@kici-dev/compiler 0.1.16 → 0.1.17

package/dist/remote/uploader.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { encryptTarball } from "./encryption.js";
 import path from "node:path";
 import fs from "node:fs/promises";
@@ -30,6 +30,41 @@ function gitLines(cmd, cwd) {
 		return [];
 	}
 }
+/** True for repo-relative paths inside the `.git` directory. */
+function isGitDirPath(relPath) {
+	return relPath === ".git" || relPath.startsWith(".git/");
+}
+/**
+* Recursively enumerate every file under `<repoRoot>/.git`, returning paths
+* relative to `repoRoot` (so they keep the `.git/...` prefix in the tarball
+* and extract back in place).
+*
+* `git ls-files` never lists `.git` contents, so for `kici run remote` — which
+* uploads the developer's working tree as a self-contained overlay with NO
+* clone on the agent — we enumerate the directory explicitly. Including the
+* whole `.git` directory (objects, refs, HEAD, index, config, packed-refs)
+* makes the extracted overlay a real git repository, so workflow steps that
+* shell out to git work exactly as they do under `kici run local`.
+*/
+async function collectGitDirFiles(repoRoot) {
+	const gitRoot = path.join(repoRoot, ".git");
+	const out = [];
+	async function walk(absDir) {
+		let entries;
+		try {
+			entries = await fs.readdir(absDir, { withFileTypes: true });
+		} catch {
+			return;
+		}
+		await Promise.all(entries.map(async (entry) => {
+			const abs = path.join(absDir, entry.name);
+			if (entry.isDirectory()) await walk(abs);
+			else if (entry.isFile() || entry.isSymbolicLink()) out.push(path.relative(repoRoot, abs));
+		}));
+	}
+	await walk(gitRoot);
+	return out;
+}
 /**
 * Load .kiciignore patterns from a file.
 * Returns a picomatch matcher function or null if file doesn't exist.
@@ -56,6 +91,13 @@ async function loadKiciIgnore(kiciIgnorePath) {
 * files like `.kici/.env.local` — are excluded by `--exclude-standard` and
 * never appear in the selection.
 *
+* When `fullWorkingTree` is set (the `kici run remote` path), the entire
+* `.git` directory is additively included so the extracted overlay is a real
+* git repository on the agent — workflow steps that shell out to git then work
+* exactly as they do under `kici run local`. The `.git` files are added after
+* `.kiciignore` filtering (git internals are never subject to working-tree
+* ignore globs).
+*
 * @param repoRoot - Path to the git repository root
 * @param options - Optional configuration
 * @returns HEAD SHA, remote flag, and the existing/deleted file partition
@@ -67,7 +109,7 @@ async function selectOverlayFiles(repoRoot, options) {
 	}).trim();
 	const hasRemote = gitLines("git remote", repoRoot).length > 0;
 	let allFiles;
-	if (hasRemote) {
+	if (hasRemote && !options?.fullWorkingTree) {
 		const unstaged = gitLines("git diff --name-only HEAD", repoRoot);
 		const staged = gitLines("git diff --name-only --cached HEAD", repoRoot);
 		const untracked = gitLines("git ls-files --others --exclude-standard", repoRoot);
@@ -83,6 +125,10 @@ async function selectOverlayFiles(repoRoot, options) {
 	}
 	const kiciIgnore = await loadKiciIgnore(options?.kiciIgnorePath ?? path.join(repoRoot, ".kiciignore"));
 	if (kiciIgnore) allFiles = allFiles.filter((f) => !kiciIgnore(f));
+	if (options?.fullWorkingTree) {
+		const gitFiles = await collectGitDirFiles(repoRoot);
+		allFiles = [...new Set([...allFiles, ...gitFiles])];
+	}
 	const existingFiles = [];
 	const deletedFiles = [];
 	await Promise.all(allFiles.map(async (file) => {
@@ -117,8 +163,9 @@ async function selectOverlayFiles(repoRoot, options) {
 async function createOverlayTarball(repoRoot, options) {
 	const { sha, hasRemote, existingFiles, deletedFiles } = await selectOverlayFiles(repoRoot, options);
 	const untrackedSet = new Set(gitLines("git ls-files --others --exclude-standard", repoRoot));
-	const newFiles = existingFiles.filter((f) => untrackedSet.has(f));
-	const modifiedFiles = existingFiles.filter((f) => !untrackedSet.has(f));
+	const workingTreeFiles = existingFiles.filter((f) => !isGitDirPath(f));
+	const newFiles = workingTreeFiles.filter((f) => untrackedSet.has(f));
+	const modifiedFiles = workingTreeFiles.filter((f) => !untrackedSet.has(f));
 	const checksums = {};
 	await Promise.all(existingFiles.map(async (file) => {
 		checksums[file] = await sha256File(path.join(repoRoot, file));

