@kici-dev/agent 0.6.0 → 0.7.0

package/dist/workflow-runner-bundle.js

@@ -185946,6 +185946,38 @@ var init_attestation_origin = __esmMin((() => {
 		"deferred",
 		"offline-backfill"
 	]);
+}));
+//#endregion
+//#region ../engine/dist/provenance/id-token-event-claims.js
+var provenanceContextSchema;
+var init_id_token_event_claims = __esmMin((() => {
+	init_zod();
+	provenanceContextSchema = object({
+		/** `owner/repo`, the token's `repository` claim. */
+		repository: string$1().nullable(),
+		/** The branch the run PRESENTS — a pull request's BASE branch. */
+		ref: string$1().nullable(),
+		/** The run's commit SHA, the token's `sha` claim. */
+		sha: string$1().nullable(),
+		/**
+		* The token's `workflow_ref` claim (`<workflow_name>@<sha>`) — NOT the git
+		* ref used to clone a global workflow's repository. The statement's
+		* `workflow.path` is compared against this.
+		*/
+		workflowRef: string$1().nullable(),
+		runId: string$1(),
+		jobId: string$1(),
+		/** The customer's public org id, resolved server-side from the routing key. */
+		orgId: string$1(),
+		/** `triggered` or `run-remote`, derived from the run's local-working-tree flag. */
+		sourceOrigin: string$1(),
+		/** Informational source provider (github / gitlab / …). */
+		provider: string$1().nullable(),
+		/** The orchestrator's provenance issuer, for the statement's `builder.id`. */
+		issuer: string$1(),
+		/** This orchestrator's instance id, also for `builder.id`. */
+		orchestratorId: string$1()
+	}).passthrough();
 })), heartbeatSchema, nackSchema;
 var init_common = __esmMin((() => {
 	init_zod();
@@ -186562,6 +186594,7 @@ var init_access_log = __esmMin((() => {
 		"runs.list.read",
 		"runs.filters.read",
 		"sources.list.read",
+		"admin_tokens.list.read",
 		"run.payload.read",
 		"run.orch_logs.read",
 		"step.logs.read",
@@ -186806,6 +186839,7 @@ var init_event_log = __esmMin((() => {
 	init_zod();
 	EventLogStatus = _enum([
 		"received",
+		"shed",
 		"processed",
 		"duplicate",
 		"lockfile_missing",
@@ -186835,9 +186869,24 @@ var init_deployment_identity = __esmMin((() => {
 		adminInvocation: string$1().min(1).optional(),
 		adminPath: string$1().min(1).optional()
 	});
+}));
+//#endregion
+//#region ../engine/dist/protocol/messages/config-paths.js
+var ConfigPathsSchema;
+var init_config_paths = __esmMin((() => {
+	init_zod();
+	ConfigPathsSchema = object({
+		/** The env file the service manager loads (`EnvironmentFile=` / `env_file:`). */
+		envFile: string$1().min(1).optional(),
+		/** The scaler YAML file, or the directory when only a directory is configured. */
+		scalerConfig: string$1().min(1).optional(),
+		/** The generated compose file, for a compose deployment. */
+		composeFile: string$1().min(1).optional()
+	});
 })), SourceSubtype, OrchestratorMode, SourceProvider, sourceRegistrationSchema, acceptedSourceSchema, sourceRegistrationAckSchema, sourceDeregisterSchema, sourceDeregisterAckSchema;
 var init_source_registration = __esmMin((() => {
 	init_deployment_identity();
+	init_config_paths();
 	init_zod();
 	SourceSubtype = _enum([
 		"github_app",
@@ -186924,6 +186973,13 @@ var init_source_registration = __esmMin((() => {
 		* publish it, in which case the dashboard treats the shape as `unknown`.
 		*/
 		deployment: DeploymentIdentitySchema.optional(),
+		/**
+		* Where this orchestrator's own config files live on its host, so the
+		* dashboard can point an operator straight at them. Optional: an
+		* orchestrator that predates the field omits it, and each member is omitted
+		* independently when that path is not knowable.
+		*/
+		configPaths: ConfigPathsSchema.optional(),
 		/** Whether this orchestrator has S3 log storage configured. Used for multi-orch pool validation. */
 		s3LogAccess: boolean$1().optional(),
 		/** Queue timeout in ms. Platform uses this (with margin) for safety-net GC of stale queued jobs. */
@@ -187107,6 +187163,27 @@ var init_types$3 = __esmMin((() => {
 	]);
 }));
 //#endregion
+//#region ../engine/dist/regex-flags.js
+/**
+* Drop `g` and `y` from a flag string. Every other ECMAScript flag —
+* `d` (hasIndices), `i`, `m`, `s`, `u`, `v` — is meaningful to a single
+* `.test()` and is preserved.
+*/
+function stripStatefulRegexFlags(flags) {
+	return (flags ?? "").replace(STATEFUL_FLAGS, "");
+}
+/**
+* Same, but collapsing an empty result to `undefined` — the shape the SDK's
+* pattern types and the lock file use for "no flags".
+*/
+function normalizeRegexFlags(flags) {
+	return stripStatefulRegexFlags(flags) || void 0;
+}
+var STATEFUL_FLAGS;
+var init_regex_flags = __esmMin((() => {
+	STATEFUL_FLAGS = /[gy]/g;
+}));
+//#endregion
 //#region ../engine/dist/labels-match.js
 var LabelMatcher, HostTargetValue, HostTargetSelector;
 var init_labels_match = __esmMin((() => {
@@ -187304,7 +187381,7 @@ var init_dashboard_global_workflows = __esmMin((() => {
 		settings: globalWorkflowSettingsSchema.optional(),
 		error: string$1().optional()
 	});
-})), dashboardRunDetailRequestSchema, dashboardRunStructuredRequestSchema, dashboardRunStructuredResponseSchema, dashboardRunStateRequestSchema, dashboardRunStateResponseSchema, dashboardStepLogsRequestSchema, dashboardStepDetailSchema, dashboardJobDetailSchema, trustContextSchema, dashboardRunDetailResponseSchema, dashboardStepLogsResponseSchema, dashboardAttestationsListRequestSchema, attestationVerifyStatusSchema, attestationListItemSchema, dashboardAttestationsListResponseSchema, dashboardArtifactsListRequestSchema, artifactListItemSchema, dashboardArtifactsListResponseSchema, attestationListSummarySchema, attestationListFiltersSchema, dashboardAttestationsListAllRequestSchema, dashboardAttestationsListAllResponseSchema, dashboardAttestationGetRequestSchema, dashboardAttestationGetResponseSchema, dashboardAttestationRetryRequestSchema, dashboardAttestationRetryResponseSchema, dashboardRunSummarySchema, dashboardRunsListRequestSchema, dashboardRunsListResponseSchema, dashboardRunsFiltersRequestSchema, dashboardRunsFiltersResponseSchema, dashboardSourceSummarySchema, dashboardSourcesListRequestSchema, dashboardSourcesListResponseSchema, runRerunRequestSchema, runRerunResponseSchema, manualScheduleRequestSchema, manualScheduleResponseSchema, runCancelRequestSchema, runCancelResponseSchema, dashboardPayloadRequestSchema, dashboardPayloadResponseSchema, runLineageSchema, eventLogListItemSchema, dashboardEventLogListRequestSchema, dashboardEventLogListResponseSchema, dashboardEventLogDetailRequestSchema, dashboardEventLogDetailResponseSchema, dashboardEventLogActivityRequestSchema, eventLogActivityCountsSchema, dashboardEventLogActivityResponseSchema, EventLogPayloadStreamError, dashboardEventLogPayloadStreamRequestSchema, dashboardEventLogPayloadChunkSchema, browserEventLogPayloadChunkSchema, dashboardEventDlqListItemSchema, dashboardEventDlqListRequestSchema, dashboardEventDlqListResponseSchema, dashboardEventDlqCountRequestSchema, dashboardEventDlqCountResponseSchema, dashboardEventDlqRetryRequestSchema, dashboardEventDlqRetryResponseSchema, dashboardEventDlqDiscardRequestSchema, dashboardEventDlqDiscardResponseSchema, contextTypeSchema, contextListRequestSchema, contextListResponseSchema, contextGetRequestSchema, contextGetResponseSchema, contextCreateRequestSchema, contextCreateResponseSchema, contextUpdateRequestSchema, contextUpdateResponseSchema, contextTestAccessSetRequestSchema, contextTestAccessSetResponseSchema, contextDeleteRequestSchema, ContextDeleteErrorCode, contextDeleteResponseSchema, contextVarsListRequestSchema, contextVarsListResponseSchema, contextVarSetRequestSchema, contextVarSetResponseSchema, contextVarDeleteRequestSchema, contextVarDeleteResponseSchema, contextSourceOverridesListRequestSchema, contextSourceOverridesListResponseSchema, contextSourceOverrideSetRequestSchema, contextSourceOverrideSetResponseSchema, contextSourceOverrideDeleteRequestSchema, contextSourceOverrideDeleteResponseSchema, contextBindingEntrySchema, contextBindingsListRequestSchema, contextBindingsListResponseSchema, contextBindingsSetRequestSchema, contextBindingsSetResponseSchema, contextSecretsListRequestSchema, contextSecretsListResponseSchema, contextSecretSetRequestSchema, contextSecretSetResponseSchema, contextSecretDeleteRequestSchema, contextSecretDeleteResponseSchema, contextSecretScopeCreateRequestSchema, contextSecretScopeCreateResponseSchema, contextSecretScopeRenameRequestSchema, contextSecretScopeRenameResponseSchema, contextSecretScopeDeleteRequestSchema, contextSecretScopeDeleteResponseSchema, contextHistoryRequestSchema, contextHistoryResponseSchema, HeldRunQueueType, heldRunsListRequestSchema, heldRunsListResponseSchema, heldRunApproveRequestSchema, heldRunApproveResponseSchema, heldRunRejectRequestSchema, heldRunRejectResponseSchema, dashboardDiagnosticsRequestSchema, fleetPinnedRunSchema, FleetHostDisposition, fleetPreviewHostSchema, dashboardFleetHostsRequestSchema, dashboardFleetHostRequestSchema, dashboardFleetPreviewRequestSchema, dashboardFleetHostsResponseSchema, dashboardFleetHostResponseSchema, dashboardFleetPreviewResponseSchema, dashboardFleetWorkflowsForHostRequestSchema, fleetHostWorkflowSchema, dashboardFleetWorkflowsForHostResponseSchema, fleetHostDeclareRequestSchema, fleetHostDeclareResponseSchema, fleetHostRemoveRequestSchema, fleetHostRemoveResponseSchema, diagnosticsAgentSchema, diagnosticsScalerSchema, diagnosticsPeerAgentSchema, diagnosticsPeerSchema, dashboardDiagnosticsResponseSchema, dashboardScalerCapacityRequestSchema, scalerCapacityItemSchema, dashboardScalerCapacityResponseSchema, dashboardScalerAgentsRequestSchema, dashboardScalerAgentsResponseSchema, registrationDisableRequestSchema, registrationDisableResponseSchema, registrationDeleteRequestSchema, registrationDeleteResponseSchema, registrationsListRequestSchema, registrationSourceSchema, registrationItemSchema, registrationsListResponseSchema, backendsListRequestSchema, backendItemSchema, backendsListResponseSchema, backendGetRequestSchema, backendGetResponseSchema, backendsSyncAllRequestSchema, backendsSyncAllResponseSchema, backendSyncRequestSchema, backendSyncResponseSchema, backendTestRequestSchema, backendTestResponseSchema, testRelayUploadsInitRequestSchema, testRelayUploadsInitResponseSchema, testRelayTriggerRequestSchema, testRelayTriggerResponseSchema, testRelayRunStatusRequestSchema, testRelayRunStatusResponseSchema, testRelayRunLogsRequestSchema, testRelayRunLogsResponseSchema, testRelayCancelRequestSchema, testRelayCancelResponseSchema, dashboardPlatformToOrchSchema, runListPrincipalUserSchema, runListSourceSchema, runListItemSchema, diagnosticsInfraAgentSchema, diagnosticsInfraScalerSchema, diagnosticsInfraOrchestratorSchema, diagnosticsInfraAlertSchema, diagnosticsExecutionMetricsSchema, identityLinkItemSchema, memberIdentityLinkSchema, memberRoleAssignmentSchema, orgMemberSchema, DASHBOARD_REQUEST_TYPES;
