhase(facts, workDir, deleteWorkdir) {
+			if (!this.betweenJobsController) {
+				await deleteWorkdir().catch((err) => logger$3.warn("Work directory cleanup error", { error: toErrorMessage(err) }));
+				return;
+			}
+			const ctx = {
+				completionHooksRan: facts?.completionHooksRan ?? true,
+				jobFailed: facts?.jobFailed ?? false,
+				backend: facts?.backend ?? "bare-metal",
+				declaresCleanup: facts?.declaresCleanup ?? false,
+				workDir,
+				reap: facts?.reap ?? (() => Promise.resolve(0)),
+				deleteWorkdir,
+				...facts?.cleanupSpawn ? { cleanupSpawn: facts.cleanupSpawn } : {}
+			};
+			try {
+				await this.betweenJobsController.afterJob(ctx);
+			} catch (err) {
+				logger$3.error("Between-jobs phase error", { error: toErrorMessage(err) });
+				await deleteWorkdir().catch(() => {});
+			}
+		}
+		/**
 		* Cancel a running job by signaling its abort controller
 		* and aborting the active sandbox.
 		*
@@ -8002,7 +9454,7 @@ var init_job_runner = __esmMin((() => {
 			}
 			if (jobConfig.buildOnly === true) {
 				if (jobConfig.fullRepo) {
-					logger$2.warn("Build job received for fullRepo run -- skipping (should not happen)", {
+					logger$3.warn("Build job received for fullRepo run -- skipping (should not happen)", {
 						jobId,
 						runId
 					});
@@ -8024,7 +9476,7 @@ var init_job_runner = __esmMin((() => {
 		async executeStandardJob(dispatch, workDir, abortController) {
 			const { runId, jobId } = dispatch;
 			const ctx = getRequestContext();
-			logger$2.info(`Run: ${ctx.runId ?? runId} | Trace: ${ctx.requestId ?? "N/A"}`);
+			logger$3.info(`Run: ${ctx.runId ?? runId} | Trace: ${ctx.requestId ?? "N/A"}`);
 			this.sendJobStatus(dispatch, ExecutionJobStatus.enum.running);
 			const heartbeatTimer = setInterval(() => {
 				this.send({
@@ -8035,12 +9487,16 @@ var init_job_runner = __esmMin((() => {
 				});
 			}, this.config.jobHeartbeatIntervalMs);
 			let sandbox;
+			let backend = "bare-metal";
+			let jobFailed = true;
 			const logStreamers = /* @__PURE__ */ new Map();
 			try {
 				const setupResult = await this.setupSandboxForExecution(dispatch, workDir, abortController);
 				if (!setupResult) return;
 				sandbox = setupResult.sandbox;
+				backend = setupResult.executionMode;
 				const result = await this.runSandboxExecution(dispatch, sandbox, abortController, logStreamers);
+				jobFailed = result.status !== ExecutionJobStatus.enum.success;
 				this.reportExecutionResult(dispatch, result, logStreamers);
 			} catch (error) {
 				for (const streamer of logStreamers.values()) streamer.destroy();
@@ -8049,9 +9505,18 @@ var init_job_runner = __esmMin((() => {
 			} finally {
 				clearInterval(heartbeatTimer);
 				if (sandbox) {
+					const jobSandbox = sandbox;
+					this.betweenJobsFacts = {
+						completionHooksRan: jobSandbox.completionHooksRan ?? true,
+						declaresCleanup: jobSandbox.declaresCleanup ?? false,
+						backend,
+						jobFailed,
+						reap: () => jobSandbox.reap?.() ?? Promise.resolve(0),
+						...jobSandbox.runCleanupOnly ? { cleanupSpawn: (wd, sig) => jobSandbox.runCleanupOnly(wd, sig) } : {}
+					};
 					this.emitRunEvent(runId, "agent.teardown", { jobId });
 					await sandbox.teardown().catch((err) => {
-						logger$2.warn("Sandbox teardown error", { error: toErrorMessage(err) });
+						logger$3.warn("Sandbox teardown error", { error: toErrorMessage(err) });
 					});
 				}
 			}
@@ -8071,7 +9536,8 @@ var init_job_runner = __esmMin((() => {
 			}
 			const executionMode = determineExecutionMode(jobConfig, {
 				executionMode: this.config.executionMode,
-				scalerManaged: this.config.scalerManaged
+				scalerManaged: this.config.scalerManaged,
+				jobImageAgent: this.config.jobImageAgent
 			});
 			const runnerPath = resolveRunnerPath();
 			const typedConfig = jobConfig;
@@ -8080,7 +9546,22 @@ var init_job_runner = __esmMin((() => {
 				jobEnv: typedConfig.jobEnv ?? void 0,
 				trustedEnv: this.config.trustedEnv
 			});
-			logger$2.info("Creating execution sandbox", {
+			const hostCheckout = executionMode === "container" && jobConfig.checkout !== false;
+			if (hostCheckout) {
+				const isGlobal = jobConfig.isGlobalWorkflow === true;
+				await cloneJobRepos(dispatch, {
+					workDir,
+					workflowDir: isGlobal ? join(workDir, "workflow") : workDir,
