@kici-dev/compiler 0.7.0 → 0.9.0

package/dist/cli.js

@@ -7,7 +7,7 @@ import { realpathSync } from "node:fs";
 import { Argument, Command } from "commander";
 import pc from "picocolors";
 //#region src/cli.ts
-const version = "0.7.0";
+const version = "0.9.0";
 /**
 * Top-level commands that were removed, mapped to their current equivalent.
 * Consulted when the CLI hits an unknown command so the user gets a precise
@@ -312,7 +312,7 @@ Environment variables:
 		],
 		[
 			"logs",
-			"Print the local dev plane orchestrator log path",
+			"Print the local dev plane log paths and rotation policy",
 			"localLogsCommand"
 		],
 		[
@@ -492,11 +492,12 @@ Environment variables:
 		});
 		process.exit(success ? 0 : 1);
 	});
-	program.command("feedback").description("Print how to report a discrepancy between what KiCI advertises and what it does. Files nothing.").option("--open", "Open the prefilled issue form in the default browser").option("--json", "Emit the reporting contract as JSON").action(async (options) => {
+	program.command("feedback").description("Print how to report a discrepancy between what KiCI advertises and what it does. Files nothing.").option("--open", "Open the prefilled issue form in the default browser").option("--json", "Emit the reporting contract as JSON").option("--draft <file>", "Build the prefilled issue-form URL from a JSON draft keyed by field id (with --open, open it)").action(async (options) => {
 		const { feedbackCommand } = await import("./commands/index.js");
 		const success = await feedbackCommand({
 			open: options.open,
-			json: options.json
+			json: options.json,
+			draft: options.draft
 		});
 		process.exit(success ? 0 : 1);
 	});

package/dist/commands/docs.js

@@ -3,11 +3,11 @@ import { fileURLToPath } from "node:url";
 import path from "node:path";
 import pc from "picocolors";
 import { readFile, readdir, writeFile } from "node:fs/promises";
-import { logger, toErrorMessage } from "@kici-dev/core";
+import { docsUrl, logger, toErrorMessage } from "@kici-dev/core";
 import open from "open";
 //#region src/commands/docs.ts
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
-const DOCS_HOME_URL = "https://kici.dev/docs/";
+const DOCS_HOME_URL = docsUrl("");
 function bundleFilenameForTopic(topic) {
 	if (!topic) return "llms.txt";
 	if (topic === "full") return "llms-full.txt";

package/dist/commands/feedback.d.ts

@@ -5,6 +5,12 @@ export declare const FEEDBACK_TEMPLATE = "agent_report.yml";
 export declare const FEEDBACK_NEW_ISSUE_URL = "https://github.com/kici-dev/kici-public/issues/new?template=agent_report.yml";
 /** Suspected vulnerabilities go here instead, privately. */
 export declare const FEEDBACK_SECURITY_ADVISORY_URL = "https://github.com/kici-dev/kici-public/security/advisories/new";
+/** How an agent turns its draft into the prefilled form a person reviews and files. */
+export declare const FEEDBACK_DRAFT_COMMAND = "kici feedback --draft <file.json> --open";
+/** GitHub's practical URL ceiling; a longer draft violates "minimal" anyway. */
+export declare const FEEDBACK_URL_WARN_BYTES = 6000;
+/** A draft: the issue title plus one string per contract field, keyed by field id. */
+export type FeedbackDraft = Record<string, string>;
 export interface FeedbackField {
     id: string;
     label: string;
@@ -26,6 +32,10 @@ export interface FeedbackContract {
     requiredFields: FeedbackField[];
     prohibited: string[];
     privateReportCommand: string;
+    /** The command that turns a JSON draft into the prefilled issue-form URL. */
+    draftCommand: string;
+    /** The keys a draft must carry: `title` plus every required field's id. */
+    draftFields: string[];
 }
 /**
  * The single definition of what a reportable discrepancy is and what a report
@@ -34,11 +44,22 @@ export interface FeedbackContract {
  * thing — so the CLI and the doc cannot drift apart.
  */
 export declare const FEEDBACK_CONTRACT: FeedbackContract;
+export declare function parseFeedbackDraft(raw: unknown): {
+    ok: true;
+    draft: FeedbackDraft;
+} | {
+    ok: false;
+    problems: string[];
+};
+/** The form URL with every draft field prefilled — GitHub reads each query param by field id. */
+export declare function draftIssueUrl(draft: FeedbackDraft): string;
 export interface FeedbackOptions {
     /** Open the prefilled issue form in the default browser. */
     open?: boolean;
     /** Emit the contract as JSON on stdout instead of prose. */
     json?: boolean;
+    /** Path to a JSON draft; print (and with --open, open) the prefilled issue-form URL. */
+    draft?: string;
 }
 /**
  * Print the contract for reporting a KiCI discrepancy: what qualifies, what a
@@ -47,7 +68,8 @@ export interface FeedbackOptions {
  *
  * The command reaches no network and files nothing. `--open` opens the
  * prefilled issue form; `--json` emits the same contract for an agent to
- * consume without parsing prose.
+ * consume without parsing prose; `--draft <file>` builds the issue-form URL
+ * with every field of a JSON draft prefilled.
  */
 export declare function feedbackCommand(options?: FeedbackOptions): Promise<boolean>;
 //# sourceMappingURL=feedback.d.ts.map