+})), dashboardRunDetailRequestSchema, dashboardRunStructuredRequestSchema, dashboardRunStructuredResponseSchema, dashboardRunStateRequestSchema, dashboardRunStateResponseSchema, dashboardStepLogsRequestSchema, dashboardStepDetailSchema, dashboardJobDetailSchema, trustContextSchema, dashboardRunDetailResponseSchema, dashboardStepLogsResponseSchema, dashboardAttestationsListRequestSchema, attestationVerifyStatusSchema, attestationListItemSchema, dashboardAttestationsListResponseSchema, dashboardArtifactsListRequestSchema, artifactListItemSchema, dashboardArtifactsListResponseSchema, attestationListSummarySchema, attestationListFiltersSchema, dashboardAttestationsListAllRequestSchema, dashboardAttestationsListAllResponseSchema, dashboardAttestationGetRequestSchema, dashboardAttestationGetResponseSchema, dashboardAttestationRetryRequestSchema, dashboardAttestationRetryResponseSchema, dashboardRunSummarySchema, dashboardRunsListRequestSchema, dashboardRunsListResponseSchema, dashboardRunsFiltersRequestSchema, dashboardRunsFiltersResponseSchema, dashboardSourceSummarySchema, dashboardSourcesListRequestSchema, dashboardSourcesListResponseSchema, dashboardAdminTokenSummarySchema, dashboardAdminTokensListRequestSchema, dashboardAdminTokensListResponseSchema, runRerunRequestSchema, runRerunResponseSchema, manualScheduleRequestSchema, manualScheduleResponseSchema, runCancelRequestSchema, runCancelResponseSchema, dashboardPayloadRequestSchema, dashboardPayloadResponseSchema, runLineageSchema, eventLogListItemSchema, dashboardEventLogListRequestSchema, dashboardEventLogListResponseSchema, dashboardEventLogDetailRequestSchema, dashboardEventLogDetailResponseSchema, dashboardEventLogActivityRequestSchema, eventLogActivityCountsSchema, dashboardEventLogActivityResponseSchema, EventLogPayloadStreamError, dashboardEventLogPayloadStreamRequestSchema, dashboardEventLogPayloadChunkSchema, browserEventLogPayloadChunkSchema, dashboardEventDlqListItemSchema, dashboardEventDlqListRequestSchema, dashboardEventDlqListResponseSchema, dashboardEventDlqCountRequestSchema, dashboardEventDlqCountResponseSchema, dashboardEventDlqRetryRequestSchema, dashboardEventDlqRetryResponseSchema, dashboardEventDlqDiscardRequestSchema, dashboardEventDlqDiscardResponseSchema, contextTypeSchema, contextListRequestSchema, contextListResponseSchema, contextGetRequestSchema, contextGetResponseSchema, contextCreateRequestSchema, contextCreateResponseSchema, contextUpdateRequestSchema, contextUpdateResponseSchema, contextTestAccessSetRequestSchema, contextTestAccessSetResponseSchema, contextDeleteRequestSchema, ContextDeleteErrorCode, contextDeleteResponseSchema, contextVarsListRequestSchema, contextVarsListResponseSchema, contextVarSetRequestSchema, contextVarSetResponseSchema, contextVarDeleteRequestSchema, contextVarDeleteResponseSchema, contextSourceOverridesListRequestSchema, contextSourceOverridesListResponseSchema, contextSourceOverrideSetRequestSchema, contextSourceOverrideSetResponseSchema, contextSourceOverrideDeleteRequestSchema, contextSourceOverrideDeleteResponseSchema, contextBindingEntrySchema, contextBindingsListRequestSchema, contextBindingsListResponseSchema, contextBindingsSetRequestSchema, contextBindingsSetResponseSchema, contextSecretsListRequestSchema, contextSecretsListResponseSchema, contextSecretSetRequestSchema, contextSecretSetResponseSchema, contextSecretDeleteRequestSchema, contextSecretDeleteResponseSchema, contextSecretScopeCreateRequestSchema, contextSecretScopeCreateResponseSchema, contextSecretScopeRenameRequestSchema, contextSecretScopeRenameResponseSchema, contextSecretScopeDeleteRequestSchema, contextSecretScopeDeleteResponseSchema, contextHistoryRequestSchema, contextHistoryResponseSchema, HeldRunQueueType, heldRunsListRequestSchema, heldRunsListResponseSchema, heldRunApproveRequestSchema, heldRunApproveResponseSchema, heldRunRejectRequestSchema, heldRunRejectResponseSchema, dashboardDiagnosticsRequestSchema, fleetPinnedRunSchema, FleetHostDisposition, fleetPreviewHostSchema, dashboardFleetHostsRequestSchema, dashboardFleetHostRequestSchema, dashboardFleetPreviewRequestSchema, dashboardFleetHostsResponseSchema, dashboardFleetHostResponseSchema, dashboardFleetPreviewResponseSchema, dashboardFleetWorkflowsForHostRequestSchema, fleetHostWorkflowSchema, dashboardFleetWorkflowsForHostResponseSchema, fleetHostDeclareRequestSchema, fleetHostDeclareResponseSchema, fleetHostRemoveRequestSchema, fleetHostRemoveResponseSchema, diagnosticsAgentSchema, diagnosticsScalerSchema, diagnosticsPeerAgentSchema, diagnosticsPeerSchema, dashboardDiagnosticsResponseSchema, dashboardScalerCapacityRequestSchema, scalerCapacityItemSchema, dashboardScalerCapacityResponseSchema, dashboardScalerAgentsRequestSchema, dashboardScalerAgentsResponseSchema, registrationDisableRequestSchema, registrationDisableResponseSchema, registrationDeleteRequestSchema, registrationDeleteResponseSchema, registrationsListRequestSchema, registrationSourceSchema, registrationItemSchema, registrationsListResponseSchema, backendsListRequestSchema, backendItemSchema, backendsListResponseSchema, backendGetRequestSchema, backendGetResponseSchema, backendsSyncAllRequestSchema, backendsSyncAllResponseSchema, backendSyncRequestSchema, backendSyncResponseSchema, backendTestRequestSchema, backendTestResponseSchema, testRelayUploadsInitRequestSchema, testRelayUploadsInitResponseSchema, testRelayTriggerRequestSchema, testRelayTriggerResponseSchema, testRelayRunStatusRequestSchema, testRelayRunStatusResponseSchema, testRelayRunLogsRequestSchema, testRelayRunLogsResponseSchema, testRelayCancelRequestSchema, testRelayCancelResponseSchema, dashboardPlatformToOrchSchema, runListPrincipalUserSchema, runListSourceSchema, runListItemSchema, diagnosticsInfraAgentSchema, diagnosticsInfraScalerSchema, diagnosticsInfraOrchestratorSchema, diagnosticsInfraAlertSchema, diagnosticsExecutionMetricsSchema, identityLinkItemSchema, memberIdentityLinkSchema, memberRoleAssignmentSchema, orgMemberSchema, DASHBOARD_REQUEST_TYPES;
 var init_dashboard = __esmMin((() => {
 	init_check_mode();
 	init_source_origin();
@@ -187780,6 +187857,40 @@ var init_dashboard = __esmMin((() => {
 		nextCursor: string$1().optional(),
 		error: string$1().optional()
 	});
+	dashboardAdminTokenSummarySchema = object({
+		id: string$1(),
+		label: string$1(),
+		/** `owner`, `admin` or `auditor` — the orchestrator's three fixed roles. */
+		role: string$1(),
+		/**
+		* The intended holder the operator recorded at `token create --subject` (an
+		* OIDC `sub` or an email), or null when nobody did. Null is the report's
+		* `unlinked` finding.
+		*/
+		subject: string$1().nullable(),
+		/**
+		* The single routing key this token is restricted to, or null for an
+		* unscoped token. Load-bearing for the report: a routing-key-scoped token is
+		* refused outright on the secret, context, org-settings and trust-policy
+		* routes, so it is materially less privileged than its role alone suggests.
+		*/
+		routingKey: string$1().nullable(),
+		createdAt: string$1(),
+		expiresAt: string$1().nullable(),
+		lastUsedAt: string$1().nullable(),
+		revoked: boolean$1()
+	});
+	dashboardAdminTokensListRequestSchema = object({
+		type: literal("dashboard.admin-tokens.list"),
+		requestId: string$1(),
+		actor: actorPrincipalSchema
+	});
+	dashboardAdminTokensListResponseSchema = object({
+		type: literal("dashboard.admin-tokens.list.response"),
+		requestId: string$1(),
+		tokens: array(dashboardAdminTokenSummarySchema),
+		error: string$1().optional()
+	});
 	runRerunRequestSchema = object({
 		type: literal("run.rerun.request"),
 		requestId: string$1(),
@@ -188858,7 +188969,18 @@ var init_dashboard = __esmMin((() => {
 		* (legacy / global-workflow rows). Mirrors the shape attached to run
 		* summaries so the dashboard can reuse the same icon/label helpers.
 		*/
-		source: registrationSourceSchema.nullable().optional()
+		source: registrationSourceSchema.nullable().optional(),
+		/**
+		* True when this registration is a global workflow — one whose trigger
+		* carries `repos:`, so it fires on events from other repos in the org.
+		*
+		* Optional because an orchestrator predating this field omits it. A reader
+		* that needs a value for such a row derives one from `triggers[].repos`,
+		* which is the same signal the orchestrator classifies on at registration
+		* time. Prefer this field when present: it mirrors the `is_global` column
+		* the dispatcher itself reads, so it cannot drift from dispatch behaviour.
+		*/
+		isGlobal: boolean$1().optional()
 	});
 	registrationsListResponseSchema = object({
 		type: literal("dashboard.registrations.list.response"),
@@ -189082,6 +189204,7 @@ var init_dashboard = __esmMin((() => {
 		dashboardRunsListRequestSchema,
 		dashboardRunsFiltersRequestSchema,
 		dashboardSourcesListRequestSchema,
+		dashboardAdminTokensListRequestSchema,
 		runRerunRequestSchema,
 		manualScheduleRequestSchema,
 		runCancelRequestSchema,
@@ -189158,6 +189281,7 @@ var init_dashboard = __esmMin((() => {
 		dashboardRunsListResponseSchema,
 		dashboardRunsFiltersResponseSchema,
 		dashboardSourcesListResponseSchema,
+		dashboardAdminTokensListResponseSchema,
 		runRerunResponseSchema,
 		manualScheduleResponseSchema,
 		runCancelResponseSchema,
@@ -189381,6 +189505,26 @@ var init_dashboard = __esmMin((() => {
 			adminInvocation: string$1().nullable(),
 			adminPath: string$1().nullable()
 		}),
+		/**
+		* Absolute host paths of this orchestrator's own config files, for an
+		* operator who wants to inspect them.
+		*
+		* Optional, and every member nullable. The Platform always emits the object
+		* — all-nulls when nothing is known — but the field is declared optional
+		* because a customer-installed `kici` CLI validates this same schema and may
+		* be pointed at a Platform that predates the field. Members are null rather
+		* than absent so a reader never has to distinguish "not sent" from "not
+		* known".
+		*
+		* Null for every connection served from the database rather than from a live
+		* in-memory registry entry: these are live-host runtime paths and are not
+		* persisted, the same treatment `deployment.adminInvocation` already gets.
+		*/
+		configPaths: object({
+			envFile: string$1().nullable(),
+			scalerConfig: string$1().nullable(),
+			composeFile: string$1().nullable()
+		}).optional(),
 		s3LogAccess: boolean$1().nullable().optional(),
 		agentCount: number$1(),
 		runningJobs: number$1(),
@@ -189721,7 +189865,7 @@ var init_dashboard_write_operations = __esmMin((() => {
 			category: "Held runs",
 			label: "Approve held run",
 			sensitivity: "dispatch",
-			cliEquivalent: "kici-admin runs approve"
+			cliEquivalent: "kici-admin held-run approve"
 		},
 		{
 			name: "held_runs.reject",
@@ -189729,7 +189873,7 @@ var init_dashboard_write_operations = __esmMin((() => {
 			category: "Held runs",
 			label: "Reject held run",
 			sensitivity: "dispatch",
-			cliEquivalent: "kici-admin runs reject"
+			cliEquivalent: "kici-admin held-run reject"
 		},
 		{
 			name: "event_dlq.retry",
@@ -189820,6 +189964,7 @@ var init_dashboard_write_operations = __esmMin((() => {
 			cliEquivalent: "kici-admin host remove"
 		}
 	]);
+	Object.freeze(["held_runs.approve", "held_runs.reject"]);
 	DASHBOARD_WRITE_OPERATIONS_BY_NAME = new Map(DASHBOARD_WRITE_OPERATIONS.map((d) => [d.name, d]));
 	new Map(DASHBOARD_WRITE_OPERATIONS.map((d) => [d.wireMessageType, d]));
 	DashboardWritePolicyState = _enum([
@@ -191112,8 +191257,13 @@ var init_peer = __esmMin((() => {
 		providerContext: record(string$1(), unknown()).optional(),
 		/** Pre-signed source tarball download URL (cache hit). */
 		sourceTarUrl: string$1().optional(),
-		/** SHA-256 hash of the source tarball bytes for integrity verification. */
+		/**
+		* @deprecated Use `sourceTarDigest` — this carries the workflow
+		* `contentHash`, not a hash of the tarball bytes.
+		*/
 		sourceTarHash: string$1().optional(),
+		/** SHA-256 of the source tarball's own bytes, for integrity verification. */
+		sourceTarDigest: string$1().optional(),
 		/** Pre-signed dependency tarball download URL (cache hit). */
 		depsUrl: string$1().optional(),
 		/** Dependency tarball hash for cache keying. */
@@ -191337,6 +191487,7 @@ var init_peer = __esmMin((() => {
 	]);
 })), CacheRefScope, invokeResultSchema, gitAuthSchema, jobDispatchSchema, jobCancelSchema, registerAckSchema, agentRegisterSchema, agentStatusSchema, jobStatusSchema, globalEvalCandidateResultSchema, JobRejectReason, jobRejectSchema, jobAckSchema, agentLogChunkSchema, agentStepStatusSchema, jobHeartbeatSchema, agentLogSchema, jobConcurrencyReportSchema, jobConcurrencyAckSchema, configAckSchema, cacheUploadRequestSchema, cacheUploadResponseSchema, cacheUploadCompleteSchema, cacheUserRestoreRequestSchema, cacheUserRestoreResponseSchema, cacheUserSaveRequestSchema, cacheUserSaveResponseSchema, cacheUserSaveCompleteSchema, provenanceUploadRequestSchema, provenanceUploadResponseSchema, provenanceUploadCompleteSchema, provenanceUploadDeferSchema, ArtifactUploadOutcome, ArtifactRejectReason, ArtifactDownloadOutcome, artifactsUploadRequestSchema, artifactsUploadResponseSchema, artifactsUploadCompleteSchema, ArtifactCompleteAckOutcome, artifactsUploadCompleteAckSchema, artifactsDownloadRequestSchema, artifactsDownloadResponseSchema, eventEmitSchema, eventEmitResponseSchema, scalerClaimCredentialsSchema, scalerClaimCredentialsResponseSchema, agentMetricsSchema, agentAuthRequestSchema, agentAuthSuccessSchema, agentAuthFailureSchema, agentApiRequestSchema, agentApiResponseSchema, fleetLogsRequestSchema, fleetBundleChunkSchema, fleetBundleErrorSchema, StepApprovalOutcome, stepApprovalPayloadSchema, stepApprovalRequestSchema, stepApprovalResolvedSchema;
 var init_orchestrator_agent = __esmMin((() => {
+	init_id_token_event_claims();
 	init_execution_status();
 	init_dsse();
 	init_types$4();
@@ -191402,8 +191553,19 @@ var init_orchestrator_agent = __esmMin((() => {
 		concurrencyWaitTimeoutMs: number().optional(),
 		/** URL or file:// path to a pre-packed `.kici/` source tarball. If present, agent extracts it into workDir instead of cloning the repo. */
 		sourceTarUrl: string$1().optional(),
-		/** SHA-256 hash of the source tarball bytes for integrity verification on download. */
+		/**
+		* @deprecated Use `sourceTarDigest`. Despite its name this carries the
+		* workflow `contentHash`, not a hash of the tarball bytes, so an agent
+		* could not verify a restored tarball against it. Kept on the wire for
+		* older agents; removed at v1.0.0.
