@kici-dev/compiler 0.1.16 → 0.1.18

package/dist/remote/render.d.ts

@@ -0,0 +1,11 @@
+import { formatDuration } from '@kici-dev/core';
+export { formatDuration };
+/** Length of a string ignoring ANSI color codes (for column alignment). */
+export declare function stripAnsi(s: string): string;
+/** Human "Ns/Nm/Nh/Nd ago" from an ISO timestamp; '—' when absent/invalid. */
+export declare function relativeTime(iso: string | undefined, now?: number): string;
+/** Color a run/job/step status. picocolors disables itself for NO_COLOR / non-TTY. */
+export declare function colorStatus(status: string): string;
+/** Width-aligned ASCII table with a bold header row. */
+export declare function renderTable(headers: string[], rows: string[][]): string;
+//# sourceMappingURL=render.d.ts.map

package/dist/remote/render.js

@@ -0,0 +1,48 @@
+import "../chunk-BTugEXQM.js";
+import pc from "picocolors";
+import { formatDuration } from "@kici-dev/core";
+//#region src/remote/render.ts
+/** Shared terminal-render helpers for the diagnostics + runs commands. */
+const ANSI_SGR = /\[[0-9;]*m/g;
+/** Length of a string ignoring ANSI color codes (for column alignment). */
+function stripAnsi(s) {
+	return s.replace(ANSI_SGR, "");
+}
+/** Human "Ns/Nm/Nh/Nd ago" from an ISO timestamp; '—' when absent/invalid. */
+function relativeTime(iso, now = Date.now()) {
+	if (!iso) return "—";
+	const then = Date.parse(iso);
+	if (Number.isNaN(then)) return "—";
+	const sec = Math.max(0, Math.round((now - then) / 1e3));
+	if (sec < 60) return `${sec}s ago`;
+	const min = Math.round(sec / 60);
+	if (min < 60) return `${min}m ago`;
+	const hr = Math.round(min / 60);
+	if (hr < 24) return `${hr}h ago`;
+	return `${Math.round(hr / 24)}d ago`;
+}
+/** Color a run/job/step status. picocolors disables itself for NO_COLOR / non-TTY. */
+function colorStatus(status) {
+	if (!pc.isColorSupported) return status;
+	switch (status) {
+		case "success": return pc.green(status);
+		case "failed":
+		case "error":
+		case "timed_out": return pc.red(status);
+		case "running": return pc.cyan(status);
+		case "cancelled": return pc.yellow(status);
+		default: return pc.gray(status);
+	}
+}
+/** Width-aligned ASCII table with a bold header row. */
+function renderTable(headers, rows) {
+	const widths = headers.map((h, i) => Math.max(stripAnsi(h).length, ...rows.map((r) => stripAnsi(r[i] ?? "").length)));
+	const pad = (cell, i) => cell + " ".repeat(Math.max(0, widths[i] - stripAnsi(cell).length));
+	const header = headers.map((h, i) => pc.bold(pad(h, i))).join("  ");
+	const body = rows.map((r) => r.map((c, i) => pad(c ?? "", i)).join("  ")).join("\n");
+	return body ? `${header}\n${body}` : header;
+}
+//#endregion
+export { colorStatus, formatDuration, relativeTime, renderTable, stripAnsi };
+
+//# sourceMappingURL=render.js.map

package/dist/remote/secret-upload.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { loadLocalSecrets } from "../local-executor/secret-loader.js";
 import { encryptJson } from "@kici-dev/core";
 //#region src/remote/secret-upload.ts

package/dist/remote/uploader.d.ts

@@ -79,12 +79,20 @@ export interface OverlaySelection {
  * files like `.kici/.env.local` — are excluded by `--exclude-standard` and
  * never appear in the selection.
  *
+ * When `fullWorkingTree` is set (the `kici run remote` path), the entire
+ * `.git` directory is additively included so the extracted overlay is a real
+ * git repository on the agent — workflow steps that shell out to git then work
+ * exactly as they do under `kici run local`. The `.git` files are added after
+ * `.kiciignore` filtering (git internals are never subject to working-tree
+ * ignore globs).
+ *
  * @param repoRoot - Path to the git repository root
  * @param options - Optional configuration
  * @returns HEAD SHA, remote flag, and the existing/deleted file partition
  */
 export declare function selectOverlayFiles(repoRoot: string, options?: {
     kiciIgnorePath?: string;
+    fullWorkingTree?: boolean;
 }): Promise<OverlaySelection>;
 /**
  * Create an overlay tarball from a git repo, including only changed files.
@@ -101,6 +109,7 @@ export declare function selectOverlayFiles(repoRoot: string, options?: {
  */
 export declare function createOverlayTarball(repoRoot: string, options?: {
     kiciIgnorePath?: string;
+    fullWorkingTree?: boolean;
 }): Promise<{
     tarballPath: string;
     summary: UploadSummary;