+					sourceDir: isGlobal ? join(workDir, "source") : workDir
+				}, {
+					isGlobal,
+					log: (line) => logger$3.info(`[host-checkout] ${line}`, { jobId }),
+					excludeScratchFromGit
+				});
+				jobConfig.checkout = false;
+			}
+			const builtImage = await this.buildJobImageIfDeclared(dispatch, jobConfig, workDir, abortController);
+			logger$3.info("Creating execution sandbox", {
 				executionMode,
 				jobId,
 				runnerPath
@@ -8089,13 +9570,16 @@ var init_job_runner = __esmMin((() => {
 				runnerPath,
 				env: sanitizedEnv,
 				jobId,
-				jobConfig
+				jobConfig,
+				registryAuth: dispatch.containerRegistryAuth,
+				...builtImage ? { builtImage } : {}
 			});
 			this.activeSandbox = sandbox;
 			await sandbox.setup({
 				workDir,
 				env: sanitizedEnv,
-				extraReadOnlyBinds: fileCloneSourceBinds(dispatch.repoUrl)
+				extraReadOnlyBinds: fileCloneSourceBinds(dispatch.repoUrl),
+				...hostCheckout ? { workspaceFromHost: true } : {}
 			});
 			if (abortController.signal.aborted) {
 				this.sendJobStatus(dispatch, ExecutionJobStatus.enum.cancelled);
@@ -8114,7 +9598,8 @@ var init_job_runner = __esmMin((() => {
 			});
 			return {
 				sandbox,
-				sanitizedEnv
+				sanitizedEnv,
+				executionMode
 			};
 		}
 		/**
@@ -8176,7 +9661,12 @@ var init_job_runner = __esmMin((() => {
 						reason: ack.reason
 					};
 				},
-				onApiRequest: this._sendApiRequest ? withBootstrapInterception(async (method, params) => this._sendApiRequest(method, params)) : void 0,
+				onApiRequest: this._sendApiRequest ? withBootstrapInterception(async (method, params) => {
+					const patched = method === GIT_CREDENTIAL_REQUEST_METHOD ? this.jobGitCredentials.get(jobId)?.withRef(params ?? {}) ?? params : params;
+					return this._sendApiRequest(method, patched);
+				}) : void 0,
+				onGitGrantRequest: this.jobGitCredentials.get(jobId)?.onGitGrantRequest,
+				credentialHelperPath: this.jobGitCredentials.get(jobId)?.helperPath,
 				onCacheRequest: this._requestUserCache ? async (request) => this._requestUserCache(jobId, request) : void 0,
 				onProvenanceRequest: this._relayProvenance ? async (request) => this._relayProvenance(jobId, request) : void 0,
 				onArtifactRequest: this._requestUserArtifact ? async (request) => this._requestUserArtifact(jobId, request) : void 0,
@@ -8213,7 +9703,7 @@ var init_job_runner = __esmMin((() => {
 			}
 			if (result.status === ExecutionJobStatus.enum.failed) {
 				const stepErrors = result.stepResults.filter((r) => r.error).map((r) => `${r.name}: ${r.error.message}`).join(" | ");
-				logger$2.error("Sandbox returned failed result", {
+				logger$3.error("Sandbox returned failed result", {
 					durationMs: result.durationMs,
 					stepCount: result.stepResults.length,
 					steps: result.stepResults.map((r) => `${r.name}:${r.status}`).join(","),
@@ -8249,7 +9739,7 @@ var init_job_runner = __esmMin((() => {
 		async handleBringupJob(dispatch) {
 			const { runId, jobId, jobConfig } = dispatch;
 			const targetAgentId = String(jobConfig.bringupTarget ?? "");
-			logger$2.info("Starting bring-up job", {
+			logger$3.info("Starting bring-up job", {
 				jobId,
 				runId,
 				targetAgentId
@@ -8286,7 +9776,7 @@ var init_job_runner = __esmMin((() => {
 				this.sendStepStatus(dispatch, 0, "bring-up", ExecutionStepStatus.enum.failed, void 0, streamer.getTotalBytes());
 				streamer.destroy();
 				this.sendJobStatus(dispatch, ExecutionJobStatus.enum.failed, { error: message });
-				logger$2.warn("Bring-up job failed", {
+				logger$3.warn("Bring-up job failed", {
 					jobId,
 					runId,
 					targetAgentId,
@@ -8304,7 +9794,7 @@ var init_job_runner = __esmMin((() => {
 		async handleBuildJob(dispatch, workDir, abortController) {
 			const { runId, jobId, jobConfig } = dispatch;
 			const buildCtx = getRequestContext();
-			logger$2.info(`Run: ${buildCtx.runId ?? runId} | Trace: ${buildCtx.requestId ?? "N/A"}`);
+			logger$3.info(`Run: ${buildCtx.runId ?? runId} | Trace: ${buildCtx.requestId ?? "N/A"}`);
 			this.sendJobStatus(dispatch, ExecutionJobStatus.enum.running);
 			const buildStreamer = this.createStepStreamer(dispatch, 0);
 			const buildLog = (msg) => buildStreamer.addLine(msg);
@@ -8393,14 +9883,14 @@ var init_job_runner = __esmMin((() => {
