@kici-dev/compiler 0.1.27 → 0.3.0

package/dist/commands/doctor.js

@@ -0,0 +1,413 @@
+import "../rolldown-runtime-ClRpJifh.js";
+import { resolveKiciDir } from "../execution/executor.js";
+import "../execution/index.js";
+import { isLockStaticJob } from "../types.js";
+import { loadGlobalConfig } from "../remote/config.js";
+import { DashboardClient, DashboardClientError } from "../remote/dashboard-client.js";
+import path from "node:path";
+import pc from "picocolors";
+import fs from "node:fs/promises";
+import { deriveDiagnoseOverall, diagnoseExitCode, toErrorMessage } from "@kici-dev/core";
+import { matcherSatisfiedBy } from "@kici-dev/engine";
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+//#region src/commands/doctor.ts
+/**
+* kici doctor — walk the onboarding funnel and diagnose where a developer's
+* setup breaks. Each check reports pass/warn/fail with the exact next command
+* to run. Composed entirely from client-side state (the stored config, one
+* authenticated infrastructure read, and local filesystem/git state) — no new
+* Platform API is required.
+*/
+const execFileAsync = promisify(execFile);
+const SEVEN_DAYS_MS = 10080 * 60 * 1e3;
+/** Is a stored token + endpoint present (regardless of expiry)? */
+function hasCredentials(config) {
+	return Boolean((config.pat ?? config.token) && (config.platformEndpoint ?? config.endpoint));
+}
+/** Check 1: logged in with an unexpired token. */
+function checkLogin(config, now) {
+	const name = "login";
+	const endpoint = config.platformEndpoint ?? config.endpoint;
+	if (!hasCredentials(config)) return {
+		name,
+		status: "fail",
+		message: "Not logged in (no stored credentials).",
+		nextCommand: "kici login"
+	};
+	if (config.patExpiresAt) {
+		const expiresAt = Date.parse(config.patExpiresAt);
+		if (!Number.isNaN(expiresAt)) {
+			if (expiresAt <= now) return {
+				name,
+				status: "fail",
+				message: "Access token has expired.",
+				nextCommand: "kici login"
+			};
+			if (expiresAt - now < SEVEN_DAYS_MS) return {
+				name,
+				status: "warn",
+				message: `Access token expires in ${Math.ceil((expiresAt - now) / (1440 * 60 * 1e3))} day(s).`,
+				nextCommand: "kici login"
+			};
+		}
+	}
+	return {
+		name,
+		status: "pass",
+		message: `Logged in to ${endpoint}.`
+	};
+}
+/** Check 2: an active organization is selected. */
+function checkActiveOrg(config) {
+	const name = "active-org";
+	if (!config.activeOrgId) return {
+		name,
+		status: "fail",
+		message: "No active organization selected.",
+		nextCommand: "kici org use <name>"
+	};
+	return {
+		name,
+		status: "pass",
+		message: `Active organization: ${config.activeOrgId}.`
+	};
+}
+/** Check 3: the Platform accepted the stored token (live-token probe). */
+function checkLiveToken(probe) {
+	const name = "token-live";
+	if (probe === null) return {
+		name,
+		status: "warn",
+		message: "Skipped: requires login and an active organization."
+	};
+	if (probe.ok) return {
+		name,
+		status: "pass",
+		message: "Platform accepted the access token."
+	};
+	if (probe.kind === "unauthorized" || probe.kind === "not_logged_in") return {
+		name,
+		status: "fail",
+		message: `Authentication failed: ${probe.message}`,
+		nextCommand: "kici login"
+	};
+	return {
+		name,
+		status: "warn",
+		message: `Could not verify token: ${probe.message}`
+	};
+}
+/** Check 4: an orchestrator is connected for this org. */
+function checkOrchestrator(probe) {
+	const name = "orchestrator";
+	if (probe === null || !probe.ok) return {
+		name,
+		status: "warn",
+		message: "Skipped: Platform not reachable (see token-live)."
+	};
+	const orchestrators = probe.infra.orchestrators ?? [];
+	const connected = orchestrators.filter((o) => o.connected);
+	if (orchestrators.length === 0) return {
+		name,
+		status: "warn",
+		message: "No orchestrator has connected for this organization yet.",
+		nextCommand: "kici diagnostics"
+	};
+	if (connected.length === 0) return {
+		name,
+		status: "fail",
+		message: `${orchestrators.length} orchestrator(s) registered but none are currently connected.`,
+		nextCommand: "kici diagnostics"
+	};
+	return {
+		name,
+		status: "pass",
+		message: `${connected.length} orchestrator(s) connected.`