package/dist/remote/uploader.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { encryptTarball } from "./encryption.js";
 import path from "node:path";
 import fs from "node:fs/promises";
@@ -30,6 +30,41 @@ function gitLines(cmd, cwd) {
 		return [];
 	}
 }
+/** True for repo-relative paths inside the `.git` directory. */
+function isGitDirPath(relPath) {
+	return relPath === ".git" || relPath.startsWith(".git/");
+}
+/**
+* Recursively enumerate every file under `<repoRoot>/.git`, returning paths
+* relative to `repoRoot` (so they keep the `.git/...` prefix in the tarball
+* and extract back in place).
+*
+* `git ls-files` never lists `.git` contents, so for `kici run remote` — which
+* uploads the developer's working tree as a self-contained overlay with NO
+* clone on the agent — we enumerate the directory explicitly. Including the
+* whole `.git` directory (objects, refs, HEAD, index, config, packed-refs)
+* makes the extracted overlay a real git repository, so workflow steps that
+* shell out to git work exactly as they do under `kici run local`.
+*/
+async function collectGitDirFiles(repoRoot) {
+	const gitRoot = path.join(repoRoot, ".git");
+	const out = [];
+	async function walk(absDir) {
+		let entries;
+		try {
+			entries = await fs.readdir(absDir, { withFileTypes: true });
+		} catch {
+			return;
+		}
+		await Promise.all(entries.map(async (entry) => {
+			const abs = path.join(absDir, entry.name);
+			if (entry.isDirectory()) await walk(abs);
+			else if (entry.isFile() || entry.isSymbolicLink()) out.push(path.relative(repoRoot, abs));
+		}));
+	}
+	await walk(gitRoot);
+	return out;
+}
 /**
 * Load .kiciignore patterns from a file.
 * Returns a picomatch matcher function or null if file doesn't exist.
@@ -56,6 +91,13 @@ async function loadKiciIgnore(kiciIgnorePath) {
 * files like `.kici/.env.local` — are excluded by `--exclude-standard` and
 * never appear in the selection.
 *
+* When `fullWorkingTree` is set (the `kici run remote` path), the entire
+* `.git` directory is additively included so the extracted overlay is a real
+* git repository on the agent — workflow steps that shell out to git then work
+* exactly as they do under `kici run local`. The `.git` files are added after
+* `.kiciignore` filtering (git internals are never subject to working-tree
+* ignore globs).
+*
 * @param repoRoot - Path to the git repository root
 * @param options - Optional configuration
 * @returns HEAD SHA, remote flag, and the existing/deleted file partition
@@ -67,7 +109,7 @@ async function selectOverlayFiles(repoRoot, options) {
 	}).trim();
 	const hasRemote = gitLines("git remote", repoRoot).length > 0;
 	let allFiles;
-	if (hasRemote) {
+	if (hasRemote && !options?.fullWorkingTree) {
 		const unstaged = gitLines("git diff --name-only HEAD", repoRoot);
 		const staged = gitLines("git diff --name-only --cached HEAD", repoRoot);
 		const untracked = gitLines("git ls-files --others --exclude-standard", repoRoot);
@@ -83,6 +125,10 @@ async function selectOverlayFiles(repoRoot, options) {
 	}
 	const kiciIgnore = await loadKiciIgnore(options?.kiciIgnorePath ?? path.join(repoRoot, ".kiciignore"));
 	if (kiciIgnore) allFiles = allFiles.filter((f) => !kiciIgnore(f));
+	if (options?.fullWorkingTree) {
+		const gitFiles = await collectGitDirFiles(repoRoot);
+		allFiles = [...new Set([...allFiles, ...gitFiles])];
+	}
 	const existingFiles = [];
 	const deletedFiles = [];
 	await Promise.all(allFiles.map(async (file) => {
@@ -117,8 +163,9 @@ async function selectOverlayFiles(repoRoot, options) {
 async function createOverlayTarball(repoRoot, options) {
 	const { sha, hasRemote, existingFiles, deletedFiles } = await selectOverlayFiles(repoRoot, options);
 	const untrackedSet = new Set(gitLines("git ls-files --others --exclude-standard", repoRoot));
-	const newFiles = existingFiles.filter((f) => untrackedSet.has(f));
-	const modifiedFiles = existingFiles.filter((f) => !untrackedSet.has(f));
+	const workingTreeFiles = existingFiles.filter((f) => !isGitDirPath(f));
+	const newFiles = workingTreeFiles.filter((f) => untrackedSet.has(f));
+	const modifiedFiles = workingTreeFiles.filter((f) => !untrackedSet.has(f));
 	const checksums = {};
 	await Promise.all(existingFiles.map(async (file) => {
 		checksums[file] = await sha256File(path.join(repoRoot, file));

