@kici-dev/compiler 0.1.27 → 0.2.0

package/dist/commands/notifications.js

@@ -0,0 +1,274 @@
+import "../rolldown-runtime-ClRpJifh.js";
+import { DashboardClientError } from "../remote/dashboard-client.js";
+import { NotificationChannelKind, NotificationScopeKind, NotificationSubLevel, NotificationsClient, RosterInputForm, RosterSubjectKind } from "../remote/notifications-client.js";
+import pc from "picocolors";
+import { toErrorMessage } from "@kici-dev/core";
+//#region src/commands/notifications.ts
+/**
+* kici notifications commands
+*
+* Customer self-service management of an org's notification configuration —
+* channels, subscriptions, and the Layer 1 Slack-identity roster — under the
+* logged-in user's PAT against the hosted Platform's org-scoped HTTP API. This
+* is a tenant-plane developer operation, so it lives in the public `kici` CLI
+* (like `kici org` / `kici verify-attestation`), never the DB-direct
+* `kici-platform-admin`.
+*/
+/** Split a comma-separated flag value into a trimmed, non-empty list. */
+function parseCsv(value) {
+	if (!value) return [];
+	return value.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
+}
+/** Print a simple padded table. */
+function printTable(headers, rows) {
+	if (rows.length === 0) {
+		console.log(pc.gray("None."));
+		return;
+	}
+	const widths = headers.map((h, i) => Math.max(h.length, ...rows.map((r) => r[i].length)));
+	console.log(pc.bold(headers.map((h, i) => h.padEnd(widths[i])).join("   ")));
+	for (const row of rows) console.log(row.map((c, i) => c.padEnd(widths[i])).join("   "));
+}
+/**
+* Load the client and run `fn`, turning any {@link DashboardClientError} into a
+* red console message and a `false` return (the CLI exit-code convention).
+*/
+async function withClient(opts, fn) {
+	try {
+		return await fn(await NotificationsClient.load({ org: opts.org }));
+	} catch (err) {
+		if (err instanceof DashboardClientError) {
+			console.error(pc.red(err.message));
+			return false;
+		}
+		console.error(pc.red(`Notifications command failed: ${toErrorMessage(err)}`));
+		return false;
+	}
+}
+/** Validate a value against a Zod enum, printing an actionable error on miss. */
+function requireEnum(label, value, options) {
+	if (value === void 0) {
+		console.error(pc.red(`--${label} is required (one of: ${options.join(", ")})`));
+		return null;
+	}
+	if (!options.includes(value)) {
+		console.error(pc.red(`Invalid --${label} "${value}" (one of: ${options.join(", ")})`));
+		return null;
+	}
+	return value;
+}
+async function notificationsChannelsListCommand(opts) {
+	return withClient(opts, async (client) => {
+		const channels = await client.listChannels();
+		if (opts.json) {
+			console.log(JSON.stringify(channels, null, 2));
+			return true;
+		}
+		printTable([
+			"ID",
+			"TYPE",
+			"NAME",
+			"MANAGED"
+		], channels.map((c) => [
+			c.id,
+			c.type,
+			c.name,
+			c.managed ? "yes" : "no"
+		]));
+		return true;
+	});
+}
+async function notificationsChannelsAddCommand(opts) {
+	const type = requireEnum("type", opts.type, NotificationChannelKind.options);
+	if (!type) return false;
+	if (!opts.name) {