+	};
+}
+/** Check 5: the lock file is present, fresh, and committed. */
+function checkLockFile(state) {
+	const name = "lock-file";
+	if (!state.exists) return {
+		name,
+		status: "fail",
+		message: "No compiled kici.lock.json found.",
+		nextCommand: "kici compile"
+	};
+	if (!state.fresh) return {
+		name,
+		status: "warn",
+		message: "Lock file is stale — workflow sources changed since the last compile.",
+		nextCommand: "kici compile"
+	};
+	if (state.gitAvailable && !state.committed) return {
+		name,
+		status: "warn",
+		message: "Lock file has uncommitted changes.",
+		nextCommand: "git add .kici/kici.lock.json && git commit"
+	};
+	return {
+		name,
+		status: "pass",
+		message: "Lock file present, fresh, and committed."
+	};
+}
+/**
+* A label group satisfies a requirement only when it matches EVERY runsOn
+* matcher AND matches NONE of the excludeLabels — the same authority the
+* orchestrator's job queue applies (`runsOn.every` && `!exclude.some`).
+*/
+function requirementSatisfiedBy(req, labels) {
+	return req.runsOn.every((m) => matcherSatisfiedBy(m, labels)) && !req.exclude.some((m) => matcherSatisfiedBy(m, labels));
+}
+function describeMatcher(m) {
+	return m.kind === "regex" ? `/${m.source}/${m.flags}` : m.value;
+}
+function describeRequirement(req) {
+	const base = req.runsOn.map(describeMatcher).join(" + ");
+	return req.exclude.length > 0 ? `${base} − ${req.exclude.map(describeMatcher).join(", ")}` : base;
+}
+/**
+* Collect the label groups that can satisfy a runsOn set on their own: each
+* connected agent's label set, and each scaler labelSet.
+*/
+function availableLabelGroups(infra) {
+	const groups = [];
+	for (const o of infra.orchestrators) {
+		if (!o.connected) continue;
+		for (const a of o.agents ?? []) groups.push(new Set(a.labels ?? []));
+		for (const s of o.scalers ?? []) for (const set of s.labelSets ?? []) groups.push(new Set(set));
+	}
+	return groups;
+}
+/** Check 6: every workflow's runsOn labels are satisfiable by a connected agent or scaler. */
+function checkLabels(lock, probe) {
+	const name = "labels";
+	if (!lock) return {
+		name,
+		status: "warn",
+		message: "Skipped: no compiled lock file to read labels from."
+	};
+	if (probe === null || !probe.ok) return {
+		name,
+		status: "warn",
+		message: "Skipped: Platform not reachable (see token-live)."
+	};
+	const required = [];
+	for (const wf of lock.workflows) for (const job of wf.jobs) {
+		if (!isLockStaticJob(job)) continue;
+		const runsOn = job.runsOn ?? [];
+		if (runsOn.length === 0) continue;
+		required.push({
+			runsOn,
+			exclude: job.excludeLabels ?? []
+		});
+	}
+	if (required.length === 0) return {
+		name,
+		status: "pass",
+		message: "No workflow label constraints to satisfy."
+	};
+	const groups = availableLabelGroups(probe.infra);
+	if (groups.length === 0) return {
+		name,
+		status: "warn",
+		message: "No connected agents or scalers to satisfy any workflow labels.",
+		nextCommand: "kici diagnostics"
+	};
+	const unsatisfied = /* @__PURE__ */ new Set();
+	for (const req of required) if (!groups.some((labels) => requirementSatisfiedBy(req, labels))) unsatisfied.add(describeRequirement(req));
+	if (unsatisfied.size > 0) return {
+		name,
+		status: "warn",
+		message: `No connected agent or scaler can satisfy: ${[...unsatisfied].join("; ")}.`,
+		details: { unsatisfied: [...unsatisfied] },
+		nextCommand: "kici diagnostics"
+	};
+	return {
+		name,
+		status: "pass",
+		message: "All workflow labels are satisfiable by connected capacity."
+	};
+}
+/** Newest mtime (ms) across every *.ts under the workflows directory, or 0. */
+async function newestWorkflowMtime(workflowsDir) {
+	let newest = 0;
+	let entries;
+	try {
+		entries = await fs.readdir(workflowsDir);
+	} catch {
+		return 0;
+	}
+	for (const entry of entries) {
+		if (!entry.endsWith(".ts")) continue;
+		try {
+			const st = await fs.stat(path.join(workflowsDir, entry));
+			if (st.mtimeMs > newest) newest = st.mtimeMs;
+		} catch {}
+	}
+	return newest;
+}
+/** Is the working tree clean for the given path? gitAvailable=false when not a repo. */
+async function gitCleanForPath(filePath) {
+	try {
+		const { stdout } = await execFileAsync("git", [