package/dist/templates/agents-md.d.ts

@@ -4,5 +4,5 @@
  * picked up by Claude Code, Cursor, Aider, and other coding agents that scan
  * the working tree for an authoring context file.
  */
-export declare const agentsMdTemplate = "# KiCI workflow authoring guide\n\nThis project uses KiCI \u2014 a TypeScript-native CI/CD workflow engine \u2014 instead\nof YAML-based CI. Workflows live in `.kici/workflows/*.ts`, are compiled\ninto a portable lock file, and executed by self-hosted agents.\n\n## Where the API surface lives\n\n- Public SDK types: `node_modules/@kici-dev/sdk/dist/index.d.ts` \u2014 read this\n  for the canonical signatures of `workflow`, `job`, `step`, `pr`,\n  `push`, `schedule`, `matrix`, `rule`, `dynamicJob`, etc.\n- Bundled offline reference for coding agents: `kici docs llm` prints the\n  full markdown documentation bundle to stdout. `kici docs llm --index`\n  prints just the curated link index (llms.txt format).\n- Online docs:\n  - <https://kici.dev/docs/> \u2014 published docs site.\n  - <https://kici.dev/llms.txt> \u2014 curated index for LLM consumers.\n  - <https://kici.dev/llms-full.txt> \u2014 full markdown bundle.\n  - Key pages: `user/sdk-reference`, `user/workflow-patterns`,\n    `user/testing-guide`, `user/hooks`, `user/secrets`.\n\n## The five core patterns\n\n1. **Push trigger** \u2014 `on: push({ branches: 'main' })`. Pair with `paths`\n   to scope to subtrees.\n\n   ```ts\n   import { workflow, job, step, push } from '@kici-dev/sdk';\n\n   export default workflow('build', {\n     on: push({ branches: 'main' }),\n     jobs: [\n       job('build', {\n         runsOn: 'ubuntu-latest',\n         steps: [step('install', async ({ $ }) => { await $`pnpm install`; })],\n       }),\n     ],\n   });\n   ```\n\n2. **PR + matrix** \u2014 `pr({ target: 'main' })` plus a matrix over node\n   versions. The matrix expands at dispatch time.\n\n   ```ts\n   import { workflow, job, step, pr, matrix } from '@kici-dev/sdk';\n\n   export default workflow('test-matrix', {\n     on: pr({ target: 'main' }),\n     jobs: [\n       job('test', {\n         runsOn: 'ubuntu-latest',\n         strategy: { matrix: matrix({ node: ['20', '22', '24'] }) },\n         steps: [\n           step('test', async ({ $, matrix }) => {\n             await $`node --version`;\n             await $`pnpm install`;\n             await $`pnpm test`;\n             return { node: matrix.node };\n           }),\n         ],\n       }),\n     ],\n   });\n   ```\n\n3. **Lifecycle hooks** \u2014 `onFailure` / `onSuccess` / `onCancel` on a\n   job or workflow run after the main steps in their own scope.\n\n4. **Secrets** \u2014 declared scopes resolve at dispatch:\n\n   ```ts\n   step('deploy', async ({ $, secrets }) => {\n     await $`./scripts/deploy.sh`.env({ DEPLOY_TOKEN: secrets.production.DEPLOY_TOKEN });\n   });\n   ```\n\n   Run `kici secrets list` to enumerate the contexts available for testing.\n\n5. **Dynamic jobs** \u2014 `dynamicJob` and `dynamicGroup` build the DAG at\n   runtime from a step's outputs. Don't try to compute job names at top level;\n   the lock file would be wrong.\n\n## Anti-patterns\n\n- **Do NOT write `.yml` / `.yaml` CI files** \u2014 KiCI replaces that entire\n  layer. There is no compatibility shim.\n- **Do NOT `import` from any `@kici-dev/*` package's `/dist/...`\n  subpath** \u2014 those are not part of the public API and break across versions.\n  Import from the package root.\n- **Do NOT `await` outside step bodies.** The top-level workflow file is\n  loaded by the compiler synchronously; async I/O at module scope means the\n  lock file emits before it resolves and the workflow appears empty.\n- **Do NOT mutate shared variables between jobs.** Each job runs in its own\n  agent process. Use `needs` + step outputs to thread values.\n- **Do NOT hand-edit `kici.lock.json`.** Regenerate it via `kici compile`.\n\n## Local commands a coding agent should run\n\n| Command                         | Purpose                                     |\n| ------------------------------- | ------------------------------------------- |\n| `pnpm kici compile --check`     | Validate workflow source without writing.   |\n| `pnpm kici test pr:open --debug`| Preview which workflows match an event.     |\n| `pnpm kici run local push`      | Execute workflows locally with no orchestrator. |\n| `pnpm kici docs llm`            | Print the full LLM documentation bundle.    |\n| `pnpm kici docs llm --index`    | Print the curated link index.               |\n\nIf `pnpm kici` isn't in scripts, fall back to `npx kici`.\n\n## Loop\n\n1. Read the SDK types from `node_modules/@kici-dev/sdk/dist/index.d.ts`.\n2. Pipe `kici docs llm` into the agent's context if it doesn't already have\n   the full bundle.\n3. Edit a workflow under `.kici/workflows/`.\n4. Run `kici compile --check` (zero exit means valid).\n5. Run `kici test <event>` to preview matching.\n6. Run `kici run local <event>` to execute locally before pushing.\n";
