@kici-dev/compiler 0.1.16 → 0.1.18

package/dist/auth/headless-detect.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 //#region src/auth/headless-detect.ts
 /**
 * Detect if the current environment is headless (no browser available).

package/dist/cli-banner.js

@@ -1,4 +1,4 @@
-import "./chunk-gOLHoazu.js";
+import "./chunk-BTugEXQM.js";
 //#region src/cli-banner.ts
 /**
 * Whether the version banner should be suppressed for the command about to run.

package/dist/cli.js

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
-import "./chunk-gOLHoazu.js";
+import "./chunk-BTugEXQM.js";
 import { shouldSuppressBanner } from "./cli-banner.js";
 import { fileURLToPath } from "node:url";
 import { resolve } from "node:path";
 import { Argument, Command, Option } from "commander";
 import pc from "picocolors";
 //#region src/cli.ts
-const version = "0.1.16";
+const version = "0.1.18";
 /**
 * Build the kici Commander program with every command registered. Exported so
 * the surface registry can walk the real command tree without parsing argv (no
@@ -76,7 +76,7 @@ function buildProgram() {
 		});
 		process.exit(success ? 0 : 1);
 	});
-	runCommand.command("remote").argument("[fixture]", "Fixture name or glob pattern (omit to list available)").description("Execute fixtures remotely via orchestrator").option("--workflow <name>", "Run a specific workflow directly (bypass triggers)").option("--all", "Run all available fixtures", false).option("--parallel", "Run matching fixtures concurrently", false).option("--no-wait", "Fire and forget (print runIds, don't stream)").option("--quiet", "Suppress output except final result", false).option("--json", "Output structured JSON result", false).option("--junit <path>", "Output JUnit XML result").option("--history", "Show recent run history", false).option("--routing-key <key>", "Override routing key for this run").option("--debug", "Verbose internals", false).option("--kici-dir <path>", "Path to .kici directory", ".kici").option("--context <ctx.key=value>", "Inject a namespaced context secret, uploaded encrypted to the orchestrator (repeatable)", (val, prev) => [...prev, val], []).option("--env <KEY=VALUE>", "Provide a per-run secret (repeatable); uploaded encrypted to the orchestrator", (val, prev) => [...prev, val], []).action(async (fixture, options) => {
+	runCommand.command("remote").argument("[fixture]", "Fixture name or glob pattern (omit to list available)").description("Execute fixtures remotely via orchestrator").option("--workflow <name>", "Run a specific workflow directly (bypass triggers)").option("--all", "Run all available fixtures", false).option("--parallel", "Run matching fixtures concurrently", false).option("--no-wait", "Fire and forget (print runIds, don't stream)").option("--quiet", "Suppress output except final result", false).option("--json", "Output structured JSON result", false).option("--junit <path>", "Output JUnit XML result").option("--history", "Show recent run history", false).option("--routing-key <key>", "Override routing key for this run").option("--org <id>", "Target organization (overrides the active org)").option("--orchestrator <name>", "Target orchestrator cluster (overrides the per-org default)").option("--debug", "Verbose internals", false).option("--kici-dir <path>", "Path to .kici directory", ".kici").option("--context <ctx.key=value>", "Inject a namespaced context secret, uploaded encrypted to the orchestrator (repeatable)", (val, prev) => [...prev, val], []).option("--env <KEY=VALUE>", "Provide a per-run secret (repeatable); uploaded encrypted to the orchestrator", (val, prev) => [...prev, val], []).action(async (fixture, options) => {
 		const { runRemoteCommand } = await import("./commands/index.js");
 		const success = await runRemoteCommand(fixture, {
 			...options,
@@ -102,7 +102,7 @@ function buildProgram() {
 		const success = await hookInstallCommand({ git: options.git });
 		process.exit(success ? 0 : 1);
 	});
-	program.command("login").description("Authenticate with KiCI via browser OAuth (default) or API key (--token)").option("--token <key>", "API key for direct authentication (legacy)").option("--device", "Force device authorization flow (for headless/SSH environments)").option("--endpoint <url>", "Orchestrator URL for direct connection").option("--platform-endpoint <url>", "Platform relay URL").option("--routing-key <key>", "Routing key for webhook source identification").addHelpText("after", `
