@kici-dev/compiler 0.6.1 → 0.8.0

package/dist/local-plane/plane-trigger.d.ts

@@ -11,6 +11,9 @@
  * The source's bundle hot-reload is debounced, so a first trigger can land
  * before the plane has registered the (re-pointed) local source. This resends
  * the webhook after a grace window until a run appears or the timeout elapses.
+ * When the budget still runs out, the timeout is explained rather than merely
+ * reported: the plane's own Raft role and its event-log record for this
+ * delivery decide which cause is named.
  */
 /** A minimal admin-read client (AdminApiClient.get) — injectable for tests. */
 export interface RunDiscoveryClient {
@@ -58,7 +61,32 @@ export interface TriggerRunOptions {
     pollIntervalMs?: number;
     resendAfterMs?: number;
     timeoutMs?: number;
+    /** Workdir the plane's local source points at — named in the lock-file diagnosis. */
+    repoBasePath?: string;
+    /** Plane log path — named when nothing else explains the timeout. */
+    logPath?: string;
 }
+/** What the diagnosis knows about the trigger that just timed out. */
+export interface TriggerTimeoutContext {
+    /** Routing-key-scoped delivery id, or null when the plane never accepted the webhook. */
+    deliveryId: string | null;
+    orgId: string;
+    /** Commit the synthetic push carried (the workdir's overlay commit). */
+    sha: string;
+    /** Absolute path the plane's local source points at — the run's workdir. */
+    repoBasePath?: string;
+    /** Plane log path, named in the fallback so the developer has somewhere to look. */
+    logPath?: string;
+}
+/**
+ * Explain a trigger timeout in one line, from what the plane itself recorded.
+ *
+ * Ordered most-specific-first, and every branch is a fact read back off the
+ * plane rather than an inference: the Raft role it reports, then the status it
+ * wrote for THIS delivery, then the delivery id + log path so the developer has
+ * a thread to pull even when neither surface answered.
+ */
+export declare function diagnoseTriggerTimeout(client: RunDiscoveryClient, ctx: TriggerTimeoutContext): Promise<string>;
 /**
  * Trigger the run and resolve its runId. Sends the synthetic push, then polls
  * the admin runs list filtered by this webhook's routing-key-scoped delivery id