+export declare const agentsMdTemplate = "# KiCI workflow authoring guide\n\nThis project uses KiCI \u2014 a TypeScript-native CI/CD workflow engine \u2014 instead\nof YAML-based CI. Workflows live in `.kici/workflows/*.ts`, are compiled\ninto a portable lock file, and executed by self-hosted agents.\n\n## Where the API surface lives\n\n- Public SDK types: `node_modules/@kici-dev/sdk/dist/index.d.ts` \u2014 read this\n  for the canonical signatures of `workflow`, `job`, `step`, `pr`,\n  `push`, `schedule`, `matrix`, `rule`, `dynamicJob`, etc.\n- Bundled offline reference for coding agents: `kici docs llm` prints the\n  full markdown documentation bundle to stdout. `kici docs llm --index`\n  prints just the curated link index (llms.txt format).\n- Online docs:\n  - <https://kici.dev/docs/> \u2014 published docs site.\n  - <https://kici.dev/llms.txt> \u2014 curated index for LLM consumers.\n  - <https://kici.dev/llms-full.txt> \u2014 full markdown bundle.\n  - Key pages: `user/sdk-reference`, `user/workflow-patterns`,\n    `user/testing-guide`, `user/hooks`, `user/secrets`.\n\n## The five core patterns\n\n1. **Push trigger** \u2014 `on: push({ branches: 'main' })`. Pair with `paths`\n   to scope to subtrees.\n\n   ```ts\n   import { workflow, job, step, push } from '@kici-dev/sdk';\n\n   export default workflow('build', {\n     on: push({ branches: 'main' }),\n     jobs: [\n       job('build', {\n         runsOn: 'kici:os:linux',\n         steps: [step('install', async ({ $ }) => { await $`pnpm install`; })],\n       }),\n     ],\n   });\n   ```\n\n   `kici:os:linux` targets any agent reporting that OS \u2014 every agent\n   self-reports `kici:os:` / `kici:arch:` / `kici:host:`. Use a custom label\n   (e.g. `'gpu'`, `'prod-pool'`) to target a specific agent pool your scaler\n   defines.\n\n2. **PR + matrix** \u2014 `pr({ target: 'main' })` plus a matrix over node\n   versions. The matrix expands at dispatch time.\n\n   ```ts\n   import { workflow, job, step, pr, matrix } from '@kici-dev/sdk';\n\n   export default workflow('test-matrix', {\n     on: pr({ target: 'main' }),\n     jobs: [\n       job('test', {\n         runsOn: 'kici:os:linux',\n         strategy: { matrix: matrix({ node: ['20', '22', '24'] }) },\n         steps: [\n           step('test', async ({ $, matrix }) => {\n             await $`node --version`;\n             await $`pnpm install`;\n             await $`pnpm test`;\n             return { node: matrix.node };\n           }),\n         ],\n       }),\n     ],\n   });\n   ```\n\n3. **Lifecycle hooks** \u2014 `onFailure` / `onSuccess` / `onCancel` on a\n   job or workflow run after the main steps in their own scope.\n\n4. **Secrets** \u2014 declared scopes resolve at dispatch:\n\n   ```ts\n   step('deploy', async ({ $, secrets }) => {\n     await $`./scripts/deploy.sh`.env({ DEPLOY_TOKEN: secrets.production.DEPLOY_TOKEN });\n   });\n   ```\n\n   Run `kici secrets list` to enumerate the contexts available for testing.\n\n5. **Dynamic jobs** \u2014 `dynamicJob` and `dynamicGroup` build the DAG at\n   runtime from a step's outputs. Don't try to compute job names at top level;\n   the lock file would be wrong.\n\n## Anti-patterns\n\n- **Do NOT write `.yml` / `.yaml` CI files** \u2014 KiCI replaces that entire\n  layer. There is no compatibility shim.\n- **Do NOT `import` from any `@kici-dev/*` package's `/dist/...`\n  subpath** \u2014 those are not part of the public API and break across versions.\n  Import from the package root.\n- **Do NOT `await` outside step bodies.** The top-level workflow file is\n  loaded by the compiler synchronously; async I/O at module scope means the\n  lock file emits before it resolves and the workflow appears empty.\n- **Do NOT mutate shared variables between jobs.** Each job runs in its own\n  agent process. Use `needs` + step outputs to thread values.\n- **Do NOT hand-edit `kici.lock.json`.** Regenerate it via `kici compile`.\n\n## Local commands a coding agent should run\n\n| Command                         | Purpose                                     |\n| ------------------------------- | ------------------------------------------- |\n| `pnpm kici compile --check`     | Validate workflow source without writing.   |\n| `pnpm kici test pr:open --debug`| Preview which workflows match an event.     |\n| `pnpm kici run local push`      | Execute workflows locally with no orchestrator. |\n| `pnpm kici docs llm`            | Print the full LLM documentation bundle.    |\n| `pnpm kici docs llm --index`    | Print the curated link index.               |\n\nIf `pnpm kici` isn't in scripts, fall back to `npx kici`.\n\n## Loop\n\n1. Read the SDK types from `node_modules/@kici-dev/sdk/dist/index.d.ts`.\n2. Pipe `kici docs llm` into the agent's context if it doesn't already have\n   the full bundle.\n3. Edit a workflow under `.kici/workflows/`.\n4. Run `kici compile --check` (zero exit means valid).\n5. Run `kici test <event>` to preview matching.\n6. Run `kici run local <event>` to execute locally before pushing.\n";
 //# sourceMappingURL=agents-md.d.ts.map