+			"status",
+			"--porcelain",
+			"--",
+			filePath
+		], { cwd: path.dirname(filePath) });
+		return {
+			gitAvailable: true,
+			committed: stdout.trim() === ""
+		};
+	} catch {
+		return {
+			gitAvailable: false,
+			committed: false
+		};
+	}
+}
+/** Default gatherer: read the lock file, compute freshness by mtime, check git. */
+async function defaultGatherLockState(kiciDir) {
+	const abs = resolveKiciDir(kiciDir);
+	const lockPath = path.join(abs, "kici.lock.json");
+	let lock = null;
+	let lockMtime = 0;
+	try {
+		lockMtime = (await fs.stat(lockPath)).mtimeMs;
+		lock = JSON.parse(await fs.readFile(lockPath, "utf-8"));
+	} catch {
+		return {
+			exists: false,
+			fresh: false,
+			committed: false,
+			gitAvailable: false,
+			lock: null
+		};
+	}
+	const newestSrc = await newestWorkflowMtime(path.join(abs, "workflows"));
+	const { gitAvailable, committed } = await gitCleanForPath(lockPath);
+	return {
+		exists: true,
+		fresh: lockMtime >= newestSrc,
+		committed,
+		gitAvailable,
+		lock
+	};
+}
+async function probeInfrastructure(client) {
+	try {
+		return {
+			ok: true,
+			infra: await client.getInfrastructure()
+		};
+	} catch (err) {
+		if (err instanceof DashboardClientError) return {
+			ok: false,
+			kind: err.kind,
+			message: err.message
+		};
+		return {
+			ok: false,
+			kind: "http",
+			message: toErrorMessage(err)
+		};
+	}
+}
+/** Default probe: attempt one authenticated infrastructure read, or null when not eligible. */
+async function defaultProbe(config) {
+	if (!hasCredentials(config) || !config.activeOrgId) return null;
+	let client;
+	try {
+		client = DashboardClient.fromConfig(config);
+	} catch (err) {
+		if (err instanceof DashboardClientError) return {
+			ok: false,
+			kind: err.kind,
+			message: err.message
+		};
+		throw err;
+	}
+	return probeInfrastructure(client);
+}
+const defaultDeps = {
+	loadConfig: loadGlobalConfig,
+	probe: defaultProbe,
+	gatherLockState: defaultGatherLockState,
+	now: Date.now
+};
+function colorizeStatus(status) {
+	switch (status) {
+		case "pass":
+		case "healthy": return pc.green(status);
+		case "warn":
+		case "degraded": return pc.yellow(status);
+		case "fail":
+		case "unhealthy": return pc.red(status);
+		default: return status;
+	}
+}
+/** Render the funnel as a status table with a trailing next-command hint per row. */
+function renderDoctorTable(response) {
+	const lines = [];
+	lines.push(`${pc.bold("kici doctor")}  ${colorizeStatus(response.status)}`);
+	lines.push("");
+	for (const c of response.checks) {
+		lines.push(`${colorizeStatus(c.status.padEnd(4))}  ${pc.bold(c.name.padEnd(14))} ${c.message}`);
+		if (c.nextCommand) lines.push(`      ${pc.cyan(`→ ${c.nextCommand}`)}`);
+	}
+	return lines.join("\n");
+}
+/**
+* Run the onboarding-funnel diagnostic and return the process exit code
+* (0 all pass · 1 any warn · 2 any fail). The single infrastructure probe is
+* timed and attributed to the token-live check; the local checks are instant.
+*/
+async function doctorCommand(options = {}, deps = defaultDeps) {
+	const config = await deps.loadConfig();
+	const now = deps.now();
+	const lockState = await deps.gatherLockState(options.kiciDir ?? ".kici");
+	const probeStart = deps.now();
+	const probe = await deps.probe(config);
+	const probeMs = Math.max(0, deps.now() - probeStart);
+	const checks = [
+		{
+			...checkLogin(config, now),
+			durationMs: 0
+		},
+		{
+			...checkActiveOrg(config),
+			durationMs: 0
+		},
+		{
+			...checkLockFile(lockState),
+			durationMs: 0
+		},
+		{
+			...checkLiveToken(probe),
+			durationMs: probeMs
+		},
+		{
+			...checkOrchestrator(probe),
+			durationMs: 0
+		},
+		{
+			...checkLabels(lockState.lock, probe),
+			durationMs: 0
+		}
+	];
+	const response = {
+		status: deriveDiagnoseOverall(checks),
+		checks,
+		timestamp: new Date(now).toISOString()
+	};
+	if (options.json) console.log(JSON.stringify(response, null, 2));
+	else console.log(renderDoctorTable(response));
+	return diagnoseExitCode(checks);
+}
+//#endregion
+export { checkActiveOrg, checkLabels, checkLiveToken, checkLockFile, checkLogin, checkOrchestrator, doctorCommand, hasCredentials, renderDoctorTable };
+
+//# sourceMappingURL=doctor.js.map

