@kici-dev/agent 0.6.1 → 0.7.0

package/dist/workflow-runner.js

@@ -10,7 +10,8 @@ import { createLogger, deriveSharedSecret, initZx, normalizeLineEndings, sha256,
 import { createTempScope, makeTempDir } from "@kici-dev/core/tmp";
 import { CacheOutcome, CacheStepType, CheckMode, CheckStepOutcome, ExecutionJobStatus, ExecutionStepStatus, LogStream, StepConcurrencyKind, TimeoutReason, artifactInvalidNameError, checkArtifactName, reservedEventNamePrefix } from "@kici-dev/engine";
 import { execFile, execFileSync } from "node:child_process";
-import { buildKiciApi, buildNeedsContext, createRuleContext, createStepSecrets, evaluateRules, isDynamicJobFn, isEventDefinition, isParallelGroup, normalizeApproval, normalizeCacheSpecs, provenanceSubjectIsPath, resolveJobOutputs, resolveStepOutputs, setJobOutputsMap, setStepOutputsMap, setStepRefMap } from "@kici-dev/sdk";
+import { isDynamicJobFn, isEventDefinition, isParallelGroup, provenanceSubjectIsPath, resolveJobOutputs, resolveStepOutputs } from "@kici-dev/sdk";
+import { buildKiciApi, buildNeedsContext, createRuleContext, createStepSecrets, evaluateRules, normalizeApproval, normalizeCacheSpecs, setJobOutputsMap, setStepOutputsMap, setStepRefMap } from "@kici-dev/sdk/internal";
 import { OIDC_TOKEN_REQUEST_METHOD } from "@kici-dev/engine/protocol/messages/oidc-token-relay";
 import { HOME_ANCHOR, REPO_ANCHOR, computeBackoffDelay, sha256File as sha256File$1 } from "@kici-dev/core";
 import { calculateJwkThumbprint, decodeJwt, exportJWK, generateKeyPair } from "jose";
@@ -30,6 +31,7 @@ import { AsyncLocalStorage } from "node:async_hooks";
 import { promisify } from "node:util";
 import { PNPM_IGNORE_BUILD_GATE_ARG, PackageManager, YarnFlavor, detectPackageManagerFromManifests, detectYarnFlavor } from "@kici-dev/shared/package-manager";
 import { parse, stringify } from "yaml";
+import { COMPILE_SCHEMA_VERSION, collectSourceSymlinks, findKiciDir, hashKiciSourceTree, hashedSymlinkDriftNote } from "@kici-dev/core/kici-source-digest";
 var __defProp = Object.defineProperty;
 var __esmMin = (fn, res, err) => () => {
 	if (err) throw err[0];
@@ -359,7 +361,12 @@ async function computeChangedFiles(workDir, event, auth) {
 * for a deferred attestation (no minted identity token yet). Marks
 * `attestationOrigin: 'deferred'` in the internal parameters. The caller
 * DSSE-signs the returned statement immediately and computes its statement hash
-* — the binding the later OIDC mint commits to (truth-contract property 2).
+* — one of the two bindings the later OIDC mint commits to.
+*
+* Emits the same fields `buildProvenanceStatement` emits, so a statement frozen
+* from an orchestrator-supplied context is field-for-field what a live mint
+* would have produced. That is what lets the orchestrator cross-check the
+* statement against its own run row before signing anything that commits to it.
 */
 function buildLocalProvenanceStatement(input) {
 	const c = input.context;
@@ -373,11 +380,14 @@ function buildLocalProvenanceStatement(input) {
 		predicate: {
 			buildDefinition: {
 				buildType: KICI_WORKFLOW_BUILD_TYPE,
-				externalParameters: { workflow: {
-					repository: c.repository,
-					ref: c.ref,
-					path: c.workflowRef
-				} },
+				externalParameters: {
+					workflow: {
+						repository: c.repository,
+						ref: c.ref,
+						path: c.workflowRef
+					},
+					...c.provider ? { provider: c.provider } : {}
+				},
 				internalParameters: {
 					...c.sha ? { commit: c.sha } : {},
 					runId: c.runId,
@@ -389,7 +399,7 @@ function buildLocalProvenanceStatement(input) {
 			},
 			runDetails: {
 				builder: {
-					id: `${c.issuer}/orchestrator/unknown`,
+					id: `${c.issuer}/orchestrator/${c.orchestratorId ?? "unknown"}`,
 					version: input.builderVersions
 				},
 				metadata: {
@@ -1384,15 +1394,6 @@ function createArtifactsApi(workDir, transport, roots) {
 }
 //#endregion
 //#region src/execution/sandbox/log-masker.ts
-/**
-* Secret value masking for log lines.
-*
-* Replaces all occurrences of registered secret values with '***' in log output.
-* Used by the workflow runner to prevent secret leaks in IPC log messages.
-*
-* Performance: Builds a single combined regex from all secret values, so each
-* log line is scanned in a single pass (not O(secrets * lines)).
-*/
 /** Minimum length for a secret value to be maskable (avoids false positives). */
 const MIN_MASK_LENGTH = 3;
 /**
@@ -1423,18 +1424,38 @@ var LogMasker = class {
 	* Authorization: Basic headers, base64-encoded config values).
 	* Values are sorted by length descending so longer values are matched first
 	* (prevents partial masking when one secret is a substring of another).
+	*
+	* Multi-line values additionally register each of their individual lines.
+	* Log output is split into lines before it reaches the masker, so a value
+	* containing a newline can never match as a whole — a PEM private key or a
+	* kubeconfig would otherwise stream in clear text. Two consequences of the
+	* per-line registration are deliberate:
+	*
+	* - `MIN_MASK_LENGTH` is 3, so short structural lines of a structured secret
+	*   are registered too. A `---` YAML separator or a bare `{` from a
+	*   service-account JSON is masked wherever it appears in that job's logs.
+	* - PEM header and footer lines (`-----BEGIN OPENSSH PRIVATE KEY-----`) are
+	*   not secret on their own and are masked as a side effect.
+	*
+	* Both are strictly safer than leaking the body, and no heuristic separates a
+	* structural line from a body line without risking the reverse mistake.
