@kici-dev/compiler 0.6.0 → 0.7.0

package/dist/cli.js

@@ -7,7 +7,7 @@ import { realpathSync } from "node:fs";
 import { Argument, Command } from "commander";
 import pc from "picocolors";
 //#region src/cli.ts
-const version = "0.6.0";
+const version = "0.7.0";
 /**
 * Top-level commands that were removed, mapped to their current equivalent.
 * Consulted when the CLI hits an unknown command so the user gets a precise
@@ -484,7 +484,7 @@ Environment variables:
 		const { docsCommand } = await import("./commands/index.js");
 		const success = await docsCommand({ open: options.open });
 		process.exit(success ? 0 : 1);
-	}).command("llm [topic]").description("Print KiCI LLM docs bundles. No topic prints the llms.txt index; <topic> prints a task bundle (e.g. sdk, cli, patterns, features, providers, architecture, getting-started); \"full\" prints the complete bundle.").option("--out <path>", "Write the bundle to a file instead of stdout").action(async (topic, options) => {
+	}).command("llm [topic]").description("Print KiCI LLM docs bundles. No topic prints the llms.txt index; <topic> prints a task bundle (e.g. sdk, cli, cli-remote, patterns, features, providers, architecture, getting-started); \"full\" prints the complete bundle.").option("--out <path>", "Write the bundle to a file instead of stdout").action(async (topic, options) => {
 		const { docsLlmCommand } = await import("./commands/index.js");
 		const success = await docsLlmCommand({
 			topic,
@@ -492,6 +492,14 @@ Environment variables:
 		});
 		process.exit(success ? 0 : 1);
 	});
+	program.command("feedback").description("Print how to report a discrepancy between what KiCI advertises and what it does. Files nothing.").option("--open", "Open the prefilled issue form in the default browser").option("--json", "Emit the reporting contract as JSON").action(async (options) => {
+		const { feedbackCommand } = await import("./commands/index.js");
+		const success = await feedbackCommand({
+			open: options.open,
+			json: options.json
+		});
+		process.exit(success ? 0 : 1);
+	});
 	program.command("admin").description("Operator-facing commands for running instances").command("drain-worker").description("Trigger graceful drain on a worker instance").requiredOption("--url <url>", "Worker URL (e.g., http://worker-host:<port>)").action(async (options) => {
 		const { drainWorkerCommand } = await import("./commands/index.js");
 		const success = await drainWorkerCommand({ url: options.url });

package/dist/commands/compile.js

@@ -13,6 +13,7 @@ import path from "node:path";
 import { existsSync } from "node:fs";
 import pc from "picocolors";
 import fs$1 from "node:fs/promises";
+import { findDigestReproducibilityWarnings, loadKiciIgnoreRules } from "@kici-dev/core/kici-source-digest";
 import { logger, toErrorMessage } from "@kici-dev/core";
 import { PackageManager, detectPackageManagerSync } from "@kici-dev/core/package-manager";
 import { execSync } from "node:child_process";
@@ -80,6 +81,9 @@ async function compileCommand(options) {
 		const lockJson = serializeLockFile(lockFile);
 		const windowWarning = schemaWindowWarning(BREAKING_FLOOR, SCHEMA_VERSION);
 		if (windowWarning) logger.warn(pc.yellow(windowWarning));
+		const ignoreRules = await loadKiciIgnoreRules(absoluteKiciDir);
+		for (const warning of ignoreRules.warnings) logger.warn(pc.yellow(warning));
+		for (const warning of await findDigestReproducibilityWarnings(absoluteKiciDir, ignoreRules)) logger.warn(pc.yellow(warning));
 		if (!options.check) {
 			await fs$1.writeFile(lockPath, lockJson, "utf-8");
 			if (!options.quiet) logger.info(pc.green("✓") + ` Compiled workflows → .kici/kici.lock.json` + pc.dim(` (${workflowsWithSource.length} workflow${workflowsWithSource.length !== 1 ? "s" : ""})`));
@@ -91,7 +95,7 @@ async function compileCommand(options) {
 				if (hasToken && hasEndpoint && config.activeOrgId) {
 					const { typesCommand } = await import("./types.js");
 					await typesCommand({
-						kiciDir,
+						kiciDir: absoluteKiciDir,
 						quiet: options.quiet
 					});
 				}