+	program.command("login").description("Authenticate with KiCI via browser OAuth (default) or API key (--token)").option("--token <key>", "API key for direct authentication (legacy)").option("--device", "Force device authorization flow (for headless/SSH environments)").option("--platform-endpoint <url>", "Platform relay URL").option("--routing-key <key>", "Routing key for webhook source identification").addHelpText("after", `
 Environment variables:
   KICI_BROWSER_CMD     Custom browser command (use {url} placeholder, or 'none' to suppress)
   KICI_CALLBACK_PORT   Fixed port for OAuth PKCE callback server (default: random)
@@ -114,7 +114,6 @@ Environment variables:
 		const success = await loginCommand({
 			token: options.token,
 			device: options.device,
-			endpoint: options.endpoint,
 			platformEndpoint: options.platformEndpoint,
 			routingKey: options.routingKey
 		});
@@ -141,23 +140,50 @@ Environment variables:
 		const success = await orgCurrentCommand();
 		process.exit(success ? 0 : 1);
 	});
-	program.command("secrets").description("Manage secrets").command("list").description("List test-available secret contexts").option("--endpoint <url>", "Orchestrator URL override").action(async (options) => {
+	const orchestratorsCommand = program.command("orchestrators").description("Inspect the org's orchestrator clusters and pick a default for run remote");
+	orchestratorsCommand.command("list").description("List the connected orchestrator clusters for the active org").option("--org <id>", "Target organization (overrides the active org)").action(async (options) => {
+		const { orchestratorsListCommand } = await import("./commands/index.js");
+		const success = await orchestratorsListCommand({ org: options.org });
+		process.exit(success ? 0 : 1);
+	});
+	orchestratorsCommand.command("use").argument("<name>", "Orchestrator cluster name").description("Set the per-org default orchestrator cluster for run remote").option("--org <id>", "Target organization (overrides the active org)").action(async (name, options) => {
+		const { orchestratorsUseCommand } = await import("./commands/index.js");
+		const success = await orchestratorsUseCommand(name, { org: options.org });
+		process.exit(success ? 0 : 1);
+	});
+	program.command("secrets").description("Manage secrets").command("list").description("List test-available secret contexts").action(async () => {
 		const { secretsListCommand } = await import("./commands/index.js");
-		const success = await secretsListCommand({ endpoint: options.endpoint });
+		const success = await secretsListCommand();
 		process.exit(success ? 0 : 1);
 	});
-	program.command("status").argument("<run-id>", "Run ID to inspect").description("Show status and details of a test run").option("--logs", "Stream full log replay", false).option("--job <name>", "Filter logs to specific job").option("--json", "Output raw JSON", false).action(async (runId, options) => {
-		const { statusCommand } = await import("./commands/index.js");
-		const success = await statusCommand(runId, {
-			logs: options.logs,
+	const runsCommand = program.command("runs").description("Inspect and manage execution runs");
+	runsCommand.command("list").description("List execution runs (mirrors the dashboard Runs page)").option("--status <s>", "Filter by status").option("--workflow <w>", "Filter by workflow name").option("--branch <b>", "Filter by branch/ref").option("--repo <r>", "Filter by repository").option("--trigger <t>", "Filter by trigger type").option("--source <routingKey>", "Filter by source routing key").option("--since <ts>", "Only runs since (ISO-8601 or epoch ms)").option("--page <n>", "Page number", (v) => parseInt(v, 10)).option("--json", "Output raw JSON", false).action(async (options) => {
+		const { runsListCommand } = await import("./commands/index.js");
+		const success = await runsListCommand(options);
+		process.exit(success ? 0 : 1);
+	});
+	runsCommand.command("show").argument("<run-id>", "Run ID to inspect").description("Show a run summary with its jobs and steps").option("--json", "Output raw JSON", false).action(async (runId, options) => {
+		const { runsShowCommand } = await import("./commands/index.js");
+		const success = await runsShowCommand(runId, { json: options.json });
+		process.exit(success ? 0 : 1);
+	});
+	runsCommand.command("logs").argument("<run-id>", "Run ID").description("Print step logs for a run").option("--job <name>", "Only logs for this job").option("-f, --follow", "Tail logs for a live run", false).option("--json", "Output raw JSON", false).action(async (runId, options) => {
+		const { runsLogsCommand } = await import("./commands/index.js");
+		const success = await runsLogsCommand(runId, {
 			job: options.job,