+		console.error(pc.red("--name is required"));
+		return false;
+	}
+	let body;
+	if (type === NotificationChannelKind.enum.slack) {
+		if (!opts.connection || !opts.slackChannel) {
+			console.error(pc.red("slack channels require --connection <id> and --slack-channel <id>"));
+			return false;
+		}
+		body = {
+			type: "slack",
+			connection_id: opts.connection,
+			slack_channel_id: opts.slackChannel,
+			name: opts.name
+		};
+	} else body = {
+		type: "email",
+		name: opts.name,
+		...opts.fromName ? { from_name: opts.fromName } : {},
+		...opts.replyTo ? { reply_to: opts.replyTo } : {}
+	};
+	return withClient(opts, async (client) => {
+		const channel = await client.createChannel(body);
+		console.log(pc.green(`Channel created: ${channel.id}`));
+		return true;
+	});
+}
+async function notificationsChannelsRemoveCommand(id, opts) {
+	return withClient(opts, async (client) => {
+		await client.deleteChannel(id);
+		console.log(pc.green(`Channel removed: ${id}`));
+		return true;
+	});
+}
+async function notificationsSubscriptionsListCommand(opts) {
+	return withClient(opts, async (client) => {
+		const subs = await client.listSubscriptions();
+		if (opts.json) {
+			console.log(JSON.stringify(subs, null, 2));
+			return true;
+		}
+		printTable([
+			"ID",
+			"LEVEL",
+			"SCOPE",
+			"CHANNEL",
+			"ON STATUS",
+			"ENABLED"
+		], subs.map((s) => [
+			s.id,
+			s.level,
+			s.scope_id ? `${s.scope_type}:${s.scope_id}` : s.scope_type,
+			s.channel_id,
+			(s.on_status ?? []).join(","),
+			s.enabled ? "yes" : "no"
+		]));
+		return true;
+	});
+}
+/** Build a create-subscription body from parsed flags (null on validation error). */
+function buildSubscriptionBody(opts) {
+	if (!opts.channel) {
+		console.error(pc.red("--channel <id> is required"));
+		return null;
+	}
+	const level = requireEnum("level", opts.level ?? "run", NotificationSubLevel.options);
+	if (!level) return null;
+	const scope = requireEnum("scope", opts.scope ?? "org", NotificationScopeKind.options);
+	if (!scope) return null;
+	const onStatus = parseCsv(opts.onStatus);
+	if (onStatus.length === 0) {
+		console.error(pc.red("--on-status <csv> is required (e.g. failed,success)"));
+		return null;
+	}
+	const needsScopeId = scope === NotificationScopeKind.enum.team || scope === NotificationScopeKind.enum.user;
+	if (needsScopeId && !opts.scopeId) {
+		console.error(pc.red(`--scope-id is required for ${scope} scope`));
+		return null;
+	}
+	let accumulateFor = null;
+	if (opts.accumulateFor !== void 0) {
+		accumulateFor = Number(opts.accumulateFor);
+		if (!Number.isFinite(accumulateFor)) {
+			console.error(pc.red("--accumulate-for must be a number of milliseconds"));
+			return null;
+		}
+	}
+	const mentions = parseCsv(opts.mentions);
+	const recipientOverride = parseCsv(opts.recipientOverride);
+	const onFailureClass = parseCsv(opts.onFailureClass);
+	return {
+		level,
+		channel_id: opts.channel,
+		scope_type: scope,
+		scope_id: needsScopeId ? opts.scopeId : null,
+		on_status: onStatus,
+		repo_glob: opts.repoGlob ?? null,
+		workflow_glob: opts.workflowGlob ?? null,
+		job_glob: opts.jobGlob ?? null,