 	*/
 	registerSecrets(secrets) {
 		const seen = /* @__PURE__ */ new Set();
 		const values = [];
-		for (const value of Object.values(secrets)) if (value.length >= MIN_MASK_LENGTH && !seen.has(value)) {
-			seen.add(value);
-			values.push(value);
-			const b64 = Buffer.from(value).toString("base64");
+		const add = (candidate) => {
+			if (candidate.length < MIN_MASK_LENGTH || seen.has(candidate)) return;
+			seen.add(candidate);
+			values.push(candidate);
+			const b64 = Buffer.from(candidate).toString("base64");
 			if (b64.length >= MIN_MASK_LENGTH && !seen.has(b64)) {
 				seen.add(b64);
 				values.push(b64);
 			}
+		};
+		for (const value of Object.values(secrets)) {
+			add(value);
+			if (value.includes("\n")) for (const rawLine of value.split("\n")) add(rawLine.endsWith("\r") ? rawLine.slice(0, -1) : rawLine);
 		}
 		if (values.length === 0) {
 			this.pattern = null;
@@ -1460,6 +1481,57 @@ var LogMasker = class {
 		return this.pattern !== null;
 	}
 };
+/**
+* Create a LogMasker initialized with all secret values from the request.
+*
+* Collects values from both flat secrets and all namespaced context secrets,
+* deduplicating before registration.
+*
+* Both the runner child and the agent-side fork runner build a masker from the
+* same request, so the crash tail the agent assembles from the child's stderr is
+* masked with the same value set the child used for its own log lines.
+*/
+function createSecretMasker(request) {
+	const masker = new LogMasker();
+	const allSecrets = {};
+	if (request.secrets) Object.assign(allSecrets, request.secrets);
+	if (request.namespacedSecrets) for (const contextSecrets of Object.values(request.namespacedSecrets)) Object.assign(allSecrets, contextSecrets);
+	masker.registerSecrets(allSecrets);
+	return masker;
+}
+/**
+* Mask every operator-visible text field of an outbound runner message.
+*
+* Each message type carrying free text is named here, so a new text-bearing
+* message type is a visible omission rather than a silent leak. `step.complete`
+* error text and the `job.complete` failure reason are persisted on the step and
+* run rows the dashboard renders, so they need the same masking `log.line` gets.
+*
+* Returns the message unchanged when no secrets are registered.
+*/
+function maskMessageText(msg, masker) {
+	if (!masker.hasSecrets()) return msg;
+	switch (msg.type) {
+		case "log.line": return {
+			...msg,
+			line: masker.mask(msg.line)
+		};
+		case "step.complete": return msg.error ? {
+			...msg,
+			error: {
+				...msg.error,
+				message: masker.mask(msg.error.message)
+			}
+		} : msg;
+		case "job.complete": {
+			const masked = { ...msg };
+			if (masked.error !== void 0) masked.error = masker.mask(masked.error);
+			if (masked.droppedJobs) masked.droppedJobs = masked.droppedJobs.map((j) => masker.mask(j));
+			return masked;
+		}
+		default: return msg;
+	}
+}
 //#endregion
 //#region src/execution/sandbox/env-delta.ts
 /**
@@ -1639,18 +1711,23 @@ async function executeHook(opts) {
 		step_type: `hook:${hookType}`
 	});
 	const startTime = Date.now();
+	const abortController = new AbortController();
+	let rejectTimeout = () => {};
+	const timeoutRace = new Promise((_, reject) => {
+		rejectTimeout = reject;
+	});
+	const timeoutId = setTimeout(() => {
+		rejectTimeout(/* @__PURE__ */ new Error(`Hook '${normalized.name}' timed out after ${timeoutMs}ms`));
+		abortController.abort();
+	}, timeoutMs);
 	const mergedCtx = {
 		...stepContext,
-		outcome
+		outcome,
+		signal: AbortSignal.any([...stepContext.signal ? [stepContext.signal] : [], abortController.signal]),
+		...typeof stepContext.$ === "function" ? { $: stepContext.$({ signal: abortController.signal }) } : {}
 	};
-	const abortController = new AbortController();
-	const timeoutId = setTimeout(() => abortController.abort(), timeoutMs);
 	try {
-		await Promise.race([normalized.run(mergedCtx), new Promise((_, reject) => {
-			abortController.signal.addEventListener("abort", () => {
-				reject(/* @__PURE__ */ new Error(`Hook '${normalized.name}' timed out after ${timeoutMs}ms`));
-			});
-		})]);
+		await Promise.race([normalized.run(mergedCtx), timeoutRace]);
 		clearTimeout(timeoutId);
 		sendIpc({
 			type: "step.complete",
@@ -1925,12 +2002,12 @@ const STEP_FAILURE_LOG_MAX_CHARS = 8192;
 * One consequence to know: a `$({ quiet: true })` command's output is kept out
 * of the log by the `verbose` gate in `streaming-zx-log.ts`, but when such a
 * command FAILS, zx packs its captured output into the thrown error's message —
-* which this function then writes to the log. That text is already persisted
-* unmasked on `step.complete` (the step row the dashboard renders), so the copy
-* written here is the more protected of the two, and surfacing it is the whole
-* point: a quiet command that fails is exactly the failure an operator cannot
-* otherwise diagnose. Registered secret values are masked; anything the masker
-* has never been told about is not.
+* which this function then writes to the log. Surfacing it is the whole point:
+* a quiet command that fails is exactly the failure an operator cannot
+* otherwise diagnose. The same text also travels on `step.complete` for the step
+* row the dashboard renders, and both copies pass the masker — `maskMessageText`
+* masks `step.complete.error.message` alongside `log.line`. Registered secret
+* values are masked; anything the masker has never been told about is not.