 			const cliPublicKey = jobConfig.cliPublicKey;
 			const orchestratorPrivateKey = jobConfig.orchestratorPrivateKey;
 			if (tarballUrl && cliPublicKey && orchestratorPrivateKey) {
-				logger$2.info("Applying overlay tarball for test run", { jobId });
+				logger$3.info("Applying overlay tarball for test run", { jobId });
 				const overlayResult = await applyOverlay({
 					tarballUrl,
 					cliPublicKey,
 					orchestratorPrivateKey,
 					repoDir: workDir
 				});
-				logger$2.info("Overlay applied", {
+				logger$3.info("Overlay applied", {
 					filesApplied: overlayResult.filesApplied,
 					filesDeleted: overlayResult.filesDeleted
 				});
@@ -8446,7 +9936,7 @@ var init_job_runner = __esmMin((() => {
 					orchestratorPrivateKey: initJobConfig.orchestratorPrivateKey,
 					repoDir: workDir
 				});
-				logger$2.info("Init job: overlay applied", {
+				logger$3.info("Init job: overlay applied", {
 					jobId: dispatch.jobId,
 					filesApplied: overlayResult.filesApplied,
 					filesDeleted: overlayResult.filesDeleted
@@ -8475,9 +9965,12 @@ var init_job_runner = __esmMin((() => {
 				platform: os.platform(),
 				arch: os.arch()
 			};
-			logger$2.info("Requesting dep upload URL from orchestrator", { lockfileHash: buildConfig.lockfileHash });
-			const depUploadUrl = await this.requestUploadUrl(dispatch.jobId, "deps", depKey);
-			logger$2.info("Uploading dep tarball to S3", {
+			logger$3.info("Requesting dep upload URL from orchestrator", { lockfileHash: buildConfig.lockfileHash });
+			const depUploadUrl = await this.requestUploadUrl(dispatch.jobId, "deps", {
+				...depKey,
+				depsHash: hash
+			});
+			logger$3.info("Uploading dep tarball to S3", {
 				size: tarball.length,
 				hash: hash.slice(0, 12)
 			});
@@ -8486,7 +9979,7 @@ var init_job_runner = __esmMin((() => {
 				...depKey,
 				depsHash: hash
 			});
-			logger$2.info("Dep tarball upload complete", { lockfileHash: buildConfig.lockfileHash });
+			logger$3.info("Dep tarball upload complete", { lockfileHash: buildConfig.lockfileHash });
 			buildLog(`Deps tarball uploaded (${tarball.length} bytes)`);
 			this.sendJobStatus(dispatch, ExecutionJobStatus.enum.running, {
 				buildEvent: "deps_packed",
@@ -8512,15 +10005,15 @@ var init_job_runner = __esmMin((() => {
 				platform: os.platform(),
 				arch: os.arch()
 			};
-			logger$2.info("Requesting source tarball upload URL from orchestrator", { contentHash: buildConfig.contentHash });
+			logger$3.info("Requesting source tarball upload URL from orchestrator", { contentHash: buildConfig.contentHash });
 			const sourceUploadUrl = await this.requestUploadUrl(dispatch.jobId, "source", sourceKey);
-			logger$2.info("Uploading source tarball to S3", {
+			logger$3.info("Uploading source tarball to S3", {
 				size: tarball.length,
 				contentHash: buildConfig.contentHash
 			});
 			await uploadToPresignedUrl(sourceUploadUrl, tarball);
 			this.sendUploadComplete(dispatch.jobId, "source", sourceKey);
-			logger$2.info("Source tarball upload complete", { contentHash: buildConfig.contentHash });
+			logger$3.info("Source tarball upload complete", { contentHash: buildConfig.contentHash });
 			buildLog(`Source tarball packed and uploaded (${tarball.length} bytes, hash: ${buildConfig.contentHash.slice(0, 12)})`);
 			this.sendJobStatus(dispatch, ExecutionJobStatus.enum.running, {
 				buildEvent: "source_packed",
@@ -8599,9 +10092,9 @@ var init_job_runner = __esmMin((() => {
 			const config = jobConfig;
 			const workflowDir = join(workDir, "workflow");
 			const sourceDir = join(workDir, "source");
-			logger$2.info("Starting global eval round", {
+			logger$3.info("Starting global eval round", {
 				jobId,
-				candidateCount: config.candidates.length,
+				candidateCount: Array.isArray(config.candidates) ? config.candidates.length : 0,
 				workflowRepoIdentifier: config.workflowRepoIdentifier
 			});
 			this.sendJobStatus(dispatch, ExecutionJobStatus.enum.running);
@@ -8629,6 +10122,7 @@ var init_job_runner = __esmMin((() => {
 				});
 			}, this.config.jobHeartbeatIntervalMs);
 			try {
+				if (!Array.isArray(config.candidates)) throw new Error("Global eval round dispatch is malformed: `candidates` must be an array");
 				if (abortController.signal.aborted) {