package/dist/commands/doctor.js

@@ -8,7 +8,7 @@ import path from "node:path";
 import pc from "picocolors";
 import fs from "node:fs/promises";
 import { deriveDiagnoseOverall, diagnoseExitCode, toErrorMessage } from "@kici-dev/core";
-import { matcherSatisfiedBy } from "@kici-dev/engine";
+import { canonicalizeLabelSet, canonicalizeMatcher, matcherSatisfiedBy } from "@kici-dev/engine";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 //#region src/commands/doctor.ts
@@ -157,9 +157,15 @@ function checkLockFile(state) {
 * A label group satisfies a requirement only when it matches EVERY runsOn
 * matcher AND matches NONE of the excludeLabels — the same authority the
 * orchestrator's job queue applies (`runsOn.every` && `!exclude.some`).
+*
+* Both sides are folded first, and both arms of the check get the fold: the
+* probe reports canonical agent labels while lock matchers carry whatever case
+* the workflow author wrote, so comparing them raw would report a dispatchable
+* job unreachable and would let an excluded label slip past on case alone.
 */
 function requirementSatisfiedBy(req, labels) {
-	return req.runsOn.every((m) => matcherSatisfiedBy(m, labels)) && !req.exclude.some((m) => matcherSatisfiedBy(m, labels));
+	const canonical = canonicalizeLabelSet([...labels]);
+	return req.runsOn.every((m) => matcherSatisfiedBy(canonicalizeMatcher(m), canonical)) && !req.exclude.some((m) => matcherSatisfiedBy(canonicalizeMatcher(m), canonical));
 }
 function describeMatcher(m) {
 	return m.kind === "regex" ? `/${m.source}/${m.flags}` : m.value;

package/dist/commands/feedback.d.ts

@@ -0,0 +1,53 @@
+/** The public tracker. Reports about KiCI itself go here — never customer data. */
+export declare const FEEDBACK_TRACKER_URL = "https://github.com/kici-dev/kici-public";
+/** The issue form tuned for an advertised-versus-actual report. */
+export declare const FEEDBACK_TEMPLATE = "agent_report.yml";
+export declare const FEEDBACK_NEW_ISSUE_URL = "https://github.com/kici-dev/kici-public/issues/new?template=agent_report.yml";
+/** Suspected vulnerabilities go here instead, privately. */
+export declare const FEEDBACK_SECURITY_ADVISORY_URL = "https://github.com/kici-dev/kici-public/security/advisories/new";
+export interface FeedbackField {
+    id: string;
+    label: string;
+    description: string;
+}
+export interface FeedbackContract {
+    tracker: string;
+    newIssueUrl: string;
+    template: string;
+    securityAdvisoryUrl: string;
+    guideUrl: string;
+    searchCommand: string;
+    approval: {
+        required: boolean;
+        rule: string;
+    };
+    qualifies: string[];
+    doesNotQualify: string[];
+    requiredFields: FeedbackField[];
+    prohibited: string[];
+    privateReportCommand: string;
+}
+/**
+ * The single definition of what a reportable discrepancy is and what a report
+ * must carry. `kici feedback` prints it, `--json` emits it verbatim, and
+ * hack/feedback-contract.test.ts asserts the published guide says the same
+ * thing — so the CLI and the doc cannot drift apart.
+ */
+export declare const FEEDBACK_CONTRACT: FeedbackContract;
+export interface FeedbackOptions {
+    /** Open the prefilled issue form in the default browser. */
+    open?: boolean;
+    /** Emit the contract as JSON on stdout instead of prose. */
+    json?: boolean;
+}
+/**
+ * Print the contract for reporting a KiCI discrepancy: what qualifies, what a
+ * report must carry, what must never appear in a public issue, and the rule
+ * that an agent drafts a report but a human decides to file it.
+ *
+ * The command reaches no network and files nothing. `--open` opens the
+ * prefilled issue form; `--json` emits the same contract for an agent to
+ * consume without parsing prose.
+ */
+export declare function feedbackCommand(options?: FeedbackOptions): Promise<boolean>;
+//# sourceMappingURL=feedback.d.ts.map