 */
 function emitStepFailureLog(stepName, stepIndex, message, sendFn) {
 	const prefix = `[kici] Step '${stepName}' failed: `;
@@ -1967,16 +2044,29 @@ async function executeStepInLoop(step, stepIndex, ctx, timeoutMs, sendFn, output
 	});
 	const startTime = Date.now();
 	const abortController = new AbortController();
-	const timeoutId = setTimeout(() => abortController.abort(), timeoutMs);
+	let timedOut = false;
+	let rejectTimeout = () => {};
+	const timeoutRace = new Promise((_, reject) => {
+		rejectTimeout = reject;
+	});
+	const timeoutId = setTimeout(() => {
+		timedOut = true;
+		rejectTimeout(/* @__PURE__ */ new Error(`Step '${step.name}' timed out after ${timeoutMs}ms`));
+		abortController.abort();
+		opts.abortStep?.(stepIndex);
+	}, timeoutMs);
 	const stepAbortSignal = opts.getStepAbortSignal?.(stepIndex);
+	const stepPromise = runStepWithCheckMode(step, stepIndex, ctx, checkMode, sendFn, opts);
+	let stepSettled = false;
+	const stepSettledPromise = stepPromise.then(() => {
+		stepSettled = true;
+	}, () => {
+		stepSettled = true;
+	});
 	try {
 		const phase = await Promise.race([
-			runStepWithCheckMode(step, stepIndex, ctx, checkMode, sendFn, opts),
-			new Promise((_, reject) => {
-				abortController.signal.addEventListener("abort", () => {
-					reject(/* @__PURE__ */ new Error(`Step '${step.name}' timed out after ${timeoutMs}ms`));
-				});
-			}),
+			stepPromise,
+			timeoutRace,
 			new Promise((_, reject) => {
 				if (!jobDeadlineSignal) return;
 				if (jobDeadlineSignal.aborted) {
@@ -1993,7 +2083,10 @@ async function executeStepInLoop(step, stepIndex, ctx, timeoutMs, sendFn, output
 					reject(new StepCancelledError(step.name));
 					return;
 				}
-				stepAbortSignal.addEventListener("abort", () => reject(new StepCancelledError(step.name)));
+				stepAbortSignal.addEventListener("abort", () => {
+					if (timedOut) return;
+					reject(new StepCancelledError(step.name));
+				});
 			})
 		]);
 		clearTimeout(timeoutId);
@@ -2025,6 +2118,15 @@ async function executeStepInLoop(step, stepIndex, ctx, timeoutMs, sendFn, output
 		clearTimeout(timeoutId);
 		const durationMs = Date.now() - startTime;
 		const error = e instanceof Error ? e : new Error(String(e));
+		if (timedOut && !stepSettled) {
+			await Promise.race([stepSettledPromise, delayUnref(STEP_ABORT_GRACE_MS)]);
+			if (!stepSettled) sendFn({
+				type: "log.line",
+				stepIndex,
+				line: `[timeout] Step '${step.name}' did not stop within ${STEP_ABORT_GRACE_MS}ms of its abort signal; continuing without it.`,
+				stream: LogStream.enum.stderr
+			});
+		}
 		if (e instanceof StepCancelledError) {
 			const secretsAccessed = getSecretsAccessLog?.(stepIndex);
 			emitSecretMountEvents(getSecretMountRecords?.(stepIndex), stepIndex, sendFn);
@@ -2073,6 +2175,17 @@ async function executeStepInLoop(step, stepIndex, ctx, timeoutMs, sendFn, output
 	}
 }
 /**
+* How long a timed-out step is given to unwind after its abort signal fires,
+* before the loop reports that the step ignored it and moves on.
+*/
+const STEP_ABORT_GRACE_MS = 2e3;
+/** A timer-backed delay that never keeps the process alive on its own. */
+function delayUnref(ms) {
+	return new Promise((resolve) => {
+		setTimeout(resolve, ms).unref?.();
+	});
+}
+/**
 * Emit one `step.secret_mount` IPC event per `mountFile` / `exposeFile` call
 * the step performed. Called from both the success and failure paths so the
 * orchestrator's audit trail records every mount regardless of step outcome.
@@ -3365,10 +3478,12 @@ function redactNpmOutput(input, tokens) {
 *
 * `nodeLinker: node-modules` makes berry lay down a real `node_modules` tree
 * (no PnP `.pnp.cjs`), so the agent's packer / restore / sibling-walk /
-* workflow-loader work unchanged. `enableScripts: false` (when a private
-* registry is configured) keeps dependency lifecycle scripts from seeing the
-* synthesized token env vars — the same security model as npm/pnpm/classic
-* `--ignore-scripts`.
+* workflow-loader work unchanged. `enableScripts: false` keeps dependency
+* lifecycle scripts from running at all — for every install, not only one
+* against a private registry — the same security model as npm/pnpm/classic
+* `--ignore-scripts`. An operator opts back in with
+* `KICI_ALLOW_INSTALL_SCRIPTS=true`, which arrives here as
+* `ignoreScripts: false`.
 *
 * Reuses the same `ApplyNpmRegistryConfigArgs` / `ApplyNpmRegistryConfigResult`
 * shapes as the npm overlay so `dep-installer` can pick either by flavor.
@@ -3415,8 +3530,8 @@ async function applyYarnrcBerryConfig(args) {
 	};
 	const tokenEnv = {};
 	const tokensForRedaction = [];
+	if (args.ignoreScripts !== false) merged.enableScripts = false;
 	if (hasPrivateRegistry) {
-		merged.enableScripts = false;
 		const npmScopes = { ...doc.npmScopes ?? {} };
 		for (let i = 0; i < registries.length; i++) {
 			const reg = registries[i];
@@ -3725,9 +3840,11 @@ function isAbsoluteRel(rel) {
 * Security: the install runs with an isolated per-invocation cache/store
 * directory to prevent cache poisoning across build jobs — a malicious
 * package.json in one repo cannot taint the cache used by subsequent builds.
-* The same pressure rules out letting lifecycle scripts see synthesized auth
-* env vars — the install runs with `--ignore-scripts` whenever a private
-* registry is configured.
+* The install runs with `--ignore-scripts` for every package manager. A
+* lifecycle script in a committed `package.json` is customer code the agent
+* never agreed to execute: it would run wherever the install runs, which for a
+* step-child install is the process holding the job's secrets. Operators who
+* genuinely need it set `KICI_ALLOW_INSTALL_SCRIPTS=true` on the agent.
 */
 const logger$2 = createLogger({ prefix: "dep-installer" });
 const execFileAsync = promisify(execFile);
@@ -3763,9 +3880,11 @@ async function detectKiciYarnFlavor(repoRoot, kiciDir) {
 * between build jobs; the directory is removed after installation.
 *
 * If `opts.npmRegistries` / `opts.installEnvSecrets` is provided, a job-scoped
-* `.kici/.npmrc` overlay is synthesized for the install, restored in `finally`,
-* and the install runs with `--ignore-scripts` so lifecycle scripts in a
-* committed `package.json` cannot exfiltrate the synthesized token env vars.
+* `.kici/.npmrc` overlay is synthesized for the install and restored in
+* `finally`.
+*
+* Lifecycle scripts are disabled for every package manager unless the operator
+* set `opts.allowInstallScripts`.
 *
 * @param kiciDir - Path to the `.kici/` directory containing package.json.
 * @param opts    - Optional registry / installEnv / repoRoot configuration.