 					await closeStreamer();
 					this.sendStepStatus(dispatch, 0, "global-eval", ExecutionStepStatus.enum.skipped, void 0, evalStreamer.getTotalBytes());
@@ -8660,7 +10154,7 @@ var init_job_runner = __esmMin((() => {
 				}));
 				const running = roundResult.candidates.filter((c) => c.run).length;
 				const indeterminate = roundResult.candidates.filter((c) => c.indeterminate).length;
-				logger$2.info("Global eval round completed", {
+				logger$3.info("Global eval round completed", {
 					jobId,
 					candidateCount: roundResult.candidates.length,
 					running,
@@ -8676,7 +10170,7 @@ var init_job_runner = __esmMin((() => {
 				});
 			} catch (err) {
 				const errorMsg = toErrorMessage(err);
-				logger$2.error("Global eval round failed", {
+				logger$3.error("Global eval round failed", {
 					jobId,
 					error: errorMsg
 				});
@@ -8706,7 +10200,7 @@ var init_job_runner = __esmMin((() => {
 		async handleInitJob(dispatch, workDir, abortController) {
 			const { runId, jobId, jobConfig } = dispatch;
 			const config = jobConfig;
-			logger$2.info("Starting init job", {
+			logger$3.info("Starting init job", {
 				jobId,
 				targetJobName: config.targetJobName,
 				workflowName: config.workflowName
@@ -8750,7 +10244,7 @@ var init_job_runner = __esmMin((() => {
 				await this.materializeInitJobSource(dispatch, workDir, initLog);
 				const kiciDir = join(workDir, ".kici");
 				const hasPackage = await fileExists(join(kiciDir, "package.json"));
-				logger$2.info("Init job: checking deps", {
+				logger$3.info("Init job: checking deps", {
 					kiciDir,
 					hasPackageJson: hasPackage,
 					source: config.source
@@ -8776,7 +10270,7 @@ var init_job_runner = __esmMin((() => {
 						hasFilter: config.hasFilter ?? false
 					}, config.timeoutMs, filterInput);
 				});
-				logger$2.info("Init job completed successfully", {
+				logger$3.info("Init job completed successfully", {
 					jobId,
 					hasContext: initResult.contextNames !== void 0,
 					hasEnv: initResult.env !== void 0,
@@ -8793,7 +10287,7 @@ var init_job_runner = __esmMin((() => {
 				});
 			} catch (err) {
 				const errorMsg = toErrorMessage(err);
-				logger$2.error("Init job failed", {
+				logger$3.error("Init job failed", {
 					jobId,
 					error: errorMsg
 				});
@@ -8819,7 +10313,7 @@ var init_job_runner = __esmMin((() => {
 			const { runId, jobId, jobConfig } = dispatch;
 			const config = jobConfig;
 			const timeoutMs = config.timeoutMs ?? 12e4;
-			logger$2.info("Starting DynamicJobFn evaluation", {
+			logger$3.info("Starting DynamicJobFn evaluation", {
 				jobId,
 				workflowName: config.workflowName,
 				sourceIndex: config.source.index
@@ -8843,14 +10337,7 @@ var init_job_runner = __esmMin((() => {
 					return;
 				}
 				await materializeEvalWorkspace(dispatch, workDir, evalLog);
-				const { $: zx$ } = await import("zx");
-				const scopedDollar = zx$({
-					cwd: workDir,
-					env: { ...process.env },
-					verbose: true,
-					quiet: false,
-					log: makeStreamingZxLog((line, stream) => evalStreamer.addLine(line, stream))
-				});
+				const scopedDollar = await buildEvalShell(workDir, (line, stream) => evalStreamer.addLine(line, stream));
 				const evalSink = { addLine: (line) => evalStreamer.addLine(line) };
 				const filterInput = config.hasFilter ? await buildInitFilterInput(dispatch, config.event, workDir, (line, stream) => evalStreamer.addLine(line, stream)) : void 0;
 				const dynamicJobLogger = {
@@ -8891,7 +10378,7 @@ var init_job_runner = __esmMin((() => {
 						workflowName: config.workflowName
 					});
 				});
-				logger$2.info("DynamicJobFn evaluation completed", {
+				logger$3.info("DynamicJobFn evaluation completed", {
 					jobId,
 					generatedJobCount: lockJobs.length,
 					jobNames: lockJobs.map((j) => j.name)
@@ -8906,7 +10393,7 @@ var init_job_runner = __esmMin((() => {
 				});
 			} catch (err) {
 				const errorMsg = toErrorMessage(err);
-				logger$2.error("DynamicJobFn evaluation failed", {
+				logger$3.error("DynamicJobFn evaluation failed", {
 					jobId,
 					error: errorMsg
 				});
@@ -8930,13 +10417,50 @@ var init_job_runner = __esmMin((() => {
 			}
 		}
 		/**
+		* Build the job's container image when it declared a Dockerfile, and return
+		* the tag the sandbox must run.