package/dist/commands/feedback.js

@@ -0,0 +1,142 @@
+import "../rolldown-runtime-ClRpJifh.js";
+import pc from "picocolors";
+import { logger, toErrorMessage } from "@kici-dev/core";
+import open from "open";
+//#region src/commands/feedback.ts
+/** The public tracker. Reports about KiCI itself go here — never customer data. */
+const FEEDBACK_TRACKER_URL = "https://github.com/kici-dev/kici-public";
+/** The issue form tuned for an advertised-versus-actual report. */
+const FEEDBACK_TEMPLATE = "agent_report.yml";
+const FEEDBACK_NEW_ISSUE_URL = `${FEEDBACK_TRACKER_URL}/issues/new?template=${FEEDBACK_TEMPLATE}`;
+/** Suspected vulnerabilities go here instead, privately. */
+const FEEDBACK_SECURITY_ADVISORY_URL = `${FEEDBACK_TRACKER_URL}/security/advisories/new`;
+/**
+* The single definition of what a reportable discrepancy is and what a report
+* must carry. `kici feedback` prints it, `--json` emits it verbatim, and
+* hack/feedback-contract.test.ts asserts the published guide says the same
+* thing — so the CLI and the doc cannot drift apart.
+*/
+const FEEDBACK_CONTRACT = {
+	tracker: FEEDBACK_TRACKER_URL,
+	newIssueUrl: FEEDBACK_NEW_ISSUE_URL,
+	template: FEEDBACK_TEMPLATE,
+	securityAdvisoryUrl: FEEDBACK_SECURITY_ADVISORY_URL,
+	guideUrl: "https://kici.dev/docs/user/reporting-discrepancies/",
+	searchCommand: "gh issue list --repo kici-dev/kici-public --search \"<terms>\" --state all",
+	approval: {
+		required: true,
+		rule: "Draft the issue, show the full body to the person you are working with, and file it only after they say yes."
+	},
+	qualifies: [
+		"A documented flag, command, or option that does not exist in the version you ran.",
+		"Documented output — a shape, a field, an exit code — that differs from what the command produced.",
+		"A CLI --help description that contradicts the published docs.",
+		"A documented behaviour that does not happen, or a documented guarantee that does not hold.",
+		"A documented error or limit that the tool does not actually enforce."
+	],
+	doesNotQualify: [
+		"Usage questions, or behaviour you find surprising but that the docs describe correctly.",
+		"Feature requests and design preferences.",
+		"Anything you inferred from reading docs without running the command.",
+		"Anything reproduced only on a locally built or unreleased version.",
+		"A failure that is your workflow, your credentials, or your environment."
+	],
+	requiredFields: [
+		{
+			id: "advertised",
+			label: "What the docs or CLI advertise",
+			description: "The exact claim, quoted, plus its source: a docs URL or the command whose --help says it."
+		},
+		{
+			id: "observed",
+			label: "What actually happened",
+			description: "The real output or behaviour, quoted, with any error text."
+		},
+		{
+			id: "reproduction",
+			label: "Minimal reproduction, including setup",
+			description: "Every step from an empty directory: the setup commands, a minimal synthetic workflow, and the exact command you ran."
+		},
+		{
+			id: "version",
+			label: "Version and environment",
+			description: "Output of `kici --version`, plus Node version and OS."
+		},
+		{
+			id: "justification",
+			label: "Why this is a discrepancy",