+		*/
 		sourceTarHash: string$1().optional(),
+		/**
+		* SHA-256 of the source tarball's own bytes, for integrity verification
+		* before extraction. The sibling of `depsHash`, which has always carried
+		* the dependency tarball's real digest.
+		*/
+		sourceTarDigest: string$1().optional(),
 		/** URL or file:// path to pre-built dependency tarball. If present, agent extracts to .kici/node_modules/ instead of running install. */
 		depsUrl: string$1().optional(),
 		/** SHA-256 hash of the dependency tarball for integrity verification. */
@@ -191412,6 +191574,22 @@ var init_orchestrator_agent = __esmMin((() => {
 		requestId: string$1().optional(),
 		/** Base64-encoded X25519 public key for the workflow run (for encrypting secret outputs). */
 		runPublicKey: string$1().optional(),
+		/**
+		* The orchestrator's own view of the build, for a provenance statement the
+		* agent has to freeze before its identity token exists (the deferred path).
+		*
+		* Every field is what `buildIdTokenClaims` derives from the run row, so a
+		* frozen statement built from this is field-for-field what a live mint
+		* would have produced — and the server can therefore cross-check it. The
+		* agent's local guess is NOT: the job's checkout `ref` is a pull request's
+		* HEAD branch where the claim is the BASE branch, and `workflowRef` here is
+		* the `<name>@<sha>` claim rather than a global workflow's clone ref.
+		*
+		* Additive and optional: an older orchestrator omits it and the agent falls
+		* back to its local guess. That fallback statement fails the capture
+		* cross-check, so the defer is dropped rather than stored unchecked.
+		*/
+		provenanceContext: provenanceContextSchema.optional(),
 		/** Plain outputs from upstream jobs (keyed by job name, then by step name). Populated for downstream jobs with `needs` dependencies. */
 		upstreamJobOutputs: record(string$1(), record(string$1(), unknown())).optional(),
 		/** Terminal status of each upstream job (keyed by job name; per-child for fan-out). Powers `ctx.needs.<job>.status`. */
@@ -191772,7 +191950,18 @@ var init_orchestrator_agent = __esmMin((() => {
 		* and hashed it by the time it asks. Optional so an older agent that omits it
 		* still gets a usable (lockfile-keyed) URL during a mixed-version rollout.
 		*/
-		depsHash: string$1().optional()
+		depsHash: string$1().optional(),
+		/**
+		* SHA-256 of the source tarball about to be uploaded. Source uploads only.
+		*
+		* The source tarball is stored under its own content hash, so the
+		* orchestrator needs it to sign the upload URL — the agent has already packed
+		* and hashed it by the time it asks. Optional so an older agent that omits it
+		* still gets a usable URL during a mixed-version rollout.
+		*/
+		sourceTarDigest: string$1().optional(),
+		/** In-repo `workspace:` sibling closure digest; part of the dep pointer key. */
+		siblingsDigest: string$1().optional()
 	});
 	cacheUploadResponseSchema = object({
 		type: literal("cache.upload.response"),
@@ -191789,7 +191978,11 @@ var init_orchestrator_agent = __esmMin((() => {
 		platform: string$1(),
 		arch: string$1(),
 		/** SHA-256 hash of the dependency tarball for integrity verification. Only present for deps uploads. */
-		depsHash: string$1().optional()
+		depsHash: string$1().optional(),
+		/** SHA-256 of the source tarball's own bytes. Only present for source uploads. */
+		sourceTarDigest: string$1().optional(),
+		/** In-repo `workspace:` sibling closure digest; part of the dep pointer key. */
+		siblingsDigest: string$1().optional()
 	});
 	cacheUserRestoreRequestSchema = object({
 		type: literal("cache.user.restore.request"),
@@ -191869,8 +192062,12 @@ var init_orchestrator_agent = __esmMin((() => {
 		subjectName: string$1(),
 		/** Primary subject digest (lowercase hex). */
 		subjectDigest: string$1(),
-		/** Requested token audience for the later mint. */
-		audience: string$1(),
+		/**
+		* Requested token audience for the later mint. Bounded to match the LIVE
+		* mint's `oidcTokenRequestParamsSchema` — the two are the same
+		* agent-supplied value and had no reason to differ.
+		*/
+		audience: string$1().min(1).max(255),
 		/** Bundle media type. */
 		mediaType: string$1(),
 		/** SHA-256 of the frozen DSSE statement payload — the later-mint binding. */
@@ -202296,6 +202493,20 @@ var init_plan_type = __esmMin((() => {
 	PlanType.exclude(["free"]);
 	PlanType.options;
 	PlanType.enum.free, PlanType.enum.pro, PlanType.enum.team, PlanType.enum.business;
+})), StripeSubscriptionStatus;
+var init_subscription_status = __esmMin((() => {
+	init_zod();
+	StripeSubscriptionStatus = _enum([
+		"incomplete",
+		"incomplete_expired",
+		"trialing",
+		"active",
+		"past_due",
+		"canceled",
+		"unpaid",
+		"paused"
+	]);
+	StripeSubscriptionStatus.enum.active, StripeSubscriptionStatus.enum.trialing, StripeSubscriptionStatus.enum.past_due;
 })), InfraAlertType;
 var init_infra_alert = __esmMin((() => {
 	init_zod();
@@ -202314,6 +202525,7 @@ var init_dist$1 = __esmMin((() => {
 	init_check_mode();
 	init_source_origin();
 	init_attestation_origin();
+	init_id_token_event_claims();
 	init_common();
 	init_actor();
 	init_pat_kind();
@@ -202328,11 +202540,13 @@ var init_dist$1 = __esmMin((() => {
 	init_run_events();
 	init_event_log();
 	init_deployment_identity();
+	init_config_paths();
 	init_source_registration();
 	init_scaler_backend_type();
 	init_types$4();
 	init_presentation();
 	init_types$3();
+	init_regex_flags();
 	init_labels_match();
 	init_concurrency_strategy();
 	init_inventory();
@@ -202374,6 +202588,7 @@ var init_dist$1 = __esmMin((() => {
 	init_expand$1();
 	init_name();
 	init_plan_type();
+	init_subscription_status();
 	init_infra_alert();
 }));
 //#endregion
@@ -203445,6 +203660,25 @@ var init_outputs = __esmMin((() => {
 function assertSecretName(value, field, subject = "git credential") {
 	if (value.startsWith("-----BEGIN") || /^gh[pousr]_/.test(value) || value.startsWith("github_pat_")) throw new Error(`${subject} '${field}' looks like the credential itself, not the name of a secret holding it. Store it with \`kici-admin secret set\` and name it here.`);
 }
+/**
+* Every `<name>Secret` field in a credential map names a secret in qualified
+* `<context>:<secret-name>` form, and never carries the material itself.
+*
+* `subject` is the declaring surface as the author wrote it — `job('build')` or
+* `dynamicJob('reports')` — so a message names the call the author can find.
+* A `<name>Value` sibling is material by design and is not checked here.
+*/
+function validateGitCredentials(subject, credentials) {
+	for (const [alias, ref] of Object.entries(credentials)) {
+		const bag = ref;
+		for (const [field, value] of Object.entries(bag)) {
+			if (!field.endsWith("Secret") || typeof value !== "string") continue;
+			assertSecretName(value, `${alias}.${field}`);
+			const idx = value.indexOf(":");
+			if (idx <= 0 || idx >= value.length - 1 || value.slice(idx + 1).includes(":")) throw new Error(`${subject}: gitCredentials.${alias}.${field} must use qualified <context>:<secret-name> syntax (got: ${value})`);
+		}
+	}
+}
 var init_git_types = __esmMin((() => {}));
 //#endregion
 //#region ../sdk/dist/job.js
@@ -203497,7 +203731,7 @@ function job(nameOrOptions, maybeOptions) {
 	if (options.runsOn !== void 0 && options.runsOnAll !== void 0) throw new Error(`job('${name}'): runsOn and runsOnAll are mutually exclusive`);
 	if (options.container !== void 0) validateContainerImageSource(name, options.container);
 	if (options.container && typeof options.container === "object" && options.container.auth) validateContainerAuth(name, options.container.auth);
-	if (options.gitCredentials) validateGitCredentials(name, options.gitCredentials);
+	if (options.gitCredentials) validateGitCredentials(`job('${name}')`, options.gitCredentials);
 	if (options.invoke === void 0 && options.runsOn === void 0 && options.runsOnAll === void 0) throw new Error(`job('${name}'): one of runsOn or runsOnAll is required`);
 	if (options.onUnreachable !== void 0 && options.runsOnAll === void 0) console.warn(`[kici] job('${name}'): onUnreachable is ignored without runsOnAll`);
 	if (options.includeUninitialized !== void 0 && options.runsOnAll === void 0) console.warn(`[kici] job('${name}'): includeUninitialized is ignored without runsOnAll`);
@@ -203615,17 +203849,6 @@ function validateContainerAuth(name, auth) {
 		if (idx <= 0 || idx >= value.length - 1 || value.slice(idx + 1).includes(":")) throw new Error(`job('${name}'): container.auth.${field} must use qualified <context>:<secret-name> syntax (got: ${value})`);
 	}
 }
-function validateGitCredentials(name, credentials) {
-	for (const [alias, ref] of Object.entries(credentials)) {
-		const bag = ref;
-		for (const [field, value] of Object.entries(bag)) {
-			if (!field.endsWith("Secret") || typeof value !== "string") continue;
-			assertSecretName(value, `${alias}.${field}`);
-			const idx = value.indexOf(":");
-			if (idx <= 0 || idx >= value.length - 1 || value.slice(idx + 1).includes(":")) throw new Error(`job('${name}'): gitCredentials.${alias}.${field} must use qualified <context>:<secret-name> syntax (got: ${value})`);
-		}
-	}
-}
 var init_job = __esmMin((() => {
 	init_outputs();
 	init_git_types();
@@ -204124,12 +204347,17 @@ var init_invoke = __esmMin((() => {
 /**
 * Convert a string or RegExp to a BranchPattern.
 * Strings become glob patterns, RegExp becomes regex patterns.
+*
+* `g` and `y` are dropped from the author's flags: the matcher memoizes one
+* `RegExp` per (flags, pattern), and a sticky instance carries `lastIndex`
+* between calls — so `/^release-\d+/g` would match `release-1`, miss
+* `release-2`, and match `release-3`, silently skipping every second push.
 */
 function toBranchPattern(input) {
 	if (input instanceof RegExp) return {
 		type: "regex",
 		pattern: input.source,
-		flags: input.flags || void 0
+		flags: normalizeRegexFlags(input.flags)
 	};
 	return {
 		type: "glob",
@@ -204144,6 +204372,7 @@ function asArray(value) {
 }
 var DEFAULT_PR_EVENTS;
 var init_types$2 = __esmMin((() => {
+	init_dist$1();
 	DEFAULT_PR_EVENTS = [
 		"opened",
 		"synchronize",
@@ -204283,12 +204512,16 @@ var init_tag = __esmMin((() => {
 /**
 * Convert a string or RegExp to a BodyMatchPattern.
 * Strings become glob patterns, RegExp becomes regex patterns.
+*
+* `g` and `y` are dropped for the same reason as `toBranchPattern`: the reader
+* memoizes the compiled instance, so a sticky one alternates verdicts between
+* comments.
 */
 function toBodyMatchPattern(input) {
 	if (input instanceof RegExp) return {
 		type: "regex",
 		pattern: input.source,
-		flags: input.flags || void 0
+		flags: normalizeRegexFlags(input.flags)
 	};
 	return {
 		type: "glob",
@@ -204322,6 +204555,7 @@ function comment(config) {
 }
 var init_comment = __esmMin((() => {
 	init_types$2();
+	init_dist$1();
 }));
 //#endregion
 //#region ../sdk/dist/triggers/review.js
@@ -204871,6 +205105,27 @@ function defineDispatchInputs(map) {
 }
 var init_dispatch_inputs = __esmMin((() => {}));
 //#endregion
+//#region ../sdk/dist/triggers/index.js
+var init_triggers = __esmMin((() => {
+	init_types$2();
+	init_pr();
+	init_push();
+	init_tag();
+	init_comment();
+	init_review();
+	init_review_comment();
+	init_release();
+	init_dispatch();
+	init_create();
+	init_delete();
+	init_status();
+	init_workflow_run();
+	init_fork();
+	init_star();
+	init_watch();
+	init_webhook();
+}));
+//#endregion
 //#region ../sdk/dist/hooks/index.js
 /**
 * Normalize HookInput to extract run function and optional timeout.
@@ -205225,12 +205480,16 @@ function isDynamicJobFn(item) {
 * Two forms:
 * - **Function form** (event-only): `dynamicJob('shards', async ({ ctx }) => [...])`.
 *   Dispatched at webhook time; deterministic from `ctx.event` alone.
-* - **Options form** (result-aware): `dynamicJob('reports', { needs, generate })`.
-*   Deferred until every job/group in `needs` completes, then `generate` is
-*   evaluated with the upstreams' frozen outputs available as `ctx.needs`.
+* - **Options form**: `dynamicJob('reports', { needs, generate, gitCredentials })`.
+*   With `needs` it is result-aware — deferred until every job/group in `needs`
+*   completes, then `generate` is evaluated with the upstreams' frozen outputs
+*   available as `ctx.needs`. `needs` is optional: without it the generator is
+*   dispatched at webhook time, as the function form is. `gitCredentials`
+*   declares the named credentials every generated job inherits, and only the
+*   options form can carry it.
 *
 * @param groupName - The group name (must match what static jobs reference)
-* @param fnOrConfig - The generator function, or a result-aware `{ needs, generate }` config
+* @param fnOrConfig - The generator function, or a `{ needs, generate, gitCredentials }` config
 */
 function dynamicJob(groupName, fnOrConfig) {
 	const isConfig = typeof fnOrConfig !== "function";
@@ -205239,10 +205498,17 @@ function dynamicJob(groupName, fnOrConfig) {
 		value: groupName,
 		enumerable: false
 	});
-	if (isConfig) Object.defineProperty(tagged, DYNAMIC_JOB_NEEDS_TAG, {
+	if (isConfig && fnOrConfig.needs) Object.defineProperty(tagged, DYNAMIC_JOB_NEEDS_TAG, {
 		value: fnOrConfig.needs,
 		enumerable: false
 	});
+	if (isConfig && fnOrConfig.gitCredentials) {
+		validateGitCredentials(`dynamicJob('${groupName}')`, fnOrConfig.gitCredentials);
+		Object.defineProperty(tagged, DYNAMIC_JOB_GIT_CREDENTIALS_TAG, {
+			value: fnOrConfig.gitCredentials,
+			enumerable: false
+		});
+	}
 	return tagged;
 }
 /**
@@ -205259,10 +205525,19 @@ function getDynamicJobGroup(fn) {
 function getDynamicJobNeeds(fn) {
 	return fn[DYNAMIC_JOB_NEEDS_TAG];
 }
-var DYNAMIC_JOB_GROUP_TAG, DYNAMIC_JOB_NEEDS_TAG;
+/**
+* Read the named git credentials a generator declared.