package/dist/templates/agents-md.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 //#region src/templates/agents-md.ts
 /**
 * Template body for .kici/AGENTS.md, written by `kici init` (unless opted out
@@ -39,13 +39,18 @@ into a portable lock file, and executed by self-hosted agents.
      on: push({ branches: 'main' }),
      jobs: [
        job('build', {
-         runsOn: 'ubuntu-latest',
+         runsOn: 'kici:os:linux',
          steps: [step('install', async ({ $ }) => { await $\`pnpm install\`; })],
        }),
      ],
    });
    \`\`\`
 
+   \`kici:os:linux\` targets any agent reporting that OS — every agent
+   self-reports \`kici:os:\` / \`kici:arch:\` / \`kici:host:\`. Use a custom label
+   (e.g. \`'gpu'\`, \`'prod-pool'\`) to target a specific agent pool your scaler
+   defines.
+
 2. **PR + matrix** — \`pr({ target: 'main' })\` plus a matrix over node
    versions. The matrix expands at dispatch time.
 
@@ -56,7 +61,7 @@ into a portable lock file, and executed by self-hosted agents.
      on: pr({ target: 'main' }),
      jobs: [
        job('test', {
-         runsOn: 'ubuntu-latest',
+         runsOn: 'kici:os:linux',
          strategy: { matrix: matrix({ node: ['20', '22', '24'] }) },
          steps: [
            step('test', async ({ $, matrix }) => {

package/dist/templates/index.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { agentsMdTemplate } from "./agents-md.js";
 import { helloWorldWorkflow } from "./workflows/hello-world.js";
 import { prChecksWorkflow } from "./workflows/pr-checks.js";

package/dist/templates/package-json.js

@@ -1,6 +1,6 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 //#region src/templates/package-json.ts
-const sdkVersion = "0.1.16";
+const sdkVersion = "0.1.18";
 /**
 * Generate package.json content for .kici/ directory
 *
@@ -10,7 +10,7 @@ const sdkVersion = "0.1.16";
 * @returns JSON string with proper formatting (2-space indent, trailing newline)
 */
 function generatePackageJson(devMode = false) {
-	const pkg = {
+	return JSON.stringify({
 		name: "@kici-dev/workflows",
 		private: true,
 		type: "module",
@@ -19,8 +19,7 @@ function generatePackageJson(devMode = false) {
 			typecheck: "tsc --noEmit"
 		},
 		devDependencies: { "@kici-dev/sdk": devMode ? ">=0.0.1-0" : `^${sdkVersion}` }
-	};
-	return JSON.stringify(pkg, null, 2) + "\n";
+	}, null, 2) + "\n";
 }
 //#endregion
 export { generatePackageJson };