@@ -3787,13 +3906,15 @@ async function installDeps(kiciDir, opts = {}) {
 		yarnFlavor
 	});
 	const startTime = Date.now();
-	const hasPrivateRegistry = (opts.npmRegistries?.length ?? 0) > 0 || (opts.installEnvSecrets ? Object.keys(opts.installEnvSecrets).length > 0 : false);
+	const ignoreScripts = opts.allowInstallScripts !== true;
+	const baseEnv = opts.baseEnv ?? process.env;
 	const isBerry = packageManager === PackageManager.Yarn && yarnFlavor === YarnFlavor.Berry;
 	const registryConfig = isBerry ? await applyYarnrcBerryConfig({
 		kiciDir,
 		npmRegistries: opts.npmRegistries,
 		installEnvSecrets: opts.installEnvSecrets,
-		jobIdShort: opts.jobIdShort ?? "00000000"
+		jobIdShort: opts.jobIdShort ?? "00000000",
+		ignoreScripts
 	}) : await applyNpmRegistryConfig({
 		kiciDir,
 		npmRegistries: opts.npmRegistries,
@@ -3803,22 +3924,26 @@ async function installDeps(kiciDir, opts = {}) {
 	try {
 		if (packageManager === PackageManager.Pnpm) await runPnpmInstall({
 			kiciDir,
-			hasPrivateRegistry,
-			registryConfig
+			ignoreScripts,
+			registryConfig,
+			baseEnv
 		});
 		else if (isBerry) await runYarnBerryInstall({
 			kiciDir,
-			registryConfig
+			registryConfig,
+			baseEnv
 		});
 		else if (packageManager === PackageManager.Yarn) await runYarnInstall({
 			kiciDir,
-			hasPrivateRegistry,
-			registryConfig
+			ignoreScripts,
+			registryConfig,
+			baseEnv
 		});
 		else await runNpmInstall({
 			kiciDir,
-			hasPrivateRegistry,
-			registryConfig
+			ignoreScripts,
+			registryConfig,
+			baseEnv
 		});
 	} catch (e) {
 		const tokens = registryConfig.tokensForRedaction;
@@ -3828,8 +3953,8 @@ async function installDeps(kiciDir, opts = {}) {
 	} finally {
 		await registryConfig.cleanup();
 	}
-	if (packageManager === PackageManager.Pnpm && await kiciHasLocalProtocolDeps(kiciDir)) await buildWorkspaceClosure(repoRoot);
-	if (packageManager === PackageManager.Yarn) await buildYarnWorkspaceClosure(repoRoot, kiciDir, yarnFlavor);
+	if (packageManager === PackageManager.Pnpm && await kiciHasLocalProtocolDeps(kiciDir)) await buildWorkspaceClosure(repoRoot, baseEnv);
+	if (packageManager === PackageManager.Yarn) await buildYarnWorkspaceClosure(repoRoot, kiciDir, yarnFlavor, baseEnv);
 	const durationMs = Date.now() - startTime;
 	process.stderr.write(`[dep-installer:trace] install complete: ${durationMs}ms\n`);
 	logger$2.info("Deps installed inline", {
@@ -3837,20 +3962,26 @@ async function installDeps(kiciDir, opts = {}) {
 		durationMs
 	});
 }
-/** Build the Node binary directory onto PATH so spawned tools find `node`. */
-function envWithNodeOnPath(extraEnv, nodeDir) {
-	const { NODE_ENV: _NODE_ENV, ...restEnv } = process.env;
+/**
+* Build the Node binary directory onto PATH so spawned tools find `node`.
+*
+* `baseEnv` is the caller's declared environment for the subprocess. It
+* defaults to `process.env` because inside the runner child that IS the
+* sanitized job environment; an agent-process caller passes a sanitized base.
+*/
+function envWithNodeOnPath(extraEnv, nodeDir, baseEnv = process.env) {
+	const { NODE_ENV: _NODE_ENV, ...restEnv } = baseEnv;
 	return {
 		...restEnv,
 		...extraEnv,
-		PATH: `${nodeDir}${process.platform === "win32" ? ";" : ":"}${process.env.PATH ?? ""}`
+		PATH: `${nodeDir}${process.platform === "win32" ? ";" : ":"}${restEnv.PATH ?? ""}`
 	};
 }
 /** Run `npm install` in `.kici/` with an isolated cache directory. */
 async function runNpmInstall(args) {
 	const { npmCliPath, nodeExe, nodeDir } = resolveNpm();
 	const { path: cacheDir, cleanup } = await makeTempDir("npm-cache");
-	const env = envWithNodeOnPath(args.registryConfig.extraEnv, nodeDir);
+	const env = envWithNodeOnPath(args.registryConfig.extraEnv, nodeDir, args.baseEnv);
 	const buildArgs = (...prefix) => {
 		const a = [
 			...prefix,
@@ -3860,7 +3991,7 @@ async function runNpmInstall(args) {
 			"--no-audit",
 			"--no-fund"
 		];
-		if (args.hasPrivateRegistry) a.push("--ignore-scripts");
+		if (args.ignoreScripts) a.push("--ignore-scripts");
 		return a;
 	};
 	try {
@@ -3889,7 +4020,7 @@ async function runPnpmInstall(args) {
 	await assertPnpmAvailable();
 	const { nodeDir } = resolveNpm();
 	const { path: storeDir, cleanup } = await makeTempDir("pnpm-store");
-	const env = envWithNodeOnPath(args.registryConfig.extraEnv, nodeDir);
+	const env = envWithNodeOnPath(args.registryConfig.extraEnv, nodeDir, args.baseEnv);
 	const argv = [
 		"install",
 		`--config.store-dir=${storeDir}`,
@@ -3898,7 +4029,7 @@ async function runPnpmInstall(args) {
 		"--config.side-effects-cache=false",
 		PNPM_IGNORE_BUILD_GATE_ARG
 	];
-	if (args.hasPrivateRegistry) argv.push("--ignore-scripts");
+	if (args.ignoreScripts) argv.push("--ignore-scripts");
 	try {
 		process.stderr.write(`[dep-installer:trace] running: pnpm ${argv.join(" ")}\n`);
 		await execFileAsync("pnpm", argv, {
@@ -3912,7 +4043,7 @@ async function runPnpmInstall(args) {
 	}
 }
 /** Pure: argv for `yarn install` with an isolated cache folder. */
-function buildYarnInstallArgs(cacheDir, hasPrivateRegistry) {
+function buildYarnInstallArgs(cacheDir, ignoreScripts) {
 	const a = [
 		"install",
 		"--cache-folder",
@@ -3920,7 +4051,7 @@ function buildYarnInstallArgs(cacheDir, hasPrivateRegistry) {
 		"--non-interactive",
 		"--no-progress"
 	];
-	if (hasPrivateRegistry) a.push("--ignore-scripts");
+	if (ignoreScripts) a.push("--ignore-scripts");
 	return a;
 }
 /**
@@ -3935,8 +4066,8 @@ async function runYarnInstall(args) {
 	await assertYarnAvailable();
 	const { nodeDir } = resolveNpm();
 	const { path: cacheDir, cleanup } = await makeTempDir("yarn-cache");
-	const env = envWithNodeOnPath(args.registryConfig.extraEnv, nodeDir);
-	const argv = buildYarnInstallArgs(cacheDir, args.hasPrivateRegistry);
+	const env = envWithNodeOnPath(args.registryConfig.extraEnv, nodeDir, args.baseEnv);
+	const argv = buildYarnInstallArgs(cacheDir, args.ignoreScripts);
 	try {
 		process.stderr.write(`[dep-installer:trace] running: yarn ${argv.join(" ")}\n`);
 		await execFileAsync("yarn", argv, {
@@ -3966,7 +4097,7 @@ async function runYarnBerryInstall(args) {
 	await assertYarnAvailable();
 	const { nodeDir } = resolveNpm();
 	const env = {
-		...envWithNodeOnPath(args.registryConfig.extraEnv, nodeDir),
+		...envWithNodeOnPath(args.registryConfig.extraEnv, nodeDir, args.baseEnv),
 		COREPACK_ENABLE_DOWNLOAD_PROMPT: "0"
 	};
 	const argv = buildYarnBerryInstallArgs();
@@ -3997,11 +4128,11 @@ async function assertYarnAvailable() {
 * Deep cross-sibling build chains may build out of strict topological order —
 * real `.kici` closures are shallow.