+* Returns undefined for the bare function form, which cannot declare any.
+*/
+function getDynamicJobGitCredentials(fn) {
+	return fn[DYNAMIC_JOB_GIT_CREDENTIALS_TAG];
+}
+var DYNAMIC_JOB_GROUP_TAG, DYNAMIC_JOB_NEEDS_TAG, DYNAMIC_JOB_GIT_CREDENTIALS_TAG;
 var init_types$1 = __esmMin((() => {
+	init_git_types();
 	DYNAMIC_JOB_GROUP_TAG = Symbol.for("kici:dynamicJobGroup");
 	DYNAMIC_JOB_NEEDS_TAG = Symbol.for("kici:dynamicJobNeeds");
+	DYNAMIC_JOB_GIT_CREDENTIALS_TAG = Symbol.for("kici:dynamicJobGitCredentials");
 }));
 //#endregion
 //#region ../sdk/dist/needs-context.js
@@ -205579,6 +205854,7 @@ var dist_exports = /* @__PURE__ */ __exportAll({
 	CacheSpecSchema: () => CacheSpecSchema,
 	ChangedFilesUnavailableError: () => ChangedFilesUnavailableError,
 	DYNAMIC_GROUP_TAG: () => DYNAMIC_GROUP_TAG,
+	DYNAMIC_JOB_GIT_CREDENTIALS_TAG: () => DYNAMIC_JOB_GIT_CREDENTIALS_TAG,
 	DYNAMIC_JOB_GROUP_TAG: () => DYNAMIC_JOB_GROUP_TAG,
 	DYNAMIC_JOB_NEEDS_TAG: () => DYNAMIC_JOB_NEEDS_TAG,
 	SCALER_EVENT_NAMES: () => SCALER_EVENT_NAMES,
@@ -205617,6 +205893,7 @@ var dist_exports = /* @__PURE__ */ __exportAll({
 	flattenStepInputs: () => flattenStepInputs,
 	fork: () => fork,
 	genericWebhook: () => genericWebhook,
+	getDynamicJobGitCredentials: () => getDynamicJobGitCredentials,
 	getDynamicJobGroup: () => getDynamicJobGroup,
 	getDynamicJobNeeds: () => getDynamicJobNeeds,
 	getJobOutputsMap: () => getJobOutputsMap,
@@ -205725,6 +206002,7 @@ var init_dist = __esmMin((() => {
 	init_schedule();
 	init_lifecycle();
 	init_dispatch_inputs();
+	init_triggers();
 	init_hooks();
 	init_rule();
 	init_context();
@@ -205745,6 +206023,21 @@ var init_dist = __esmMin((() => {
 	init_zod();
 }));
 //#endregion
+//#region ../sdk/dist/internal.js
+init_dist();
+init_api_types();
+init_approval();
+init_cache_types();
+init_filter_context();
+init_outputs();
+init_context();
+init_evaluator();
+init_rules();
+init_needs_context();
+init_secrets();
+init_expand();
+init_matrix();
+//#endregion
 //#region ../../node_modules/.pnpm/jose@6.2.10/node_modules/jose/dist/webapi/lib/buffer_utils.js
 const encoder = new TextEncoder();
 const decoder = new TextDecoder();
@@ -206239,13 +206532,21 @@ async function generateKeyPair(alg, options) {
 }
 //#endregion
 //#region ../engine/dist/provenance/statement-hash.js
-init_dist();
 /**
-* Lowercase-hex SHA-256 of the DSSE statement payload bytes. This is the binding
-* a deferred OIDC mint commits to (truth-contract property 2): the later token
-* carries this hash as a claim so the Platform identity cannot be re-bound to a
-* different frozen statement at retry time. Browser-safe: `crypto.subtle` only,
-* so the verifier (dashboard + CLI) can recompute it.
+* Lowercase-hex SHA-256 of the DSSE statement payload bytes.
+*
+* One of the two bindings a deferred OIDC mint commits to: the later token
+* carries this hash as a claim, so the identity cannot be re-bound to a
+* different frozen statement at retry time.
+*
+* It is a binding, not a substitute for the build-context cross-check. The
+* verifier requires BOTH for a non-live origin — the hash proves the statement
+* has not been swapped, and the cross-check proves the statement agrees with
+* the run the token names. A hash-only rule verified a bundle whose statement
+* claimed a release SHA the build never touched.
+*
+* Browser-safe: `crypto.subtle` only, so the verifier (dashboard + CLI) can
+* recompute it.
 */
 async function computeStatementHash(payload) {
 	const digest = await crypto.subtle.digest("SHA-256", payload);
@@ -206407,7 +206708,12 @@ inTotoStatementSchema.extend({
 * for a deferred attestation (no minted identity token yet). Marks
 * `attestationOrigin: 'deferred'` in the internal parameters. The caller
 * DSSE-signs the returned statement immediately and computes its statement hash
-* — the binding the later OIDC mint commits to (truth-contract property 2).
+* — one of the two bindings the later OIDC mint commits to.
+*
+* Emits the same fields `buildProvenanceStatement` emits, so a statement frozen
+* from an orchestrator-supplied context is field-for-field what a live mint
+* would have produced. That is what lets the orchestrator cross-check the
+* statement against its own run row before signing anything that commits to it.
 */
 function buildLocalProvenanceStatement(input) {
 	const c = input.context;
@@ -206421,11 +206727,14 @@ function buildLocalProvenanceStatement(input) {
 		predicate: {
 			buildDefinition: {
 				buildType: KICI_WORKFLOW_BUILD_TYPE,
-				externalParameters: { workflow: {
-					repository: c.repository,
-					ref: c.ref,
-					path: c.workflowRef
-				} },
+				externalParameters: {
+					workflow: {
+						repository: c.repository,
+						ref: c.ref,
+						path: c.workflowRef
+					},
+					...c.provider ? { provider: c.provider } : {}
+				},
 				internalParameters: {
 					...c.sha ? { commit: c.sha } : {},
 					runId: c.runId,
@@ -206437,7 +206746,7 @@ function buildLocalProvenanceStatement(input) {
 			},
 			runDetails: {
 				builder: {
-					id: `${c.issuer}/orchestrator/unknown`,
+					id: `${c.issuer}/orchestrator/${c.orchestratorId ?? "unknown"}`,
 					version: input.builderVersions
 				},
 				metadata: {
@@ -210720,15 +211029,6 @@ function createArtifactsApi(workDir, transport, roots) {
 }
 //#endregion
 //#region src/execution/sandbox/log-masker.ts
-/**
-* Secret value masking for log lines.
-*
-* Replaces all occurrences of registered secret values with '***' in log output.
-* Used by the workflow runner to prevent secret leaks in IPC log messages.
-*
-* Performance: Builds a single combined regex from all secret values, so each
-* log line is scanned in a single pass (not O(secrets * lines)).
-*/
 /** Minimum length for a secret value to be maskable (avoids false positives). */
 const MIN_MASK_LENGTH = 3;
 /**
@@ -210759,18 +211059,38 @@ var LogMasker = class {
 	* Authorization: Basic headers, base64-encoded config values).
 	* Values are sorted by length descending so longer values are matched first
 	* (prevents partial masking when one secret is a substring of another).
+	*
+	* Multi-line values additionally register each of their individual lines.
+	* Log output is split into lines before it reaches the masker, so a value
+	* containing a newline can never match as a whole — a PEM private key or a
+	* kubeconfig would otherwise stream in clear text. Two consequences of the
+	* per-line registration are deliberate:
+	*
+	* - `MIN_MASK_LENGTH` is 3, so short structural lines of a structured secret
+	*   are registered too. A `---` YAML separator or a bare `{` from a
+	*   service-account JSON is masked wherever it appears in that job's logs.
+	* - PEM header and footer lines (`-----BEGIN OPENSSH PRIVATE KEY-----`) are
+	*   not secret on their own and are masked as a side effect.
+	*
+	* Both are strictly safer than leaking the body, and no heuristic separates a
+	* structural line from a body line without risking the reverse mistake.
 	*/
 	registerSecrets(secrets) {
 		const seen = /* @__PURE__ */ new Set();
 		const values = [];
-		for (const value of Object.values(secrets)) if (value.length >= MIN_MASK_LENGTH && !seen.has(value)) {
-			seen.add(value);
-			values.push(value);
-			const b64 = Buffer.from(value).toString("base64");
+		const add = (candidate) => {
+			if (candidate.length < MIN_MASK_LENGTH || seen.has(candidate)) return;
+			seen.add(candidate);
+			values.push(candidate);
+			const b64 = Buffer.from(candidate).toString("base64");
 			if (b64.length >= MIN_MASK_LENGTH && !seen.has(b64)) {
 				seen.add(b64);
 				values.push(b64);
 			}
+		};
+		for (const value of Object.values(secrets)) {
+			add(value);
+			if (value.includes("\n")) for (const rawLine of value.split("\n")) add(rawLine.endsWith("\r") ? rawLine.slice(0, -1) : rawLine);
 		}
 		if (values.length === 0) {
 			this.pattern = null;
@@ -210796,6 +211116,57 @@ var LogMasker = class {
 		return this.pattern !== null;
 	}
 };
+/**
+* Create a LogMasker initialized with all secret values from the request.
+*
+* Collects values from both flat secrets and all namespaced context secrets,
+* deduplicating before registration.
+*
+* Both the runner child and the agent-side fork runner build a masker from the
+* same request, so the crash tail the agent assembles from the child's stderr is
+* masked with the same value set the child used for its own log lines.
+*/
+function createSecretMasker(request) {
+	const masker = new LogMasker();
+	const allSecrets = {};
+	if (request.secrets) Object.assign(allSecrets, request.secrets);
+	if (request.namespacedSecrets) for (const contextSecrets of Object.values(request.namespacedSecrets)) Object.assign(allSecrets, contextSecrets);
+	masker.registerSecrets(allSecrets);
+	return masker;
+}
+/**
+* Mask every operator-visible text field of an outbound runner message.
+*
+* Each message type carrying free text is named here, so a new text-bearing
+* message type is a visible omission rather than a silent leak. `step.complete`
+* error text and the `job.complete` failure reason are persisted on the step and
+* run rows the dashboard renders, so they need the same masking `log.line` gets.
+*
+* Returns the message unchanged when no secrets are registered.
+*/
+function maskMessageText(msg, masker) {
+	if (!masker.hasSecrets()) return msg;
+	switch (msg.type) {
+		case "log.line": return {
+			...msg,
+			line: masker.mask(msg.line)
+		};
+		case "step.complete": return msg.error ? {
+			...msg,
+			error: {
+				...msg.error,
+				message: masker.mask(msg.error.message)
+			}
+		} : msg;
+		case "job.complete": {
+			const masked = { ...msg };
+			if (masked.error !== void 0) masked.error = masker.mask(masked.error);
+			if (masked.droppedJobs) masked.droppedJobs = masked.droppedJobs.map((j) => masker.mask(j));
+			return masked;
+		}
+		default: return msg;
+	}
+}
 //#endregion
 //#region src/execution/sandbox/env-delta.ts
 /**
@@ -210977,18 +211348,23 @@ async function executeHook(opts) {
 		step_type: `hook:${hookType}`
 	});
 	const startTime = Date.now();
+	const abortController = new AbortController();
+	let rejectTimeout = () => {};
+	const timeoutRace = new Promise((_, reject) => {
+		rejectTimeout = reject;
+	});
+	const timeoutId = setTimeout(() => {
+		rejectTimeout(/* @__PURE__ */ new Error(`Hook '${normalized.name}' timed out after ${timeoutMs}ms`));
+		abortController.abort();
+	}, timeoutMs);
 	const mergedCtx = {
 		...stepContext,
-		outcome
+		outcome,
+		signal: AbortSignal.any([...stepContext.signal ? [stepContext.signal] : [], abortController.signal]),
+		...typeof stepContext.$ === "function" ? { $: stepContext.$({ signal: abortController.signal }) } : {}
 	};
-	const abortController = new AbortController();
-	const timeoutId = setTimeout(() => abortController.abort(), timeoutMs);
 	try {
-		await Promise.race([normalized.run(mergedCtx), new Promise((_, reject) => {
-			abortController.signal.addEventListener("abort", () => {
-				reject(/* @__PURE__ */ new Error(`Hook '${normalized.name}' timed out after ${timeoutMs}ms`));
-			});
-		})]);
+		await Promise.race([normalized.run(mergedCtx), timeoutRace]);
 		clearTimeout(timeoutId);
 		sendIpc({
 			type: "step.complete",
@@ -211130,7 +211506,6 @@ async function runParallelGroup(node, opts) {
 }
 //#endregion
 //#region src/execution/sandbox/step-loop.ts
-init_dist();
 init_dist$1();
 init_idempotency();
 init_dist$4();
@@ -211257,12 +211632,12 @@ const STEP_FAILURE_LOG_MAX_CHARS = 8192;
 * One consequence to know: a `$({ quiet: true })` command's output is kept out
 * of the log by the `verbose` gate in `streaming-zx-log.ts`, but when such a
 * command FAILS, zx packs its captured output into the thrown error's message —
-* which this function then writes to the log. That text is already persisted
-* unmasked on `step.complete` (the step row the dashboard renders), so the copy
-* written here is the more protected of the two, and surfacing it is the whole
-* point: a quiet command that fails is exactly the failure an operator cannot
-* otherwise diagnose. Registered secret values are masked; anything the masker
-* has never been told about is not.