+		*
+		* Returns `undefined` for every other job — one with no container, or one
+		* naming a finalized image — which is the common case and costs nothing.
+		*
+		* Extracted from `setupSandboxForExecution` so that function stays inside the
+		* 200-line ceiling, and so the build's streamer lifecycle is visibly bounded
+		* by one `finally`.
+		*/
+		async buildJobImageIfDeclared(dispatch, jobConfig, workDir, abortController) {
+			const container = jobConfig.container;
+			if (!container || typeof container === "string" || !container.dockerfile) return void 0;
+			const streamer = this.createStepStreamer(dispatch, CONTAINER_BUILD_STEP_INDEX);
+			try {
+				return await runJobImageBuild({
+					container,
+					workDir,
+					jobId: dispatch.jobId,
+					jobName: jobConfig.name ?? jobConfig.baseJobName ?? "job",
+					onLog: (line) => streamer.addLine(line),
+					build: async (spec, onLog) => buildJobImage({
+						spec,
+						cli: resolveBuildCli({ configured: this.config.containerBuildCli }),
+						socketPath: sandboxSocketPath(),
+						...dispatch.containerRegistryAuth ? { authconfig: dispatch.containerRegistryAuth } : {},
+						onLog,
+						signal: abortController.signal
+					}),
+					sendStepStatus: (name, state, data) => this.sendStepStatus(dispatch, CONTAINER_BUILD_STEP_INDEX, name, state, data, streamer.getTotalBytes())
+				});
+			} finally {
+				await streamer.flush();
+				streamer.destroy();
+			}
+		}
+		/**
 		* Create the appropriate sandbox backend based on execution mode.
 		*/
 		createSandbox(mode, opts) {
 			switch (mode) {
 				case "container": {
 					const containerConfig = opts.jobConfig.container;
-					const image = typeof containerConfig === "string" ? containerConfig : containerConfig?.image ?? "node:20-alpine";
+					const image = opts.builtImage ?? (typeof containerConfig === "string" ? containerConfig : containerConfig?.image ?? "node:20-alpine");
 					return new ContainerSandbox({
 						docker: new Docker(),
 						image,
@@ -8953,7 +10477,11 @@ var init_job_runner = __esmMin((() => {
 							nanoCpus: this.config.sandboxNanoCpus,
 							networkMode: this.config.sandboxNetwork === "host" ? "host" : "default",
 							grant: opts.jobConfig.sandboxGrant
-						}
+						},
+						...opts.registryAuth ? { registryAuth: opts.registryAuth } : {},
+						...opts.builtImage ? { buildTag: opts.builtImage } : {},
+						...this.config.runtimeNodeSource ? { runtimeNodePath: this.config.runtimeNodeSource } : {},
+						...this.config.runtimeImage ? { runtimeImage: this.config.runtimeImage } : {}
 					});
 				}
 				case "firecracker": return new FirecrackerSandbox({
@@ -8964,7 +10492,8 @@ var init_job_runner = __esmMin((() => {
 					runnerPath: opts.runnerPath,
 					env: opts.env,
 					sandbox: this.config.sandbox,
-					sandboxNetwork: this.config.sandboxNetwork
+					sandboxNetwork: this.config.sandboxNetwork,
+					orphanCleanup: this.config.orphanCleanup
 				});
 			}
 		}
@@ -9087,6 +10616,168 @@ var init_job_runner = __esmMin((() => {
 	};
 }));
 //#endregion
+//#region src/execution/between-jobs-reset.ts
+/**
+* Run the operator between-jobs reset command. Fail-open: never throws, always
+* resolves to a status. Skips when unconfigured, or when runOn=on-failure and
+* the job succeeded.