package/dist/local-plane/plane-trigger.js

@@ -1,4 +1,5 @@
 import "../rolldown-runtime-ClRpJifh.js";
+import { EventLogStatus } from "@kici-dev/engine";
 import { randomUUID } from "node:crypto";
 import { AdminApiClient } from "@kici-dev/orchestrator";
 //#region src/local-plane/plane-trigger.ts
@@ -15,6 +16,9 @@ import { AdminApiClient } from "@kici-dev/orchestrator";
 * The source's bundle hot-reload is debounced, so a first trigger can land
 * before the plane has registered the (re-pointed) local source. This resends
 * the webhook after a grace window until a run appears or the timeout elapses.
+* When the budget still runs out, the timeout is explained rather than merely
+* reported: the plane's own Raft role and its event-log record for this
+* delivery decide which cause is named.
 */
 /**
 * Build the GitHub-shaped webhook request the plane's local provider normalizer
@@ -62,6 +66,50 @@ async function sendLocalTrigger(planeUrl, req) {
 		deliveryId
 	};
 }
+/** Raft role the plane reports, or null when `/cluster/health` cannot be read. */
+async function readPlaneRole(client) {
+	try {
+		const health = await client.get("/cluster/health");
+		return typeof health.role === "string" ? health.role : null;
+	} catch {
+		return null;
+	}
+}
+/** The plane's own record of this delivery, or null when there is none to read. */
+async function readDelivery(client, orgId, deliveryId) {
+	try {
+		const qs = new URLSearchParams({
+			deliveryId,
+			orgId,
+			limit: "1"
+		});
+		return (await client.get(`/api/v1/admin/event-log?${qs}`)).deliveries?.[0] ?? null;
+	} catch {
+		return null;
+	}
+}
+/**
+* Explain a trigger timeout in one line, from what the plane itself recorded.
+*
+* Ordered most-specific-first, and every branch is a fact read back off the
+* plane rather than an inference: the Raft role it reports, then the status it
+* wrote for THIS delivery, then the delivery id + log path so the developer has
+* a thread to pull even when neither surface answered.
+*/
+async function diagnoseTriggerTimeout(client, ctx) {
+	const role = await readPlaneRole(client);
+	if (role !== null && role !== "leader") return `plane is not leader yet (election grace period) — it reports Raft role "${role}". A single-node plane should elect itself within seconds; check ${ctx.logPath ?? "the plane log (`kici local logs`)"} for "self-electing as leader".`;
+	const delivery = ctx.deliveryId ? await readDelivery(client, ctx.orgId, ctx.deliveryId) : null;
+	if (delivery?.status === EventLogStatus.enum.lockfile_missing) {
+		const where = ctx.repoBasePath ? ` in ${ctx.repoBasePath}` : "";
+		return `no kici.lock.json at ${ctx.sha}${where} — the plane resolved no lock file for this commit, so nothing matched. Make sure .kici/kici.lock.json is committed or present in the working tree the run packs.`;
+	}
+	if (delivery?.status) {
+		const detail = delivery.errorMessage ? ` (${delivery.errorMessage})` : "";
+		return `the plane recorded delivery ${ctx.deliveryId} as "${delivery.status}"${detail} but created no run.`;
+	}
+	return `no run appeared for ${ctx.deliveryId ? `delivery ${ctx.deliveryId}` : "this trigger — the plane never accepted the webhook (no delivery id came back)"}${ctx.logPath ? ` — see ${ctx.logPath}` : ""}`;
+}
 /**
 * Trigger the run and resolve its runId. Sends the synthetic push, then polls
 * the admin runs list filtered by this webhook's routing-key-scoped delivery id
@@ -90,7 +138,14 @@ async function triggerRun(planeUrl, adminToken, input, opts = {}) {
 		}
 		await sleep(pollIntervalMs);
 	}
-	throw new Error("offline run: no run appeared after triggering the local plane");
+	const cause = await diagnoseTriggerTimeout(client, {
+		deliveryId,
+		orgId: input.orgId,
+		sha: input.sha,
+		...opts.repoBasePath !== void 0 && { repoBasePath: opts.repoBasePath },
+		...opts.logPath !== void 0 && { logPath: opts.logPath }
+	});
+	throw new Error(`offline run: ${cause}`);
 }
 /** Return the run created by this webhook delivery, or null when none yet. */
 async function findRunByDelivery(client, deliveryId) {
@@ -105,6 +160,6 @@ function sleep(ms) {
 	return new Promise((r) => setTimeout(r, ms));
 }
 //#endregion
-export { buildLocalTriggerRequest, sendLocalTrigger, triggerRun };
+export { buildLocalTriggerRequest, diagnoseTriggerTimeout, sendLocalTrigger, triggerRun };
 
 //# sourceMappingURL=plane-trigger.js.map

package/dist/local-plane/postgres.js

@@ -1,5 +1,6 @@
 import "../rolldown-runtime-ClRpJifh.js";
 import { planePaths, planePorts } from "./paths.js";
+import { rotatePlaneLogIfOversized } from "./plane-log.js";
 import { createRequire } from "node:module";
 import path from "node:path";
 import fs from "node:fs";
@@ -104,14 +105,13 @@ async function embeddedClusterIsServing(port) {
 /**
 * Start a detached embedded postmaster via `pg_ctl` so it survives the exit of
 * this CLI process (embedded-postgres's in-process server is killed by its own
-* exit hook, so it cannot back a warm plane). A cluster already serving this
-* plane's port is reused as-is.
+* exit hook, so it cannot back a warm plane). The caller decides whether a
+* cluster is already serving; this always starts one.
 */
 async function defaultEmbeddedDaemon(port) {
-	const { pgData, logFile } = planePaths();
-	if (await embeddedClusterIsServing(port)) return;
+	const { pgData, pgLogFile } = planePaths();
 	const pgCtl = resolvePgCtl();
-	await $`${pgCtl} -D ${pgData} -o ${`-p ${port}`} -l ${`${logFile}.pg`} -w start`.quiet();
+	await $`${pgCtl} -D ${pgData} -o ${`-p ${port}`} -l ${pgLogFile} -w start`.quiet();
 }
 /** Stop the detached embedded postmaster (handle-independent, reads the data dir). */
 async function stopEmbeddedDaemon() {
@@ -141,7 +141,10 @@ async function startPlanePostgres(opts = {}) {
 	const url = `postgres://kici:kici@127.0.0.1:${port}/kici_local`;
 	if (!(opts.forcePodman || process.env.KICI_LOCAL_PG_MODE === "podman")) try {
 		await ensureEmbeddedCluster(port);
-		await embeddedDaemon(port);
+		if (!await embeddedClusterIsServing(port)) {
+			rotatePlaneLogIfOversized(planePaths().pgLogFile);
+			await embeddedDaemon(port);
+		}
 		return {
 			url,
 			kind: "embedded",