package/dist/templates/tsconfig-json.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 //#region src/templates/tsconfig-json.ts
 /**
 * tsconfig.json template for kici init command

package/dist/templates/workflows/hello-world.js

@@ -1,10 +1,10 @@
-import "../../chunk-gOLHoazu.js";
+import "../../chunk-BTugEXQM.js";
 import { job, push, step, workflow } from "@kici-dev/sdk";
 //#region src/templates/workflows/hello-world.ts
 const helloWorldWorkflow = workflow("hello-world", {
 	on: push(),
 	jobs: [job("greet", {
-		runsOn: "ubuntu-latest",
+		runsOn: "kici:os:linux",
 		steps: [step("say-hello", async ({ $ }) => {
 			await $`echo "Hello, World!"`;
 		})]

package/dist/templates/workflows/hello-world.ts

@@ -10,7 +10,7 @@ export const helloWorldWorkflow = workflow('hello-world', {
 
   jobs: [
     job('greet', {
-      runsOn: 'ubuntu-latest',
+      runsOn: 'kici:os:linux',
       steps: [
         step('say-hello', async ({ $ }) => {
           await $`echo "Hello, World!"`;

package/dist/templates/workflows/pr-checks.js

@@ -1,4 +1,4 @@
-import "../../chunk-gOLHoazu.js";
+import "../../chunk-BTugEXQM.js";
 import { isEventType, job, pr, rule, skip, step, workflow } from "@kici-dev/sdk";
 //#region src/templates/workflows/pr-checks.ts
 const prChecksWorkflow = workflow("pr-checks", {
@@ -13,14 +13,14 @@ const prChecksWorkflow = workflow("pr-checks", {
 		return ctx.changedFiles.some((file) => file.startsWith("src/"));
 	})],
 	jobs: [job("lint", {
-		runsOn: "ubuntu-latest",
+		runsOn: "kici:os:linux",
 		steps: [step("checkout", async ({ $ }) => {
 			await $`echo "Checking out code..."`;
 		}), step("run-linter", async ({ $ }) => {
 			await $`echo "Running linter..."`;
 		})]
 	}), job("test", {
-		runsOn: "ubuntu-latest",
+		runsOn: "kici:os:linux",
 		needs: ["lint"],
 		steps: [
 			step("checkout", async ({ $ }) => {

package/dist/templates/workflows/pr-checks.ts

@@ -26,7 +26,7 @@ export const prChecksWorkflow = workflow('pr-checks', {
   // Jobs: run in parallel unless connected via `needs`
   jobs: [
     job('lint', {
-      runsOn: 'ubuntu-latest',
+      runsOn: 'kici:os:linux',
       steps: [
         step('checkout', async ({ $ }) => {
           await $`echo "Checking out code..."`;
@@ -39,7 +39,7 @@ export const prChecksWorkflow = workflow('pr-checks', {
     }),
 
     job('test', {
-      runsOn: 'ubuntu-latest',
+      runsOn: 'kici:os:linux',
       needs: ['lint'], // Waits for lint to pass
       steps: [
         step('checkout', async ({ $ }) => {

package/dist/test-runner/dry-run.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import pc from "picocolors";
 import { logger } from "@kici-dev/core";
 //#region src/test-runner/dry-run.ts

package/dist/test-runner/event-types.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 //#region src/test-runner/event-types.ts
 /**
 * Parse CLI event argument to EventType.

package/dist/test-runner/git-detector.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import path from "node:path";
 import { readFile } from "node:fs/promises";
 //#region src/test-runner/git-detector.ts

package/dist/test-runner/index.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { displayDryRun } from "./dry-run.js";
 import { parseEventArg, triggerSummary, triggerToEventArg } from "./event-types.js";
 import { detectRepoFromGit } from "./git-detector.js";