package/dist/commands/endpoints.js

@@ -113,6 +113,12 @@ function categorizeTrigger(workflowName, trigger, groups) {
 				eventName: `workflow_complete${trigger.name ? `:${trigger.name}` : ""}`
 			});
 			break;
+		case "workflows_failed_batch":
+			groups.kiciEvent.push({
+				workflowName,
+				eventName: `workflows_failed_batch${trigger.name ? `:${trigger.name}` : ""}`
+			});
+			break;
 		case "job_complete":
 			groups.kiciEvent.push({
 				workflowName,

package/dist/commands/fixture.js

@@ -16,6 +16,7 @@ import { logger } from "@kici-dev/core";
 const INTERNAL_EVENT_TYPES = /* @__PURE__ */ new Set([
 	"kici_event",
 	"workflow_complete",
+	"workflows_failed_batch",
 	"job_complete",
 	"generic_webhook",
 	"schedule",
@@ -45,6 +46,18 @@ function generateInternalFixture(eventType) {
 			status: "status" in eventType ? eventType.status : "success",
 			sourceRepo: "owner/repo"
 		};
+		case "workflows_failed_batch": return {
+			total: 2,
+			runs: [{
+				runId: "run-1",
+				repo: "owner/repo",
+				workflowName: "ci"
+			}, {
+				runId: "run-2",
+				repo: "owner/repo",
+				workflowName: "deploy"
+			}]
+		};
 		case "job_complete": return {
 			workflowName: "workflowName" in eventType ? eventType.workflowName : "ci",
 			jobName: "jobName" in eventType ? eventType.jobName : "build",