+* which this function then writes to the log. Surfacing it is the whole point:
+* a quiet command that fails is exactly the failure an operator cannot
+* otherwise diagnose. The same text also travels on `step.complete` for the step
+* row the dashboard renders, and both copies pass the masker — `maskMessageText`
+* masks `step.complete.error.message` alongside `log.line`. Registered secret
+* values are masked; anything the masker has never been told about is not.
 */
 function emitStepFailureLog(stepName, stepIndex, message, sendFn) {
 	const prefix = `[kici] Step '${stepName}' failed: `;
@@ -211299,16 +211674,29 @@ async function executeStepInLoop(step, stepIndex, ctx, timeoutMs, sendFn, output
 	});
 	const startTime = Date.now();
 	const abortController = new AbortController();
-	const timeoutId = setTimeout(() => abortController.abort(), timeoutMs);
+	let timedOut = false;
+	let rejectTimeout = () => {};
+	const timeoutRace = new Promise((_, reject) => {
+		rejectTimeout = reject;
+	});
+	const timeoutId = setTimeout(() => {
+		timedOut = true;
+		rejectTimeout(/* @__PURE__ */ new Error(`Step '${step.name}' timed out after ${timeoutMs}ms`));
+		abortController.abort();
+		opts.abortStep?.(stepIndex);
+	}, timeoutMs);
 	const stepAbortSignal = opts.getStepAbortSignal?.(stepIndex);
+	const stepPromise = runStepWithCheckMode(step, stepIndex, ctx, checkMode, sendFn, opts);
+	let stepSettled = false;
+	const stepSettledPromise = stepPromise.then(() => {
+		stepSettled = true;
+	}, () => {
+		stepSettled = true;
+	});
 	try {
 		const phase = await Promise.race([
-			runStepWithCheckMode(step, stepIndex, ctx, checkMode, sendFn, opts),
-			new Promise((_, reject) => {
-				abortController.signal.addEventListener("abort", () => {
-					reject(/* @__PURE__ */ new Error(`Step '${step.name}' timed out after ${timeoutMs}ms`));
-				});
-			}),
+			stepPromise,
+			timeoutRace,
 			new Promise((_, reject) => {
 				if (!jobDeadlineSignal) return;
 				if (jobDeadlineSignal.aborted) {
@@ -211325,7 +211713,10 @@ async function executeStepInLoop(step, stepIndex, ctx, timeoutMs, sendFn, output
 					reject(new StepCancelledError(step.name));
 					return;
 				}
-				stepAbortSignal.addEventListener("abort", () => reject(new StepCancelledError(step.name)));
+				stepAbortSignal.addEventListener("abort", () => {
+					if (timedOut) return;
+					reject(new StepCancelledError(step.name));
+				});
 			})
 		]);
 		clearTimeout(timeoutId);
@@ -211357,6 +211748,15 @@ async function executeStepInLoop(step, stepIndex, ctx, timeoutMs, sendFn, output
 		clearTimeout(timeoutId);
 		const durationMs = Date.now() - startTime;
 		const error = e instanceof Error ? e : new Error(String(e));
+		if (timedOut && !stepSettled) {
+			await Promise.race([stepSettledPromise, delayUnref(STEP_ABORT_GRACE_MS)]);
+			if (!stepSettled) sendFn({
+				type: "log.line",
+				stepIndex,
+				line: `[timeout] Step '${step.name}' did not stop within ${STEP_ABORT_GRACE_MS}ms of its abort signal; continuing without it.`,
+				stream: LogStream.enum.stderr
+			});
+		}
 		if (e instanceof StepCancelledError) {
 			const secretsAccessed = getSecretsAccessLog?.(stepIndex);
 			emitSecretMountEvents(getSecretMountRecords?.(stepIndex), stepIndex, sendFn);
@@ -211405,6 +211805,17 @@ async function executeStepInLoop(step, stepIndex, ctx, timeoutMs, sendFn, output
 	}
 }
 /**
+* How long a timed-out step is given to unwind after its abort signal fires,
+* before the loop reports that the step ignored it and moves on.
+*/
+const STEP_ABORT_GRACE_MS = 2e3;
+/** A timer-backed delay that never keeps the process alive on its own. */
+function delayUnref(ms) {
+	return new Promise((resolve) => {
+		setTimeout(resolve, ms).unref?.();
+	});
+}
+/**
 * Emit one `step.secret_mount` IPC event per `mountFile` / `exposeFile` call
 * the step performed. Called from both the success and failure paths so the
 * orchestrator's audit trail records every mount regardless of step outcome.
@@ -212847,10 +213258,12 @@ function redactNpmOutput(input, tokens) {
 *
 * `nodeLinker: node-modules` makes berry lay down a real `node_modules` tree
 * (no PnP `.pnp.cjs`), so the agent's packer / restore / sibling-walk /
-* workflow-loader work unchanged. `enableScripts: false` (when a private
-* registry is configured) keeps dependency lifecycle scripts from seeing the
-* synthesized token env vars — the same security model as npm/pnpm/classic
-* `--ignore-scripts`.
+* workflow-loader work unchanged. `enableScripts: false` keeps dependency
+* lifecycle scripts from running at all — for every install, not only one
+* against a private registry — the same security model as npm/pnpm/classic
+* `--ignore-scripts`. An operator opts back in with
+* `KICI_ALLOW_INSTALL_SCRIPTS=true`, which arrives here as
+* `ignoreScripts: false`.
 *
 * Reuses the same `ApplyNpmRegistryConfigArgs` / `ApplyNpmRegistryConfigResult`
 * shapes as the npm overlay so `dep-installer` can pick either by flavor.
@@ -212899,8 +213312,8 @@ async function applyYarnrcBerryConfig(args) {
 	};
 	const tokenEnv = {};
 	const tokensForRedaction = [];
+	if (args.ignoreScripts !== false) merged.enableScripts = false;
 	if (hasPrivateRegistry) {
-		merged.enableScripts = false;
 		const npmScopes = { ...doc.npmScopes ?? {} };
 		for (let i = 0; i < registries.length; i++) {
 			const reg = registries[i];
@@ -213238,9 +213651,11 @@ function isAbsoluteRel(rel) {
 * Security: the install runs with an isolated per-invocation cache/store
 * directory to prevent cache poisoning across build jobs — a malicious
 * package.json in one repo cannot taint the cache used by subsequent builds.
-* The same pressure rules out letting lifecycle scripts see synthesized auth
-* env vars — the install runs with `--ignore-scripts` whenever a private
-* registry is configured.
+* The install runs with `--ignore-scripts` for every package manager. A
+* lifecycle script in a committed `package.json` is customer code the agent
+* never agreed to execute: it would run wherever the install runs, which for a
+* step-child install is the process holding the job's secrets. Operators who
+* genuinely need it set `KICI_ALLOW_INSTALL_SCRIPTS=true` on the agent.
 */
 init_tmp();
 init_dist$2();
@@ -213278,9 +213693,11 @@ async function detectKiciYarnFlavor(repoRoot, kiciDir) {
 * between build jobs; the directory is removed after installation.
 *
 * If `opts.npmRegistries` / `opts.installEnvSecrets` is provided, a job-scoped
-* `.kici/.npmrc` overlay is synthesized for the install, restored in `finally`,
-* and the install runs with `--ignore-scripts` so lifecycle scripts in a
-* committed `package.json` cannot exfiltrate the synthesized token env vars.
+* `.kici/.npmrc` overlay is synthesized for the install and restored in
+* `finally`.
+*
+* Lifecycle scripts are disabled for every package manager unless the operator
+* set `opts.allowInstallScripts`.
 *
 * @param kiciDir - Path to the `.kici/` directory containing package.json.
 * @param opts    - Optional registry / installEnv / repoRoot configuration.
@@ -213302,13 +213719,15 @@ async function installDeps(kiciDir, opts = {}) {
 		yarnFlavor
 	});
 	const startTime = Date.now();
-	const hasPrivateRegistry = (opts.npmRegistries?.length ?? 0) > 0 || (opts.installEnvSecrets ? Object.keys(opts.installEnvSecrets).length > 0 : false);
+	const ignoreScripts = opts.allowInstallScripts !== true;
+	const baseEnv = opts.baseEnv ?? process.env;
 	const isBerry = packageManager === PackageManager.Yarn && yarnFlavor === YarnFlavor.Berry;
 	const registryConfig = isBerry ? await applyYarnrcBerryConfig({
 		kiciDir,
 		npmRegistries: opts.npmRegistries,
 		installEnvSecrets: opts.installEnvSecrets,
-		jobIdShort: opts.jobIdShort ?? "00000000"
+		jobIdShort: opts.jobIdShort ?? "00000000",
+		ignoreScripts
 	}) : await applyNpmRegistryConfig({
 		kiciDir,
 		npmRegistries: opts.npmRegistries,
@@ -213318,22 +213737,26 @@ async function installDeps(kiciDir, opts = {}) {
 	try {
 		if (packageManager === PackageManager.Pnpm) await runPnpmInstall({
 			kiciDir,
-			hasPrivateRegistry,
-			registryConfig
+			ignoreScripts,
+			registryConfig,
+			baseEnv
 		});
 		else if (isBerry) await runYarnBerryInstall({
 			kiciDir,
-			registryConfig
+			registryConfig,
+			baseEnv
 		});
 		else if (packageManager === PackageManager.Yarn) await runYarnInstall({
 			kiciDir,
-			hasPrivateRegistry,
-			registryConfig
+			ignoreScripts,
+			registryConfig,
+			baseEnv
 		});
 		else await runNpmInstall({
 			kiciDir,
-			hasPrivateRegistry,
-			registryConfig
+			ignoreScripts,
+			registryConfig,
+			baseEnv
 		});
 	} catch (e) {
 		const tokens = registryConfig.tokensForRedaction;
@@ -213343,8 +213766,8 @@ async function installDeps(kiciDir, opts = {}) {
 	} finally {
 		await registryConfig.cleanup();
 	}
-	if (packageManager === PackageManager.Pnpm && await kiciHasLocalProtocolDeps(kiciDir)) await buildWorkspaceClosure(repoRoot);
-	if (packageManager === PackageManager.Yarn) await buildYarnWorkspaceClosure(repoRoot, kiciDir, yarnFlavor);
+	if (packageManager === PackageManager.Pnpm && await kiciHasLocalProtocolDeps(kiciDir)) await buildWorkspaceClosure(repoRoot, baseEnv);
+	if (packageManager === PackageManager.Yarn) await buildYarnWorkspaceClosure(repoRoot, kiciDir, yarnFlavor, baseEnv);
 	const durationMs = Date.now() - startTime;
 	process.stderr.write(`[dep-installer:trace] install complete: ${durationMs}ms\n`);
 	logger$2.info("Deps installed inline", {
@@ -213352,20 +213775,26 @@ async function installDeps(kiciDir, opts = {}) {
 		durationMs
 	});
 }
-/** Build the Node binary directory onto PATH so spawned tools find `node`. */
-function envWithNodeOnPath(extraEnv, nodeDir) {
-	const { NODE_ENV: _NODE_ENV, ...restEnv } = process.env;
+/**
+* Build the Node binary directory onto PATH so spawned tools find `node`.
+*
+* `baseEnv` is the caller's declared environment for the subprocess. It
+* defaults to `process.env` because inside the runner child that IS the
+* sanitized job environment; an agent-process caller passes a sanitized base.
+*/
+function envWithNodeOnPath(extraEnv, nodeDir, baseEnv = process.env) {
+	const { NODE_ENV: _NODE_ENV, ...restEnv } = baseEnv;
 	return {
 		...restEnv,
 		...extraEnv,
-		PATH: `${nodeDir}${process.platform === "win32" ? ";" : ":"}${process.env.PATH ?? ""}`
+		PATH: `${nodeDir}${process.platform === "win32" ? ";" : ":"}${restEnv.PATH ?? ""}`
 	};
 }
 /** Run `npm install` in `.kici/` with an isolated cache directory. */
 async function runNpmInstall(args) {
 	const { npmCliPath, nodeExe, nodeDir } = resolveNpm();
 	const { path: cacheDir, cleanup } = await makeTempDir("npm-cache");
-	const env = envWithNodeOnPath(args.registryConfig.extraEnv, nodeDir);
+	const env = envWithNodeOnPath(args.registryConfig.extraEnv, nodeDir, args.baseEnv);
 	const buildArgs = (...prefix) => {
 		const a = [
 			...prefix,
@@ -213375,7 +213804,7 @@ async function runNpmInstall(args) {
 			"--no-audit",
 			"--no-fund"
 		];
-		if (args.hasPrivateRegistry) a.push("--ignore-scripts");
+		if (args.ignoreScripts) a.push("--ignore-scripts");
 		return a;
 	};
 	try {
@@ -213404,7 +213833,7 @@ async function runPnpmInstall(args) {
 	await assertPnpmAvailable();
 	const { nodeDir } = resolveNpm();
 	const { path: storeDir, cleanup } = await makeTempDir("pnpm-store");
-	const env = envWithNodeOnPath(args.registryConfig.extraEnv, nodeDir);
+	const env = envWithNodeOnPath(args.registryConfig.extraEnv, nodeDir, args.baseEnv);
 	const argv = [
 		"install",
 		`--config.store-dir=${storeDir}`,
@@ -213413,7 +213842,7 @@ async function runPnpmInstall(args) {
 		"--config.side-effects-cache=false",
 		PNPM_IGNORE_BUILD_GATE_ARG
 	];
-	if (args.hasPrivateRegistry) argv.push("--ignore-scripts");
+	if (args.ignoreScripts) argv.push("--ignore-scripts");
 	try {
 		process.stderr.write(`[dep-installer:trace] running: pnpm ${argv.join(" ")}\n`);
 		await execFileAsync("pnpm", argv, {
@@ -213427,7 +213856,7 @@ async function runPnpmInstall(args) {
 	}
 }
 /** Pure: argv for `yarn install` with an isolated cache folder. */
-function buildYarnInstallArgs(cacheDir, hasPrivateRegistry) {
+function buildYarnInstallArgs(cacheDir, ignoreScripts) {
 	const a = [
 		"install",
 		"--cache-folder",
@@ -213435,7 +213864,7 @@ function buildYarnInstallArgs(cacheDir, hasPrivateRegistry) {
 		"--non-interactive",
 		"--no-progress"
 	];
-	if (hasPrivateRegistry) a.push("--ignore-scripts");
+	if (ignoreScripts) a.push("--ignore-scripts");
 	return a;
 }
 /**
@@ -213450,8 +213879,8 @@ async function runYarnInstall(args) {
 	await assertYarnAvailable();
 	const { nodeDir } = resolveNpm();
 	const { path: cacheDir, cleanup } = await makeTempDir("yarn-cache");
-	const env = envWithNodeOnPath(args.registryConfig.extraEnv, nodeDir);
-	const argv = buildYarnInstallArgs(cacheDir, args.hasPrivateRegistry);
+	const env = envWithNodeOnPath(args.registryConfig.extraEnv, nodeDir, args.baseEnv);
+	const argv = buildYarnInstallArgs(cacheDir, args.ignoreScripts);
 	try {
 		process.stderr.write(`[dep-installer:trace] running: yarn ${argv.join(" ")}\n`);
 		await execFileAsync("yarn", argv, {
@@ -213481,7 +213910,7 @@ async function runYarnBerryInstall(args) {
 	await assertYarnAvailable();
 	const { nodeDir } = resolveNpm();
 	const env = {
-		...envWithNodeOnPath(args.registryConfig.extraEnv, nodeDir),
+		...envWithNodeOnPath(args.registryConfig.extraEnv, nodeDir, args.baseEnv),
 		COREPACK_ENABLE_DOWNLOAD_PROMPT: "0"
 	};
 	const argv = buildYarnBerryInstallArgs();
@@ -213512,11 +213941,11 @@ async function assertYarnAvailable() {
 * Deep cross-sibling build chains may build out of strict topological order —
 * real `.kici` closures are shallow.