+		mentions: mentions.length > 0 ? mentions : null,
+		recipient_override: recipientOverride.length > 0 ? recipientOverride : null,
+		on_failure_class: onFailureClass.length > 0 ? onFailureClass : null,
+		accumulate_for: accumulateFor
+	};
+}
+async function notificationsSubscriptionsAddCommand(opts) {
+	const body = buildSubscriptionBody(opts);
+	if (!body) return false;
+	return withClient(opts, async (client) => {
+		const sub = await client.createSubscription(body);
+		console.log(pc.green(`Subscription created: ${sub.id}`));
+		return true;
+	});
+}
+async function notificationsSubscriptionsRemoveCommand(id, opts) {
+	return withClient(opts, async (client) => {
+		await client.deleteSubscription(id);
+		console.log(pc.green(`Subscription removed: ${id}`));
+		return true;
+	});
+}
+async function notificationsRosterListCommand(opts) {
+	return withClient(opts, async (client) => {
+		const identities = await client.listIdentities();
+		if (opts.json) {
+			console.log(JSON.stringify(identities, null, 2));
+			return true;
+		}
+		printTable([
+			"ID",
+			"SUBJECT KIND",
+			"SUBJECT",
+			"SLACK MEMBER",
+			"STATUS"
+		], identities.map((r) => [
+			r.id,
+			r.subject_kind,
+			r.subject_value,
+			r.slack_member_id,
+			r.status
+		]));
+		return true;
+	});
+}
+/** Build an add-identity body from parsed flags (null on validation error). */
+function buildIdentityBody(opts) {
+	if (!opts.connection) {
+		console.error(pc.red("--connection <id> is required"));
+		return null;
+	}
+	const subjectKind = requireEnum("subject-kind", opts.subjectKind, RosterSubjectKind.options);
+	if (!subjectKind) return null;
+	if (!opts.subject) {
+		console.error(pc.red("--subject <value> is required (the KiCI user sub, git login, or email)"));
+		return null;
+	}
+	const inputForm = requireEnum("input-form", opts.inputForm ?? "id", RosterInputForm.options);
+	if (!inputForm) return null;
+	if (!opts.value) {
+		console.error(pc.red("--value <slack id | email | @handle> is required"));
+		return null;
+	}
+	return {
+		connection_id: opts.connection,
+		subject_kind: subjectKind,
+		subject_value: opts.subject,
+		input_form: inputForm,
+		value: opts.value
+	};
+}
+async function notificationsRosterAddCommand(opts) {
+	const body = buildIdentityBody(opts);
+	if (!body) return false;
+	return withClient(opts, async (client) => {
+		const row = await client.addIdentity(body);
+		console.log(pc.green(`Roster identity added: ${row.id} → ${row.slack_member_id}`));
+		return true;
+	});
+}
+async function notificationsRosterRemoveCommand(id, opts) {
+	return withClient(opts, async (client) => {
+		await client.deleteIdentity(id);
+		console.log(pc.green(`Roster identity removed: ${id}`));
+		return true;
+	});
+}
+//#endregion
+export { notificationsChannelsAddCommand, notificationsChannelsListCommand, notificationsChannelsRemoveCommand, notificationsRosterAddCommand, notificationsRosterListCommand, notificationsRosterRemoveCommand, notificationsSubscriptionsAddCommand, notificationsSubscriptionsListCommand, notificationsSubscriptionsRemoveCommand };
+
+//# sourceMappingURL=notifications.js.map