 */
-async function buildYarnWorkspaceClosure(repoRoot, kiciDir, yarnFlavor) {
+async function buildYarnWorkspaceClosure(repoRoot, kiciDir, yarnFlavor, baseEnv) {
 	const siblings = await collectInRepoSiblings(repoRoot, kiciDir, resolveYarnNodeModulesRoot(repoRoot, kiciDir));
 	if (siblings.length === 0) return;
 	const { nodeDir } = resolveNpm();
-	const env = envWithNodeOnPath({}, nodeDir);
+	const env = envWithNodeOnPath({}, nodeDir, baseEnv);
 	for (const rel of [...siblings].reverse()) {
 		const sibDir = join(repoRoot, rel);
 		if (!await siblingHasBuildScript(sibDir)) continue;
@@ -4045,9 +4176,9 @@ async function siblingHasBuildScript(sibDir) {
 * the subprocess stderr/stdout is folded into the thrown error so the job's
 * failure message names the real cause instead of a bare "Command failed".
 */
-async function buildWorkspaceClosure(repoRoot) {
+async function buildWorkspaceClosure(repoRoot, baseEnv) {
 	const { nodeDir } = resolveNpm();
-	const env = envWithNodeOnPath({}, nodeDir);
+	const env = envWithNodeOnPath({}, nodeDir, baseEnv);
 	const argv = [
 		"--filter",
 		"{.kici}^...",
@@ -4141,12 +4272,17 @@ function buildGeneratorContext(input) {
 * ESM modules by resolved URL, so importing that path yields the workflow's live
 * singleton, not a fresh copy.
 *
-* Falls back to the agent's bundled setters when resolution fails (mirrors
+* Both specifiers resolve to the same module-global maps — `internal.ts` and the
+* root barrel re-export the same `outputs.js` bindings — so the fallback below
+* changes which entry is imported, never which singleton is mutated.
+*
+* Falls back to the agent's bundled setters when neither resolves (mirrors
 * `resolveSdkSetters` in the compiler's test runner).
 */
 async function resolveWorkflowSdkSetters(workflowFilePath) {
-	try {
-		const sdkEntry = createRequire(workflowFilePath).resolve("@kici-dev/sdk");
+	const req = createRequire(workflowFilePath);
+	for (const specifier of ["@kici-dev/sdk/internal", "@kici-dev/sdk"]) try {
+		const sdkEntry = req.resolve(specifier);
 		const sdk = await import(pathToFileURL(sdkEntry).href);
 		if (typeof sdk.setStepOutputsMap === "function" && typeof sdk.setStepRefMap === "function" && typeof sdk.setJobOutputsMap === "function") return {
 			setStepOutputsMap: sdk.setStepOutputsMap,
@@ -4160,8 +4296,8 @@ async function resolveWorkflowSdkSetters(workflowFilePath) {
 		setJobOutputsMap
 	};
 }
-const AGENT_SDK_VERSION = "0.6.1";
-const AGENT_SDK_BUNDLE_HASH = "22faf0da45de7c243ce87f80fd33ee51b1df52809fde457b16bb821678f65eb3";
+const AGENT_SDK_VERSION = "0.7.0";
+const AGENT_SDK_BUNDLE_HASH = "065963c7765dc8d87e04d45f57d7e15be1613da705e4ff3ec3742fd1408b7bf5";
 /**
 * Register the ESM loader hook that transforms `.ts` / `.tsx` files on the fly
 * for subsequent dynamic `import()` calls. Idempotent at our level via the
@@ -4201,10 +4337,49 @@ function ensureLoaderHookRegistered() {
 * with lockfiles compiled on Linux (LF).
 */
 function computeContentHash(rawSource, assetDigest) {
-	let input = `5:${normalizeLineEndings(rawSource)}`;
+	let input = `${COMPILE_SCHEMA_VERSION}:${normalizeLineEndings(rawSource)}`;
 	if (assetDigest !== void 0 && assetDigest.length > 0) input += `\0${normalizeLineEndings(assetDigest)}`;
 	return sha256(input);
 }
+/**
+* The compile schema version the lock file records for `sourceFile`, or null
+* when the tree carries no readable lock (a `file://` in-place run, a workflow
+* outside the `.kici/` convention, a hand-built fixture).
+*
+* The source tarball carries `.kici/kici.lock.json` — the digest excludes it,
+* but `source-packer.ts` packs it — so the agent can read the producing
+* compiler's schema version from the tree it already has, with no wire field
+* to plumb and no protocol change.
+*
+* A malformed or unreadable lock returns null rather than throwing: this is a
+* diagnostic gate in front of the real hash check, so it must never convert a
+* bad lock into a worse error than the hash comparison already gives.