+			follow: options.follow,
 			json: options.json
 		});
 		process.exit(success ? 0 : 1);
 	});
-	program.command("cancel").argument("[run-id]", "Run ID to cancel").description("Cancel a running workflow or all runs on a branch").option("--force", "Force cancel (kill immediately, skip hooks)", false).option("--branch <name>", "Cancel all in-progress runs on this branch").action(async (runId, options) => {
-		const { cancelCommand } = await import("./commands/index.js");
-		const success = await cancelCommand(runId, {
+	runsCommand.command("rerun").argument("<run-id>", "Run ID to rerun").description("Re-trigger a run").option("--json", "Output raw JSON", false).action(async (runId, options) => {
+		const { runsRerunCommand } = await import("./commands/index.js");
+		const success = await runsRerunCommand(runId, { json: options.json });
+		process.exit(success ? 0 : 1);
+	});
+	runsCommand.command("cancel").argument("[run-id]", "Run ID to cancel").description("Cancel a run, or all in-progress runs on a branch").option("--force", "Force cancel (kill immediately, skip hooks)", false).option("--branch <name>", "Cancel all in-progress runs on this branch").action(async (runId, options) => {
+		const { runsCancelCommand } = await import("./commands/index.js");
+		const success = await runsCancelCommand(runId, {
 			force: options.force,
 			branch: options.branch
 		});
@@ -180,12 +206,9 @@ Environment variables:
 		});
 		process.exit(success ? 0 : 1);
 	});
-	program.command("types").description("Generate TypeScript declarations for secret contexts").option("--kici-dir <path>", "Path to .kici directory", ".kici").option("--endpoint <url>", "Orchestrator URL override").action(async (options) => {
+	program.command("types").description("Generate TypeScript declarations for secret contexts").option("--kici-dir <path>", "Path to .kici directory", ".kici").action(async (options) => {
 		const { typesCommand } = await import("./commands/index.js");
-		const success = await typesCommand({
-			kiciDir: options.kiciDir,
-			endpoint: options.endpoint
-		});
+		const success = await typesCommand({ kiciDir: options.kiciDir });
 		process.exit(success ? 0 : 1);
 	});
 	program.command("endpoints").description("List all webhook entrypoints for the current project").option("--kici-dir <path>", "Path to .kici directory", ".kici").action(async (options) => {
@@ -193,6 +216,15 @@ Environment variables:
 		const success = await endpointsCommand({ kiciDir: options.kiciDir });
 		process.exit(success ? 0 : 1);
 	});
+	program.command("diagnostics").description("Show orchestrators, scalers, and agents (mirrors the dashboard Diagnostics page)").option("--json", "Output raw JSON", false).option("--verbose", "Show extended per-agent fields", false).option("--orchestrator <id>", "Scope the tree to one connection id").action(async (options) => {
+		const { diagnosticsCommand } = await import("./commands/index.js");
+		const success = await diagnosticsCommand({
+			json: options.json,
+			verbose: options.verbose,
+			orchestrator: options.orchestrator
+		});
+		process.exit(success ? 0 : 1);
+	});
 	program.command("workflows").description("Manage workflow registrations").command("list").description("List permanently registered workflows").option("--json", "Output as JSON", false).option("--stale <duration>", "Filter stale registrations (e.g., 30d, 7d)").option("--trigger-type <type>", "Filter by trigger type").option("--repo <repo>", "Filter by repository").action(async (options) => {
 		const { workflowsListCommand } = await import("./commands/index.js");
 		const success = await workflowsListCommand({
@@ -220,6 +252,11 @@ Environment variables:
 		const success = await drainWorkerCommand({ url: options.url });
 		process.exit(success ? 0 : 1);
 	});
+	program.command("verify-attestation").argument("[artifact]", "Artifact path to digest-check against the attestation subject (optional)").description("Verify a KiCI provenance attestation bundle offline").option("--bundle <path>", "Path or URL to the attestation bundle JSON").option("--trust-root <url-or-file>", "Trusted issuer URL, or a self-contained { issuer, jwks } file").option("--audience <aud>", "Expected token audience").option("--json", "Output structured JSON result", false).action(async (artifact, options) => {
+		const { verifyAttestationCommand } = await import("./commands/index.js");
+		const success = await verifyAttestationCommand(artifact, options);
+		process.exit(success ? 0 : 1);
+	});
 	return program;
 }
 /** Build the program and parse argv — the bin-shim entry point. */