+			description: "One or two sentences ruling out the likely misreads — why the docs cannot be read to match what you observed."
+		}
+	],
+	prohibited: [
+		"No secrets, tokens, or credentials — not even redacted-looking ones.",
+		"No private repository names, internal hostnames, organization ids, or run ids.",
+		"No log excerpts you have not read line by line.",
+		"Reproduce with a minimal synthetic workflow, never the real one you were working on."
+	],
+	privateReportCommand: "kici report --run <run-id> --upload"
+};
+function printContract() {
+	const c = FEEDBACK_CONTRACT;
+	logger.info(pc.bold("Reporting a KiCI discrepancy"));
+	logger.info("");
+	logger.info("Use this when the published docs or the CLI advertise one behaviour and KiCI does another.");
+	logger.info(`Tracker: ${c.tracker}`);
+	logger.info(`Full guide: ${c.guideUrl}`);
+	logger.info("");
+	logger.info(pc.bold("1. Search first"));
+	logger.info("Comment on an existing report rather than opening a second one.");
+	logger.info(`  ${c.searchCommand}`);
+	logger.info("");
+	logger.info(pc.bold("2. Check it qualifies"));
+	for (const item of c.qualifies) logger.info(`  ${pc.green("+")} ${item}`);
+	logger.info("  Not a discrepancy:");
+	for (const item of c.doesNotQualify) logger.info(`  ${pc.gray("-")} ${item}`);
+	logger.info("");
+	logger.info(pc.bold("3. Never file these publicly"));
+	logger.info(`  A suspected vulnerability is never a public issue — open a private advisory instead:\n    ${c.securityAdvisoryUrl}`);
+	logger.info(`  A problem with your own runs is not a tracker issue — send it privately instead:\n    ${c.privateReportCommand}`);
+	for (const rule of c.prohibited) logger.info(`  ${pc.yellow("!")} ${rule}`);
+	logger.info("");
+	logger.info(pc.bold("4. Draft the report"));
+	for (const field of c.requiredFields) {
+		logger.info(`  ${field.label}`);
+		logger.info(pc.gray(`    ${field.description}`));
+	}
+	logger.info("");
+	logger.info(pc.bold("5. Get approval, then file"));
+	logger.info(`  ${c.approval.rule}`);
+	logger.info(`  Form: ${c.newIssueUrl}`);
+	logger.info(pc.gray(`  Or: kici feedback --open`));
+	logger.info("");
+	logger.info(pc.gray("Machine-readable: kici feedback --json"));
+}
+/**
+* Print the contract for reporting a KiCI discrepancy: what qualifies, what a
+* report must carry, what must never appear in a public issue, and the rule
+* that an agent drafts a report but a human decides to file it.
+*
+* The command reaches no network and files nothing. `--open` opens the
+* prefilled issue form; `--json` emits the same contract for an agent to
+* consume without parsing prose.
+*/
+async function feedbackCommand(options = {}) {
+	if (options.json) {
+		process.stdout.write(`${JSON.stringify(FEEDBACK_CONTRACT, null, 2)}\n`);
+		return true;
+	}
+	printContract();
+	if (!options.open) return true;
+	try {
+		await open(FEEDBACK_NEW_ISSUE_URL);
+		return true;
+	} catch (error) {
+		logger.error(pc.red(`Could not open a browser: ${toErrorMessage(error)}`));
+		logger.info(pc.gray(`Open ${FEEDBACK_NEW_ISSUE_URL} manually.`));
+		return false;
+	}
+}
+//#endregion
+export { FEEDBACK_CONTRACT, FEEDBACK_NEW_ISSUE_URL, FEEDBACK_SECURITY_ADVISORY_URL, FEEDBACK_TEMPLATE, FEEDBACK_TRACKER_URL, feedbackCommand };
+
+//# sourceMappingURL=feedback.js.map