package/dist/templates/agents-md.d.ts

@@ -4,5 +4,5 @@
  * picked up by Claude Code, Cursor, Aider, and other coding agents that scan
  * the working tree for an authoring context file.
  */
-export declare const agentsMdTemplate = "# KiCI workflow authoring guide\n\nThis project uses KiCI \u2014 a TypeScript-native CI/CD workflow engine \u2014 instead\nof YAML-based CI. Workflows live in `.kici/workflows/*.ts`, are compiled\ninto a portable lock file, and executed by self-hosted agents.\n\n## Where the API surface lives\n\n- Public SDK types: `node_modules/@kici-dev/sdk/dist/index.d.ts` \u2014 read this\n  for the canonical signatures of `workflow`, `job`, `step`, `pr`,\n  `push`, `schedule`, `matrix`, `rule`, `dynamicJob`, etc.\n- Bundled offline reference for coding agents: `kici docs llm` prints the\n  full markdown documentation bundle to stdout. `kici docs llm --index`\n  prints just the curated link index (llms.txt format).\n- Online docs:\n  - <https://kici.dev/docs/> \u2014 published docs site.\n  - <https://kici.dev/llms.txt> \u2014 curated index for LLM consumers.\n  - <https://kici.dev/llms-full.txt> \u2014 full markdown bundle.\n  - Key pages: `user/sdk-reference`, `user/workflow-patterns`,\n    `user/testing-guide`, `user/hooks`, `user/secrets`.\n\n## The five core patterns\n\n1. **Push trigger** \u2014 `on: push({ branches: 'main' })`. Pair with `paths`\n   to scope to subtrees.\n\n   ```ts\n   import { workflow, job, step, push } from '@kici-dev/sdk';\n\n   export default workflow('build', {\n     on: push({ branches: 'main' }),\n     jobs: [\n       job('build', {\n         runsOn: 'ubuntu-latest',\n         steps: [step('install', async ({ $ }) => { await $`pnpm install`; })],\n       }),\n     ],\n   });\n   ```\n\n2. **PR + matrix** \u2014 `pr({ target: 'main' })` plus a matrix over node\n   versions. The matrix expands at dispatch time.\n\n   ```ts\n   import { workflow, job, step, pr, matrix } from '@kici-dev/sdk';\n\n   export default workflow('test-matrix', {\n     on: pr({ target: 'main' }),\n     jobs: [\n       job('test', {\n         runsOn: 'ubuntu-latest',\n         strategy: { matrix: matrix({ node: ['20', '22', '24'] }) },\n         steps: [\n           step('test', async ({ $, matrix }) => {\n             await $`node --version`;\n             await $`pnpm install`;\n             await $`pnpm test`;\n             return { node: matrix.node };\n           }),\n         ],\n       }),\n     ],\n   });\n   ```\n\n3. **Lifecycle hooks** \u2014 `onFailure` / `onSuccess` / `onCancel` on a\n   job or workflow run after the main steps in their own scope.\n\n4. **Secrets** \u2014 declared scopes resolve at dispatch:\n\n   ```ts\n   step('deploy', async ({ $, secrets }) => {\n     await $`./scripts/deploy.sh`.env({ DEPLOY_TOKEN: secrets.production.DEPLOY_TOKEN });\n   });\n   ```\n\n   Run `kici secrets list` to enumerate the contexts available for testing.\n\n5. **Dynamic jobs** \u2014 `dynamicJob` and `dynamicGroup` build the DAG at\n   runtime from a step's outputs. Don't try to compute job names at top level;\n   the lock file would be wrong.\n\n## Anti-patterns\n\n- **Do NOT write `.yml` / `.yaml` CI files** \u2014 KiCI replaces that entire\n  layer. There is no compatibility shim.\n- **Do NOT `import` from any `@kici-dev/*` package's `/dist/...