+*/
+async function runBetweenJobsReset(input) {
+	const started = performance.now();
+	const done = (status) => ({
+		status,
+		durationMs: Math.round(performance.now() - started)
+	});
+	if (!input.command) return done("skipped");
+	if (input.runOn === "on-failure" && !input.jobFailed) return done("skipped");
+	const exec = input.exec ?? defaultExec;
+	try {
+		const r = await exec(input.command, input.timeoutMs);
+		if (r.timedOut) return done("timeout");
+		return done(r.code === 0 ? "success" : "failed");
+	} catch {
+		return done("failed");
+	}
+}
+var defaultExec;
+var init_between_jobs_reset = __esmMin((() => {
+	defaultExec = (command, timeoutMs) => new Promise((resolve) => {
+		const child = spawn("/bin/sh", ["-c", command], { stdio: "ignore" });
+		let timedOut = false;
+		const timer = setTimeout(() => {
+			timedOut = true;
+			child.kill("SIGKILL");
+		}, timeoutMs);
+		child.on("exit", (code) => {
+			clearTimeout(timer);
+			resolve({
+				code,
+				timedOut
+			});
+		});
+		child.on("error", () => {
+			clearTimeout(timer);
+			resolve({
+				code: 1,
+				timedOut
+			});
+		});
+	});
+}));
+//#endregion
+//#region src/execution/cleanup-rerun.ts
+/**
+* Re-run a hard-killed job's declared cleanup/onFailure hooks out-of-band,
+* against its preserved workdir, in a fresh bounded child. Returns 'skipped'
+* when there is nothing to do (no declared cleanup, wrong backend, or a
+* non-positive timeout). Never throws — a failure is reported as a status.
+*/
+async function runDeclaredCleanupOutOfBand(input) {
+	const started = performance.now();
+	const done = (status) => ({
+		status,
+		durationMs: Math.round(performance.now() - started)
+	});
+	if (!input.declaresCleanup) return done("skipped");
+	if (!HOST_SHARING_BACKENDS.has(input.backend)) return done("skipped");
+	if (!Number.isFinite(input.timeoutMs) || input.timeoutMs <= 0) return done("skipped");
+	const controller = new AbortController();
+	const timer = setTimeout(() => controller.abort(), input.timeoutMs);
+	try {
+		await input.spawn(input.workDir, controller.signal);
+		return done("success");
+	} catch {
+		return done(controller.signal.aborted ? "timeout" : "failed");
+	} finally {
+		clearTimeout(timer);
+	}
+}
+var HOST_SHARING_BACKENDS;
+var init_cleanup_rerun = __esmMin((() => {
+	HOST_SHARING_BACKENDS = /* @__PURE__ */ new Set(["bare-metal"]);
+}));
+//#endregion
+//#region src/execution/between-jobs-controller.ts
+var between_jobs_controller_exports = /* @__PURE__ */ __exportAll({ BetweenJobsController: () => BetweenJobsController$1 });
+var logger$2, BetweenJobsController$1;
+var init_between_jobs_controller = __esmMin((() => {
+	init_between_jobs_reset();
+	init_cleanup_rerun();
+	init_prometheus();
+	logger$2 = createLogger({ prefix: "between-jobs" });
+	BetweenJobsController$1 = class {
+		deps;
+		_consecutiveResetFailures = 0;
+		/** Consecutive between-jobs reset failures, for the supervisor's drain gate. */
+		get consecutiveResetFailures() {
+			return this._consecutiveResetFailures;
+		}
+		constructor(deps) {
+			this.deps = deps;
+		}
+		async runRerunPhase(ctx) {
+			if (ctx.completionHooksRan || !ctx.cleanupSpawn) return "skipped";
+			const r = await (this.deps.rerun ?? runDeclaredCleanupOutOfBand)({
+				workDir: ctx.workDir,
+				backend: ctx.backend,
+				declaresCleanup: ctx.declaresCleanup,
+				timeoutMs: this.deps.config.betweenJobsResetTimeoutMs,
+				spawn: ctx.cleanupSpawn
+			});
+			orphanCleanupTotal.add(1, { status: r.status });
+			if (r.status === "failed" || r.status === "timeout") logger$2.warn("between-jobs out-of-band cleanup did not complete", { status: r.status });
+			return r.status;
+		}
+		async runResetPhase(ctx) {
+			const reset = await (this.deps.reset ?? runBetweenJobsReset)({
+				command: this.deps.config.betweenJobsResetCommand,
+				timeoutMs: this.deps.config.betweenJobsResetTimeoutMs,
+				runOn: this.deps.config.betweenJobsResetRunOn,
+				jobFailed: ctx.jobFailed
+			});
+			if (reset.status !== "skipped") {
+				betweenJobsResetTotal.add(1, { status: reset.status });
+				betweenJobsResetDurationSeconds.record(reset.durationMs / 1e3);
+			}
+			if (reset.status === "failed" || reset.status === "timeout") {
+				this._consecutiveResetFailures += 1;
+				logger$2.warn("between-jobs reset failed", {
+					status: reset.status,
+					consecutive: this._consecutiveResetFailures
+				});
+			} else if (reset.status === "success") this._consecutiveResetFailures = 0;
+			return reset.status;
+		}
+		async afterJob(ctx) {
+			let rerun = "skipped";
+			try {
+				rerun = await this.runRerunPhase(ctx);
+			} catch (err) {
+				logger$2.warn("between-jobs out-of-band cleanup threw", { error: toErrorMessage(err) });
+			}
+			let reaped = 0;
+			if (this.deps.config.orphanCleanup) try {
+				reaped = await ctx.reap();
+				if (reaped > 0) orphansReapedTotal.add(reaped);
+			} catch (err) {
+				logger$2.warn("between-jobs reap threw", { error: toErrorMessage(err) });
+			}
+			try {
+				await ctx.deleteWorkdir();
+			} catch (err) {
+				logger$2.warn("between-jobs workdir delete threw", { error: toErrorMessage(err) });
+			}
+			const reset = await this.runResetPhase(ctx);
+			return {
+				rerun,
+				reaped,
+				reset,
+				consecutiveResetFailures: this._consecutiveResetFailures
+			};
+		}
+	};
+}));
+//#endregion
 //#region src/server.ts
 /**
 * Agent entry point.