package/dist/commands/index.d.ts

@@ -57,7 +57,9 @@ export type { WorkflowsListOptions } from './workflows.js';
 export { drainWorkerCommand } from './drain-worker.js';
 export type { DrainWorkerOptions } from './drain-worker.js';
 export { docsCommand, docsLlmCommand } from './docs.js';
+export { feedbackCommand, FEEDBACK_CONTRACT } from './feedback.js';
 export type { DocsOptions, DocsLlmOptions } from './docs.js';
+export type { FeedbackOptions, FeedbackContract, FeedbackField } from './feedback.js';
 export { verifyAttestationCommand } from './verify-attestation.js';
 export type { VerifyAttestationOptions } from './verify-attestation.js';
 export { notificationsChannelsListCommand, notificationsChannelsAddCommand, notificationsChannelsRemoveCommand, notificationsSubscriptionsListCommand, notificationsSubscriptionsAddCommand, notificationsSubscriptionsRemoveCommand, notificationsRosterListCommand, notificationsRosterAddCommand, notificationsRosterRemoveCommand, } from './notifications.js';

package/dist/commands/index.js

@@ -6,6 +6,7 @@ import { docsCommand, docsLlmCommand } from "./docs.js";
 import { doctorCommand } from "./doctor.js";
 import { drainWorkerCommand } from "./drain-worker.js";
 import { endpointsCommand } from "./endpoints.js";
+import { FEEDBACK_CONTRACT, feedbackCommand } from "./feedback.js";
 import { fixtureCommand } from "./fixture.js";
 import { hookInstallCommand } from "./hook.js";
 import { watchCommand } from "./watch.js";
@@ -34,4 +35,4 @@ import { rejectCommand } from "./reject.js";
 import { workflowsListCommand } from "./workflows.js";
 import { verifyAttestationCommand } from "./verify-attestation.js";
 import { notificationsChannelsAddCommand, notificationsChannelsListCommand, notificationsChannelsRemoveCommand, notificationsRosterAddCommand, notificationsRosterListCommand, notificationsRosterRemoveCommand, notificationsSubscriptionsAddCommand, notificationsSubscriptionsListCommand, notificationsSubscriptionsRemoveCommand } from "./notifications.js";
-export { approveCommand, compileCommand, diagnosticsCommand, docsCommand, docsLlmCommand, doctorCommand, drainWorkerCommand, endpointsCommand, fixtureCommand, hookInstallCommand, initCommand, localAttachCommand, localDetachCommand, localDownCommand, localLogsCommand, localStatusCommand, localTrustRootCommand, localUpCommand, loginCommand, logoutCommand, notificationsChannelsAddCommand, notificationsChannelsListCommand, notificationsChannelsRemoveCommand, notificationsRosterAddCommand, notificationsRosterListCommand, notificationsRosterRemoveCommand, notificationsSubscriptionsAddCommand, notificationsSubscriptionsListCommand, notificationsSubscriptionsRemoveCommand, orchestratorsListCommand, orchestratorsUseCommand, orgCurrentCommand, orgListCommand, orgUseCommand, patCreateCommand, previewCommand, previewEvent, rejectCommand, reportCommand, reportListCommand, reportWithdrawCommand, runRemoteCommand, runRoutedCommand, runsArtifactsDownloadCommand, runsArtifactsListCommand, runsCancelCommand, runsListCommand, runsLogsCommand, runsRerunCommand, runsShowCommand, secretsListCommand, typesCommand, verifyAttestationCommand, watchCommand, workflowsListCommand };
+export { FEEDBACK_CONTRACT, approveCommand, compileCommand, diagnosticsCommand, docsCommand, docsLlmCommand, doctorCommand, drainWorkerCommand, endpointsCommand, feedbackCommand, fixtureCommand, hookInstallCommand, initCommand, localAttachCommand, localDetachCommand, localDownCommand, localLogsCommand, localStatusCommand, localTrustRootCommand, localUpCommand, loginCommand, logoutCommand, notificationsChannelsAddCommand, notificationsChannelsListCommand, notificationsChannelsRemoveCommand, notificationsRosterAddCommand, notificationsRosterListCommand, notificationsRosterRemoveCommand, notificationsSubscriptionsAddCommand, notificationsSubscriptionsListCommand, notificationsSubscriptionsRemoveCommand, orchestratorsListCommand, orchestratorsUseCommand, orgCurrentCommand, orgListCommand, orgUseCommand, patCreateCommand, previewCommand, previewEvent, rejectCommand, reportCommand, reportListCommand, reportWithdrawCommand, runRemoteCommand, runRoutedCommand, runsArtifactsDownloadCommand, runsArtifactsListCommand, runsCancelCommand, runsListCommand, runsLogsCommand, runsRerunCommand, runsShowCommand, secretsListCommand, typesCommand, verifyAttestationCommand, watchCommand, workflowsListCommand };

package/dist/commands/init.d.ts

@@ -48,4 +48,13 @@ export declare function initCommand(options?: InitOptions): Promise<boolean>;
  * @param kiciDir - The resolved `.kici` directory path.
  */
 export declare function writeKiciGitignore(kiciDir: string): Promise<void>;
+/**
+ * Scaffold `.kici/.kiciignore` with the default exclusion set. Never overwrites
+ * an existing file — the customer may have tuned it — and never runs from
+ * `kici compile`: a compile that wrote into the tree it is hashing is the exact
+ * hazard the exclusion set exists to close.
+ *
+ * @param kiciDir - The resolved `.kici` directory path.
+ */
+export declare function writeKiciIgnore(kiciDir: string): Promise<void>;
 //# sourceMappingURL=init.d.ts.map