`\n  subpath** \u2014 those are not part of the public API and break across versions.\n  Import from the package root.\n- **Do NOT `await` outside step bodies.** The top-level workflow file is\n  loaded by the compiler synchronously; async I/O at module scope means the\n  lock file emits before it resolves and the workflow appears empty.\n- **Do NOT mutate shared variables between jobs.** Each job runs in its own\n  agent process. Use `needs` + step outputs to thread values.\n- **Do NOT hand-edit `kici.lock.json`.** Regenerate it via `kici compile`.\n\n## Local commands a coding agent should run\n\n| Command                         | Purpose                                     |\n| ------------------------------- | ------------------------------------------- |\n| `pnpm kici compile --check`     | Validate workflow source without writing.   |\n| `pnpm kici test pr:open --debug`| Preview which workflows match an event.     |\n| `pnpm kici run local push`      | Execute workflows locally with no orchestrator. |\n| `pnpm kici docs llm`            | Print the full LLM documentation bundle.    |\n| `pnpm kici docs llm --index`    | Print the curated link index.               |\n\nIf `pnpm kici` isn't in scripts, fall back to `npx kici`.\n\n## Loop\n\n1. Read the SDK types from `node_modules/@kici-dev/sdk/dist/index.d.ts`.\n2. Pipe `kici docs llm` into the agent's context if it doesn't already have\n   the full bundle.\n3. Edit a workflow under `.kici/workflows/`.\n4. Run `kici compile --check` (zero exit means valid).\n5. Run `kici test <event>` to preview matching.\n6. Run `kici run local <event>` to execute locally before pushing.\n";
+export declare const agentsMdTemplate = "# KiCI workflow authoring guide\n\nThis project uses KiCI \u2014 a TypeScript-native CI/CD workflow engine \u2014 instead\nof YAML-based CI. Workflows live in `.kici/workflows/*.ts`, are compiled\ninto a portable lock file, and executed by self-hosted agents.\n\n## Where the API surface lives\n\n- Public SDK types: `node_modules/@kici-dev/sdk/dist/index.d.ts` \u2014 read this\n  for the canonical signatures of `workflow`, `job`, `step`, `pr`,\n  `push`, `schedule`, `matrix`, `rule`, `dynamicJob`, etc.\n- Bundled offline reference for coding agents: `kici docs llm` prints the\n  full markdown documentation bundle to stdout. `kici docs llm --index`\n  prints just the curated link index (llms.txt format).\n- Online docs:\n  - <https://kici.dev/docs/> \u2014 published docs site.\n  - <https://kici.dev/llms.txt> \u2014 curated index for LLM consumers.\n  - <https://kici.dev/llms-full.txt> \u2014 full markdown bundle.\n  - Key pages: `user/sdk-reference`, `user/workflow-patterns`,\n    `user/testing-guide`, `user/hooks`, `user/secrets`.\n\n## The five core patterns\n\n1. **Push trigger** \u2014 `on: push({ branches: 'main' })`. Pair with `paths`\n   to scope to subtrees.\n\n   ```ts\n   import { workflow, job, step, push } from '@kici-dev/sdk';\n\n   export default workflow('build', {\n     on: push({ branches: 'main' }),\n     jobs: [\n       job('build', {\n         runsOn: 'kici:os:linux',\n         steps: [step('install', async ({ $ }) => { await $`pnpm install`; })],\n       }),\n     ],\n   });\n   ```\n\n   `kici:os:linux` targets any agent reporting that OS \u2014 every agent\n   self-reports `kici:os:` / `kici:arch:` / `kici:host:`. Use a custom label\n   (e.g. `'gpu'`, `'prod-pool'`) to target a specific agent pool your scaler\n   defines.