package/dist/local-plane/run-follow.js

@@ -1,4 +1,5 @@
 import "../rolldown-runtime-ClRpJifh.js";
+import { unwrapStoredLogLine } from "../remote/output/streaming.js";
 import { ExecutionJobStatus, ExecutionRunStatus, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES } from "@kici-dev/engine";
 import { AdminApiClient } from "@kici-dev/orchestrator";
 //#region src/local-plane/run-follow.ts
@@ -131,7 +132,7 @@ async function drainLogs(client, runId, cursors, onLine) {
 				const qs = cursor ? `?cursor=${encodeURIComponent(cursor)}` : "";
 				const page = await client.get(`/api/v1/admin/runs/${runId}/jobs/${job.jobId}/steps/${step.stepIndex}/logs${qs}`);
 				for (const l of page.lines) {
-					onLine(l.value);
+					onLine(unwrapStoredLogLine(l.value));
 					emitted++;
 				}
 				cursor = page.nextCursor ?? String(page.totalLines);

package/dist/lockfile/generator.js

@@ -2,18 +2,20 @@ import "../rolldown-runtime-ClRpJifh.js";
 import { compilerError } from "../errors/formatter.js";
 import { locationForJob, locationForWorkflow } from "../errors/source-location.js";
 import "../errors/index.js";
+import { computeSiblingsDigest } from "./workspace-siblings.js";
 import { BREAKING_FLOOR as BREAKING_FLOOR$1, SCHEMA_VERSION as SCHEMA_VERSION$1 } from "../types.js";
-import { computeContentHash } from "./hasher.js";
+import { COMPILE_SCHEMA_VERSION, computeContentHash } from "./hasher.js";
 import { resolveHashFiles } from "./hash-files.js";
 import path from "node:path";
 import { readFileSync } from "node:fs";
-import { getDynamicJobGroup, getDynamicJobNeeds, isDynamicFunction, isDynamicGroupRef, isDynamicJobFn, isParallelGroup, isStaticArray, isStaticObject, normalizeApproval, normalizeCacheSpecs } from "@kici-dev/sdk";
+import { getDynamicJobGitCredentials, getDynamicJobGroup, getDynamicJobNeeds, isDynamicFunction, isDynamicGroupRef, isDynamicJobFn, isParallelGroup, isStaticArray, isStaticObject } from "@kici-dev/sdk";
 import { sha256 } from "@kici-dev/core";
 import { PackageManager, detectPackageManagerSync, detectYarnFlavorSync } from "@kici-dev/core/package-manager";
-import { assertScheduleInputsSatisfiable, extractInputsDescriptorMap, resolveContentFormat, resolveWhenToRunOn, validateResourceRequest } from "@kici-dev/engine";
+import { assertScheduleInputsSatisfiable, extractInputsDescriptorMap, resolveContentFormat, resolveWhenToRunOn, stripStatefulRegexFlags, validateResourceRequest } from "@kici-dev/engine";
 import { assertSafeRegex } from "@kici-dev/engine/safe-regex";
-import { normalizeRunsOnAllToMatchers, normalizeRunsOnToMatchers, runsOnPickFromInput } from "@kici-dev/engine/labels/compile";
 import { execSync } from "node:child_process";
+import { normalizeRunsOnAllToMatchers, normalizeRunsOnToMatchers, runsOnPickFromInput } from "@kici-dev/engine/labels/compile";
+import { normalizeApproval, normalizeCacheSpecs } from "@kici-dev/sdk/internal";
 //#region src/lockfile/generator.ts
 /**
 * Courtesy compatibility warning for `kici compile`.
@@ -124,6 +126,7 @@ function formatExportRef(source) {
 function generateLockFile(workflowsWithSource) {
 	const gitRoot = detectGitRoot();
 	const lockfileHash = computeLockfileHash(gitRoot);
+	const siblingsDigest = computeSiblingsDigest(gitRoot);
 	const firstSource = workflowsWithSource[0]?.source;
 	const topLevelSource = firstSource ? {
 		file: path.relative(gitRoot, firstSource.file).replaceAll("\\", "/"),
@@ -147,6 +150,7 @@ function generateLockFile(workflowsWithSource) {
 		source: topLevelSource,
 		contentHash,
 		...lockfileHash && { lockfileHash },
+		...siblingsDigest && { siblingsDigest },
 		workflows
 	};
 }
@@ -169,8 +173,8 @@ function transformWorkflow(workflow, sourceFile, exportRef, bundleSource, gitRoo
 			resolvedHashFiles = resolved.resolvedPaths;
 		}
 	}
-	const contentHash = bundleSource !== void 0 ? computeContentHash(bundleSource, 5, assetDigest) : "";
-	const compileSchemaVersion = bundleSource !== void 0 ? 5 : 0;
+	const contentHash = bundleSource !== void 0 ? computeContentHash(bundleSource, COMPILE_SCHEMA_VERSION, assetDigest) : "";
+	const compileSchemaVersion = bundleSource !== void 0 ? COMPILE_SCHEMA_VERSION : 0;
 	return {
 		name: workflow.name,
 		source: {
@@ -220,15 +224,25 @@ function toArray(v) {
 	return Array.isArray(v) ? v : [v];
 }
 /**
+* The `/pattern/flags` shape the lock file stores.
+*
+* The flag class must name every ECMAScript flag, not just the ones that
+* predate ES2022. When it read `[gimsuy]`, a `d`- or `v`-flagged regex failed
+* to unwrap, so `pattern` became the whole `/release-\d+/v` string — which
+* `new RegExp` happily accepts as a pattern matching literal slashes. The lock
+* then stored `/\/release-\d+\/v/`, which compiles green and can never match.
+*/
+const REGEX_ENTRY = /^\/(.+)\/([dgimsuvy]*)$/;
+/**
 * Normalize one regex entry to the lock's `/pattern/flags` form, rejecting an
 * invalid or ReDoS-prone pattern at compile time so a catastrophic pattern fails
 * `kici compile` with author feedback instead of reaching the orchestrator.
 */
 function serializeRegexEntry(entry, ctx) {
 	const source = entry instanceof RegExp ? `/${entry.source}/${entry.flags}` : entry;
-	const wrapped = /^\/(.+)\/([gimsuy]*)$/.exec(source);
+	const wrapped = REGEX_ENTRY.exec(source);
 	const pattern = wrapped ? wrapped[1] : source;
-	const flags = wrapped ? wrapped[2] : "";
+	const flags = stripStatefulRegexFlags(wrapped ? wrapped[2] : "");
 	let re;
 	try {
 		re = new RegExp(pattern, flags);
@@ -605,6 +619,7 @@ function transformJobs(jobs, configPath, gitRoot) {
 		if (isDynamicJobFn(jobOrFactory)) {
 			const groupName = getDynamicJobGroup(jobOrFactory);
 			const declaredNeeds = getDynamicJobNeeds(jobOrFactory);
+			const declaredGitCredentials = getDynamicJobGitCredentials(jobOrFactory);
 			const resolvedNeeds = declaredNeeds ? resolveNeedsForLock(declaredNeeds, uuidToName) : void 0;
 			return {
 				_type: "dynamic",
@@ -616,7 +631,8 @@ function transformJobs(jobs, configPath, gitRoot) {
 				...resolvedNeeds && {
 					needs: resolvedNeeds.needs,
 					resultAware: true
-				}
+				},
+				...declaredGitCredentials && { gitCredentials: declaredGitCredentials }
 			};
 		}
 		const j = jobOrFactory;