package/dist/test-runner/job-executor.js

@@ -1,7 +1,8 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { formatter } from "./output-formatter.js";
 import { createStepContext } from "./step-context.js";
 import { createRuleContext, evaluateRules as evaluateRulesWithFormatting } from "./rule-evaluator.js";
+import { localRunsOnString } from "../local-executor/runs-on-display.js";
 import { pathToFileURL } from "node:url";
 import path from "node:path";
 import pc from "picocolors";
@@ -94,7 +95,7 @@ async function executeJob(job, workflowName, event, repoRoot, testSecrets, sdkSe
 	setStepRefMap(refMap);
 	const ctx = createStepContext({ name: workflowName }, {
 		name: job.name,
-		runsOn: typeof job.runsOn === "string" ? job.runsOn : Array.isArray(job.runsOn) ? job.runsOn.join(",") : (Array.isArray(job.runsOn.labels) ? job.runsOn.labels : [job.runsOn.labels]).join(",")
+		runsOn: localRunsOnString(job.runsOn)
 	}, repoRoot, void 0, void 0, testSecrets, void 0, event.payload, event.provider);
 	let stepCounter = 0;
 	for (const stepOrFn of job.steps) {

package/dist/test-runner/output-formatter.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import pc from "picocolors";
 import { logger } from "@kici-dev/core";
 //#region src/test-runner/output-formatter.ts

package/dist/test-runner/payload-builder.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { parseEventArg } from "./event-types.js";
 import { detectRepoFromGit } from "./git-detector.js";
 import { getDefaultFixture } from "../fixtures/defaults/index.js";

package/dist/test-runner/rule-evaluator.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { formatter } from "./output-formatter.js";
 import { evaluateRules } from "@kici-dev/sdk";
 import { initZx } from "@kici-dev/core";

package/dist/test-runner/secrets-file.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import path from "node:path";
 import { readFile } from "node:fs/promises";
 //#region src/test-runner/secrets-file.ts

package/dist/test-runner/step-context.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { formatter } from "./output-formatter.js";
 import { join } from "node:path";
 import { chmodSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
@@ -128,14 +128,18 @@ function createStepContext(workflowInfo, jobInfo, repoRoot, inputs = {}, matrix,
 			return resolveJobOutputs(ref);
 		},
 		setSecretOutput: () => {},
-		kici: { infrastructure: { list: () => Promise.resolve({
-			scalers: [],
-			agents: []
-		}) } },
+		kici: {
+			infrastructure: { list: () => Promise.resolve({
+				scalers: [],
+				agents: []
+			}) },
+			oidc: { token: () => Promise.reject(/* @__PURE__ */ new Error("ctx.kici.oidc.token() is not available in the local test runner")) }
+		},
 		cache: {
 			restore: async () => ({ hit: false }),
 			save: async () => {}
-		}
+		},
+		attestProvenance: () => Promise.reject(/* @__PURE__ */ new Error("ctx.attestProvenance() is not available in the local test runner"))
 	};
 }
 //#endregion