\n\n2. **PR + matrix** \u2014 `pr({ target: 'main' })` plus a matrix over node\n   versions. The matrix expands at dispatch time.\n\n   ```ts\n   import { workflow, job, step, pr, matrix } from '@kici-dev/sdk';\n\n   export default workflow('test-matrix', {\n     on: pr({ target: 'main' }),\n     jobs: [\n       job('test', {\n         runsOn: 'kici:os:linux',\n         strategy: { matrix: matrix({ node: ['20', '22', '24'] }) },\n         steps: [\n           step('test', async ({ $, matrix }) => {\n             await $`node --version`;\n             await $`pnpm install`;\n             await $`pnpm test`;\n             return { node: matrix.node };\n           }),\n         ],\n       }),\n     ],\n   });\n   ```\n\n3. **Lifecycle hooks** \u2014 `onFailure` / `onSuccess` / `onCancel` on a\n   job or workflow run after the main steps in their own scope.\n\n4. **Secrets** \u2014 declared scopes resolve at dispatch:\n\n   ```ts\n   step('deploy', async ({ $, secrets }) => {\n     await $`./scripts/deploy.sh`.env({ DEPLOY_TOKEN: secrets.production.DEPLOY_TOKEN });\n   });\n   ```\n\n   Run `kici secrets list` to enumerate the contexts available for testing.\n\n5. **Dynamic jobs** \u2014 `dynamicJob` and `dynamicGroup` build the DAG at\n   runtime from a step's outputs. Don't try to compute job names at top level;\n   the lock file would be wrong.\n\n## Anti-patterns\n\n- **Do NOT write `.yml` / `.yaml` CI files** \u2014 KiCI replaces that entire\n  layer. There is no compatibility shim.\n- **Do NOT `import` from any `@kici-dev/*` package's `/dist/...`\n  subpath** \u2014 those are not part of the public API and break across versions.\n  Import from the package root.\n- **Do NOT `await` outside step bodies.** The top-level workflow file is\n  loaded by the compiler synchronously; async I/O at module scope means the\n  lock file emits before it resolves and the workflow appears empty.\n- **Do NOT mutate shared variables between jobs.** Each job runs in its own\n  agent process. Use `needs` + step outputs to thread values.\n- **Do NOT hand-edit `kici.lock.json`.** Regenerate it via `kici compile`.\n\n## Local commands a coding agent should run\n\n| Command                         | Purpose                                     |\n| ------------------------------- | ------------------------------------------- |\n| `pnpm kici compile --check`     | Validate workflow source without writing.   |\n| `pnpm kici test pr:open --debug`| Preview which workflows match an event.     |\n| `pnpm kici run local push`      | Execute workflows locally with no orchestrator. |\n| `pnpm kici docs llm`            | Print the full LLM documentation bundle.    |\n| `pnpm kici docs llm --index`    | Print the curated link index.               |\n\nIf `pnpm kici` isn't in scripts, fall back to `npx kici`.\n\n## Loop\n\n1. Read the SDK types from `node_modules/@kici-dev/sdk/dist/index.d.ts`.\n2. Pipe `kici docs llm` into the agent's context if it doesn't already have\n   the full bundle.\n3. Edit a workflow under `.kici/workflows/`.\n4. Run `kici compile --check` (zero exit means valid).\n5. Run `kici test <event>` to preview matching.\n6. Run `kici run local <event>` to execute locally before pushing.\n";
 //# sourceMappingURL=agents-md.d.ts.map