+*/
+async function readLockCompileSchemaVersion(kiciDir, sourceFile) {
+	let parsed;
+	try {
+		parsed = JSON.parse(await fsPromises.readFile(path.join(kiciDir, "kici.lock.json"), "utf-8"));
+	} catch {
+		return null;
+	}
+	const workflows = parsed?.workflows;
+	if (!Array.isArray(workflows)) return null;
+	const normalize = (p) => p.replaceAll("\\", "/").replace(/^\.\//, "");
+	const target = normalize(sourceFile);
+	const versionOf = (w) => {
+		const v = w?.compileSchemaVersion;
+		return typeof v === "number" && Number.isFinite(v) && v > 0 ? v : null;
+	};
+	for (const w of workflows) {
+		const file = w?.source?.file;
+		if (typeof file === "string" && normalize(file) === target) return versionOf(w);
+	}
+	for (const w of workflows) {
+		const v = versionOf(w);
+		if (v !== null) return v;
+	}
+	return null;
+}
 async function buildAssetDigestFromResolvedPaths(workDir, resolvedPaths) {
 	const parts = [];
 	for (const rel of resolvedPaths) {
@@ -4226,20 +4401,30 @@ async function buildAssetDigestFromResolvedPaths(workDir, resolvedPaths) {
 * `node_modules/` the same way any `tsx`-style runner would — so host-repo
 * helpers and `@kici-dev/sdk` Just Work.
 *
-* When `expectedContentHash` is provided, verifies the raw source matches
-* the hash in the lock file. Drift between source and lock file produces a
-* descriptive error that surfaces the baked agent SDK fingerprint (useful
-* when debugging "is the agent running a stale build?").
+* When `expectedContentHash` is provided, verifies the extracted `.kici/` tree
+* matches the hash in the lock file. It re-hashes the whole tree, not the entry
+* file alone, so an edit to an imported helper is caught — that was the gap
+* that let a warm cache restore a stale tarball and run the OLD helper green.
+* Drift produces a descriptive error that surfaces the baked agent SDK
+* fingerprint (useful when debugging "is the agent running a stale build?").
 */
 async function loadWorkflowSource(workDir, sourceFile, expectedContentHash, resolvedHashFiles) {
 	ensureLoaderHookRegistered();
 	const filePath = path.join(workDir, sourceFile);
 	if (expectedContentHash) {
-		const rawSource = await fsPromises.readFile(filePath, "utf-8");
+		const kiciDir = findKiciDir(filePath);
+		if (kiciDir) {
+			const lockVersion = await readLockCompileSchemaVersion(kiciDir, sourceFile);
+			if (lockVersion !== null && lockVersion !== COMPILE_SCHEMA_VERSION) throw new Error(`kici.lock.json was compiled by an incompatible @kici-dev/compiler: the lock declares compile schema ${lockVersion}, this agent implements ${COMPILE_SCHEMA_VERSION}. The schema version is mixed into every contentHash, so recompiling cannot reconcile them. Align the versions: upgrade the agent to one implementing schema ${lockVersion}, or pin @kici-dev/compiler to a release implementing schema ${COMPILE_SCHEMA_VERSION} and recompile (agent baked @kici-dev/sdk@${AGENT_SDK_VERSION} bundleHash=${AGENT_SDK_BUNDLE_HASH}).`);
+		}
+		const rawSource = (kiciDir ? await hashKiciSourceTree(kiciDir) : "") || await fsPromises.readFile(filePath, "utf-8");
 		let assetDigest;
 		if (resolvedHashFiles?.length) assetDigest = await buildAssetDigestFromResolvedPaths(workDir, resolvedHashFiles);
 		const actualHash = computeContentHash(rawSource, assetDigest);
-		if (actualHash !== expectedContentHash) throw new Error(`Lock file is out of date: workflow source changed without regenerating kici.lock.json (expected contentHash ${expectedContentHash}, got ${actualHash}, agent baked @kici-dev/sdk@${AGENT_SDK_VERSION} bundleHash=${AGENT_SDK_BUNDLE_HASH}). Run 'kici compile' and commit the updated lock file.`);
+		if (actualHash !== expectedContentHash) {
+			const symlinkNote = kiciDir ? hashedSymlinkDriftNote(await collectSourceSymlinks(kiciDir)) : "";
+			throw new Error(`Lock file is out of date: workflow source changed without regenerating kici.lock.json (expected contentHash ${expectedContentHash}, got ${actualHash}, agent baked @kici-dev/sdk@${AGENT_SDK_VERSION} bundleHash=${AGENT_SDK_BUNDLE_HASH}). Run 'kici compile' and commit the updated lock file.${symlinkNote}`);
+		}
 	}
 	return {
 		module: await import(pathToFileURL(filePath).href + `?t=${Date.now()}`),
@@ -4402,22 +4587,30 @@ function applyGlobalWorkflowEnv(repos) {
 * `.kici/` source tarball restoration for execution agents.
 *
 * Downloads a pre-built `.kici/` source tarball from the orchestrator's cache
-* and extracts it into `workDir/` so the workflow entry point becomes
+* and installs it at `workDir/.kici` so the workflow entry point becomes
 * importable. Mirrors the shape of `dep-restore.ts` but without the streaming
 * optimization — source tarballs are tiny (kilobytes, not the hundreds of
 * megabytes a `node_modules/` tarball carries).
 *
-* Note on integrity: `dispatch.sourceTarHash` is the workflow `contentHash`
-* (computed over the raw source per `workflow-loader.ts::computeContentHash`),
-* not the SHA-256 of the tarball bytes. The shared S3 cache key is derived
-* from that same contentHash, so a signed GET URL from the orchestrator
-* already establishes provenance for restored tarballs. Every
-* `loadWorkflowSource` call site — build, init, and dynamic eval — passes
-* the dispatched `contentHash` (and `resolvedHashFiles` when present) so
-* the lock-vs-source drift gate fires at each author-TS load site, not
-* only the build phase. That closes the corner cases where init or eval
-* runs without a preceding build (cache infrastructure unavailable, or a
-* build job that failed but left dynamic dispatch in flight).
+* Two properties this path is responsible for, both of which it previously
+* lacked:
+*
+* **Verification.** `dispatch.sourceTarDigest` is the SHA-256 of the tarball's
+* own bytes, so the download is checked before anything is extracted — the same
+* contract `restoreDeps` has always had via `depsHash`. The older
+* `dispatch.sourceTarHash` field carries the workflow `contentHash` instead, so
+* it never could serve this purpose; it stays on the wire for older peers and
+* is deliberately not used as a verification input here. When no digest is
+* dispatched (an older orchestrator, or a source that did not come from the
+* content-addressed cache) the restore proceeds unverified rather than failing,
+* so a mixed-version rollout still runs.
+*
+* **Replacement, not overlay.** Extraction lands in a scratch directory and the
+* result REPLACES `workDir/.kici` wholesale, save for `node_modules/` — the one
+* directory the tarball deliberately omits, which the deps restore has already
+* written by the time this runs. Extracting over the existing tree left any file
+* the tarball no longer carries in place, so a helper the author deleted
+* survived every warm-cache run and kept being imported.