package/dist/commands/hook.js

@@ -7,6 +7,7 @@ import pc from "picocolors";
 import { readFile } from "node:fs/promises";
 import { logger, toErrorMessage } from "@kici-dev/core";
 import { select } from "@inquirer/prompts";
+import { isCiEnvironment } from "@kici-dev/core/ci-env";
 //#region src/commands/hook.ts
 /**
 * kici hook command
@@ -30,7 +31,7 @@ async function hookInstallCommand(options = {}) {
 		if (options.git) selectedTool = "git";
 		else {
 			const tools = await detectHookTools();
-			if (tools.length === 0) if (process.stdout.isTTY && process.env.CI !== "true") {
+			if (tools.length === 0) if (process.stdout.isTTY && !isCiEnvironment()) {
 				const choice = await select({
 					message: "No pre-commit tool detected. How would you like to install the hook?",
 					choices: [{
@@ -53,7 +54,7 @@ async function hookInstallCommand(options = {}) {
 			else if (tools.length === 1) {
 				selectedTool = tools[0].name;
 				logger.info(pc.gray(`Detected ${selectedTool}, installing hook...`));
-			} else if (process.stdout.isTTY && process.env.CI !== "true") selectedTool = await select({
+			} else if (process.stdout.isTTY && !isCiEnvironment()) selectedTool = await select({
 				message: "Multiple pre-commit tools detected. Which would you like to use?",
 				choices: tools.map((t) => ({
 					name: t.name,

package/dist/commands/index.d.ts

@@ -28,12 +28,18 @@ export { runsRerunCommand } from './runs/rerun.js';
 export type { RunsRerunOptions } from './runs/rerun.js';
 export { runsCancelCommand } from './runs/cancel.js';
 export type { RunsCancelOptions } from './runs/cancel.js';
+export { runsArtifactsListCommand } from './runs/artifacts/list.js';
+export type { RunsArtifactsListOptions } from './runs/artifacts/list.js';
+export { runsArtifactsDownloadCommand } from './runs/artifacts/download.js';
+export type { RunsArtifactsDownloadOptions } from './runs/artifacts/download.js';
 export { typesCommand } from './types.js';
 export type { TypesOptions } from './types.js';
 export { endpointsCommand } from './endpoints.js';
 export type { EndpointsOptions } from './endpoints.js';
 export { diagnosticsCommand } from './diagnostics.js';
 export type { DiagnosticsOptions } from './diagnostics.js';
+export { doctorCommand } from './doctor.js';
+export type { DoctorOptions } from './doctor.js';
 export { orgListCommand, orgUseCommand, orgCurrentCommand } from './org.js';
 export { orchestratorsListCommand, orchestratorsUseCommand } from './orchestrators.js';
 export type { OrchestratorsOptions } from './orchestrators.js';
@@ -52,4 +58,6 @@ export { docsCommand, docsLlmCommand } from './docs.js';
 export type { DocsOptions, DocsLlmOptions } from './docs.js';
 export { verifyAttestationCommand } from './verify-attestation.js';
 export type { VerifyAttestationOptions } from './verify-attestation.js';
+export { notificationsChannelsListCommand, notificationsChannelsAddCommand, notificationsChannelsRemoveCommand, notificationsSubscriptionsListCommand, notificationsSubscriptionsAddCommand, notificationsSubscriptionsRemoveCommand, notificationsRosterListCommand, notificationsRosterAddCommand, notificationsRosterRemoveCommand, } from './notifications.js';
+export type { NotificationsCommonOptions, NotificationsListOptions, ChannelsAddOptions, SubscriptionsAddOptions, RosterAddOptions, } from './notifications.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/commands/index.js