package/dist/templates/agents-md.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 //#region src/templates/agents-md.ts
 /**
 * Template body for .kici/AGENTS.md, written by `kici init` (unless opted out
@@ -39,13 +39,18 @@ into a portable lock file, and executed by self-hosted agents.
      on: push({ branches: 'main' }),
      jobs: [
        job('build', {
-         runsOn: 'ubuntu-latest',
+         runsOn: 'kici:os:linux',
          steps: [step('install', async ({ $ }) => { await $\`pnpm install\`; })],
        }),
      ],
    });
    \`\`\`
 
+   \`kici:os:linux\` targets any agent reporting that OS — every agent
+   self-reports \`kici:os:\` / \`kici:arch:\` / \`kici:host:\`. Use a custom label
+   (e.g. \`'gpu'\`, \`'prod-pool'\`) to target a specific agent pool your scaler
+   defines.
+
 2. **PR + matrix** — \`pr({ target: 'main' })\` plus a matrix over node
    versions. The matrix expands at dispatch time.
 
@@ -56,7 +61,7 @@ into a portable lock file, and executed by self-hosted agents.
      on: pr({ target: 'main' }),
      jobs: [
        job('test', {
-         runsOn: 'ubuntu-latest',
+         runsOn: 'kici:os:linux',
          strategy: { matrix: matrix({ node: ['20', '22', '24'] }) },
          steps: [
            step('test', async ({ $, matrix }) => {

package/dist/templates/index.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { agentsMdTemplate } from "./agents-md.js";
 import { helloWorldWorkflow } from "./workflows/hello-world.js";
 import { prChecksWorkflow } from "./workflows/pr-checks.js";

package/dist/templates/package-json.js

@@ -1,6 +1,6 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 //#region src/templates/package-json.ts
-const sdkVersion = "0.1.16";
+const sdkVersion = "0.1.17";
 /**
 * Generate package.json content for .kici/ directory
 *
@@ -10,7 +10,7 @@ const sdkVersion = "0.1.16";
 * @returns JSON string with proper formatting (2-space indent, trailing newline)
 */
 function generatePackageJson(devMode = false) {
-	const pkg = {
+	return JSON.stringify({
 		name: "@kici-dev/workflows",
 		private: true,
 		type: "module",
@@ -19,8 +19,7 @@ function generatePackageJson(devMode = false) {
 			typecheck: "tsc --noEmit"
 		},
 		devDependencies: { "@kici-dev/sdk": devMode ? ">=0.0.1-0" : `^${sdkVersion}` }
-	};
-	return JSON.stringify(pkg, null, 2) + "\n";
+	}, null, 2) + "\n";
 }
 //#endregion
 export { generatePackageJson };

package/dist/templates/tsconfig-json.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 //#region src/templates/tsconfig-json.ts
 /**
 * tsconfig.json template for kici init command

package/dist/templates/workflows/hello-world.js

@@ -1,10 +1,10 @@
-import "../../chunk-gOLHoazu.js";
+import "../../chunk-BTugEXQM.js";
 import { job, push, step, workflow } from "@kici-dev/sdk";
 //#region src/templates/workflows/hello-world.ts
 const helloWorldWorkflow = workflow("hello-world", {
 	on: push(),
 	jobs: [job("greet", {
-		runsOn: "ubuntu-latest",
+		runsOn: "kici:os:linux",
 		steps: [step("say-hello", async ({ $ }) => {
 			await $`echo "Hello, World!"`;
 		})]

package/dist/templates/workflows/hello-world.ts

@@ -10,7 +10,7 @@ export const helloWorldWorkflow = workflow('hello-world', {
 
   jobs: [
     job('greet', {
-      runsOn: 'ubuntu-latest',
+      runsOn: 'kici:os:linux',
       steps: [
         step('say-hello', async ({ $ }) => {
           await $`echo "Hello, World!"`;

package/dist/templates/workflows/pr-checks.js

@@ -1,4 +1,4 @@
-import "../../chunk-gOLHoazu.js";
+import "../../chunk-BTugEXQM.js";
 import { isEventType, job, pr, rule, skip, step, workflow } from "@kici-dev/sdk";
 //#region src/templates/workflows/pr-checks.ts
 const prChecksWorkflow = workflow("pr-checks", {
@@ -13,14 +13,14 @@ const prChecksWorkflow = workflow("pr-checks", {
 		return ctx.changedFiles.some((file) => file.startsWith("src/"));
 	})],
 	jobs: [job("lint", {
-		runsOn: "ubuntu-latest",
+		runsOn: "kici:os:linux",
 		steps: [step("checkout", async ({ $ }) => {
 			await $`echo "Checking out code..."`;
 		}), step("run-linter", async ({ $ }) => {
 			await $`echo "Running linter..."`;
 		})]
 	}), job("test", {
-		runsOn: "ubuntu-latest",
+		runsOn: "kici:os:linux",
 		needs: ["lint"],
 		steps: [
 			step("checkout", async ({ $ }) => {

package/dist/templates/workflows/pr-checks.ts

@@ -26,7 +26,7 @@ export const prChecksWorkflow = workflow('pr-checks', {
   // Jobs: run in parallel unless connected via `needs`
   jobs: [
     job('lint', {
-      runsOn: 'ubuntu-latest',
+      runsOn: 'kici:os:linux',
       steps: [
         step('checkout', async ({ $ }) => {
           await $`echo "Checking out code..."`;
@@ -39,7 +39,7 @@ export const prChecksWorkflow = workflow('pr-checks', {
     }),
 