 */
 init_dep_restore();
 const logger$1 = createLogger({ prefix: "source-restore" });
@@ -4431,7 +4624,14 @@ async function extractSourceTarball(data, targetDir) {
 		})).on("finish", resolve).on("error", reject);
 	});
 }
-async function restoreSource(workDir, sourceTarUrl) {
+/**
+* Download, verify, and install the `.kici/` source tree.
+*
+* @param workDir - Root of the cloned repository; `.kici` is replaced under it
+* @param sourceTarUrl - `http://`, `https://`, or `file://` URL to the tarball
+* @param sourceTarDigest - Expected SHA-256 of the tarball bytes, when known
+*/
+async function restoreSource(workDir, sourceTarUrl, sourceTarDigest) {
 	sourceTarUrl = resolveOrchestratorUrl(sourceTarUrl);
 	logger$1.info("Restoring .kici/ source from tarball", { sourceTarUrl });
 	const startTime = Date.now();
@@ -4441,11 +4641,34 @@ async function restoreSource(workDir, sourceTarUrl) {
 		data = await fsPromises.readFile(localPath);
 	} else if (sourceTarUrl.startsWith("http://") || sourceTarUrl.startsWith("https://")) data = await downloadUrl(sourceTarUrl);
 	else throw new Error(`Unsupported source tarball URL scheme: ${sourceTarUrl}`);
-	await extractSourceTarball(data, workDir);
+	if (sourceTarDigest) {
+		const actual = createHash("sha256").update(data).digest("hex");
+		if (actual !== sourceTarDigest) throw new Error(`Source tarball hash mismatch: expected ${sourceTarDigest}, got ${actual}. The restored source does not match what the orchestrator dispatched.`);
+	}
+	const kiciDir = path.join(workDir, ".kici");
+	const scratch = path.join(workDir, `.kici.restore-${process.pid}-${Date.now()}`);
+	try {
+		await extractSourceTarball(data, scratch);
+		const extracted = path.join(scratch, ".kici");
+		const src = (await fsPromises.stat(extracted).catch(() => null))?.isDirectory() ? extracted : scratch;
+		const installedDeps = path.join(kiciDir, "node_modules");
+		if (await fsPromises.stat(installedDeps).catch(() => null)) await rename(installedDeps, path.join(src, "node_modules"));
+		await rm(kiciDir, {
+			recursive: true,
+			force: true
+		});
+		await rename(src, kiciDir);
+	} finally {
+		await rm(scratch, {
+			recursive: true,
+			force: true
+		}).catch(() => {});
+	}
 	const durationMs = Date.now() - startTime;
 	logger$1.info(".kici/ source restored", {
 		sizeKB: (data.length / 1024).toFixed(2),
-		durationMs
+		durationMs,
+		verified: sourceTarDigest !== void 0
 	});
 }
 //#endregion
@@ -4594,7 +4817,7 @@ async function applyOverlay(config) {
 */
 init_download();
 init_dep_restore();
-const AGENT_VERSION = "0.6.1";
+const AGENT_VERSION = "0.7.0";
 process.on("uncaughtException", (err) => {
 	process.stderr.write(`[workflow-runner] UNCAUGHT EXCEPTION: ${err.message}\n`);
 	if (err.stack) process.stderr.write(`[workflow-runner] Stack: ${err.stack}\n`);
@@ -4666,7 +4889,12 @@ function installOutputCapture() {
 				line
 			});
 		}
-		if (isForkMode) return origStdoutWrite(chunk, encodingOrCb, cb);
+		if (isForkMode) {
+			if (!captureIsActive() || process.env.KICI_RUNNER_DEBUG_STDIO === "true") return origStdoutWrite(chunk, encodingOrCb, cb);
+			const forkCallback = typeof encodingOrCb === "function" ? encodingOrCb : cb;
+			if (forkCallback) forkCallback();
+			return true;
+		}
 		const callback = typeof encodingOrCb === "function" ? encodingOrCb : cb;
 		if (callback) callback();
 		return true;
@@ -5256,6 +5484,46 @@ function extractRepoIdentifier(repoUrl) {
 * mint failure the statement is frozen + reported for later minting (deferred);
 * the step still completes.
 */
+/**
+* The context a deferred attestation's frozen statement is built from.
+*
+* Prefers the orchestrator's `provenanceContext` — server truth, derived from
+* the same run row the mint reads, so the frozen statement is field-for-field
+* what a live mint would have produced and the orchestrator can cross-check it.
+*
+* Falls back to the agent's local view when an older orchestrator sent none.
+* That fallback disagrees with the claims by construction: `request.ref` is the
+* job's CHECKOUT ref, which for a pull request is the HEAD branch where the
+* claim is the BASE branch, and `request.workflowRef` is a global workflow's
+* CLONE ref where the claim is `<name>@<sha>`. So a statement built from it
+* fails the capture cross-check and the defer is dropped — a green job with no
+* attestation, rather than an unchecked statement the orchestrator signs.
+*/
+function buildLocalContext(request) {
+	const ctx = request.provenanceContext;
+	if (ctx) return {
+		repository: ctx.repository ?? "",
+		ref: ctx.ref ?? "",
+		sha: ctx.sha,
+		workflowRef: ctx.workflowRef ?? "",
+		runId: ctx.runId,
+		jobId: ctx.jobId,
+		orgId: ctx.orgId,
+		sourceOrigin: ctx.sourceOrigin,
+		...ctx.provider ? { provider: ctx.provider } : {},
+		issuer: ctx.issuer,
+		orchestratorId: ctx.orchestratorId
+	};
+	return {
+		repository: extractRepoIdentifier(request.repoUrl),
+		ref: request.ref,
+		sha: request.sha || null,
+		workflowRef: request.workflowRef ?? request.workflowName,
+		runId: request.runId,
+		jobId: request.jobId,
+		issuer: ""
+	};
+}
 function buildAttestProvenanceFn(request, workDir, getIdToken) {
 	return async (opts) => {
 		const subject = provenanceSubjectIsPath(opts.subject) ? {
@@ -5271,15 +5539,7 @@ function buildAttestProvenanceFn(request, workDir, getIdToken) {
 				"kici-agent": AGENT_VERSION,
 				"kici-orchestrator": "unknown"
 			},
-			localContext: {
-				repository: extractRepoIdentifier(request.repoUrl),
-				ref: request.ref,
-				sha: request.sha || null,
-				workflowRef: request.workflowRef ?? request.workflowName,
-				runId: request.runId,
-				jobId: request.jobId,
-				issuer: request.provenanceIssuer ?? ""
-			},
+			localContext: buildLocalContext(request),
 			reportDeferred: async (report) => {
 				await relayProvenanceIpc({
 					op: "defer",
@@ -5584,20 +5844,6 @@ function buildStepSecrets(request, masker, onMaskerSecretsAdded) {
 	});
 }
 /**
-* Create a LogMasker initialized with all secret values from the request.