@@ -3,6 +3,7 @@ import { approveCommand } from "./approve.js";
 import { compileCommand } from "./compile.js";
 import { diagnosticsCommand } from "./diagnostics.js";
 import { docsCommand, docsLlmCommand } from "./docs.js";
+import { doctorCommand } from "./doctor.js";
 import { drainWorkerCommand } from "./drain-worker.js";
 import { endpointsCommand } from "./endpoints.js";
 import { fixtureCommand } from "./fixture.js";
@@ -20,6 +21,8 @@ import { runsShowCommand } from "./runs/show.js";
 import { runsLogsCommand } from "./runs/logs.js";
 import { runsRerunCommand } from "./runs/rerun.js";
 import { runsCancelCommand } from "./runs/cancel.js";
+import { runsArtifactsListCommand } from "./runs/artifacts/list.js";
+import { runsArtifactsDownloadCommand } from "./runs/artifacts/download.js";
 import { typesCommand } from "./types.js";
 import { orgCurrentCommand, orgListCommand, orgUseCommand } from "./org.js";
 import { orchestratorsListCommand, orchestratorsUseCommand } from "./orchestrators.js";
@@ -29,4 +32,5 @@ import { logoutCommand } from "./logout.js";
 import { rejectCommand } from "./reject.js";
 import { workflowsListCommand } from "./workflows.js";
 import { verifyAttestationCommand } from "./verify-attestation.js";
-export { approveCommand, compileCommand, diagnosticsCommand, docsCommand, docsLlmCommand, drainWorkerCommand, endpointsCommand, fixtureCommand, hookInstallCommand, initCommand, localAttachCommand, localDetachCommand, localDownCommand, localLogsCommand, localStatusCommand, localTrustRootCommand, localUpCommand, loginCommand, logoutCommand, orchestratorsListCommand, orchestratorsUseCommand, orgCurrentCommand, orgListCommand, orgUseCommand, patCreateCommand, previewCommand, previewEvent, rejectCommand, runRemoteCommand, runRoutedCommand, runsCancelCommand, runsListCommand, runsLogsCommand, runsRerunCommand, runsShowCommand, secretsListCommand, typesCommand, verifyAttestationCommand, watchCommand, workflowsListCommand };
+import { notificationsChannelsAddCommand, notificationsChannelsListCommand, notificationsChannelsRemoveCommand, notificationsRosterAddCommand, notificationsRosterListCommand, notificationsRosterRemoveCommand, notificationsSubscriptionsAddCommand, notificationsSubscriptionsListCommand, notificationsSubscriptionsRemoveCommand } from "./notifications.js";
+export { approveCommand, compileCommand, diagnosticsCommand, docsCommand, docsLlmCommand, doctorCommand, drainWorkerCommand, endpointsCommand, fixtureCommand, hookInstallCommand, initCommand, localAttachCommand, localDetachCommand, localDownCommand, localLogsCommand, localStatusCommand, localTrustRootCommand, localUpCommand, loginCommand, logoutCommand, notificationsChannelsAddCommand, notificationsChannelsListCommand, notificationsChannelsRemoveCommand, notificationsRosterAddCommand, notificationsRosterListCommand, notificationsRosterRemoveCommand, notificationsSubscriptionsAddCommand, notificationsSubscriptionsListCommand, notificationsSubscriptionsRemoveCommand, orchestratorsListCommand, orchestratorsUseCommand, orgCurrentCommand, orgListCommand, orgUseCommand, patCreateCommand, previewCommand, previewEvent, rejectCommand, runRemoteCommand, runRoutedCommand, runsArtifactsDownloadCommand, runsArtifactsListCommand, runsCancelCommand, runsListCommand, runsLogsCommand, runsRerunCommand, runsShowCommand, secretsListCommand, typesCommand, verifyAttestationCommand, watchCommand, workflowsListCommand };