package/dist/commands/approve.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { listHeldRunsForRun, postApprove, resolveHeldRunContext } from "./held-run-client.js";
 import { resolveHeldRunId } from "./held-run-resolve.js";
 import pc from "picocolors";

package/dist/commands/compile.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { formatError, isCompilerError } from "../errors/formatter.js";
 import "../errors/index.js";
 import { discoverWorkflows, resolveKiciDir } from "../execution/executor.js";
@@ -12,6 +12,7 @@ import pc from "picocolors";
 import { existsSync } from "node:fs";
 import fs from "node:fs/promises";
 import { logger, toErrorMessage } from "@kici-dev/core";
+import { PackageManager, detectPackageManagerSync } from "@kici-dev/core/package-manager";
 import { execSync } from "node:child_process";
 //#region src/commands/compile.ts
 /**
@@ -26,22 +27,21 @@ async function readExistingLockfileHash(lockPath) {
 	}
 }
 /**
-* Reinstall dependencies in .kici/ using npm.
+* Reinstall dependencies in .kici/ using the project's package manager.
+*
+* Detects the manager from `.kici/` (pnpm-lock.yaml / yarn.lock /
+* package-lock.json) so a standalone-pnpm or -yarn `.kici` is reinstalled with
+* the right tool — running `npm ci` against a pnpm lock fails, and against a
+* stale npm lock left beside a pnpm lock it fails even harder.
 */
 async function reinstallDeps(kiciDir) {
-	if (existsSync(path.join(kiciDir, "package-lock.json"))) {
-		logger.info("Running " + pc.cyan("npm ci") + ` in ${kiciDir}`);
-		execSync("npm ci", {
-			cwd: kiciDir,
-			stdio: "inherit"
-		});
-	} else {
-		logger.info("Running " + pc.cyan("npm install") + ` in ${kiciDir}`);
-		execSync("npm install", {
-			cwd: kiciDir,
-			stdio: "inherit"
-		});
-	}
+	const pm = detectPackageManagerSync(kiciDir);
+	const command = pm === PackageManager.Pnpm ? "pnpm install" : pm === PackageManager.Yarn ? "yarn install" : existsSync(path.join(kiciDir, "package-lock.json")) ? "npm ci" : "npm install";
+	logger.info("Running " + pc.cyan(command) + ` in ${kiciDir}`);
+	execSync(command, {
+		cwd: kiciDir,
+		stdio: "inherit"
+	});
 }
 /**
 * Execute the compile command.
@@ -80,12 +80,14 @@ async function compileCommand(options) {
 			try {
 				const { loadGlobalConfig } = await import("../remote/config.js");
 				const config = await loadGlobalConfig();
-				if (config.token && config.endpoint) {
+				const hasToken = Boolean(config.pat ?? config.token);
+				const hasEndpoint = Boolean(config.platformEndpoint ?? config.endpoint);
+				if (hasToken && hasEndpoint && config.activeOrgId) {
 					const { typesCommand } = await import("./types.js");
 					await typesCommand({ kiciDir });
 				}
 			} catch {
-				logger.warn(pc.yellow("Could not refresh types (orchestrator unreachable). Compilation succeeded."));
+				logger.warn(pc.yellow("Could not refresh types (Platform unreachable). Compilation succeeded."));
 			}
 		} else logger.info(pc.green("✓") + ` Workflows are valid` + pc.dim(` (${workflowsWithSource.length} workflow${workflowsWithSource.length !== 1 ? "s" : ""})`));
 		return true;

package/dist/commands/diagnostics.d.ts

@@ -0,0 +1,7 @@
+export interface DiagnosticsOptions {
+    json?: boolean;
+    verbose?: boolean;
+    orchestrator?: string;
+}
+export declare function diagnosticsCommand(options?: DiagnosticsOptions): Promise<boolean>;
+//# sourceMappingURL=diagnostics.d.ts.map