 */
-async function buildYarnWorkspaceClosure(repoRoot, kiciDir, yarnFlavor) {
+async function buildYarnWorkspaceClosure(repoRoot, kiciDir, yarnFlavor, baseEnv) {
 	const siblings = await collectInRepoSiblings(repoRoot, kiciDir, resolveYarnNodeModulesRoot(repoRoot, kiciDir));
 	if (siblings.length === 0) return;
 	const { nodeDir } = resolveNpm();
-	const env = envWithNodeOnPath({}, nodeDir);
+	const env = envWithNodeOnPath({}, nodeDir, baseEnv);
 	for (const rel of [...siblings].reverse()) {
 		const sibDir = join(repoRoot, rel);
 		if (!await siblingHasBuildScript(sibDir)) continue;
@@ -213560,9 +213989,9 @@ async function siblingHasBuildScript(sibDir) {
 * the subprocess stderr/stdout is folded into the thrown error so the job's
 * failure message names the real cause instead of a bare "Command failed".
 */
-async function buildWorkspaceClosure(repoRoot) {
+async function buildWorkspaceClosure(repoRoot, baseEnv) {
 	const { nodeDir } = resolveNpm();
-	const env = envWithNodeOnPath({}, nodeDir);
+	const env = envWithNodeOnPath({}, nodeDir, baseEnv);
 	const argv = [
 		"--filter",
 		"{.kici}^...",
@@ -213605,6 +214034,394 @@ function logSubprocessStreams(e, tokens) {
 	if (e && typeof e === "object" && "stderr" in e) process.stderr.write(`[dep-installer:trace] stderr: ${redactNpmOutput(String(e.stderr), tokens).slice(0, 500)}\n`);
 }
 //#endregion
+//#region ../core/dist/kici-ignore.js
+/**
+* `.kici/.kiciignore` — the declared list of paths the source digest excludes.
+*
+* The digest names a workflow's identity, so *which files it covers* is part of
+* that identity's definition. Before this file that definition was three
+* hard-coded constants, and it was wrong: the agent rewrites
+* `.kici/package-lock.json` (`npm install`, deliberately not `npm ci`, so a
+* resolved URL baked into the lock file cannot point at the wrong registry) and
+* `.kici/.npmrc` (a managed auth block, applied for one install and restored
+* after) inside the very tree whose digest it must reproduce. Neither was
+* excluded, so the drift gate rejected runs whose source had not changed.
+*
+* Making the set declarative rather than hard-coded is what lets a customer
+* whose own tooling writes into `.kici/` fix the same class of problem without
+* a release.
+*
+* ## Not to be confused with the repo-root `.kiciignore`
+*
+* A repo **root** `.kiciignore` already exists and is unrelated: it selects
+* which working-tree files a `kici run --remote` overlay uploads
+* (`compiler/src/remote/uploader.ts`, glob-matched, relative to the repo root).
+* This one lives at `.kici/.kiciignore`, is matched relative to `.kici/`, and
+* affects only the digest. The two files never read each other.
+*
+* ## Semantics
+*
+* gitignore-style, and deliberately implemented here rather than delegated to a
+* glob library: a glob matcher reads `node_modules/` as a directory named
+* `node_modules` and NOT as everything beneath it, which would silently fail to
+* exclude the exact paths this file exists to exclude. The digest is a
+* compat-protected identity input, so its matching rules are spelled out and
+* tested rather than inherited.
+*
+* - Blank lines and `#` comments are dropped; `\#` escapes a leading `#`.
+* - A trailing `/` makes a pattern directory-only.
+* - A pattern containing a slash is anchored at `.kici/`; a bare name matches
+*   at any depth.
+* - `*` matches within one segment, `**` across segments, `?` one character.
+* - A leading `!` re-includes; the last matching pattern wins.
+* - A path under an ignored directory is ignored.
+*
+* One deliberate deviation from gitignore: a **symlink to a directory counts as
+* a directory**, so `node_modules/` covers a symlinked `node_modules`. `git`
+* treats a symlink as a file and would not. The purpose of the entry is
+* "exclude the dependency tree, whatever shape it takes on disk" — and treating
+* the link as a file hashed a `symlink:<target>` member into the identity that
+* the agent's own tree, where the dependency install writes a real directory,
+* structurally could not hold. The resolution happens in `collectSourcePaths`,
+* which stats a link to classify it and never follows one to read what is
+* behind it; the matcher below is unchanged and merely receives a truthful
+* `isDir`.
+*/
+/**
+* The exclusion set applied when `.kici/.kiciignore` is absent.
+*
+* `node_modules/` and `types/` are build outputs the tarball either omits or
+* regenerates; `.npmrc`, `package-lock.json` and `pnpm-lock.yaml` are rewritten
+* by the dependency install a run performs before it re-hashes;
+* `kici.lock.json` is the file the digest is written into.
+*/
+const KICI_DIGEST_DEFAULT_EXCLUSIONS = [
+	"node_modules/",
+	"types/",
+	".npmrc",
+	"package-lock.json",
+	"pnpm-lock.yaml",
+	"kici.lock.json"
+];
+/**
+* Excluded no matter what `.kiciignore` says.
+*
+* The compiler writes the computed digest INTO `.kici/kici.lock.json`, so a
+* digest covering that file would be an input to itself and no fixed point
+* would exist. This is arithmetic, not policy — there is no configuration under
+* which hashing it could work, so honoring a `.kiciignore` that omits it would
+* only produce a gate that rejects every run.
+*
+* The lock file's own integrity comes from elsewhere: the orchestrator fetches
+* it at the commit SHA, so provenance vouches for it, never `contentHash`.
+*/
+const KICI_DIGEST_FORCED_EXCLUSIONS = ["kici.lock.json"];
+/**
+* Paths a run rewrites inside `.kici/` before it re-hashes the tree.
+*
+* Under replace semantics a short `.kiciignore` silently re-includes these, and
+* the digest then changes on every run with nothing naming why. A compile whose
+* file omits one warns rather than failing: the customer keeps full control,
+* and the failure stops being mysterious.
+*/
+const KICI_RUN_REWRITTEN_PATHS = [
+	"node_modules/",
+	".npmrc",
+	"package-lock.json"
+];
+/**
+* The `.kiciignore` file's name, relative to `.kici/`. Only the copy at the
+* root of `.kici/` is consulted; a nested one is ordinary hashed source.
+*/
+const KICI_IGNORE_FILENAME = ".kiciignore";
+/**
+* Hashed no matter what `.kiciignore` says — including when it names itself.
+*
+* The file declares which paths define a workflow's identity, so it is part of
+* that identity: editing it must move the digest and force a recompile. Were it
+* able to exclude itself, someone could change what a lock file attests to
+* without changing the lock file, which is the one outcome the digest exists to
+* prevent. Forced inclusion beats every exclusion, the forced ones included.
+*/
+const KICI_DIGEST_FORCED_INCLUSIONS = [KICI_IGNORE_FILENAME];
+/**
+* Split a `.kiciignore` file into patterns: trimmed, comment- and blank-free.
+*
+* Returns an empty array for a file that declares nothing, which under replace
+* semantics genuinely means "exclude nothing but the forced entry" — distinct
+* from an absent file, which means "use the defaults".
+*/
+function parseKiciIgnore(content) {
+	const patterns = [];
+	for (const rawLine of content.split("\n")) {
+		const line = rawLine.trim();
+		if (line.length === 0 || line.startsWith("#")) continue;
+		patterns.push(line.startsWith("\\#") ? line.slice(1) : line);
+	}
+	return patterns;
+}
+/** Translate one gitignore-style pattern body into an anchored regular expression. */
+function globToRegExpSource(glob) {
+	let out = "";
+	for (let i = 0; i < glob.length; i++) {
+		const ch = glob[i];
+		if (ch === "*") {
+			if (glob[i + 1] === "*") {
+				out += ".*";
+				i++;
+			} else out += "[^/]*";
+		} else if (ch === "?") out += "[^/]";
+		else out += ch.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+	}
+	return out;
+}
+function compilePattern(pattern) {
+	let body = pattern;
+	const negated = body.startsWith("!");
+	if (negated) body = body.slice(1);
+	if (body.startsWith("\\!")) body = body.slice(1);
+	if (body.length === 0) return null;
+	const dirOnly = body.endsWith("/");
+	if (dirOnly) body = body.slice(0, -1);
+	if (body.length === 0) return null;
+	const leadingSlash = body.startsWith("/");
+	if (leadingSlash) body = body.slice(1);
+	if (body.length === 0) return null;
+	const anchored = leadingSlash || body.includes("/");
+	const source = globToRegExpSource(body);
+	return {
+		re: new RegExp(anchored ? `^${source}$` : `(?:^|/)${source}$`),
+		dirOnly,
+		negated
+	};
+}
+/**
+* Build a matcher over patterns already parsed from a `.kiciignore`.
+*
+* The returned predicate takes a POSIX path relative to `.kici/` and whether it
+* names a directory. It reports true when the path itself — or any directory
+* above it — is excluded, so a directory pattern covers its whole subtree.
+*/
+function buildKiciIgnoreMatcher(patterns) {
+	const compiled = [];
+	for (const pattern of patterns) {
+		const entry = compilePattern(pattern);
+		if (entry) compiled.push(entry);
+	}
+	if (compiled.length === 0) return () => false;
+	/** Decide one concrete path, ancestors not considered. Last match wins. */
+	const decideSelf = (relPath, isDir) => {
+		let ignored = false;
+		for (const { re, dirOnly, negated } of compiled) {
+			if (dirOnly && !isDir) continue;
+			if (re.test(relPath)) ignored = !negated;
+		}
+		return ignored;
+	};
+	return (relPath, isDir) => {
+		const segments = relPath.split("/");
+		for (let i = 1; i < segments.length; i++) if (decideSelf(segments.slice(0, i).join("/"), true)) return true;
+		return decideSelf(relPath, isDir);
+	};
+}
+/**
+* Which of the run-rewritten paths a pattern set fails to cover.
+*
+* Asks the matcher rather than comparing strings, so a broader pattern that
+* genuinely does exclude a path (`*`, `*.json`) is credited and does not warn.
+* Returned sorted, so the warning text is deterministic.
+*/
+function findUncoveredRunRewrittenPaths(patterns) {
+	const matches = buildKiciIgnoreMatcher(patterns);
+	const uncovered = [];
+	for (const target of KICI_RUN_REWRITTEN_PATHS) {
+		const isDir = target.endsWith("/");
+		if (!matches(isDir ? target.slice(0, -1) : target, isDir)) uncovered.push(target);
+	}
+	return uncovered.sort();
+}
+/** The warning text for one run-rewritten path a `.kiciignore` omits. */
+function runRewrittenWarning(target) {
+	return `.kici/.kiciignore does not exclude '${target}', which a run rewrites inside .kici/ before the agent re-hashes the tree. The workflow's contentHash will therefore change on every run and the drift gate will reject it. Add '${target}' to .kici/.kiciignore, or remove the file to fall back to the defaults.`;
+}
+//#endregion
+//#region ../core/dist/kici-source-digest.js
+init_crypto();
+/**
+* Resolve the exclusion rules for `kiciDir`, reading `.kici/.kiciignore`.
+*
+* Separate from `hashKiciSourceTree` because the compiler needs the warnings
+* without needing a digest — and because a caller that wants to explain the
+* exclusion set should not have to re-implement how it was chosen.
+*
+* An unreadable file falls back to the defaults: the digest's job is to be
+* computable, and a read failure that silently emptied the exclusion set would
+* make every subsequent run drift instead.
+*/
+async function loadKiciIgnoreRules(kiciDir) {
+	let patterns = KICI_DIGEST_DEFAULT_EXCLUSIONS;
+	let source = "default";
+	try {
+		patterns = parseKiciIgnore(await ro.readFile(path$1.join(kiciDir, KICI_IGNORE_FILENAME), "utf-8"));
+		source = "file";
+	} catch {}
+	const missingRunRewritten = source === "file" ? findUncoveredRunRewrittenPaths(patterns) : [];
+	return {
+		source,
+		patterns,
+		forced: KICI_DIGEST_FORCED_EXCLUSIONS,
+		missingRunRewritten,
+		warnings: missingRunRewritten.map(runRewrittenWarning)
+	};
+}
+/**
+* Whether the exclusion patterns should see this entry as a directory.
+*
+* `Dirent.isDirectory()` describes the link itself, so a symlinked
+* `.kici/node_modules` reads as a file and the directory-only `node_modules/`
+* pattern misses it. The compiler then hashes a `symlink:<target>` member that
+* no agent can hold: the tarball drops `.kici/node_modules` by prefix, and the
+* restore materialises a real directory the exclusion does match. The producer
+* and its verifier disagree on a tree nobody edited, and recompiling reproduces
+* the same lock.
+*
+* So classification resolves the link and the walk does not. An entry that
+* survives exclusion is still recorded as a member and still contributes its
+* target string; nothing here follows a link to read what is behind it, which
+* is what keeps the walk terminating and keeps the hashed set equal to what the
+* tarball carries.