@@ -9108,23 +10799,30 @@ var init_job_runner = __esmMin((() => {
 */
 init_console_capture();
 init_npm_resolver();
-const AGENT_VERSION = "0.5.0";
-const BUILD_COMMIT = "cb51c7d1e";
-const SDK_VERSION = "0.5.0";
-const SDK_BUNDLE_HASH = "5b85e7cffa4a08e39329ff80448a2744af8e5b5f9840ec3801fad45ed11a3de9";
-const SHARED_VERSION = "0.5.0";
-const SHARED_BUNDLE_HASH = "b6b6d1818d1fe648150422daf073dafc18b037404cacf82e0ec03b4a2863e4c4";
-const ENGINE_VERSION = "0.5.0";
-const ENGINE_BUNDLE_HASH = "35d174ce6f4748abffcad194b335b508cade5d1c8af16d9cd3bdcb744f38717e";
+const AGENT_VERSION = "0.6.0";
+const BUILD_COMMIT = "e4a936029";
+const SDK_VERSION = "0.6.0";
+const SDK_BUNDLE_HASH = "22faf0da45de7c243ce87f80fd33ee51b1df52809fde457b16bb821678f65eb3";
+const SHARED_VERSION = "0.6.0";
+const SHARED_BUNDLE_HASH = "a79be949815735b9e36eecc716f7eb07aa36c7bffba62e798e7e19f31a474eff";
+const ENGINE_VERSION = "0.6.0";
+const ENGINE_BUNDLE_HASH = "e49533b19f122155b3a78d95d105f97da259c2a45dee579578324b0702c91708";
 initTelemetry({
 	serviceName: "kici-agent",
 	otlpEndpoint: process.env.OTEL_EXPORTER_OTLP_ENDPOINT
 });
 const { connectionStatus, jobsActive, jobsTotal } = await Promise.resolve().then(() => (init_prometheus(), prometheus_exports));
 const { JobRunner } = await Promise.resolve().then(() => (init_job_runner(), job_runner_exports));
+const { BetweenJobsController } = await Promise.resolve().then(() => (init_between_jobs_controller(), between_jobs_controller_exports));
 setServiceName("agent");
 const logger$1 = createLogger({ prefix: "agent" });
 /**
+* Consecutive between-jobs reset failures after which a `drainOnResetFailure`
+* agent drains — a persistently dirty host stops taking work rather than
+* running every subsequent job against unclean state.