package/dist/lockfile/hasher.d.ts

@@ -1,18 +1,10 @@
 /**
- * Compile schema version -- bump when compilation approach changes
- * (bundler change, bundling config, output format, etc.).
- * This is NOT the lock file schema version.
- *
- * Bumped 3 → 4: the agent artifact switched from a Rolldown-bundled
- * `.compiled.mjs` to a raw `.kici/` source tarball that the agent extracts
- * and imports via the shared oxc-transform ESM loader hook.
- *
- * Bumped 4 → 5: the hash input is now line-ending-normalized (CRLF → LF) so a
- * lockfile produced on Linux (LF) matches the agent's hash on Windows, where
- * Git's `core.autocrlf=true` system default rewrites checked-out text files to
- * CRLF. Old lockfiles must be regenerated via `kici compile`.
+ * Compile schema version, re-exported from its single definition in
+ * `@kici-dev/core/kici-source-digest` — where it sits beside the digest it
+ * qualifies, so the compiler that writes a `contentHash` and the agent that
+ * re-verifies it cannot drift onto different numbers.
  */
-export declare const COMPILE_SCHEMA_VERSION = 5;
+export { COMPILE_SCHEMA_VERSION } from '@kici-dev/core/kici-source-digest';
 /**
  * Compute content hash for a compiled workflow bundle, optionally including asset file contents.
  * Hash = SHA-256(schemaVersion + ":" + bundleSource + "\0" + assetDigest) when assetDigest is provided,

package/dist/lockfile/hasher.js

@@ -1,22 +1,8 @@
 import "../rolldown-runtime-ClRpJifh.js";
+import { COMPILE_SCHEMA_VERSION } from "@kici-dev/core/kici-source-digest";
 import { normalizeLineEndings, sha256 } from "@kici-dev/core";
 //#region src/lockfile/hasher.ts
 /**
-* Compile schema version -- bump when compilation approach changes
-* (bundler change, bundling config, output format, etc.).
-* This is NOT the lock file schema version.
-*
-* Bumped 3 → 4: the agent artifact switched from a Rolldown-bundled
-* `.compiled.mjs` to a raw `.kici/` source tarball that the agent extracts
-* and imports via the shared oxc-transform ESM loader hook.
-*
-* Bumped 4 → 5: the hash input is now line-ending-normalized (CRLF → LF) so a
-* lockfile produced on Linux (LF) matches the agent's hash on Windows, where
-* Git's `core.autocrlf=true` system default rewrites checked-out text files to
-* CRLF. Old lockfiles must be regenerated via `kici compile`.
-*/
-const COMPILE_SCHEMA_VERSION = 5;
-/**
 * Compute content hash for a compiled workflow bundle, optionally including asset file contents.
 * Hash = SHA-256(schemaVersion + ":" + bundleSource + "\0" + assetDigest) when assetDigest is provided,
 * otherwise SHA-256(schemaVersion + ":" + bundleSource) for backward compatibility.