package/dist/commands/diagnostics.js

@@ -0,0 +1,58 @@
+import "../chunk-BTugEXQM.js";
+import { DashboardClient, DashboardClientError } from "../remote/dashboard-client.js";
+import { relativeTime } from "../remote/render.js";
+import pc from "picocolors";
+import { logger, toErrorMessage } from "@kici-dev/core";
+//#region src/commands/diagnostics.ts
+/** kici diagnostics — mirrors the dashboard Diagnostics page (infra tree). */
+async function diagnosticsCommand(options = {}) {
+	try {
+		const client = await DashboardClient.load();
+		const [summary, infra] = await Promise.all([client.getDiagnosticsSummary(), client.getInfrastructure()]);
+		let orchestrators = infra.orchestrators;
+		if (options.orchestrator) orchestrators = orchestrators.filter((o) => o.connectionId === options.orchestrator);
+		if (options.json) {
+			console.log(JSON.stringify({
+				summary,
+				orchestrators,
+				alerts: infra.alerts
+			}, null, 2));
+			return true;
+		}
+		printSummary(summary);
+		printAlerts(infra.alerts);
+		if (orchestrators.length === 0) {
+			console.log(pc.gray("\nNo orchestrators connected."));
+			return true;
+		}
+		for (const o of orchestrators) printOrchestrator(o, options.verbose ?? false);
+		return true;
+	} catch (err) {
+		logger.error(pc.red(err instanceof DashboardClientError ? err.message : toErrorMessage(err)));
+		return false;
+	}
+}
+function printSummary(s) {
+	const m = s.executionMetrics;
+	console.log(pc.bold("\nDiagnostics") + pc.gray(`  runs(24h)=${m.totalRuns} success=${m.successRate}% avg=${m.avgDurationSeconds}s queued=${m.queuedJobs} running=${m.runningJobs}` + (s.orphanedConnections > 0 ? ` orphaned=${s.orphanedConnections}` : "")));
+}
+function printAlerts(alerts) {
+	for (const a of alerts) {
+		const color = a.severity === "critical" ? pc.red : pc.yellow;
+		console.log(color(`  ! [${a.type}] ${a.message}`));
+	}
+}
+function printOrchestrator(o, verbose) {
+	const hb = o.lastHeartbeat ? relativeTime(new Date(o.lastHeartbeat).toISOString()) : "—";
+	const head = pc.bold(o.clusterName ?? o.connectionId) + pc.gray(` [${o.connectionId}] keys=${o.routingKeys.join(",") || "—"} ${o.connected ? pc.green("connected") : pc.red("disconnected")} raft=${o.raftRole ?? "—"} hb=${hb}`);
+	console.log(`\n${head}`);
+	for (const sc of o.scalers) console.log(pc.gray("  └─ ") + `${sc.name} (${sc.type}) ${sc.activeAgents}/${sc.maxAgents} ` + pc.gray(`labels=${sc.labelSets.map((set) => set.join("+")).join(" | ") || "—"}`));
+	for (const ag of o.agents) {
+		const extra = verbose ? ` host=${ag.hostname ?? "—"} node=${ag.nodeVersion ?? "—"} mem=${ag.memoryUsedMb ?? "—"}MB` : "";
+		console.log(pc.gray("     • ") + `${ag.agentId} ` + pc.cyan(`[${ag.labels.join(",")}]`) + pc.gray(` ${ag.platform}/${ag.arch} jobs=${ag.activeJobs}/${ag.maxConcurrency} hb=${relativeTime(new Date(ag.lastHeartbeatAt).toISOString())}${extra}`));
+	}
+}
+//#endregion
+export { diagnosticsCommand };
+
+//# sourceMappingURL=diagnostics.js.map

package/dist/commands/docs.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { fileURLToPath } from "node:url";
 import path from "node:path";
 import pc from "picocolors";

package/dist/commands/drain-worker.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import pc from "picocolors";
 import { logger, toErrorMessage } from "@kici-dev/core";
 //#region src/commands/drain-worker.ts

package/dist/commands/endpoints.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { resolveKiciDir } from "../execution/executor.js";
 import "../execution/index.js";
 import { loadGlobalConfig } from "../remote/config.js";

package/dist/commands/fixture.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { parseEventArg } from "../test-runner/event-types.js";
 import { detectRepoFromGit } from "../test-runner/git-detector.js";
 import { getDefaultFixture } from "../fixtures/defaults/index.js";

package/dist/commands/held-run-client.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { loadGlobalConfig } from "../remote/config.js";
 import pc from "picocolors";
 import { logger } from "@kici-dev/core";

package/dist/commands/held-run-resolve.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 //#region src/commands/held-run-resolve.ts
 /**
 * Resolve the held-run id matching the filter from a list of pending holds.