package/dist/commands/init.js

@@ -11,12 +11,13 @@ import { rewriteRunsOnForHost, shouldOfferFirstRun } from "./init-host-os.js";
 import path from "node:path";
 import pc from "picocolors";
 import { access, mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import { KICI_DIGEST_DEFAULT_EXCLUSIONS, KICI_IGNORE_FILENAME } from "@kici-dev/core/kici-source-digest";
 import { $ } from "zx";
 import { initZx, logger, toErrorMessage } from "@kici-dev/core";
 import { detectPackageManager, detectWorkspaceRoot, installBuildPolicyArgs, installCommand, parsePackageManager } from "@kici-dev/core/package-manager";
+import os from "node:os";
 import { checkbox, confirm, select } from "@inquirer/prompts";
 import { isCiEnvironment } from "@kici-dev/core/ci-env";
-import os from "node:os";
 //#region src/commands/init.ts
 /**
 * kici init command
@@ -77,6 +78,7 @@ async function initCommand(options = {}) {
 			await writeFile(kiciIgnorePath, kiciIgnoreTemplate, "utf-8");
 		}
 		await writeKiciGitignore(kiciDir);
+		await writeKiciIgnore(kiciDir);
 		const devMode = await detectDevelopmentMode();
 		const mode = await resolveScaffoldMode(options);
 		const useVerdaccio = devMode;
@@ -230,8 +232,21 @@ async function resolvePackageManager(override, dir = process.cwd()) {
 	}
 	return detectPackageManager(dir);
 }
-/** The @kici-dev scope → local Verdaccio registry line written in dev mode. */
-const VERDACCIO_NPMRC = "@kici-dev:registry=http://verdaccio.local:4873\n";
+/**
+* The `@kici-dev` scope → local registry line written in dev mode, or `null`
+* when no dev registry is configured.
+*
+* The registry URL comes from `KICI_DEV_REGISTRY` rather than a literal in this
+* file. `init.ts` ships in the published `@kici-dev/compiler` source and
+* bundle, so a hard-coded internal hostname is published to every customer who
+* unpacks the tarball — a disclosure, not a reachable path (every write site is
+* behind the dev-mode gate), but an avoidable one. With dev mode on and the
+* variable unset there is nothing to point at, so no `.npmrc` is written.
+*/
+function devRegistryNpmrc() {
+	const registry = process.env.KICI_DEV_REGISTRY?.trim();
+	return registry ? `@kici-dev:registry=${registry}\n` : null;
+}
 /** Write .kici/tsconfig.json + the empty types/ dir (TypeScript mode only). */
 async function writeTsConfigAndTypesDir(kiciDir) {
 	logger.info(pc.gray("Writing .kici/tsconfig.json"));
@@ -254,13 +269,15 @@ async function runInstall(pm, dir) {
 async function wireStandaloneDeps(kiciDir, devMode, options) {
 	logger.info(pc.gray("Writing .kici/package.json"));
 	await writeFile(path.join(kiciDir, "package.json"), generatePackageJson(devMode), "utf-8");
-	if (devMode) {
-		logger.info(pc.yellow("Pointing @kici-dev to local Verdaccio registry."));
-		await writeFile(path.join(kiciDir, ".npmrc"), VERDACCIO_NPMRC, "utf-8");
+	const devNpmrc = devMode ? devRegistryNpmrc() : null;
+	if (devMode && !devNpmrc) logger.info(pc.yellow("Dev mode: KICI_DEV_REGISTRY is unset, writing no .npmrc."));
+	if (devNpmrc) {
+		logger.info(pc.yellow("Pointing @kici-dev to the dev registry."));
+		await writeFile(path.join(kiciDir, ".npmrc"), devNpmrc, "utf-8");
 		const rootNpmrc = path.resolve(".npmrc");
 		if (!await checkExists(rootNpmrc)) {
-			logger.info(pc.gray("Writing .npmrc (Verdaccio scope)"));
-			await writeFile(rootNpmrc, VERDACCIO_NPMRC, "utf-8");
+			logger.info(pc.gray("Writing .npmrc (dev registry scope)"));
+			await writeFile(rootNpmrc, devNpmrc, "utf-8");