+*
+* A link that cannot be resolved — dangling, cyclic (the kernel's own
+* `ELOOP`), or unreadable — is a file, which is what it contributes anyway.
+*
+* This is a deliberate deviation from gitignore, where `node_modules/` does not
+* match a symlinked `node_modules`. The purpose of the entry is "exclude the
+* dependency tree, whatever shape it takes on disk", and a link to the
+* dependency tree is the dependency tree.
+*/
+async function matchesAsDirectory(abs, entry) {
+	if (entry.isDirectory()) return true;
+	if (!entry.isSymbolicLink()) return false;
+	try {
+		return (await ro.stat(abs)).isDirectory();
+	} catch {
+		return false;
+	}
+}
+/** Every file the source tarball carries, as `.kici/`-prefixed POSIX paths. */
+async function collectSourcePaths(kiciDir, rules) {
+	const found = [];
+	const isExcluded = buildKiciIgnoreMatcher(rules.patterns);
+	const isForced = buildKiciIgnoreMatcher(rules.forced);
+	async function walk(absDir, relDir) {
+		const entries = await ro.readdir(absDir, { withFileTypes: true });
+		for (const entry of entries) {
+			const rel = relDir ? `${relDir}/${entry.name}` : entry.name;
+			const member = `.kici/${rel}`;
+			const abs = path$1.join(absDir, entry.name);
+			const asDir = await matchesAsDirectory(abs, entry);
+			if (!(!asDir && KICI_DIGEST_FORCED_INCLUSIONS.includes(rel)) && (isForced(rel, asDir) || isExcluded(rel, asDir))) continue;
+			if (entry.isDirectory()) await walk(abs, rel);
+			else found.push(member);
+		}
+	}
+	await walk(kiciDir, "");
+	return found.sort();
+}
+/**
+* Read one member's contribution. A symlink contributes its target; a file its
+* text. An unreadable entry contributes the empty string rather than throwing —
+* the digest's job is to change when the tree changes, and a read failure is
+* reported by the tar step that follows, not here.
+*/
+async function readMember(abs) {
+	if ((await ro.lstat(abs)).isSymbolicLink()) return `symlink:${await ro.readlink(abs)}`;
+	return ro.readFile(abs, "utf-8");
+}
+/**
+* SHA-256 over every file in `kiciDir`, excluding `.kici/node_modules/`.
+*
+* Returns the empty string when the directory does not exist, which the callers
+* treat exactly as they already treat an unreadable entry file: no hash, so no
+* drift gate.
+*/
+async function hashKiciSourceTree(kiciDir) {
+	let members;
+	try {
+		members = await collectSourcePaths(kiciDir, await loadKiciIgnoreRules(kiciDir));
+	} catch {
+		return "";
+	}
+	const parts = [];
+	for (const member of members) {
+		const abs = path$1.join(kiciDir, member.slice(6));
+		let content;
+		try {
+			content = await readMember(abs);
+		} catch {
+			content = "";
+		}
+		parts.push(`${member}\0${normalizeLineEndings(content)}\0`);
+	}
+	return sha256(parts.join(""));
+}
+/**
+* Every symlink the digest hashes, in member order.
+*
+* Reads the same member set the digest does, so a link an exclusion covers is
+* absent here for the same reason it is absent from the hash.
+*/
+async function collectSourceSymlinks(kiciDir, rules) {
+	let members;
+	try {
+		members = await collectSourcePaths(kiciDir, rules ?? await loadKiciIgnoreRules(kiciDir));
+	} catch {
+		return [];
+	}
+	const found = [];
+	for (const member of members) {
+		const abs = path$1.join(kiciDir, member.slice(6));
+		try {
+			if ((await ro.lstat(abs)).isSymbolicLink()) found.push({
+				member,
+				target: await ro.readlink(abs)
+			});
+		} catch {}
+	}
+	return found;
+}
+/**
+* The sentence a drift error adds when the hashed tree carries symlinks.
+*
+* "Run 'kici compile'" is the right remedy for ordinary drift and is actively
+* misleading here: a symlink the tarball omits or extraction rewrites makes the
+* producer's hash unreachable on this side, so recompiling reproduces the same
+* lock forever. Naming the links turns an unrecoverable loop into something the
+* error text alone explains. Empty when the tree carries none, so an ordinary
+* drift error is unchanged.
+*/
+function hashedSymlinkDriftNote(symlinks) {
+	if (symlinks.length === 0) return "";
+	const named = symlinks.map(({ member, target }) => `${member} -> ${target}`).join(", ");
+	return ` The hashed .kici/ tree carries ${symlinks.length} symlink${symlinks.length === 1 ? "" : "s"} (${named}). A symlink is hashed as its target string, not the bytes behind it, so a link the source tarball omits or extraction rewrites cannot reproduce the compiling machine's hash and recompiling will not change that. Remove it from .kici/, or exclude it in .kici/.kiciignore.`;
+}
+/**
+* Locate the `.kici` directory a workflow file lives under, or null when it
+* does not live under one (a config file outside the convention). Walks
+* ancestors rather than taking the directory as a parameter, so every entry
+* point that loads a workflow module resolves the same tree without threading
+* one more argument through each of them.
+*/
+function findKiciDir(entryPath) {
+	let dir = path$1.dirname(path$1.resolve(entryPath));
+	for (;;) {
+		if (path$1.basename(dir) === ".kici") return dir;
+		const parent = path$1.dirname(dir);
+		if (parent === dir) return null;
+		dir = parent;
+	}
+}
+//#endregion
 //#region src/execution/generator-context.ts
 /**
 * Build the context handed to a `DynamicJobFn`.
@@ -213658,12 +214475,17 @@ init_dist();
 * ESM modules by resolved URL, so importing that path yields the workflow's live
 * singleton, not a fresh copy.
 *
-* Falls back to the agent's bundled setters when resolution fails (mirrors
+* Both specifiers resolve to the same module-global maps — `internal.ts` and the
+* root barrel re-export the same `outputs.js` bindings — so the fallback below
+* changes which entry is imported, never which singleton is mutated.
+*
+* Falls back to the agent's bundled setters when neither resolves (mirrors
 * `resolveSdkSetters` in the compiler's test runner).
 */
 async function resolveWorkflowSdkSetters(workflowFilePath) {
-	try {
-		const sdkEntry = createRequire(workflowFilePath).resolve("@kici-dev/sdk");
+	const req = createRequire(workflowFilePath);
+	for (const specifier of ["@kici-dev/sdk/internal", "@kici-dev/sdk"]) try {
+		const sdkEntry = req.resolve(specifier);
 		const sdk = await import(pathToFileURL(sdkEntry).href);
 		if (typeof sdk.setStepOutputsMap === "function" && typeof sdk.setStepRefMap === "function" && typeof sdk.setJobOutputsMap === "function") return {
 			setStepOutputsMap: sdk.setStepOutputsMap,
@@ -213677,8 +214499,8 @@ async function resolveWorkflowSdkSetters(workflowFilePath) {
 		setJobOutputsMap
 	};
 }
-const AGENT_SDK_VERSION = "0.6.0";
-const AGENT_SDK_BUNDLE_HASH = "22faf0da45de7c243ce87f80fd33ee51b1df52809fde457b16bb821678f65eb3";
+const AGENT_SDK_VERSION = "0.7.0";
+const AGENT_SDK_BUNDLE_HASH = "065963c7765dc8d87e04d45f57d7e15be1613da705e4ff3ec3742fd1408b7bf5";
 /**
 * Register the ESM loader hook that transforms `.ts` / `.tsx` files on the fly
 * for subsequent dynamic `import()` calls. Idempotent at our level via the
@@ -213718,10 +214540,49 @@ function ensureLoaderHookRegistered() {
 * with lockfiles compiled on Linux (LF).
 */
 function computeContentHash(rawSource, assetDigest) {
-	let input = `5:${normalizeLineEndings(rawSource)}`;
+	let input = `7:${normalizeLineEndings(rawSource)}`;
 	if (assetDigest !== void 0 && assetDigest.length > 0) input += `\0${normalizeLineEndings(assetDigest)}`;
 	return sha256(input);
 }
+/**
+* The compile schema version the lock file records for `sourceFile`, or null
+* when the tree carries no readable lock (a `file://` in-place run, a workflow
+* outside the `.kici/` convention, a hand-built fixture).
+*
+* The source tarball carries `.kici/kici.lock.json` — the digest excludes it,
+* but `source-packer.ts` packs it — so the agent can read the producing
+* compiler's schema version from the tree it already has, with no wire field
+* to plumb and no protocol change.
+*
+* A malformed or unreadable lock returns null rather than throwing: this is a
+* diagnostic gate in front of the real hash check, so it must never convert a
+* bad lock into a worse error than the hash comparison already gives.
+*/
+async function readLockCompileSchemaVersion(kiciDir, sourceFile) {
+	let parsed;
+	try {
+		parsed = JSON.parse(await ro.readFile(path$1.join(kiciDir, "kici.lock.json"), "utf-8"));
+	} catch {
+		return null;
+	}
+	const workflows = parsed?.workflows;
+	if (!Array.isArray(workflows)) return null;
+	const normalize = (p) => p.replaceAll("\\", "/").replace(/^\.\//, "");
+	const target = normalize(sourceFile);
+	const versionOf = (w) => {
+		const v = w?.compileSchemaVersion;
+		return typeof v === "number" && Number.isFinite(v) && v > 0 ? v : null;
+	};
+	for (const w of workflows) {
+		const file = w?.source?.file;
+		if (typeof file === "string" && normalize(file) === target) return versionOf(w);
+	}
+	for (const w of workflows) {
+		const v = versionOf(w);
+		if (v !== null) return v;
+	}
+	return null;
+}
 async function buildAssetDigestFromResolvedPaths(workDir, resolvedPaths) {
 	const parts = [];
 	for (const rel of resolvedPaths) {
@@ -213743,20 +214604,30 @@ async function buildAssetDigestFromResolvedPaths(workDir, resolvedPaths) {
 * `node_modules/` the same way any `tsx`-style runner would — so host-repo
 * helpers and `@kici-dev/sdk` Just Work.
 *
-* When `expectedContentHash` is provided, verifies the raw source matches
-* the hash in the lock file. Drift between source and lock file produces a
-* descriptive error that surfaces the baked agent SDK fingerprint (useful
-* when debugging "is the agent running a stale build?").
+* When `expectedContentHash` is provided, verifies the extracted `.kici/` tree
+* matches the hash in the lock file. It re-hashes the whole tree, not the entry
+* file alone, so an edit to an imported helper is caught — that was the gap
+* that let a warm cache restore a stale tarball and run the OLD helper green.
+* Drift produces a descriptive error that surfaces the baked agent SDK
+* fingerprint (useful when debugging "is the agent running a stale build?").
 */
 async function loadWorkflowSource(workDir, sourceFile, expectedContentHash, resolvedHashFiles) {
 	ensureLoaderHookRegistered();
 	const filePath = path$1.join(workDir, sourceFile);
 	if (expectedContentHash) {
-		const rawSource = await ro.readFile(filePath, "utf-8");
+		const kiciDir = findKiciDir(filePath);
+		if (kiciDir) {
+			const lockVersion = await readLockCompileSchemaVersion(kiciDir, sourceFile);
+			if (lockVersion !== null && lockVersion !== 7) throw new Error(`kici.lock.json was compiled by an incompatible @kici-dev/compiler: the lock declares compile schema ${lockVersion}, this agent implements 7. The schema version is mixed into every contentHash, so recompiling cannot reconcile them. Align the versions: upgrade the agent to one implementing schema ${lockVersion}, or pin @kici-dev/compiler to a release implementing schema 7 and recompile (agent baked @kici-dev/sdk@${AGENT_SDK_VERSION} bundleHash=${AGENT_SDK_BUNDLE_HASH}).`);
+		}
+		const rawSource = (kiciDir ? await hashKiciSourceTree(kiciDir) : "") || await ro.readFile(filePath, "utf-8");
 		let assetDigest;
 		if (resolvedHashFiles?.length) assetDigest = await buildAssetDigestFromResolvedPaths(workDir, resolvedHashFiles);
 		const actualHash = computeContentHash(rawSource, assetDigest);
-		if (actualHash !== expectedContentHash) throw new Error(`Lock file is out of date: workflow source changed without regenerating kici.lock.json (expected contentHash ${expectedContentHash}, got ${actualHash}, agent baked @kici-dev/sdk@${AGENT_SDK_VERSION} bundleHash=${AGENT_SDK_BUNDLE_HASH}). Run 'kici compile' and commit the updated lock file.`);
+		if (actualHash !== expectedContentHash) {
+			const symlinkNote = kiciDir ? hashedSymlinkDriftNote(await collectSourceSymlinks(kiciDir)) : "";
+			throw new Error(`Lock file is out of date: workflow source changed without regenerating kici.lock.json (expected contentHash ${expectedContentHash}, got ${actualHash}, agent baked @kici-dev/sdk@${AGENT_SDK_VERSION} bundleHash=${AGENT_SDK_BUNDLE_HASH}). Run 'kici compile' and commit the updated lock file.${symlinkNote}`);
+		}
 	}
 	return {
 		module: await import(pathToFileURL(filePath).href + `?t=${Date.now()}`),
@@ -213919,22 +214790,30 @@ function applyGlobalWorkflowEnv(repos) {
 * `.kici/` source tarball restoration for execution agents.
 *
 * Downloads a pre-built `.kici/` source tarball from the orchestrator's cache
-* and extracts it into `workDir/` so the workflow entry point becomes
+* and installs it at `workDir/.kici` so the workflow entry point becomes
 * importable. Mirrors the shape of `dep-restore.ts` but without the streaming
 * optimization — source tarballs are tiny (kilobytes, not the hundreds of
 * megabytes a `node_modules/` tarball carries).
 *
-* Note on integrity: `dispatch.sourceTarHash` is the workflow `contentHash`
-* (computed over the raw source per `workflow-loader.ts::computeContentHash`),
-* not the SHA-256 of the tarball bytes. The shared S3 cache key is derived
-* from that same contentHash, so a signed GET URL from the orchestrator
-* already establishes provenance for restored tarballs. Every
-* `loadWorkflowSource` call site — build, init, and dynamic eval — passes
-* the dispatched `contentHash` (and `resolvedHashFiles` when present) so
-* the lock-vs-source drift gate fires at each author-TS load site, not
-* only the build phase. That closes the corner cases where init or eval
-* runs without a preceding build (cache infrastructure unavailable, or a
-* build job that failed but left dynamic dispatch in flight).