package/dist/commands/hook.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { detectHookTools, findGitDir } from "../hooks/detector.js";
 import { installHook } from "../hooks/installer.js";
 import "../hooks/index.js";

package/dist/commands/index.d.ts

@@ -14,16 +14,26 @@ export { loginCommand } from './login.js';
 export type { LoginOptions } from './login.js';
 export { secretsListCommand } from './secrets-list.js';
 export type { SecretsListOptions } from './secrets-list.js';
-export { statusCommand } from './status.js';
-export type { StatusOptions } from './status.js';
+export { runsListCommand } from './runs/list.js';
+export type { RunsListOptions } from './runs/list.js';
+export { runsShowCommand } from './runs/show.js';
+export type { RunsShowOptions } from './runs/show.js';
+export { runsLogsCommand } from './runs/logs.js';
+export type { RunsLogsOptions } from './runs/logs.js';
+export { runsRerunCommand } from './runs/rerun.js';
+export type { RunsRerunOptions } from './runs/rerun.js';
+export { runsCancelCommand } from './runs/cancel.js';
+export type { RunsCancelOptions } from './runs/cancel.js';
 export { typesCommand } from './types.js';
 export type { TypesOptions } from './types.js';
 export { endpointsCommand } from './endpoints.js';
 export type { EndpointsOptions } from './endpoints.js';
+export { diagnosticsCommand } from './diagnostics.js';
+export type { DiagnosticsOptions } from './diagnostics.js';
 export { orgListCommand, orgUseCommand, orgCurrentCommand } from './org.js';
+export { orchestratorsListCommand, orchestratorsUseCommand } from './orchestrators.js';
+export type { OrchestratorsOptions } from './orchestrators.js';
 export { logoutCommand } from './logout.js';
-export { cancelCommand } from './cancel.js';
-export type { CancelOptions } from './cancel.js';
 export { approveCommand } from './approve.js';
 export type { ApproveOptions } from './approve.js';
 export { rejectCommand } from './reject.js';
@@ -34,4 +44,6 @@ export { drainWorkerCommand } from './drain-worker.js';
 export type { DrainWorkerOptions } from './drain-worker.js';
 export { docsCommand, docsLlmCommand } from './docs.js';
 export type { DocsOptions, DocsLlmOptions } from './docs.js';
+export { verifyAttestationCommand } from './verify-attestation.js';
+export type { VerifyAttestationOptions } from './verify-attestation.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/commands/index.js

@@ -1,7 +1,7 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { compileCommand } from "./compile.js";
 import { approveCommand } from "./approve.js";
-import { cancelCommand } from "./cancel.js";
+import { diagnosticsCommand } from "./diagnostics.js";
 import { docsCommand, docsLlmCommand } from "./docs.js";
 import { drainWorkerCommand } from "./drain-worker.js";
 import { endpointsCommand } from "./endpoints.js";
@@ -13,10 +13,16 @@ import { runLocalCommand, runRemoteCommand } from "./run.js";
 import { initCommand } from "./init.js";
 import { loginCommand } from "./login.js";
 import { secretsListCommand } from "./secrets-list.js";
-import { statusCommand } from "./status.js";
+import { runsListCommand } from "./runs/list.js";
+import { runsShowCommand } from "./runs/show.js";
+import { runsLogsCommand } from "./runs/logs.js";
+import { runsRerunCommand } from "./runs/rerun.js";
+import { runsCancelCommand } from "./runs/cancel.js";
 import { typesCommand } from "./types.js";
 import { orgCurrentCommand, orgListCommand, orgUseCommand } from "./org.js";
+import { orchestratorsListCommand, orchestratorsUseCommand } from "./orchestrators.js";
 import { logoutCommand } from "./logout.js";
 import { rejectCommand } from "./reject.js";
 import { workflowsListCommand } from "./workflows.js";
-export { approveCommand, cancelCommand, compileCommand, docsCommand, docsLlmCommand, drainWorkerCommand, endpointsCommand, fixtureCommand, hookInstallCommand, initCommand, loginCommand, logoutCommand, orgCurrentCommand, orgListCommand, orgUseCommand, rejectCommand, runLocalCommand, runRemoteCommand, secretsListCommand, statusCommand, testCommand, testDryRun, typesCommand, watchCommand, workflowsListCommand };
+import { verifyAttestationCommand } from "./verify-attestation.js";
+export { approveCommand, compileCommand, diagnosticsCommand, docsCommand, docsLlmCommand, drainWorkerCommand, endpointsCommand, fixtureCommand, hookInstallCommand, initCommand, loginCommand, logoutCommand, orchestratorsListCommand, orchestratorsUseCommand, orgCurrentCommand, orgListCommand, orgUseCommand, rejectCommand, runLocalCommand, runRemoteCommand, runsCancelCommand, runsListCommand, runsLogsCommand, runsRerunCommand, runsShowCommand, secretsListCommand, testCommand, testDryRun, typesCommand, verifyAttestationCommand, watchCommand, workflowsListCommand };