 		}
 	}
 	if (!options.mjs) {
@@ -276,11 +293,13 @@ async function wireStandaloneDeps(kiciDir, devMode, options) {
 */
 async function wireIntegrateDeps(kiciDir, workspaceRoot, devMode, options) {
 	await addSdkToRootManifest(workspaceRoot, devMode);
-	if (devMode) {
+	const devNpmrc = devMode ? devRegistryNpmrc() : null;
+	if (devMode && !devNpmrc) logger.info(pc.yellow("Dev mode: KICI_DEV_REGISTRY is unset, writing no .npmrc."));
+	if (devNpmrc) {
 		const rootNpmrc = path.join(workspaceRoot, ".npmrc");
 		if (!await checkExists(rootNpmrc)) {
-			logger.info(pc.gray("Writing workspace-root .npmrc (Verdaccio scope)"));
-			await writeFile(rootNpmrc, VERDACCIO_NPMRC, "utf-8");
+			logger.info(pc.gray("Writing workspace-root .npmrc (dev registry scope)"));
+			await writeFile(rootNpmrc, devNpmrc, "utf-8");
 		}
 	}
 	if (!options.mjs) await writeTsConfigAndTypesDir(kiciDir);
@@ -389,6 +408,52 @@ async function writeKiciGitignore(kiciDir) {
 	await writeFile(gitignorePath, KICI_GITIGNORE_TEMPLATE, "utf-8");
 }
 /**
+* Build the `.kici/.kiciignore` scaffold: the default exclusion set, annotated.
+*
+* Rendered from `KICI_DIGEST_DEFAULT_EXCLUSIONS` rather than a hand-typed list,
+* so a new default cannot ship with the seeded file silently short of it — the
+* file replaces the defaults rather than merging with them, which makes a stale
+* template an unstable hash rather than a cosmetic drift.
+*/
+function buildKiciIgnoreTemplate() {
+	return [
+		"# Paths the workflow source digest does NOT cover.",
+		"#",
+		"# This file IS the exclusion list: it replaces the built-in defaults rather",
+		"# than adding to them. The entries below are those defaults. Removing one",
+		"# re-includes that path in the hash — and node_modules/, .npmrc and",
+		"# package-lock.json are rewritten during a run, so dropping one makes the",
+		"# hash change on every run and the drift gate reject it. `kici compile`",
+		"# warns when that happens.",
+		"#",
+		"# Patterns are gitignore-style, relative to .kici/. Unrelated to the",
+		"# repo-root .kiciignore, which selects what `kici run --remote` uploads.",
+		"#",
+		"# This file is itself hashed: which files define a workflow identity is",
+		"# part of that identity, so editing it forces a recompile.",
+		"",
+		...KICI_DIGEST_DEFAULT_EXCLUSIONS,
+		""
+	].join("\n");
+}
+/**
+* Scaffold `.kici/.kiciignore` with the default exclusion set. Never overwrites
+* an existing file — the customer may have tuned it — and never runs from
+* `kici compile`: a compile that wrote into the tree it is hashing is the exact
+* hazard the exclusion set exists to close.
+*
+* @param kiciDir - The resolved `.kici` directory path.
+*/
+async function writeKiciIgnore(kiciDir) {
+	const kiciIgnorePath = path.join(kiciDir, KICI_IGNORE_FILENAME);
+	if (await checkExists(kiciIgnorePath)) {
+		logger.info(pc.gray(`Skipping .kici/${KICI_IGNORE_FILENAME} (already exists)`));
+		return;
+	}
+	logger.info(pc.gray(`Writing .kici/${KICI_IGNORE_FILENAME}`));
+	await writeFile(kiciIgnorePath, buildKiciIgnoreTemplate(), "utf-8");
+}
+/**
 * Update .gitignore with .kici/ entries
 *
 * Safely appends to .gitignore, checking for existing entries to avoid duplicates.
@@ -560,6 +625,6 @@ async function offerHookInstallation(useVerdaccio) {
 	} else logger.warn(pc.yellow(`Warning: ${result.message}`));
 }
 //#endregion
-export { initCommand, writeKiciGitignore };
+export { initCommand, writeKiciGitignore, writeKiciIgnore };
 