+*/
+const RESET_FAILURE_DRAIN_THRESHOLD = 3;
+/**
 * Serialize the agent's current Prometheus metrics to text. The OTel
 * PrometheusExporter exposes no direct serialize method, so the metrics are
 * piped through its request handler with a mock ServerResponse. Returns an
@@ -9174,7 +10872,10 @@ await guardStartup(logger$1, async () => {
 		name: "bash",
 		reason: "required for step execution"
 	}]);
-	if (toolErrors.length > 0) throw new Error("Agent required-tools validation failed:\n" + toolErrors.map((e) => `  - ${e}`).join("\n"));
+	if (toolErrors.length > 0) {
+		const jobImageHint = config.jobImageAgent ? "\nThis agent runs inside the job's own container image, so that image must provide these tools. Either add them to the image, or run the job on a pool whose agent stays outside it." : "";
+		throw new Error("Agent required-tools validation failed:\n" + toolErrors.map((e) => `  - ${e}`).join("\n") + jobImageHint);
+	}
 	if (config.roles === void 0 || config.roles.includes("builder")) {
 		const npmVersion = verifyNpmAvailable();
 		logger$1.info("Builder role: npm verified", { npmVersion });
@@ -9183,9 +10884,17 @@ await guardStartup(logger$1, async () => {
 	let idleShutdownTimer;
 	let rebootIntent = false;
 	let client;
+	const betweenJobsController = new BetweenJobsController({ config: {
+		betweenJobsResetCommand: config.betweenJobsResetCommand,
+		betweenJobsResetTimeoutMs: config.betweenJobsResetTimeoutMs,
+		betweenJobsResetRunOn: config.betweenJobsResetRunOn,
+		orphanCleanup: config.orphanCleanup,
+		drainOnResetFailure: config.drainOnResetFailure
+	} });
 	const jobRunner = new JobRunner({
 		send: (msg) => client.send(msg),
 		config,
+		betweenJobsController,
 		requestUploadUrl: (jobId, cacheType, key) => client.requestUploadUrl(jobId, cacheType, key),
 		sendUploadComplete: (jobId, cacheType, key) => client.sendUploadComplete(jobId, cacheType, key),
 		sendEventEmit: (jobId, requestId, eventName, payload, target) => client.sendEventEmit(jobId, requestId, eventName, payload, target),
@@ -9201,6 +10910,12 @@ await guardStartup(logger$1, async () => {
 				rebootIntent = true;
 				return result;
 			}
+			if (method === "scaler.claim-credentials") {
+				const claimCode = String((params ?? {}).claimCode ?? "");
+				const r = await client.sendClaimCredentials(claimCode);
+				if (r.error) throw new Error(r.error);
+				return r.credentials;
+			}
 			return client.sendApiRequest(method, params ?? {});
 		},
 		requestUserCache: (jobId, request) => client.requestUserCache(jobId, request),
@@ -9215,13 +10930,14 @@ await guardStartup(logger$1, async () => {
 			messageId: randomUUID(),
 			agentId: config.agentId,
 			activeJobs: jobRunner.activeJobs.size,
-			memoryUsedMb: Math.round((os.totalmem() - os.freemem()) / (1024 * 1024)),
-			memoryAvailableMb: Math.round(os.freemem() / (1024 * 1024)),
+			memoryUsedMb: Math.round((os.totalmem() - os.freemem()) / 1048576),
+			memoryAvailableMb: Math.round(os.freemem() / 1048576),
 			uptimeSeconds: Math.round(os.uptime())
 		});
 	}
 	client = new OrchestratorClient({
 		...agentClientConnectionOptions(config),
+		scalerClaimCode: config.scalerClaimCode,
 		getFleetBundleInputs: async () => ({
 			config,
 			logDir: process.env.KICI_LOG_DIR,
@@ -9291,6 +11007,10 @@ await guardStartup(logger$1, async () => {
 				}).finally(() => {
 					jobsActive.add(-1);
 					metricsReporter.collectAndSend().catch(() => {});
+					if (config.drainOnResetFailure && !isDraining && betweenJobsController.consecutiveResetFailures >= RESET_FAILURE_DRAIN_THRESHOLD) {
+						logger$1.warn("Draining agent after repeated between-jobs reset failures", { consecutive: betweenJobsController.consecutiveResetFailures });
+						isDraining = true;
+					}
 					sendAgentStatus();
 					if (rebootIntent) {
 						rebootIntent = false;
@@ -9340,9 +11060,23 @@ await guardStartup(logger$1, async () => {
 			}, idleMs);
 		}
 	}
-	client.onRegistered = ({ pendingDispatch }) => {
-		if (!config.scalerManaged || jobRunner.activeJobs.size > 0) return;
-		if (pendingDispatch) {
+	client.onRegistered = ({ pendingDispatch, warmPool }) => {
+		const decision = decideIdleShutdown({
+			scalerManaged: config.scalerManaged,
+			activeJobs: jobRunner.activeJobs.size,
+			pendingDispatch,
+			warmPool
+		});
+		if (decision === "none") return;
+		if (decision === "warm") {
+			logger$1.info("Warm-pool agent registered and ready, awaiting work");
+			if (idleShutdownTimer) {
+				clearTimeout(idleShutdownTimer);
+				idleShutdownTimer = void 0;
+			}
+			return;
+		}
+		if (decision === "pending-dispatch") {
 			const safetyMs = config.scalerPendingDispatchTimeoutMs;
 			logger$1.info(`Scaler-managed agent registered with pending bound dispatch, deferring idle shutdown for ${safetyMs}ms`);
 			if (idleShutdownTimer) clearTimeout(idleShutdownTimer);
@@ -9453,6 +11187,10 @@ await guardStartup(logger$1, async () => {
 			}
 		]
 	});
+	client.onClaimFailedPermanently = (reason) => {
+		logger$1.error("Self-bootstrap claim failed permanently, shutting down", { reason });
+		gracefulShutdown("scaler-claim-failed", 1);
+	};
 	process.on("SIGUSR1", () => {
 		logger$1.info("Received SIGUSR1, entering drain mode");
 		isDraining = true;