package/dist/commands/init-host-os.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Host-OS helpers for `kici init`.
+ *
+ * The starter templates target `kici:os:linux`. On a macOS or Windows host that
+ * label matches no local dev-plane agent, so the first `kici run push --local`
+ * dispatches nothing. These helpers rewrite the scaffolded `runsOn` to the
+ * host's own `kici:os:*` label so the first run lands, mirroring how `kici init`
+ * already rewrites the default branch.
+ */
+/**
+ * The primary `kici:os:*` label the host reports (linux→kici:os:linux,
+ * darwin→kici:os:macos, win32→kici:os:windows). Derived from the engine's
+ * canonical mapping — the same derivation the local dev-plane routing uses — so
+ * the value is never hand-spelled here and always matches what the plane can
+ * satisfy.
+ */
+export declare function primaryHostOsLabel(platform: string, arch: string): string;
+/**
+ * Rewrite a template's `'kici:os:linux'` runsOn to the host's primary OS label.
+ * A no-op on a Linux host (the templates already target it).
+ */
+export declare function rewriteRunsOnForHost(content: string, platform: string, arch: string): string;
+/**
+ * Whether to offer the post-init `Run it now?` prompt: interactive (TTY, not CI)
+ * and with dependencies installed (not `--mjs`, not `--skip-install`), so the
+ * offered `kici run push --local` can compile the workflow it just scaffolded.
+ */
+export declare function shouldOfferFirstRun(env: {
+    isTTY: boolean;
+    ci: boolean;
+    mjs: boolean;
+    skipInstall: boolean;
+}): boolean;
+//# sourceMappingURL=init-host-os.d.ts.map

package/dist/commands/init-host-os.js

@@ -0,0 +1,44 @@
+import "../rolldown-runtime-ClRpJifh.js";
+import { deriveOsArchLabels } from "@kici-dev/engine";
+//#region src/commands/init-host-os.ts
+/**
+* Host-OS helpers for `kici init`.
+*
+* The starter templates target `kici:os:linux`. On a macOS or Windows host that
+* label matches no local dev-plane agent, so the first `kici run push --local`
+* dispatches nothing. These helpers rewrite the scaffolded `runsOn` to the
+* host's own `kici:os:*` label so the first run lands, mirroring how `kici init`
+* already rewrites the default branch.
+*/
+const OS_LABEL_PREFIX = "kici:os:";
+/**
+* The primary `kici:os:*` label the host reports (linux→kici:os:linux,
+* darwin→kici:os:macos, win32→kici:os:windows). Derived from the engine's
+* canonical mapping — the same derivation the local dev-plane routing uses — so
+* the value is never hand-spelled here and always matches what the plane can
+* satisfy.
+*/
+function primaryHostOsLabel(platform, arch) {
+	return deriveOsArchLabels(platform, arch).find((l) => l.startsWith(OS_LABEL_PREFIX)) ?? `${OS_LABEL_PREFIX}${platform}`;
+}
+/**
+* Rewrite a template's `'kici:os:linux'` runsOn to the host's primary OS label.
+* A no-op on a Linux host (the templates already target it).
+*/
+function rewriteRunsOnForHost(content, platform, arch) {
+	const hostLabel = primaryHostOsLabel(platform, arch);
+	if (hostLabel === "kici:os:linux") return content;
+	return content.replaceAll(`'kici:os:linux'`, `'${hostLabel}'`);
+}
+/**
+* Whether to offer the post-init `Run it now?` prompt: interactive (TTY, not CI)
+* and with dependencies installed (not `--mjs`, not `--skip-install`), so the
+* offered `kici run push --local` can compile the workflow it just scaffolded.
+*/
+function shouldOfferFirstRun(env) {
+	return env.isTTY && !env.ci && !env.mjs && !env.skipInstall;
+}
+//#endregion
+export { primaryHostOsLabel, rewriteRunsOnForHost, shouldOfferFirstRun };
+
+//# sourceMappingURL=init-host-os.js.map

package/dist/commands/init.d.ts

@@ -29,6 +29,10 @@ export interface InitOptions {
     privateRegistrySecret?: string;
     /** Skip writing the .kici/AGENTS.md LLM-authoring context file. Default: write it. */
     noAgentsMd?: boolean;
+    /** Force integrate mode: join .kici/ to the detected workspace (skip the prompt). */
+    workspace?: boolean;
+    /** Force standalone mode even inside a workspace (skip the prompt). */
+    standalone?: boolean;
 }
 /**
  * Initialize .kici/ directory with workflow templates