package/dist/types.d.ts

@@ -10,8 +10,9 @@
  * v8 adds runsOn polymorphic type (string | string[] | selector) and excludeLabels.
  * v11 adds LockInlineValue type for pure function inline evaluation.
  * v15 adds per-job init config(s).
+ * v17 widens per-job init to typed presets ('mise' / { mise }) and 'auto' detection.
  */
-import type { ResourceRequest, ApproverClause } from '@kici-dev/engine';
+import type { ResourceRequest, ApproverClause, RunsOnAllPredicate, OnUnreachableMode, LabelMatcher } from '@kici-dev/engine';
 /**
  * Normalized approval config carried in the lock file. Mirrors the engine
  * `LockApproval` type. Produced by the compiler from an SDK `requireApproval`.
@@ -22,7 +23,7 @@ export interface LockApproval {
     readonly timeoutSeconds?: number;
 }
 /** Schema version - re-exported from engine as single source of truth */
-export declare const SCHEMA_VERSION: 16;
+export declare const SCHEMA_VERSION: 20;
 /**
  * Source file reference with meaningful path.
  * Format: file is relative path from git root, export uses hash syntax.
@@ -370,8 +371,17 @@ export interface LockNeedsGroupEntry {
 export interface LockJob {
     readonly _type: 'static';
     readonly name: string;
-    readonly runsOn: string | readonly string[];
-    readonly excludeLabels?: readonly string[];
+    /** Single-agent targeting matchers. Absent when the job uses runsOnAll instead. */
+    readonly runsOn?: readonly LabelMatcher[];
+    readonly excludeLabels?: readonly LabelMatcher[];
+    /** Host fan-out predicate (mutually exclusive with runsOn). */
+    readonly runsOnAll?: RunsOnAllPredicate;
+    /** Failure policy for unreachable durable hosts in a runsOnAll fan-out. */
+    readonly onUnreachable?: OnUnreachableMode;
+    /** Fan-out concurrency width (sliding window; 1 = serial). Applies to matrix and runsOnAll. */
+    readonly maxParallel?: number;
+    /** Halt the fan-out on first child failure, skipping the held remainder. Default false. */
+    readonly failFast?: boolean;
     readonly needs: readonly (string | LockNeedsEntry | LockNeedsGroupEntry)[];
     /** Group names this job depends on (populated from dynamicGroup refs). */
     readonly dependsOnGroups?: readonly string[];
@@ -425,11 +435,13 @@ export interface LockJob {
      */
     readonly resources?: ResourceRequest;
     /**
-     * Per-job init config(s) run after clone, before steps. `false` is an explicit
-     * opt-out. Threaded verbatim from the SDK `Job.init` -- the agent reads it from
-     * the loaded module, the lock copy is for orchestrator/dashboard visibility.
+     * Per-job init config(s) run after clone, before steps. A generic config,
+     * a typed preset (`'mise'` / `{ mise }`), an ordered array, `'auto'`
+     * (detect from committed files), or `false` (opt-out). Threaded verbatim from
+     * the SDK `Job.init` -- the agent reads it from the loaded module, the lock
+     * copy is for orchestrator/dashboard visibility.
      */
-    readonly init?: import('@kici-dev/sdk').GenericInitConfig | readonly import('@kici-dev/sdk').GenericInitConfig[] | false;
+    readonly init?: import('@kici-dev/sdk').InitConfig;
     /** Normalized approval gate; when set the job is held before dispatch. */
     readonly approval?: LockApproval;
 }
@@ -445,6 +457,15 @@ export interface LockDynamicJobFn {
     };
     /** Group name for cross-domain needs (set when dynamicJob('name', fn) is used). */
     readonly group?: string;
+    /**
+     * Declared upstream needs for a result-aware generator. When present the
+     * generator's eval job is deferred until these upstreams complete, then run
+     * with their frozen outputs available as ctx.needs. Same normalized shape as
+     * a static job's `needs`.
+     */
+    readonly needs?: readonly (string | LockNeedsEntry | LockNeedsGroupEntry)[];
+    /** True when this dynamic entry was authored as dynamicJob(group, { needs, generate }). */
+    readonly resultAware?: boolean;
 }
 /** Job or dynamic job generator */
 export type LockJobOrFactory = LockJob | LockDynamicJobFn;

package/dist/types.js

@@ -1,4 +1,4 @@
-import "./chunk-gOLHoazu.js";
+import "./chunk-BTugEXQM.js";
 import { SCHEMA_VERSION as SCHEMA_VERSION$1 } from "@kici-dev/engine";
 //#region src/types.ts
 /**
@@ -13,6 +13,7 @@ import { SCHEMA_VERSION as SCHEMA_VERSION$1 } from "@kici-dev/engine";
 * v8 adds runsOn polymorphic type (string | string[] | selector) and excludeLabels.
 * v11 adds LockInlineValue type for pure function inline evaluation.
 * v15 adds per-job init config(s).
+* v17 widens per-job init to typed presets ('mise' / { mise }) and 'auto' detection.
 */
 /** Schema version - re-exported from engine as single source of truth */
 const SCHEMA_VERSION = SCHEMA_VERSION$1;

package/dist/validation/index.js

@@ -1,3 +1,3 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { validateConfig } from "./validator.js";
 export { validateConfig };

package/dist/validation/validator.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { compilerError } from "../errors/formatter.js";
 import "../errors/index.js";
 import { getDynamicJobGroup, isDynamicGroupRef, isDynamicJobFn, isStaticArray, isStaticObject, validateDag } from "@kici-dev/sdk";

package/dist/workflows/hello-world.ts

@@ -10,7 +10,7 @@ export const helloWorldWorkflow = workflow('hello-world', {
 
   jobs: [
     job('greet', {
-      runsOn: 'ubuntu-latest',
+      runsOn: 'kici:os:linux',
       steps: [
         step('say-hello', async ({ $ }) => {
           await $`echo "Hello, World!"`;

package/dist/workflows/pr-checks.ts

@@ -26,7 +26,7 @@ export const prChecksWorkflow = workflow('pr-checks', {
   // Jobs: run in parallel unless connected via `needs`
   jobs: [
     job('lint', {
-      runsOn: 'ubuntu-latest',
+      runsOn: 'kici:os:linux',
       steps: [
         step('checkout', async ({ $ }) => {
           await $`echo "Checking out code..."`;
@@ -39,7 +39,7 @@ export const prChecksWorkflow = workflow('pr-checks', {
     }),
 
     job('test', {
-      runsOn: 'ubuntu-latest',
+      runsOn: 'kici:os:linux',
       needs: ['lint'], // Waits for lint to pass
       steps: [
         step('checkout', async ({ $ }) => {