package/dist/lockfile/workspace-siblings.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Static resolution of the in-repo `workspace:` sibling closure `.kici` depends
+ * on, and a digest over its source.
+ *
+ * The deps tarball carries those sibling package directories **with their built
+ * output** (`packKiciDeps`), while the pointer that names it is keyed on
+ * `lockfileHash` — a hash of the package-manager lock file. Editing a sibling's
+ * source moves no package-manager lock file, so a repo whose `.kici` depends on
+ * an in-repo `workspace:` package restored that sibling's STALE build over the
+ * fresh clone on every warm-cache run. `siblingsDigest` closes that: it enters
+ * the dep pointer key, so a sibling edit is a pointer miss and the deps are
+ * rebuilt.
+ *
+ * Resolution is **static** — manifests and `git ls-files`, never an installed
+ * `node_modules`. The agent's own `collectInRepoSiblings` walks an installed
+ * tree, which cannot be used here: `kici compile` would then emit a different
+ * lock file before and after an install, and a lock file whose contents depend
+ * on whether you have installed is not hermetic.
+ */
+/**
+ * The workspace globs declared at the repo root — `pnpm-workspace.yaml`'s
+ * `packages:` first, then `package.json#workspaces` (npm / yarn / bun). Empty
+ * when the repo declares no workspace, in which case a `workspace:` specifier
+ * resolves to nothing and is skipped rather than guessed at.
+ */
+export declare function readWorkspaceGlobs(gitRoot: string): string[];
+/**
+ * Every in-repo sibling directory `.kici` depends on, transitively, as sorted
+ * repo-relative POSIX paths.
+ *
+ * `.kici` itself is excluded: its own source is already covered by
+ * `contentHash`, and including it here would make a `.kici` edit invalidate the
+ * dep cache for no reason.
+ */
+export declare function collectInRepoSiblings(gitRoot: string, kiciDir?: string): string[];
+/**
+ * SHA-256 over the git-tracked source of every resolved sibling directory, or
+ * null when `.kici` depends on none.
+ *
+ * `git ls-files` is install-independent and is already the compiler's world (it
+ * resolves `gitRoot` to generate the lock at all). Content is read as text and
+ * `\0`-delimited against its path, exactly as the `.kici/` tree digest is, so a
+ * rename cannot be disguised as a content edit.
+ */
+export declare function computeSiblingsDigest(gitRoot: string, kiciDir?: string): string | null;
+//# sourceMappingURL=workspace-siblings.d.ts.map