package/dist/commands/preview.js

@@ -2,6 +2,8 @@ import "../rolldown-runtime-ClRpJifh.js";
 import { discoverWorkflows, resolveKiciDir } from "../execution/executor.js";
 import "../execution/index.js";
 import { transformTriggers } from "../lockfile/generator.js";
+import { analyzeJobPurity } from "../lockfile/purity-diagnostics.js";
+import "../lockfile/index.js";
 import { displayDryRun } from "../test-runner/dry-run.js";
 import { parseEventArg } from "../test-runner/event-types.js";
 import { buildEventPayload } from "../test-runner/payload-builder.js";
@@ -88,10 +90,15 @@ async function previewEvent(event, options) {
 				return false;
 			}
 		}
+		const purityWarnings = [];
+		for (const w of workflows) for (const j of w.jobs) {
+			if (typeof j === "function") continue;
+			purityWarnings.push(...analyzeJobPurity(j, w.name));
+		}
 		displayDryRun(lockWorkflows, decisions, {
 			workflow: options.workflow,
 			job: options.job
-		});
+		}, purityWarnings);
 		return true;
 	} catch (error) {
 		const message = toErrorMessage(error);

package/dist/commands/run-routed.js

@@ -2,7 +2,9 @@ import "../rolldown-runtime-ClRpJifh.js";
 import { resolveKiciDir } from "../execution/executor.js";
 import "../execution/index.js";
 import { formatSummary } from "../remote/output/summary.js";
+import { detectOsMismatchHints } from "../local-plane/os-mismatch-hint.js";
 import { IN_PLACE_ROUTING_LABEL, TRUSTED_ROUTING_LABEL } from "../local-plane/scaler-config.js";
+import { planeLogPath } from "../local-plane/plane-manager.js";
 import { ensureLocalSource } from "../local-plane/plane-seed.js";
 import { triggerRun } from "../local-plane/plane-trigger.js";
 import { resolvePlaneForRun } from "../local-plane/resolve-plane.js";
@@ -76,6 +78,12 @@ async function runRouted(options) {
 		check: false,
 		verbose: options.debug ?? false
 	}))) return false;
+	if (!quiet) try {
+		const os = await import("node:os");
+		const lockRaw = readFileSync(path.join(kiciDir, "kici.lock.json"), "utf-8");
+		const hints = detectOsMismatchHints(JSON.parse(lockRaw), os.platform(), os.arch());
+		for (const hint of hints) logger.warn(pc.yellow(hint));
+	} catch {}
 	let cleanup;
 	const restoreLocks = [];
 	try {
@@ -146,7 +154,8 @@ async function runRouted(options) {
 		if (!quiet) logger.info(pc.green(`Run started: ${runId}`));
 		const outcome = await followRun(plane.url, plane.adminToken, runId, {
 			quiet,
-			onLine: (line) => process.stdout.write(line + "\n")
+			onLine: (line) => process.stdout.write(line + "\n"),
+			hintLogPath: planeLogPath()
 		});
 		if (!quiet) {
 			const result = {