 //# sourceMappingURL=init.js.map

package/dist/commands/preview.js

@@ -9,10 +9,10 @@ import { loadSecretsFile } from "../test-runner/secrets-file.js";
 import path from "node:path";
 import pc from "picocolors";
 import { readFile } from "node:fs/promises";
-import { flattenStepInputs } from "@kici-dev/sdk";
 import { logger, toErrorMessage } from "@kici-dev/core";
 import { matchAllWorkflows } from "@kici-dev/engine";
 import { normalizeRunsOnToMatchers } from "@kici-dev/engine/labels/compile";
+import { flattenStepInputs } from "@kici-dev/sdk/internal";
 //#region src/commands/preview.ts
 /**
 * Main preview command entry point.

package/dist/commands/report/identity.d.ts

@@ -13,6 +13,17 @@ export interface OrchestratorIdentity {
     version: string | null;
     mode: string | null;
     connected: boolean;
+    /**
+     * Where this orchestrator's config files live on its host. Recorded so a
+     * support bundle names the files whoever reads it should ask for. Paths
+     * only — the bundle never carries their contents. Each is null when the
+     * orchestrator did not report it.
+     */
+    configPaths: {
+        envFile: string | null;
+        scalerConfig: string | null;
+        composeFile: string | null;
+    };
 }
 export interface ReportIdentity {
     kiciCliVersion: string;

package/dist/commands/report/identity.js

@@ -19,7 +19,7 @@ import { PROTOCOL_VERSION } from "@kici-dev/engine";
 */
 function collectIdentity(probe) {
 	const identity = {
-		kiciCliVersion: "0.6.0",
+		kiciCliVersion: "0.7.0",
 		nodeVersion: process.version,
 		platform: process.platform,
 		arch: process.arch,
@@ -38,7 +38,12 @@ function collectIdentity(probe) {
 		clusterName: o.clusterName ?? "(unnamed)",
 		version: o.version ?? null,
 		mode: o.mode ?? null,
-		connected: o.connected
+		connected: o.connected,
+		configPaths: {
+			envFile: o.configPaths?.envFile ?? null,
+			scalerConfig: o.configPaths?.scalerConfig ?? null,
+			composeFile: o.configPaths?.composeFile ?? null
+		}
 	}));
 	if (probe.infra.latestVersion) identity.latestKnownVersion = probe.infra.latestVersion;
 	return identity;

package/dist/commands/run-routed.js

@@ -129,6 +129,7 @@ async function runRouted(options) {
 		}
 		const seeded = await ensureLocalSource(plane.url, plane.adminToken, {
 			repoDir: workdir.dir,
+			...resolved.kind === "attached" && { orgId: resolved.orgId },
 			inPlace: Boolean(options.inPlace)
 		});
 		const seededSecrets = await seedLocalSecrets(plane.url, plane.adminToken, {

package/dist/commands/types.d.ts

@@ -1,5 +1,10 @@
 export interface TypesOptions {
-    /** Path to .kici directory (defaults to .kici) */
+    /**
+     * Path to the `.kici` directory (defaults to `.kici`). Resolved through
+     * `resolveKiciDir`, the same resolver every other command uses, so a
+     * relative value is interpreted against the project rather than against
+     * whatever directory the CLI happened to be invoked from.
+     */
     kiciDir?: string;
     /** Suppress the success line on stdout (so machine-readable output stays pure). */
     quiet?: boolean;

package/dist/commands/types.js

@@ -1,4 +1,5 @@
 import "../rolldown-runtime-ClRpJifh.js";
+import { resolveKiciDir } from "../execution/executor.js";
 import { loadGlobalConfig } from "../remote/config.js";
 import { DashboardClient, DashboardClientError } from "../remote/dashboard-client.js";
 import { generateSecretsDts } from "../generators/secrets-dts.js";
@@ -44,7 +45,7 @@ async function fileExists(p) {
 * @returns true on success, false on error
 */
 async function typesCommand(options = {}) {
-	const kiciDir = options.kiciDir ?? ".kici";
+	const kiciDir = resolveKiciDir(options.kiciDir);
 	const typesDir = path.join(kiciDir, "types");
 	const outputPath = path.join(typesDir, "secrets.d.ts");
 	try {

package/dist/execution/executor.js

@@ -6,6 +6,7 @@ import { pathToFileURL } from "node:url";
 import path from "node:path";
 import { existsSync } from "node:fs";
 import fs$1 from "node:fs/promises";
+import { findKiciDir, hashKiciSourceTree } from "@kici-dev/core/kici-source-digest";
 //#region src/execution/executor.ts
 /**
 * Map a caught runtime error's stack to a `SourceLocation` in the entry file.
@@ -46,7 +47,12 @@ function locateInEntry(stack, entryPoint) {
 */
 async function loadModule(entryPoint, errorContext) {
 	let hashBundleSource;
-	try {
+	const kiciDir = findKiciDir(entryPoint);
+	if (kiciDir) {
+		const digest = await hashKiciSourceTree(kiciDir);
+		if (digest) hashBundleSource = digest;
+	}
+	if (hashBundleSource === void 0) try {
 		hashBundleSource = await fs$1.readFile(entryPoint, "utf-8");
 	} catch {}
 	try {