package/dist/lockfile/workspace-siblings.js

@@ -0,0 +1,197 @@
+import "../rolldown-runtime-ClRpJifh.js";
+import path from "node:path";
+import { existsSync, readFileSync } from "node:fs";
+import { sha256 } from "@kici-dev/core";
+import { execFileSync } from "node:child_process";
+import { parse } from "yaml";
+//#region src/lockfile/workspace-siblings.ts
+/**
+* Static resolution of the in-repo `workspace:` sibling closure `.kici` depends
+* on, and a digest over its source.
+*
+* The deps tarball carries those sibling package directories **with their built
+* output** (`packKiciDeps`), while the pointer that names it is keyed on
+* `lockfileHash` — a hash of the package-manager lock file. Editing a sibling's
+* source moves no package-manager lock file, so a repo whose `.kici` depends on
+* an in-repo `workspace:` package restored that sibling's STALE build over the
+* fresh clone on every warm-cache run. `siblingsDigest` closes that: it enters
+* the dep pointer key, so a sibling edit is a pointer miss and the deps are
+* rebuilt.
+*
+* Resolution is **static** — manifests and `git ls-files`, never an installed
+* `node_modules`. The agent's own `collectInRepoSiblings` walks an installed
+* tree, which cannot be used here: `kici compile` would then emit a different
+* lock file before and after an install, and a lock file whose contents depend
+* on whether you have installed is not hermetic.
+*/
+/** Dependency protocols that name a directory inside this repository. */
+const IN_REPO_PROTOCOLS = [
+	"workspace:",
+	"file:",
+	"link:",
+	"portal:"
+];
+function readManifest(dir) {
+	const file = path.join(dir, "package.json");
+	if (!existsSync(file)) return null;
+	try {
+		return JSON.parse(readFileSync(file, "utf-8"));
+	} catch {
+		return null;
+	}
+}
+/** Every dependency specifier in a manifest, across all four dependency maps. */
+function allSpecifiers(m) {
+	return Object.entries({
+		...m.dependencies,
+		...m.devDependencies,
+		...m.optionalDependencies,
+		...m.peerDependencies
+	});
+}
+/**
+* The workspace globs declared at the repo root — `pnpm-workspace.yaml`'s
+* `packages:` first, then `package.json#workspaces` (npm / yarn / bun). Empty
+* when the repo declares no workspace, in which case a `workspace:` specifier
+* resolves to nothing and is skipped rather than guessed at.
+*/
+function readWorkspaceGlobs(gitRoot) {
+	const pnpmFile = path.join(gitRoot, "pnpm-workspace.yaml");
+	if (existsSync(pnpmFile)) try {
+		const doc = parse(readFileSync(pnpmFile, "utf-8"));
+		if (Array.isArray(doc?.packages)) return doc.packages.filter((p) => typeof p === "string");
+	} catch {}
+	const ws = readManifest(gitRoot)?.workspaces;
+	if (Array.isArray(ws)) return ws;
+	if (ws && Array.isArray(ws.packages)) return ws.packages;
+	return [];
+}
+/**
+* Directories the workspace globs match, each carrying a manifest. Resolved with
+* `git ls-files` so the set is exactly what is tracked — the same authority the
+* digest itself uses, and one that needs no install.
+*/
+function workspacePackageDirs(gitRoot, globs) {
+	const byName = /* @__PURE__ */ new Map();
+	if (globs.length === 0) return byName;
+	let manifests;
+	try {
+		manifests = execFileSync("git", [
+			"ls-files",
+			"--",
+			"*package.json",
+			"package.json"
+		], {
+			cwd: gitRoot,
+			encoding: "utf-8",
+			maxBuffer: 33554432
+		}).split("\n").filter(Boolean);
+	} catch {
+		return byName;
+	}
+	for (const rel of manifests) {
+		const dir = path.dirname(rel);