package/dist/commands/run.js

@@ -4,7 +4,7 @@ import "../execution/index.js";
 import { loadGlobalConfig } from "../remote/config.js";
 import { RunHistory } from "../remote/history.js";
 import { buildLocalRepoIdentity } from "../remote/local-repo-identity.js";
-import { AccessDeniedError, AmbiguousClusterError, AuthenticationError, ConnectionError, NoClusterError, PlatformRunClient } from "../remote/platform-client.js";
+import { AccessDeniedError, AmbiguousClusterError, AuthenticationError, ConnectionError, NoClusterError, NotFoundError, PlatformRunClient } from "../remote/platform-client.js";
 import { buildEncryptedSecrets } from "../remote/secret-upload.js";
 import { createOverlayTarball, getSizeWarning, uploadTarball } from "../remote/uploader.js";
 import { formatJsonResult } from "../remote/output/json.js";
@@ -20,17 +20,22 @@ import path from "node:path";
 import pc from "picocolors";
 import { readFile, writeFile } from "node:fs/promises";
 import { formatBytes, logger, toErrorMessage } from "@kici-dev/core";
-import { coerceDispatchInputs, parseInputPairs } from "@kici-dev/engine";
+import { TERMINAL_RUN_STATES, coerceDispatchInputs, parseInputPairs, toCanonicalStatus } from "@kici-dev/engine";
 import { normalizeRunsOnToMatchers } from "@kici-dev/engine/labels/compile";
 import { confirm } from "@inquirer/prompts";
 //#region src/commands/run.ts
-/** Terminal run statuses returned by the Platform run-status snapshot. */
-const TERMINAL_STATUSES = /* @__PURE__ */ new Set([
-	"success",
-	"failed",
-	"cancelled",
-	"error"
-]);
+/**
+* True when the Platform run-status snapshot reports a terminal run status.
+*
+* Resolves through the engine's canonical vocabulary rather than matching a
+* hand-written literal set: that is what makes the legacy `error` spelling
+* terminal without a second copy of the alias, and what stops a newly-added
+* terminal status leaving `kici run` polling a finished run forever.
+*/
+function isTerminalRunStatus(status) {
+	const canonical = toCanonicalStatus(status.toLowerCase());
+	return canonical !== void 0 && TERMINAL_RUN_STATES.has(canonical);
+}
 /**
 * Compile `--target` selector strings into a {@link HostTargetSelector}. Each
 * string becomes one AND value (its own include set); repeated values
@@ -91,6 +96,19 @@ function buildDispatchInputs(pairs, descriptor) {
 /** Interval between status/log polls while a run is active. */
 const POLL_INTERVAL_MS = 750;
 /**
+* How long a freshly triggered run may still read as missing before a 404 is
+* reported as a real error.
+*
+* The trigger call answers with the run id as soon as the orchestrator has
+* created the run, while the Platform's view of that run arrives over the
+* relay a moment later. The first poll therefore fires while the run is not
+* yet readable and legitimately 404s. Within this budget — and only until the
+* first successful read — a 404 means "not visible yet" and the poll retries;
+* after it, or once the run has been read at least once, a 404 is surfaced as
+* a genuinely missing run.
+*/
+const RUN_VISIBILITY_GRACE_MS = 3e4;
+/**
 * Run `fn` with everything written to `process.stdout` redirected to
 * `process.stderr`, then restore the original writer. Compiling a repo
 * evaluates every user workflow / fixture module, and a `console.log` at a
@@ -466,16 +484,27 @@ async function pollRunToCompletion(ctx, runId, fixtureId, options) {
 		let lastStatus = null;
 		const seenHolds = /* @__PURE__ */ new Set();
 		let heldCtx;
+		let runSeen = false;
 		while (!cancelled) {
-			const logs = await ctx.client.runLogs(ctx.orgId, runId, cursor, ctx.target);
+			let logs;
+			try {
+				logs = await ctx.client.runLogs(ctx.orgId, runId, cursor, ctx.target);
+				lastStatus = await ctx.client.runStatus(ctx.orgId, runId, ctx.target);
+			} catch (err) {
+				if (err instanceof NotFoundError && !runSeen && Date.now() - startTime < RUN_VISIBILITY_GRACE_MS) {
+					await new Promise((resolve) => setTimeout(resolve, POLL_INTERVAL_MS));
+					continue;
+				}
+				throw err;
+			}
+			runSeen = true;
 			for (const line of logs.lines) {
 				if (!options.quiet) process.stdout.write(line + "\n");
 				tailLines.push(line);
 				while (tailLines.length > MAX_TAIL) tailLines.shift();
 			}
 			cursor = logs.nextCursor;
-			lastStatus = await ctx.client.runStatus(ctx.orgId, runId, ctx.target);
-			const terminal = lastStatus.done || TERMINAL_STATUSES.has(lastStatus.status);
+			const terminal = lastStatus.done || isTerminalRunStatus(lastStatus.status);
 			if (terminal && logs.done) return finishRun(fixtureId, runId, lastStatus, startTime, tailLines, options);
 			if (!terminal) await watchRunHolds(runId, seenHolds, () => heldCtx, (c) => heldCtx = c, options);
 			await new Promise((resolve) => setTimeout(resolve, POLL_INTERVAL_MS));

package/dist/commands/runs/artifacts/download.d.ts

@@ -0,0 +1,24 @@
+export interface RunsArtifactsDownloadOptions {
+    archive?: boolean;
+    output?: string;
+}
+/** Basename an artifact takes under the output directory in the given mode. */
+export declare function destBasename(name: string, archive: boolean): string;
+/**
+ * Reduce a basename to the form a case-insensitive filesystem looks it up by.
+ *
+ * The NFC pass is deliberate defence for a widened artifact-name charset:
+ * `ArtifactNameSchema` accepts ASCII only today, so no live name can differ by
+ * normalisation — but HFS+ stores NFD and APFS folds case while preserving
+ * normalisation, so a non-ASCII name would collide on those volumes without it.
+ */
+export declare function foldBasename(basename: string): string;
+/**
+ * Group basenames that a case-insensitive filesystem resolves to one path.
+ *
+ * Groups appear in first-appearance order and each group is sorted; a basename
+ * with no partner is not reported.
+ */
+export declare function findCaseCollisions(basenames: string[]): string[][];
+export declare function runsArtifactsDownloadCommand(runId: string, name: string | undefined, options?: RunsArtifactsDownloadOptions): Promise<boolean>;
+//# sourceMappingURL=download.d.ts.map

