@kici-dev/agent 0.8.0 → 0.9.0

package/dist/workflow-runner.js

@@ -1360,10 +1360,10 @@ function createArtifactsApi(workDir, transport, roots) {
 			if (paths.length === 0) throw new Error(`artifact "${name}" upload requires at least one path`);
 			const { tarball, hash } = await packCachePaths(workDir, paths, roots);
 			const grant = await transport.beginUpload(name, tarball.length);
-			if (grant.outcome === "rejected" || !grant.uploadUrl || !grant.storageKey) throw new Error(rejectionMessage(name, grant.reason, grant.error));
+			if (grant.outcome === "rejected" || !grant.uploadUrl) throw new Error(rejectionMessage(name, grant.reason, grant.error));
 			const { uploadToPresignedUrl } = await Promise.resolve().then(() => (init_download(), download_exports));
 			await uploadToPresignedUrl(grant.uploadUrl, tarball);
-			await transport.completeUpload(name, tarball.length, hash, grant.storageKey);
+			await transport.completeUpload(name, hash);
 			logger$3.info("artifact uploaded", {
 				name,
 				sizeBytes: tarball.length,
@@ -4272,32 +4272,29 @@ function buildGeneratorContext(input) {
 * ESM modules by resolved URL, so importing that path yields the workflow's live
 * singleton, not a fresh copy.
 *
-* Both specifiers resolve to the same module-global maps — `internal.ts` and the
-* root barrel re-export the same `outputs.js` bindings — so the fallback below
-* changes which entry is imported, never which singleton is mutated.
-*
-* Falls back to the agent's bundled setters when neither resolves (mirrors
-* `resolveSdkSetters` in the compiler's test runner).
+* The setters live only on `@kici-dev/sdk/internal`. A tree whose SDK does not
+* publish that subpath cannot be wired to this agent, and the agent's own
+* bundled setters would mutate a map the workflow's proxies never read — so the
+* mismatch is refused here rather than surfacing later as an empty `.result`.
 */
 async function resolveWorkflowSdkSetters(workflowFilePath) {
 	const req = createRequire(workflowFilePath);
-	for (const specifier of ["@kici-dev/sdk/internal", "@kici-dev/sdk"]) try {
-		const sdkEntry = req.resolve(specifier);
-		const sdk = await import(pathToFileURL(sdkEntry).href);
-		if (typeof sdk.setStepOutputsMap === "function" && typeof sdk.setStepRefMap === "function" && typeof sdk.setJobOutputsMap === "function") return {
-			setStepOutputsMap: sdk.setStepOutputsMap,
-			setStepRefMap: sdk.setStepRefMap,
-			setJobOutputsMap: sdk.setJobOutputsMap
-		};
-	} catch {}
+	let sdk;
+	try {
+		const sdkEntry = req.resolve("@kici-dev/sdk/internal");
+		sdk = await import(pathToFileURL(sdkEntry).href);
+	} catch (err) {
+		throw new Error(`Could not resolve @kici-dev/sdk/internal from ${workflowFilePath}: the workflow tree must depend on @kici-dev/sdk@>=0.8.0 to run on this agent (agent baked @kici-dev/sdk@${AGENT_SDK_VERSION}). Upgrade the repository's @kici-dev/sdk and recompile: ${toErrorMessage(err)}`);
+	}
+	if (typeof sdk.setStepOutputsMap !== "function" || typeof sdk.setStepRefMap !== "function" || typeof sdk.setJobOutputsMap !== "function") throw new Error(`@kici-dev/sdk/internal resolved from ${workflowFilePath} carries no output-map setters; the workflow tree must depend on @kici-dev/sdk@>=0.8.0 to run on this agent (agent baked @kici-dev/sdk@${AGENT_SDK_VERSION}).`);
 	return {
-		setStepOutputsMap,
-		setStepRefMap,
-		setJobOutputsMap
+		setStepOutputsMap: sdk.setStepOutputsMap,
+		setStepRefMap: sdk.setStepRefMap,
+		setJobOutputsMap: sdk.setJobOutputsMap
 	};
 }
-const AGENT_SDK_VERSION = "0.8.0";
-const AGENT_SDK_BUNDLE_HASH = "065963c7765dc8d87e04d45f57d7e15be1613da705e4ff3ec3742fd1408b7bf5";
+const AGENT_SDK_VERSION = "0.9.0";
+const AGENT_SDK_BUNDLE_HASH = "b012bd8bace3df9e574252bf290c652bc39766da617acf51729a08586756266d";
 /**
 * Register the ESM loader hook that transforms `.ts` / `.tsx` files on the fly
 * for subsequent dynamic `import()` calls. Idempotent at our level via the
@@ -4490,7 +4487,7 @@ async function extractStepsFromDynamicJob(workflow, dynamicIndex, jobName, event
 	const dynamicFn = extractDynamicJobFn(workflow, dynamicIndex);
 	const { $ } = await import("zx");
 	const { createLogger } = await import("@kici-dev/shared");
-	const { buildKiciApi, buildNeedsContext } = await import("@kici-dev/sdk");
+	const { buildKiciApi, buildNeedsContext } = await import("@kici-dev/sdk/internal");
 	const log = createLogger({ prefix: `dynamic-job-fn:${workflow.name}` });
 	const kici = buildKiciApi(apiTransport ?? (() => Promise.reject(/* @__PURE__ */ new Error("Agent API not available during re-evaluation"))));
 	const needs = upstreamSnapshot ? buildNeedsContext(upstreamSnapshot, declaredNeeds ?? []) : void 0;
@@ -4592,18 +4589,13 @@ function applyGlobalWorkflowEnv(repos) {
 * optimization — source tarballs are tiny (kilobytes, not the hundreds of
 * megabytes a `node_modules/` tarball carries).
 *
-* Two properties this path is responsible for, both of which it previously
-* lacked:
+* Two properties this path is responsible for:
 *
 * **Verification.** `dispatch.sourceTarDigest` is the SHA-256 of the tarball's
 * own bytes, so the download is checked before anything is extracted — the same
-* contract `restoreDeps` has always had via `depsHash`. The older
-* `dispatch.sourceTarHash` field carries the workflow `contentHash` instead, so
-* it never could serve this purpose; it stays on the wire for older peers and
-* is deliberately not used as a verification input here. When no digest is
-* dispatched (an older orchestrator, or a source that did not come from the
-* content-addressed cache) the restore proceeds unverified rather than failing,
-* so a mixed-version rollout still runs.
+* contract `restoreDeps` has via `depsHash`. When no digest is dispatched (a
+* source that did not come from the content-addressed cache) the restore
+* proceeds unverified rather than failing.
 *
 * **Replacement, not overlay.** Extraction lands in a scratch directory and the
 * result REPLACES `workDir/.kici` wholesale, save for `node_modules/` — the one
@@ -4817,7 +4809,7 @@ async function applyOverlay(config) {
 */
 init_download();
 init_dep_restore();
-const AGENT_VERSION = "0.8.0";
+const AGENT_VERSION = "0.9.0";
 process.on("uncaughtException", (err) => {
 	process.stderr.write(`[workflow-runner] UNCAUGHT EXCEPTION: ${err.message}\n`);
 	if (err.stack) process.stderr.write(`[workflow-runner] Stack: ${err.stack}\n`);
@@ -5422,16 +5414,14 @@ function buildArtifactTransport() {
 				...response.rejectionDetail && { error: response.rejectionDetail }
 			};
 		},
-		async completeUpload(name, sizeBytes, sha256, storageKey) {
+		async completeUpload(name, sha256) {
 			const requestId = randomUUID();
 			sendMessage({
 				type: "artifacts.request",
 				requestId,
 				op: "completeUpload",
 				name,
-				sizeBytes,
-				sha256,
-				storageKey
+				sha256
 			});
 			const response = await waitForArtifactResponse(requestId);
 			if (response.error) throw new Error(`Artifact upload-complete failed: ${response.error}`);