package/dist/commands/init.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { agentsMdTemplate } from "../templates/agents-md.js";
 import { tsconfigTemplate } from "../templates/tsconfig-json.js";
 import { generatePackageJson } from "../templates/package-json.js";
@@ -292,7 +292,7 @@ export default workflow('private-registry-example', {
   ],
   jobs: [
     job('build', {
-      runsOn: 'linux',
+      runsOn: 'kici:os:linux',
       steps: [step('install', async () => { /* deps install with auth */ })],
     }),
   ],

package/dist/commands/login.d.ts

@@ -1,8 +1,6 @@
 export interface LoginOptions {
     /** API key for non-interactive authentication */
     token?: string;
-    /** Orchestrator URL for direct connection */
-    endpoint?: string;
     /** Platform relay URL */
     platformEndpoint?: string;
     /** Routing key for webhook source identification */

package/dist/commands/login.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { getConfigPath, mergeGlobalConfig } from "../remote/config.js";
 import { deviceFlow, exchangeTokenForPat, pkceFlow } from "../remote/oauth.js";
 import "../remote/prod-defaults.js";
@@ -75,7 +75,6 @@ async function oauthLogin(options) {
 		patId: patResult.id,
 		patExpiresAt: patResult.expiresAt
 	};
-	if (options.endpoint) configUpdate.endpoint = options.endpoint;
 	if (options.platformEndpoint) configUpdate.platformEndpoint = options.platformEndpoint;
 	if (options.routingKey) configUpdate.routingKey = options.routingKey;
 	await mergeGlobalConfig(configUpdate);
@@ -117,7 +116,6 @@ async function legacyTokenLogin(options) {
 		return false;
 	}
 	const update = { token };
-	if (options.endpoint) update.endpoint = options.endpoint;
 	if (options.platformEndpoint) update.platformEndpoint = options.platformEndpoint;
 	if (options.routingKey) update.routingKey = options.routingKey;
 	await mergeGlobalConfig(update);

package/dist/commands/logout.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { getConfigPath, loadGlobalConfig, saveGlobalConfig } from "../remote/config.js";
 import pc from "picocolors";
 //#region src/commands/logout.ts

package/dist/commands/orchestrators.d.ts

@@ -0,0 +1,25 @@
+/**
+ * kici orchestrators commands
+ *
+ * Inspect the org's connected orchestrator clusters and pick a per-org default
+ * for `kici run remote`. `list` reads the Platform orchestrators index;
+ * `use <name>` records `config.defaultClusters[orgId]` so a developer with a
+ * preferred cluster types no `--orchestrator` flag.
+ */
+/** Options shared by the orchestrators subcommands. */
+export interface OrchestratorsOptions {
+    /** Target organization id (overrides config.activeOrgId). */
+    org?: string;
+}
+/**
+ * List the org's connected orchestrator clusters, marking the per-org default.
+ */
+export declare function orchestratorsListCommand(options: OrchestratorsOptions): Promise<boolean>;
+/**
+ * Set the per-org default orchestrator cluster.
+ *
+ * Validates the cluster name against the org's connected clusters before
+ * writing it to `config.defaultClusters[orgId]`.
+ */
+export declare function orchestratorsUseCommand(clusterName: string, options: OrchestratorsOptions): Promise<boolean>;
+//# sourceMappingURL=orchestrators.d.ts.map