package/dist/commands/runs/artifacts/download.js

@@ -0,0 +1,154 @@
+import "../../../rolldown-runtime-ClRpJifh.js";
+import { extractArtifactTarball } from "../../../remote/artifact-extract.js";
+import { DashboardClient, DashboardClientError } from "../../../remote/dashboard-client.js";
+import { isCaseInsensitiveDir } from "../../../remote/fs-case.js";
+import { join } from "node:path";
+import pc from "picocolors";
+import { mkdir, writeFile } from "node:fs/promises";
+import { logger, sha256, toErrorMessage } from "@kici-dev/core";
+import { ArtifactNameSchema } from "@kici-dev/engine";
+//#region src/commands/runs/artifacts/download.ts
+/** kici runs artifacts download — fetch one artifact (by name) or every artifact of a run. */
+/** Extension of the raw artifact archive written by `--archive`. */
+const ARCHIVE_EXTENSION = ".tar.gz";
+/** Basename an artifact takes under the output directory in the given mode. */
+function destBasename(name, archive) {
+	return archive ? `${name}${ARCHIVE_EXTENSION}` : name;
+}
+/**
+* Reduce a basename to the form a case-insensitive filesystem looks it up by.
+*
+* The NFC pass is deliberate defence for a widened artifact-name charset:
+* `ArtifactNameSchema` accepts ASCII only today, so no live name can differ by
+* normalisation — but HFS+ stores NFD and APFS folds case while preserving
+* normalisation, so a non-ASCII name would collide on those volumes without it.
+*/
+function foldBasename(basename) {
+	return basename.normalize("NFC").toLowerCase();
+}
+/**
+* Group basenames that a case-insensitive filesystem resolves to one path.
+*
+* Groups appear in first-appearance order and each group is sorted; a basename
+* with no partner is not reported.
+*/
+function findCaseCollisions(basenames) {
+	const byFold = /* @__PURE__ */ new Map();
+	for (const basename of basenames) {
+		const fold = foldBasename(basename);
+		const group = byFold.get(fold);
+		if (group) group.add(basename);
+		else byFold.set(fold, /* @__PURE__ */ new Set([basename]));
+	}
+	return [...byFold.values()].filter((g) => g.size > 1).map((g) => [...g].sort());
+}
+/**
+* Fetch a presigned artifact URL into a Buffer and verify its sha-256.
+*
+* NO `Authorization` header: `downloadUrl` is a presigned object-storage GET,
+* and the PAT authenticates to the Platform, not to object storage — attaching
+* it would leak the credential to the storage host. The bytes therefore flow
+* CLI <-> object storage directly and never transit the Platform.
+*/
+async function fetchArtifactBytes(entry) {
+	if (!entry.downloadUrl) throw new Error(`artifact "${entry.name}" has no download URL (the stored object is missing or expired)`);
+	const res = await fetch(entry.downloadUrl);
+	if (!res.ok) throw new Error(`download of "${entry.name}" failed (HTTP ${res.status})`);
+	const buf = Buffer.from(await res.arrayBuffer());
+	const actual = sha256(buf);
+	if (actual !== entry.sha256) throw new Error(`artifact "${entry.name}" checksum mismatch: expected ${entry.sha256}, got ${actual}`);
+	return buf;
+}
+/**
+* Refuse a listed name that is not a valid artifact name.
+*
+* Every name is validated against {@link ArtifactNameSchema} at upload, so a
+* response carrying one outside that contract comes from a broken or hostile
+* peer. The name becomes a path component under the output directory, so it is
+* checked before it is joined — an unchecked `../…` would let a list response
+* write anywhere on the caller's filesystem.
+*/
+function assertPathSafeName(name) {
+	if (!ArtifactNameSchema.safeParse(name).success) throw new Error(`listed artifact "${name}" is not a valid artifact name — refusing to write it under the output directory`);
+}
+/**
+* Refuse the whole invocation when two targets would land on the same path.
+*
+* Artifact names are case-sensitive, so a run can legitimately hold both