+		if (dir.split("/").includes("node_modules")) continue;
+		const m = readManifest(path.join(gitRoot, dir));
+		if (m?.name) byName.set(m.name, dir);
+	}
+	return byName;
+}
+/**
+* Resolve one specifier to a repo-relative directory, or null when it does not
+* name one. `file:` / `link:` / `portal:` carry the path; `workspace:` carries a
+* version range, so the package NAME is resolved through the workspace globs.
+*/
+function resolveSpecifier(pkgName, spec, fromDir, gitRoot, workspacePkgs) {
+	if (spec.startsWith("workspace:")) return workspacePkgs.get(pkgName) ?? null;
+	for (const proto of [
+		"file:",
+		"link:",
+		"portal:"
+	]) {
+		if (!spec.startsWith(proto)) continue;
+		const target = spec.slice(proto.length);
+		const abs = path.resolve(gitRoot, fromDir, target);
+		const rel = path.relative(gitRoot, abs).replaceAll("\\", "/");
+		if (rel.startsWith("..") || path.isAbsolute(rel)) return null;
+		return rel;
+	}
+	return null;
+}
+/**
+* Every in-repo sibling directory `.kici` depends on, transitively, as sorted
+* repo-relative POSIX paths.
+*
+* `.kici` itself is excluded: its own source is already covered by
+* `contentHash`, and including it here would make a `.kici` edit invalidate the
+* dep cache for no reason.
+*/
+function collectInRepoSiblings(gitRoot, kiciDir = ".kici") {
+	const kiciManifest = readManifest(path.join(gitRoot, kiciDir));
+	if (!kiciManifest) return [];
+	const workspacePkgs = workspacePackageDirs(gitRoot, readWorkspaceGlobs(gitRoot));
+	const found = /* @__PURE__ */ new Set();
+	const queue = [{
+		dir: kiciDir,
+		manifest: kiciManifest
+	}];
+	const visited = /* @__PURE__ */ new Set([kiciDir]);
+	while (queue.length > 0) {
+		const { dir, manifest } = queue.shift();
+		for (const [name, spec] of allSpecifiers(manifest)) {
+			if (!IN_REPO_PROTOCOLS.some((p) => spec.startsWith(p))) continue;
+			const target = resolveSpecifier(name, spec, dir, gitRoot, workspacePkgs);
+			if (target === null || visited.has(target)) continue;
+			visited.add(target);
+			found.add(target);
+			const m = readManifest(path.join(gitRoot, target));
+			if (m) queue.push({
+				dir: target,
+				manifest: m
+			});
+		}
+	}
+	return [...found].sort();
+}
+/**
+* SHA-256 over the git-tracked source of every resolved sibling directory, or
+* null when `.kici` depends on none.
+*
+* `git ls-files` is install-independent and is already the compiler's world (it
+* resolves `gitRoot` to generate the lock at all). Content is read as text and
+* `\0`-delimited against its path, exactly as the `.kici/` tree digest is, so a
+* rename cannot be disguised as a content edit.
+*/
+function computeSiblingsDigest(gitRoot, kiciDir = ".kici") {
+	const siblings = collectInRepoSiblings(gitRoot, kiciDir);
+	if (siblings.length === 0) return null;
+	const parts = [];
+	for (const dir of siblings) {
+		let files;
+		try {
+			files = execFileSync("git", [
+				"ls-files",
+				"--",
+				dir
+			], {
+				cwd: gitRoot,
+				encoding: "utf-8",
+				maxBuffer: 67108864
+			}).split("\n").filter(Boolean).sort();
+		} catch {
+			continue;
+		}
+		for (const rel of files) {
+			let content = "";
+			try {
+				content = readFileSync(path.join(gitRoot, rel), "utf-8");
+			} catch {}
+			parts.push(`${rel}\0${content.replaceAll("\r\n", "\n")}\0`);
+		}
+	}
+	return parts.length > 0 ? sha256(parts.join("")) : null;
+}
+//#endregion
+export { collectInRepoSiblings, computeSiblingsDigest, readWorkspaceGlobs };
+
+//# sourceMappingURL=workspace-siblings.js.map