+* Two properties this path is responsible for, both of which it previously
+* lacked:
+*
+* **Verification.** `dispatch.sourceTarDigest` is the SHA-256 of the tarball's
+* own bytes, so the download is checked before anything is extracted — the same
+* contract `restoreDeps` has always had via `depsHash`. The older
+* `dispatch.sourceTarHash` field carries the workflow `contentHash` instead, so
+* it never could serve this purpose; it stays on the wire for older peers and
+* is deliberately not used as a verification input here. When no digest is
+* dispatched (an older orchestrator, or a source that did not come from the
+* content-addressed cache) the restore proceeds unverified rather than failing,
+* so a mixed-version rollout still runs.
+*
+* **Replacement, not overlay.** Extraction lands in a scratch directory and the
+* result REPLACES `workDir/.kici` wholesale, save for `node_modules/` — the one
+* directory the tarball deliberately omits, which the deps restore has already
+* written by the time this runs. Extracting over the existing tree left any file
+* the tarball no longer carries in place, so a helper the author deleted
+* survived every warm-cache run and kept being imported.
 */
 init_index_min();
 init_dist$2();
@@ -213950,7 +214829,14 @@ async function extractSourceTarball(data, targetDir) {
 		})).on("finish", resolve).on("error", reject);
 	});
 }
-async function restoreSource(workDir, sourceTarUrl) {
+/**
+* Download, verify, and install the `.kici/` source tree.
+*
+* @param workDir - Root of the cloned repository; `.kici` is replaced under it
+* @param sourceTarUrl - `http://`, `https://`, or `file://` URL to the tarball
+* @param sourceTarDigest - Expected SHA-256 of the tarball bytes, when known
+*/
+async function restoreSource(workDir, sourceTarUrl, sourceTarDigest) {
 	sourceTarUrl = resolveOrchestratorUrl(sourceTarUrl);
 	logger$1.info("Restoring .kici/ source from tarball", { sourceTarUrl });
 	const startTime = Date.now();
@@ -213960,11 +214846,34 @@ async function restoreSource(workDir, sourceTarUrl) {
 		data = await ro.readFile(localPath);
 	} else if (sourceTarUrl.startsWith("http://") || sourceTarUrl.startsWith("https://")) data = await downloadUrl(sourceTarUrl);
 	else throw new Error(`Unsupported source tarball URL scheme: ${sourceTarUrl}`);
-	await extractSourceTarball(data, workDir);
+	if (sourceTarDigest) {
+		const actual = createHash("sha256").update(data).digest("hex");
+		if (actual !== sourceTarDigest) throw new Error(`Source tarball hash mismatch: expected ${sourceTarDigest}, got ${actual}. The restored source does not match what the orchestrator dispatched.`);
+	}
+	const kiciDir = path$1.join(workDir, ".kici");
+	const scratch = path$1.join(workDir, `.kici.restore-${process.pid}-${Date.now()}`);
+	try {
+		await extractSourceTarball(data, scratch);
+		const extracted = path$1.join(scratch, ".kici");
+		const src = (await ro.stat(extracted).catch(() => null))?.isDirectory() ? extracted : scratch;
+		const installedDeps = path$1.join(kiciDir, "node_modules");
+		if (await ro.stat(installedDeps).catch(() => null)) await rename(installedDeps, path$1.join(src, "node_modules"));
+		await rm(kiciDir, {
+			recursive: true,
+			force: true
+		});
+		await rename(src, kiciDir);
+	} finally {
+		await rm(scratch, {
+			recursive: true,
+			force: true
+		}).catch(() => {});
+	}
 	const durationMs = Date.now() - startTime;
 	logger$1.info(".kici/ source restored", {
 		sizeKB: (data.length / 1024).toFixed(2),
-		durationMs
+		durationMs,
+		verified: sourceTarDigest !== void 0
 	});
 }
 //#endregion
@@ -214122,7 +215031,7 @@ init_oidc_token_relay();
 init_dist$4();
 init_download();
 init_dep_restore();
-const AGENT_VERSION = "0.6.0";
+const AGENT_VERSION = "0.7.0";
 process.on("uncaughtException", (err) => {
 	process.stderr.write(`[workflow-runner] UNCAUGHT EXCEPTION: ${err.message}\n`);
 	if (err.stack) process.stderr.write(`[workflow-runner] Stack: ${err.stack}\n`);
@@ -214194,7 +215103,12 @@ function installOutputCapture() {
 				line
 			});
 		}
-		if (isForkMode) return origStdoutWrite(chunk, encodingOrCb, cb);
+		if (isForkMode) {
+			if (!captureIsActive() || process.env.KICI_RUNNER_DEBUG_STDIO === "true") return origStdoutWrite(chunk, encodingOrCb, cb);
+			const forkCallback = typeof encodingOrCb === "function" ? encodingOrCb : cb;
+			if (forkCallback) forkCallback();
+			return true;
+		}
 		const callback = typeof encodingOrCb === "function" ? encodingOrCb : cb;
 		if (callback) callback();
 		return true;
@@ -214784,6 +215698,46 @@ function extractRepoIdentifier(repoUrl) {
 * mint failure the statement is frozen + reported for later minting (deferred);
 * the step still completes.
 */
+/**
+* The context a deferred attestation's frozen statement is built from.
+*
+* Prefers the orchestrator's `provenanceContext` — server truth, derived from
+* the same run row the mint reads, so the frozen statement is field-for-field
+* what a live mint would have produced and the orchestrator can cross-check it.
+*
+* Falls back to the agent's local view when an older orchestrator sent none.
+* That fallback disagrees with the claims by construction: `request.ref` is the
+* job's CHECKOUT ref, which for a pull request is the HEAD branch where the
+* claim is the BASE branch, and `request.workflowRef` is a global workflow's
+* CLONE ref where the claim is `<name>@<sha>`. So a statement built from it
+* fails the capture cross-check and the defer is dropped — a green job with no
+* attestation, rather than an unchecked statement the orchestrator signs.
+*/
+function buildLocalContext(request) {
+	const ctx = request.provenanceContext;
+	if (ctx) return {
+		repository: ctx.repository ?? "",
+		ref: ctx.ref ?? "",
+		sha: ctx.sha,
+		workflowRef: ctx.workflowRef ?? "",
+		runId: ctx.runId,
+		jobId: ctx.jobId,
+		orgId: ctx.orgId,
+		sourceOrigin: ctx.sourceOrigin,
+		...ctx.provider ? { provider: ctx.provider } : {},
+		issuer: ctx.issuer,
+		orchestratorId: ctx.orchestratorId
+	};
+	return {
+		repository: extractRepoIdentifier(request.repoUrl),
+		ref: request.ref,
+		sha: request.sha || null,
+		workflowRef: request.workflowRef ?? request.workflowName,
+		runId: request.runId,
+		jobId: request.jobId,
+		issuer: ""
+	};
+}
 function buildAttestProvenanceFn(request, workDir, getIdToken) {
 	return async (opts) => {
 		const subject = provenanceSubjectIsPath(opts.subject) ? {
@@ -214799,15 +215753,7 @@ function buildAttestProvenanceFn(request, workDir, getIdToken) {
 				"kici-agent": AGENT_VERSION,
 				"kici-orchestrator": "unknown"
 			},
-			localContext: {
-				repository: extractRepoIdentifier(request.repoUrl),
-				ref: request.ref,
-				sha: request.sha || null,
-				workflowRef: request.workflowRef ?? request.workflowName,
-				runId: request.runId,
-				jobId: request.jobId,
-				issuer: request.provenanceIssuer ?? ""
-			},
+			localContext: buildLocalContext(request),
 			reportDeferred: async (report) => {
 				await relayProvenanceIpc({
 					op: "defer",
@@ -215112,20 +216058,6 @@ function buildStepSecrets(request, masker, onMaskerSecretsAdded) {
 	});
 }
 /**
-* Create a LogMasker initialized with all secret values from the request.
-*
-* Collects values from both flat secrets and all namespaced context secrets,
-* deduplicating before registration.
-*/
-function createSecretMasker(request) {
-	const masker = new LogMasker();
-	const allSecrets = {};
-	if (request.secrets) Object.assign(allSecrets, request.secrets);
-	if (request.namespacedSecrets) for (const contextSecrets of Object.values(request.namespacedSecrets)) Object.assign(allSecrets, contextSecrets);
-	masker.registerSecrets(allSecrets);
-	return masker;
-}
-/**
 * Build a fresh zx `$` shell bound to the sandbox working directory and the
 * sanitized environment (process.env was set by the parent via env-sanitizer
 * before spawning this process). This is the single shell-construction code
@@ -215156,12 +216088,13 @@ function createSecretMasker(request) {
 * step$.log would only set it on the function object and NOT propagate to the
 * AsyncLocalStorage store that zx uses for ProcessPromise snapshots.
 */
-function buildSandboxShell(cwd, stepIndex, maskedSendFn) {
+function buildSandboxShell(cwd, stepIndex, maskedSendFn, signal) {
 	return $$1({
 		cwd,
 		env: process.env,
 		verbose: true,
 		quiet: false,
+		...signal ? { signal } : {},
 		log: makeStreamingZxLog((line, stream) => maskedSendFn({
 			type: "log.line",
 			stepIndex,
@@ -215246,7 +216179,7 @@ function initialJobStatus(loopStatus) {
 * inside this process with full shell access.
 */
 function createSandboxStepContext(workDir, stepIndex, stepName, request, maskedSendFn, outputsMap, refMap, operatorSecretKeys, secretOutputs, jobOutputsMap, secrets, masker, signal, jobTempScope) {
-	const step$ = buildSandboxShell(workDir, stepIndex, maskedSendFn);
+	const step$ = buildSandboxShell(workDir, stepIndex, maskedSendFn, signal);
 	const log = createIpcLogger(stepIndex, stepName, maskedSendFn);
 	const rawPayload = rawPayloadFromEvent(request.event);
 	const kici = buildKiciApi(async (method, params) => {
@@ -215501,7 +216434,8 @@ async function installDependenciesIfNeeded(workflowDir, request) {
 			await installDeps(kiciDir, {
 				npmRegistries: request.npmRegistries,
 				installEnvSecrets: request.installEnvSecrets,
-				jobIdShort: request.jobIdShort
+				jobIdShort: request.jobIdShort,
+				...request.allowInstallScripts ? { allowInstallScripts: true } : {}
 			});
 			trace("fallback install complete");
 		}
@@ -215526,7 +216460,8 @@ async function installDependenciesIfNeeded(workflowDir, request) {
 		await installDeps(kiciDir, {
 			npmRegistries: request.npmRegistries,
 			installEnvSecrets: request.installEnvSecrets,
-			jobIdShort: request.jobIdShort
+			jobIdShort: request.jobIdShort,
+			...request.allowInstallScripts ? { allowInstallScripts: true } : {}
 		});
 		trace("installDeps() returned successfully");
 	} catch (depErr) {
@@ -215556,7 +216491,7 @@ async function restoreSourceTarballIfRequested(workflowRoot, request) {
 		stepIndex: -1,
 		line: "[workflow-runner] Restoring .kici/ source from cached tarball"
 	});
-	await restoreSource(workflowRoot, request.sourceTarUrl);
+	await restoreSource(workflowRoot, request.sourceTarUrl, request.sourceTarDigest);
 	trace("source tarball restored");
 }
 /**
@@ -216057,7 +216992,7 @@ function buildJobRuleCompletion(ruleResult, normalizedSteps) {
 * success-skip). Returns false when the caller should continue to step
 * execution.
 */
-async function maybeSkipJobOnRules(job, request, normalizedSteps, repos) {
+async function maybeSkipJobOnRules(job, request, normalizedSteps, send, repos) {
 	if (!job?.rules || job.rules.length === 0) return false;
 	const ev = request.event ?? {};
 	const ruleCtx = createRuleContext({
@@ -216076,7 +217011,7 @@ async function maybeSkipJobOnRules(job, request, normalizedSteps, repos) {
 	if (!completion) return false;
 	flushOutputCapture();
 	capturePrepareActive = false;
-	sendMessage(completion);
+	send(completion);
 	process.exit(0);
 }
 /**
@@ -216302,11 +217237,7 @@ async function main() {
 	const sourceDir = isGlobal ? join(workDir, "source") : workDir;
 	const masker = createSecretMasker(request);
 	const maskedSend = (msg) => {
-		if (msg.type === "log.line" && masker.hasSecrets()) sendMessage({
-			...msg,
-			line: masker.mask(msg.line)
-		});
-		else sendMessage(msg);
+		sendMessage(maskMessageText(msg, masker));
 	};
 	const jobDeadline = armJobDeadline(request.jobTimeoutMs, (reason, timeoutMs) => {
 		jobTimedOut = true;
@@ -216341,7 +217272,7 @@ async function main() {
 		const jobHasRules = (job?.rules?.length ?? 0) > 0;
 		const anyStepHasRules = normalizedSteps.some((s) => (s.rules?.length ?? 0) > 0);
 		await resolveChangedFilesForRules(request, sourceDir, jobHasRules || anyStepHasRules);
-		await maybeSkipJobOnRules(job, request, normalizedSteps, globalRepoInfo);
+		await maybeSkipJobOnRules(job, request, normalizedSteps, maskedSend, globalRepoInfo);
 		if (aborted) abortAndExit("aborted after rules");
 	}
 	const jobHooks = collectJobHooks(job);
@@ -216450,7 +217381,8 @@ async function main() {
 		jobTimedOut,
 		jobTimeoutMs: request.jobTimeoutMs,
 		cancelFailureReason,
-		driftDroppedJobs
+		driftDroppedJobs,
+		send: maskedSend
 	});
 	process.exit(finalStatus === ExecutionJobStatus.enum.success ? 0 : 1);
 }
@@ -216463,7 +217395,7 @@ async function main() {
 function emitJobComplete(args) {
 	const aggregatedOutputs = {};
 	for (const [stepName, outputs] of args.outputsMap) aggregatedOutputs[stepName] = outputs;
-	sendMessage({
+	args.send({
 		type: "job.complete",
 		status: args.finalStatus,
 		stepResults: args.loopResult.stepResults,