     job('test', {
-      runsOn: 'ubuntu-latest',
+      runsOn: 'kici:os:linux',
       needs: ['lint'], // Waits for lint to pass
       steps: [
         step('checkout', async ({ $ }) => {

package/dist/test-runner/dry-run.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import pc from "picocolors";
 import { logger } from "@kici-dev/core";
 //#region src/test-runner/dry-run.ts

package/dist/test-runner/event-types.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 //#region src/test-runner/event-types.ts
 /**
 * Parse CLI event argument to EventType.

package/dist/test-runner/git-detector.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import path from "node:path";
 import { readFile } from "node:fs/promises";
 //#region src/test-runner/git-detector.ts

package/dist/test-runner/index.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { displayDryRun } from "./dry-run.js";
 import { parseEventArg, triggerSummary, triggerToEventArg } from "./event-types.js";
 import { detectRepoFromGit } from "./git-detector.js";

package/dist/test-runner/job-executor.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { formatter } from "./output-formatter.js";
 import { createStepContext } from "./step-context.js";
 import { createRuleContext, evaluateRules as evaluateRulesWithFormatting } from "./rule-evaluator.js";

package/dist/test-runner/output-formatter.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import pc from "picocolors";
 import { logger } from "@kici-dev/core";
 //#region src/test-runner/output-formatter.ts

package/dist/test-runner/payload-builder.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { parseEventArg } from "./event-types.js";
 import { detectRepoFromGit } from "./git-detector.js";
 import { getDefaultFixture } from "../fixtures/defaults/index.js";

package/dist/test-runner/rule-evaluator.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { formatter } from "./output-formatter.js";
 import { evaluateRules } from "@kici-dev/sdk";
 import { initZx } from "@kici-dev/core";

package/dist/test-runner/secrets-file.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import path from "node:path";
 import { readFile } from "node:fs/promises";
 //#region src/test-runner/secrets-file.ts

package/dist/test-runner/step-context.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { formatter } from "./output-formatter.js";
 import { join } from "node:path";
 import { chmodSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
@@ -128,14 +128,18 @@ function createStepContext(workflowInfo, jobInfo, repoRoot, inputs = {}, matrix,
 			return resolveJobOutputs(ref);
 		},
 		setSecretOutput: () => {},
-		kici: { infrastructure: { list: () => Promise.resolve({
-			scalers: [],
-			agents: []
-		}) } },
+		kici: {
+			infrastructure: { list: () => Promise.resolve({
+				scalers: [],
+				agents: []
+			}) },
+			oidc: { token: () => Promise.reject(/* @__PURE__ */ new Error("ctx.kici.oidc.token() is not available in the local test runner")) }
+		},
 		cache: {
 			restore: async () => ({ hit: false }),
 			save: async () => {}
-		}
+		},
+		attestProvenance: () => Promise.reject(/* @__PURE__ */ new Error("ctx.attestProvenance() is not available in the local test runner"))
 	};
 }
 //#endregion

package/dist/types.d.ts

@@ -10,6 +10,7 @@
  * v8 adds runsOn polymorphic type (string | string[] | selector) and excludeLabels.
  * v11 adds LockInlineValue type for pure function inline evaluation.
  * v15 adds per-job init config(s).
+ * v17 widens per-job init to typed presets ('mise' / { mise }) and 'auto' detection.
  */
 import type { ResourceRequest, ApproverClause } from '@kici-dev/engine';
 /**
@@ -22,7 +23,7 @@ export interface LockApproval {
     readonly timeoutSeconds?: number;
 }
 /** Schema version - re-exported from engine as single source of truth */
-export declare const SCHEMA_VERSION: 16;
+export declare const SCHEMA_VERSION: 17;
 /**
  * Source file reference with meaningful path.
  * Format: file is relative path from git root, export uses hash syntax.
@@ -425,11 +426,13 @@ export interface LockJob {
      */
     readonly resources?: ResourceRequest;
     /**
-     * Per-job init config(s) run after clone, before steps. `false` is an explicit
-     * opt-out. Threaded verbatim from the SDK `Job.init` -- the agent reads it from
-     * the loaded module, the lock copy is for orchestrator/dashboard visibility.
+     * Per-job init config(s) run after clone, before steps. A generic config,
+     * a typed preset (`'mise'` / `{ mise }`), an ordered array, `'auto'`
+     * (detect from committed files), or `false` (opt-out). Threaded verbatim from
+     * the SDK `Job.init` -- the agent reads it from the loaded module, the lock
+     * copy is for orchestrator/dashboard visibility.
      */
-    readonly init?: import('@kici-dev/sdk').GenericInitConfig | readonly import('@kici-dev/sdk').GenericInitConfig[] | false;
+    readonly init?: import('@kici-dev/sdk').InitConfig;
     /** Normalized approval gate; when set the job is held before dispatch. */
     readonly approval?: LockApproval;
 }