+* `bundle` and `Bundle`. On a filesystem that ignores case in path lookups the
+* two resolve to one path — the second extraction merges into the first's
+* directory, or overwrites its archive under `--archive`. The filesystem is
+* probed only once a fold collision is known to exist, so a case-sensitive
+* output directory downloads both exactly as before. A probe that cannot answer
+* is treated as case-insensitive: the collision is already certain, so the
+* unknown half is resolved towards refusing rather than towards losing data.
+*/
+async function assertNoCaseCollisions(targets, outDir, archive) {
+	const groups = findCaseCollisions(targets.map((t) => destBasename(t.name, archive)));
+	if (groups.length === 0) return;
+	let probeError;
+	let caseInsensitive = true;
+	try {
+		caseInsensitive = await isCaseInsensitiveDir(outDir);
+	} catch (err) {
+		probeError = err;
+	}
+	if (!caseInsensitive) return;
+	const pairs = groups.map((g) => g.map((basename) => `"${basename}"`).join(" and ")).join("; ");
+	const consequence = archive ? "writing both would overwrite one file with the other" : "extracting both would merge them into one directory";
+	const reason = probeError !== void 0 ? `the output directory ${outDir} could not be checked for case sensitivity (${toErrorMessage(probeError)})` : `the output directory ${outDir} is on a case-insensitive filesystem`;
+	throw new Error(`this run holds artifacts whose names differ only in case: ${pairs} — ${consequence}, and ${reason}. Download them one at a time into separate directories: kici runs artifacts download <run-id> <name> -o <dir>`);
+}
+/** Fetch one entry and write it to `outDir`, extracted or as the raw archive. */
+async function writeOne(entry, outDir, archive) {
+	assertPathSafeName(entry.name);
+	const buf = await fetchArtifactBytes(entry);
+	await mkdir(outDir, { recursive: true });
+	const dest = join(outDir, destBasename(entry.name, archive));
+	if (archive) {
+		await writeFile(dest, buf);
+		console.log(pc.green(`✓ ${entry.name} → ${dest}`));
+		return;
+	}
+	await extractArtifactTarball(buf, dest);
+	console.log(pc.green(`✓ ${entry.name} → ${dest}/`));
+}
+/** Resolve which listed artifacts the invocation targets. */
+function resolveTargets(artifacts, name, runId) {
+	if (!name) return artifacts;
+	const match = artifacts.find((a) => a.name === name);
+	if (match) return [match];
+	const names = artifacts.map((a) => a.name).join(", ") || "(none)";
+	throw new Error(`artifact "${name}" not found in run ${runId}. Available: ${names}`);
+}
+async function runsArtifactsDownloadCommand(runId, name, options = {}) {
+	try {
+		const { artifacts } = await (await DashboardClient.load()).listArtifacts(runId);
+		const outDir = options.output ?? process.cwd();
+		const downloadingAll = !name;
+		const targets = resolveTargets(artifacts, name, runId);
+		if (targets.length === 0) {
+			console.log(pc.gray("No artifacts for this run."));
+			return true;
+		}
+		for (const entry of targets) assertPathSafeName(entry.name);
+		if (downloadingAll) await assertNoCaseCollisions(targets.filter((t) => t.downloadUrl), outDir, options.archive ?? false);
+		let failures = 0;
+		for (const entry of targets) {
+			if (downloadingAll && !entry.downloadUrl) {
+				logger.warn(pc.yellow(`! ${entry.name} skipped — no download URL (object missing or expired)`));
+				failures++;
+				continue;
+			}
+			await writeOne(entry, outDir, options.archive ?? false);
+		}
+		return failures < targets.length;
+	} catch (err) {
+		logger.error(pc.red(err instanceof DashboardClientError ? err.message : toErrorMessage(err)));
+		return false;
+	}
+}
+//#endregion
+export { destBasename, findCaseCollisions, foldBasename, runsArtifactsDownloadCommand };
+
+//# sourceMappingURL=download.js.map