-*
-* Collects values from both flat secrets and all namespaced context secrets,
-* deduplicating before registration.
-*/
-function createSecretMasker(request) {
-	const masker = new LogMasker();
-	const allSecrets = {};
-	if (request.secrets) Object.assign(allSecrets, request.secrets);
-	if (request.namespacedSecrets) for (const contextSecrets of Object.values(request.namespacedSecrets)) Object.assign(allSecrets, contextSecrets);
-	masker.registerSecrets(allSecrets);
-	return masker;
-}
-/**
 * Build a fresh zx `$` shell bound to the sandbox working directory and the
 * sanitized environment (process.env was set by the parent via env-sanitizer
 * before spawning this process). This is the single shell-construction code
@@ -5628,12 +5874,13 @@ function createSecretMasker(request) {
 * step$.log would only set it on the function object and NOT propagate to the
 * AsyncLocalStorage store that zx uses for ProcessPromise snapshots.
 */
-function buildSandboxShell(cwd, stepIndex, maskedSendFn) {
+function buildSandboxShell(cwd, stepIndex, maskedSendFn, signal) {
 	return $({
 		cwd,
 		env: process.env,
 		verbose: true,
 		quiet: false,
+		...signal ? { signal } : {},
 		log: makeStreamingZxLog((line, stream) => maskedSendFn({
 			type: "log.line",
 			stepIndex,
@@ -5718,7 +5965,7 @@ function initialJobStatus(loopStatus) {
 * inside this process with full shell access.
 */
 function createSandboxStepContext(workDir, stepIndex, stepName, request, maskedSendFn, outputsMap, refMap, operatorSecretKeys, secretOutputs, jobOutputsMap, secrets, masker, signal, jobTempScope) {
-	const step$ = buildSandboxShell(workDir, stepIndex, maskedSendFn);
+	const step$ = buildSandboxShell(workDir, stepIndex, maskedSendFn, signal);
 	const log = createIpcLogger(stepIndex, stepName, maskedSendFn);
 	const rawPayload = rawPayloadFromEvent(request.event);
 	const kici = buildKiciApi(async (method, params) => {
@@ -5973,7 +6220,8 @@ async function installDependenciesIfNeeded(workflowDir, request) {
 			await installDeps(kiciDir, {
 				npmRegistries: request.npmRegistries,
 				installEnvSecrets: request.installEnvSecrets,
-				jobIdShort: request.jobIdShort
+				jobIdShort: request.jobIdShort,
+				...request.allowInstallScripts ? { allowInstallScripts: true } : {}
 			});
 			trace("fallback install complete");
 		}
@@ -5998,7 +6246,8 @@ async function installDependenciesIfNeeded(workflowDir, request) {
 		await installDeps(kiciDir, {
 			npmRegistries: request.npmRegistries,
 			installEnvSecrets: request.installEnvSecrets,
-			jobIdShort: request.jobIdShort
+			jobIdShort: request.jobIdShort,
+			...request.allowInstallScripts ? { allowInstallScripts: true } : {}
 		});
 		trace("installDeps() returned successfully");
 	} catch (depErr) {
@@ -6028,7 +6277,7 @@ async function restoreSourceTarballIfRequested(workflowRoot, request) {
 		stepIndex: -1,
 		line: "[workflow-runner] Restoring .kici/ source from cached tarball"
 	});
-	await restoreSource(workflowRoot, request.sourceTarUrl);
+	await restoreSource(workflowRoot, request.sourceTarUrl, request.sourceTarDigest);
 	trace("source tarball restored");
 }
 /**
@@ -6529,7 +6778,7 @@ function buildJobRuleCompletion(ruleResult, normalizedSteps) {
 * success-skip). Returns false when the caller should continue to step
 * execution.
 */
-async function maybeSkipJobOnRules(job, request, normalizedSteps, repos) {
+async function maybeSkipJobOnRules(job, request, normalizedSteps, send, repos) {
 	if (!job?.rules || job.rules.length === 0) return false;
 	const ev = request.event ?? {};
 	const ruleCtx = createRuleContext({
@@ -6548,7 +6797,7 @@ async function maybeSkipJobOnRules(job, request, normalizedSteps, repos) {
 	if (!completion) return false;
 	flushOutputCapture();
 	capturePrepareActive = false;
-	sendMessage(completion);
+	send(completion);
 	process.exit(0);
 }
 /**
@@ -6774,11 +7023,7 @@ async function main() {
 	const sourceDir = isGlobal ? join(workDir, "source") : workDir;
 	const masker = createSecretMasker(request);
 	const maskedSend = (msg) => {
-		if (msg.type === "log.line" && masker.hasSecrets()) sendMessage({
-			...msg,
-			line: masker.mask(msg.line)
-		});
-		else sendMessage(msg);
+		sendMessage(maskMessageText(msg, masker));
 	};
 	const jobDeadline = armJobDeadline(request.jobTimeoutMs, (reason, timeoutMs) => {
 		jobTimedOut = true;
@@ -6813,7 +7058,7 @@ async function main() {
 		const jobHasRules = (job?.rules?.length ?? 0) > 0;
 		const anyStepHasRules = normalizedSteps.some((s) => (s.rules?.length ?? 0) > 0);
 		await resolveChangedFilesForRules(request, sourceDir, jobHasRules || anyStepHasRules);
-		await maybeSkipJobOnRules(job, request, normalizedSteps, globalRepoInfo);
+		await maybeSkipJobOnRules(job, request, normalizedSteps, maskedSend, globalRepoInfo);
 		if (aborted) abortAndExit("aborted after rules");
 	}
 	const jobHooks = collectJobHooks(job);
@@ -6922,7 +7167,8 @@ async function main() {
 		jobTimedOut,
 		jobTimeoutMs: request.jobTimeoutMs,
 		cancelFailureReason,
-		driftDroppedJobs
+		driftDroppedJobs,
+		send: maskedSend
 	});
 	process.exit(finalStatus === ExecutionJobStatus.enum.success ? 0 : 1);
 }
@@ -6935,7 +7181,7 @@ async function main() {
 function emitJobComplete(args) {
 	const aggregatedOutputs = {};
 	for (const [stepName, outputs] of args.outputsMap) aggregatedOutputs[stepName] = outputs;
-	sendMessage({
+	args.send({
 		type: "job.complete",
 		status: args.finalStatus,
 		stepResults: args.loopResult.stepResults,