package/dist/types.js

@@ -1,4 +1,4 @@
-import "./chunk-gOLHoazu.js";
+import "./chunk-BTugEXQM.js";
 import { SCHEMA_VERSION as SCHEMA_VERSION$1 } from "@kici-dev/engine";
 //#region src/types.ts
 /**
@@ -13,6 +13,7 @@ import { SCHEMA_VERSION as SCHEMA_VERSION$1 } from "@kici-dev/engine";
 * v8 adds runsOn polymorphic type (string | string[] | selector) and excludeLabels.
 * v11 adds LockInlineValue type for pure function inline evaluation.
 * v15 adds per-job init config(s).
+* v17 widens per-job init to typed presets ('mise' / { mise }) and 'auto' detection.
 */
 /** Schema version - re-exported from engine as single source of truth */
 const SCHEMA_VERSION = SCHEMA_VERSION$1;

package/dist/validation/index.js

@@ -1,3 +1,3 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { validateConfig } from "./validator.js";
 export { validateConfig };

package/dist/validation/validator.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { compilerError } from "../errors/formatter.js";
 import "../errors/index.js";
 import { getDynamicJobGroup, isDynamicGroupRef, isDynamicJobFn, isStaticArray, isStaticObject, validateDag } from "@kici-dev/sdk";

package/dist/workflows/hello-world.ts

@@ -10,7 +10,7 @@ export const helloWorldWorkflow = workflow('hello-world', {
 
   jobs: [
     job('greet', {
-      runsOn: 'ubuntu-latest',
+      runsOn: 'kici:os:linux',
       steps: [
         step('say-hello', async ({ $ }) => {
           await $`echo "Hello, World!"`;

package/dist/workflows/pr-checks.ts

@@ -26,7 +26,7 @@ export const prChecksWorkflow = workflow('pr-checks', {
   // Jobs: run in parallel unless connected via `needs`
   jobs: [
     job('lint', {
-      runsOn: 'ubuntu-latest',
+      runsOn: 'kici:os:linux',
       steps: [
         step('checkout', async ({ $ }) => {
           await $`echo "Checking out code..."`;
@@ -39,7 +39,7 @@ export const prChecksWorkflow = workflow('pr-checks', {
     }),
 
     job('test', {
-      runsOn: 'ubuntu-latest',
+      runsOn: 'kici:os:linux',
       needs: ['lint'], // Waits for lint to pass
       steps: [
         step('checkout', async ({ $ }) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kici-dev/compiler",
-  "version": "0.1.16",
+  "version": "0.1.17",
   "description": "Compiler and CLI for KiCI workflows. Compiles `.kici/workflows/*.ts` to a `kici.lock.json` file consumed by the orchestrator and agents, and runs workflows locally or against a remote orchestrator.",
   "keywords": [
     "ci",
@@ -61,12 +61,13 @@
     "typescript": "^6.0.3",
     "ws": "^8.20.0",
     "yaml": "^2.8.3",
+    "zod": "^4.3.6",
     "zx": "^8.8.5",
-    "@kici-dev/core": "0.1.16",
-    "@kici-dev/engine": "0.1.16"
+    "@kici-dev/core": "0.1.17",
+    "@kici-dev/engine": "0.1.17"
   },
   "peerDependencies": {
-    "@kici-dev/sdk": "0.1.16"
+    "@kici-dev/sdk": "0.1.17"
   },
   "devDependencies": {
     "@types/proper-lockfile": "^4.1.4"