package/dist/commands/runs/artifacts/list.d.ts

@@ -0,0 +1,5 @@
+export interface RunsArtifactsListOptions {
+    json?: boolean;
+}
+export declare function runsArtifactsListCommand(runId: string, options?: RunsArtifactsListOptions): Promise<boolean>;
+//# sourceMappingURL=list.d.ts.map

package/dist/commands/runs/artifacts/list.js

@@ -0,0 +1,47 @@
+import "../../../rolldown-runtime-ClRpJifh.js";
+import { DashboardClient, DashboardClientError } from "../../../remote/dashboard-client.js";
+import { relativeTime, renderTable } from "../../../remote/render.js";
+import pc from "picocolors";
+import { formatBytes, logger, toErrorMessage } from "@kici-dev/core";
+//#region src/commands/runs/artifacts/list.ts
+/** kici runs artifacts list — the artifacts a run uploaded (the rows the dashboard Artifacts tab shows). */
+/** Number of leading sha-256 hex chars shown in the table (full digest via --json). */
+const SHA_PREFIX_LENGTH = 12;
+async function runsArtifactsListCommand(runId, options = {}) {
+	try {
+		const result = await (await DashboardClient.load()).listArtifacts(runId);
+		if (options.json) {
+			console.log(JSON.stringify(result, null, 2));
+			return true;
+		}
+		if (result.artifacts.length === 0) {
+			console.log(pc.gray("No artifacts for this run."));
+			return true;
+		}
+		const rows = result.artifacts.map((a) => [
+			a.name,
+			a.jobId,
+			formatBytes(a.sizeBytes),
+			a.sha256.slice(0, SHA_PREFIX_LENGTH),
+			relativeTime(a.createdAt),
+			a.downloadUrl ? "" : pc.yellow("unavailable")
+		]);
+		console.log(renderTable([
+			"name",
+			"job",
+			"size",
+			"sha-256",
+			"created",
+			""
+		], rows));
+		console.log(pc.gray(`\n${result.artifacts.length} artifact(s). Download with kici runs artifacts download ${runId} <name>`));
+		return true;
+	} catch (err) {
+		logger.error(pc.red(err instanceof DashboardClientError ? err.message : toErrorMessage(err)));
+		return false;
+	}
+}
+//#endregion
+export { runsArtifactsListCommand };
+
+//# sourceMappingURL=list.js.map

package/dist/commands/runs/cancel.js

@@ -18,8 +18,8 @@ async function runsCancelCommand(runId, options = {}) {
 			return false;
 		}
 		logger.info(`${options.force ? "Force-cancelling" : "Cancelling"} run ${pc.cyan(runId)}...`);
-		const { cancelledJobs = 0 } = await client.cancelRun(runId, options.force ?? false);
-		console.log(pc.green(`Run ${runId} cancelled (${cancelledJobs} job${cancelledJobs !== 1 ? "s" : ""} affected).`));
+		const { cancelledJobs = 0, alreadyTerminal } = await client.cancelRun(runId, options.force ?? false);
+		console.log(alreadyTerminal ? pc.yellow(`Run ${runId} had already finished; nothing was cancelled.`) : pc.green(`Run ${runId} cancelled (${cancelledJobs} job${cancelledJobs !== 1 ? "s" : ""} affected).`));
 		return true;
 	} catch (err) {
 		logger.error(pc.red(err instanceof DashboardClientError ? err.message : toErrorMessage(err)));