package/dist/remote/output/streaming.d.ts

@@ -7,6 +7,18 @@
  * - Prints step transition headers
  * - Tracks elapsed time with in-place status updates
  */
+/**
+ * The text a stored log line carries.
+ *
+ * The orchestrator stores every step log line as a JSON envelope —
+ * `{"ts":…,"level":"stdout","msg":"…","meta":{}}` — and the Platform relay
+ * returns those envelopes verbatim, so a run's log stream is the envelope
+ * stream. The dashboard unwraps `msg` before rendering; the terminal must too,
+ * or the developer watching `kici run remote` reads raw JSON. A line that is
+ * not an envelope (an orchestrator phase marker, a plain line from an older
+ * store) passes through unchanged.
+ */
+export declare function unwrapStoredLogLine(line: string): string;
 export declare class StreamingFormatter {
     /** Color assignment per job name. */
     private readonly jobColors;

package/dist/remote/output/streaming.js

@@ -19,6 +19,25 @@ const COLOR_PALETTE = [
 	pc.magenta,
 	pc.cyan
 ];
+/**
+* The text a stored log line carries.
+*
+* The orchestrator stores every step log line as a JSON envelope —
+* `{"ts":…,"level":"stdout","msg":"…","meta":{}}` — and the Platform relay
+* returns those envelopes verbatim, so a run's log stream is the envelope
+* stream. The dashboard unwraps `msg` before rendering; the terminal must too,
+* or the developer watching `kici run remote` reads raw JSON. A line that is
+* not an envelope (an orchestrator phase marker, a plain line from an older
+* store) passes through unchanged.
+*/
+function unwrapStoredLogLine(line) {
+	if (!line.startsWith("{")) return line;
+	try {
+		const parsed = JSON.parse(line);
+		if (typeof parsed === "object" && parsed !== null && typeof parsed.msg === "string") return parsed.msg;
+	} catch {}
+	return line;
+}
 var StreamingFormatter = class {
 	/** Color assignment per job name. */
 	jobColors = /* @__PURE__ */ new Map();
@@ -119,6 +138,6 @@ var StreamingFormatter = class {
 	}
 };
 //#endregion
-export { StreamingFormatter };
+export { StreamingFormatter, unwrapStoredLogLine };
 
 //# sourceMappingURL=streaming.js.map

package/dist/remote/platform-client.d.ts

@@ -106,6 +106,8 @@ export interface PlatformRunStatusResponse {
         status: string;
         exitCode?: number | null;
         errorMessage?: string | null;
+        /** Absent or null from an orchestrator that does not report it. */
+        durationMs?: number | null;
     }>;
     done: boolean;
 }