package/dist/commands/orchestrators.js

@@ -0,0 +1,115 @@
+import "../chunk-BTugEXQM.js";
+import { loadGlobalConfig, mergeGlobalConfig } from "../remote/config.js";
+import pc from "picocolors";
+//#region src/commands/orchestrators.ts
+/**
+* kici orchestrators commands
+*
+* Inspect the org's connected orchestrator clusters and pick a per-org default
+* for `kici run remote`. `list` reads the Platform orchestrators index;
+* `use <name>` records `config.defaultClusters[orgId]` so a developer with a
+* preferred cluster types no `--orchestrator` flag.
+*/
+/**
+* Resolve the authenticated config + the target org id, printing an actionable
+* error and returning null when either is missing.
+*/
+async function resolveOrgContext(options) {
+	const config = await loadGlobalConfig();
+	if (!config.pat) {
+		console.error(pc.red("Not logged in. Run `kici login` first."));
+		return null;
+	}
+	if (!config.platformEndpoint) {
+		console.error(pc.red("No Platform endpoint configured. Run `kici login` to set up your Platform."));
+		return null;
+	}
+	const orgId = options.org ?? config.activeOrgId;
+	if (!orgId) {
+		console.error(pc.red("No target organization. Select one with `kici org use <org>` or pass `--org <id>`."));
+		return null;
+	}
+	return {
+		config,
+		orgId
+	};
+}
+/**
+* Fetch the org's connected orchestrator clusters from the Platform index.
+* Returns null on an auth/HTTP failure (after printing an error).
+*/
+async function fetchOrchestrators(config, orgId) {
+	const url = `${config.platformEndpoint}/api/v1/orgs/${orgId}/orchestrators`;
+	const response = await fetch(url, { headers: {
+		Authorization: `Bearer ${config.pat}`,
+		"Content-Type": "application/json"
+	} });
+	if (!response.ok) {
+		if (response.status === 401) {
+			console.error(pc.red("Authentication failed. Your token may be expired. Run `kici login` to re-authenticate."));
+			return null;
+		}
+		console.error(pc.red(`Failed to list orchestrators: HTTP ${response.status}`));
+		return null;
+	}
+	return (await response.json()).orchestrators ?? [];
+}
+/**
+* List the org's connected orchestrator clusters, marking the per-org default.
+*/
+async function orchestratorsListCommand(options) {
+	const ctx = await resolveOrgContext(options);
+	if (!ctx) return false;
+	const orchestrators = await fetchOrchestrators(ctx.config, ctx.orgId);
+	if (orchestrators === null) return false;
+	if (orchestrators.length === 0) {
+		console.log(pc.gray("No orchestrators are connected for this organization."));
+		return true;
+	}
+	const defaultCluster = ctx.config.defaultClusters?.[ctx.orgId];
+	console.log(pc.bold("\nOrchestrators:\n"));
+	const names = orchestrators.map((o) => o.clusterName ?? "(unnamed)");
+	const nameWidth = Math.max(12, ...names.map((n) => n.length)) + 2;
+	for (const orch of orchestrators) {
+		const name = orch.clusterName ?? "(unnamed)";
+		const isDefault = orch.clusterName !== null && orch.clusterName === defaultCluster;
+		const marker = isDefault ? pc.green("* ") : "  ";
+		const display = isDefault ? pc.bold(name) : name;
+		const version = orch.orchVersion ? pc.gray(`v${orch.orchVersion}`) : pc.gray("(unknown)");
+		console.log(`  ${marker}${display.padEnd(nameWidth)} ${version}`);
+	}
+	console.log("");
+	console.log(pc.gray("Set a default with `kici orchestrators use <name>`."));
+	return true;
+}
+/**
+* Set the per-org default orchestrator cluster.
+*
+* Validates the cluster name against the org's connected clusters before
+* writing it to `config.defaultClusters[orgId]`.
+*/
+async function orchestratorsUseCommand(clusterName, options) {
+	const ctx = await resolveOrgContext(options);
+	if (!ctx) return false;
+	const orchestrators = await fetchOrchestrators(ctx.config, ctx.orgId);
+	if (orchestrators === null) return false;
+	if (!orchestrators.find((o) => o.clusterName === clusterName)) {
+		console.error(pc.red(`Orchestrator cluster not found: ${clusterName}`));
+		const named = orchestrators.map((o) => o.clusterName).filter((n) => !!n);
+		if (named.length > 0) {
+			console.error(pc.gray("Connected clusters:"));
+			for (const n of named) console.error(pc.gray(`  - ${n}`));
+		}
+		return false;
+	}
+	await mergeGlobalConfig({ defaultClusters: {
+		...ctx.config.defaultClusters ?? {},
+		[ctx.orgId]: clusterName
+	} });
+	console.log(pc.green(`Default orchestrator for ${ctx.orgId} set to: ${clusterName}`));
+	return true;
+}
+//#endregion
+export { orchestratorsListCommand, orchestratorsUseCommand };
+
+//# sourceMappingURL=orchestrators.js.map

package/dist/commands/org.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { loadGlobalConfig, mergeGlobalConfig } from "../remote/config.js";
 import pc from "picocolors";
 //#region src/commands/org.ts