package/dist/ws/orchestrator-client.d.ts

@@ -189,6 +189,18 @@ export declare class OrchestratorClient {
      * GitHub Actions run hangs until the job timeout.
      */
     onClaimFailedPermanently: ((reason: string) => void) | null;
+    /**
+     * Fired once when authentication fails permanently — an `auth.failure` frame,
+     * or the orchestrator closing with WS_CLOSE_AGENT_AUTH_FAILED (a revoked token,
+     * or a protocol version below the orchestrator's floor). The client never
+     * reconnects after this, so server.ts wires it to a non-zero graceful
+     * shutdown; without it the health HTTP server keeps a process alive that can
+     * never register again, and a one-shot GitHub Actions agent holds its runner
+     * until the job timeout.
+     */
+    onAuthFailedPermanently: ((reason: string) => void) | null;
+    /** Marks the auth failure permanent and fires onAuthFailedPermanently exactly once. */
+    private failAuthPermanently;
     constructor(options: OrchestratorClientOptions);
     /** Current connection state. */
     get state(): ConnectionState;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kici-dev/agent",
-  "version": "0.8.0",
+  "version": "0.9.0",
   "description": "Customer-deployable agent for the KiCI CI/CD stack. Connects to an orchestrator, clones the workflow repo, executes steps, and streams logs back.",
   "keywords": [
     "ci",
@@ -59,18 +59,18 @@
     "@hono/node-server": "^2.1.1",
     "archiver": "^8.0.0",
     "dockerode": "^5.0.1",
-    "hono": "^4.13.2",
-    "jose": "^6.2.10",
+    "hono": "^4.13.7",
+    "jose": "^6.2.12",
     "tar": "^7.5.22",
     "winston": "^3.19.0",
     "ws": "^8.21.3",
-    "yaml": "^2.9.0",
-    "zod": "^4.4.3",
+    "yaml": "^2.9.1",
+    "zod": "^4.6.5",
     "zx": "^8.8.5",
-    "@kici-dev/core": "0.8.0",
-    "@kici-dev/engine": "0.8.0",
-    "@kici-dev/sdk": "0.8.0",
-    "@kici-dev/shared": "0.8.0"
+    "@kici-dev/core": "0.9.0",
+    "@kici-dev/engine": "0.9.0",
+    "@kici-dev/sdk": "0.9.0",
+    "@kici-dev/shared": "0.9.0"
   },
   "kici": {
     "metrics": {
@@ -83,8 +83,8 @@
     "@types/dockerode": "^4.0.1"
   },
   "scripts": {
-    "build": "node ../../scripts/build-service.mjs && tsgo --emitDeclarationOnly",
-    "typecheck": "tsgo --noEmit",
+    "build": "node ../../scripts/build-service.mjs && tsc --emitDeclarationOnly",
+    "typecheck": "tsc --noEmit",
     "test": "vitest run"
   }
 }