package/dist/commands/feedback.js

@@ -1,6 +1,7 @@
 import "../rolldown-runtime-ClRpJifh.js";
 import pc from "picocolors";
-import { logger, toErrorMessage } from "@kici-dev/core";
+import { readFile } from "node:fs/promises";
+import { docsUrl, logger, toErrorMessage } from "@kici-dev/core";
 import open from "open";
 //#region src/commands/feedback.ts
 /** The public tracker. Reports about KiCI itself go here — never customer data. */
@@ -10,6 +11,10 @@ const FEEDBACK_TEMPLATE = "agent_report.yml";
 const FEEDBACK_NEW_ISSUE_URL = `${FEEDBACK_TRACKER_URL}/issues/new?template=${FEEDBACK_TEMPLATE}`;
 /** Suspected vulnerabilities go here instead, privately. */
 const FEEDBACK_SECURITY_ADVISORY_URL = `${FEEDBACK_TRACKER_URL}/security/advisories/new`;
+/** How an agent turns its draft into the prefilled form a person reviews and files. */
+const FEEDBACK_DRAFT_COMMAND = "kici feedback --draft <file.json> --open";
+/** GitHub's practical URL ceiling; a longer draft violates "minimal" anyway. */
+const FEEDBACK_URL_WARN_BYTES = 6e3;
 /**
 * The single definition of what a reportable discrepancy is and what a report
 * must carry. `kici feedback` prints it, `--json` emits it verbatim, and
@@ -21,7 +26,7 @@ const FEEDBACK_CONTRACT = {
 	newIssueUrl: FEEDBACK_NEW_ISSUE_URL,
 	template: FEEDBACK_TEMPLATE,
 	securityAdvisoryUrl: FEEDBACK_SECURITY_ADVISORY_URL,
-	guideUrl: "https://kici.dev/docs/user/reporting-discrepancies/",
+	guideUrl: docsUrl("user/reporting-discrepancies/"),
 	searchCommand: "gh issue list --repo kici-dev/kici-public --search \"<terms>\" --state all",
 	approval: {
 		required: true,
@@ -59,8 +64,13 @@ const FEEDBACK_CONTRACT = {
 		},
 		{
 			id: "version",
-			label: "Version and environment",
-			description: "Output of `kici --version`, plus Node version and OS."
+			label: "KiCI version",
+			description: "Output of `kici --version`."
+		},
+		{
+			id: "environment",
+			label: "Environment",
+			description: "Node version and OS."
 		},
 		{
 			id: "justification",
@@ -74,8 +84,48 @@ const FEEDBACK_CONTRACT = {
 		"No log excerpts you have not read line by line.",
 		"Reproduce with a minimal synthetic workflow, never the real one you were working on."
 	],
-	privateReportCommand: "kici report --run <run-id> --upload"
+	privateReportCommand: "kici report --run <run-id> --upload",
+	draftCommand: FEEDBACK_DRAFT_COMMAND,
+	draftFields: [
+		"title",
+		"advertised",
+		"observed",
+		"reproduction",
+		"version",
+		"environment",
+		"justification"
+	]
 };
+function parseFeedbackDraft(raw) {
+	const problems = [];
+	if (typeof raw !== "object" || raw === null || Array.isArray(raw)) return {
+		ok: false,
+		problems: ["draft must be a JSON object keyed by field id"]
+	};
+	const input = raw;
+	const allowed = new Set(FEEDBACK_CONTRACT.draftFields);
+	for (const key of Object.keys(input)) if (!allowed.has(key)) problems.push(`unknown field: ${key}`);
+	const draft = {};
+	for (const id of FEEDBACK_CONTRACT.draftFields) {
+		const value = input[id];
+		if (value === void 0) problems.push(`missing required field: ${id}`);
+		else if (typeof value !== "string" || value.trim() === "") problems.push(`field must be a non-empty string: ${id}`);
+		else draft[id] = value;
+	}
+	return problems.length === 0 ? {
+		ok: true,
+		draft
+	} : {
+		ok: false,
+		problems
+	};
+}
+/** The form URL with every draft field prefilled — GitHub reads each query param by field id. */
+function draftIssueUrl(draft) {
+	const url = new URL(FEEDBACK_NEW_ISSUE_URL);
+	for (const id of FEEDBACK_CONTRACT.draftFields) url.searchParams.set(id, draft[id] ?? "");
+	return url.toString();
+}
 function printContract() {
 	const c = FEEDBACK_CONTRACT;
 	logger.info(pc.bold("Reporting a KiCI discrepancy"));
@@ -108,6 +158,7 @@ function printContract() {
 	logger.info(`  ${c.approval.rule}`);
 	logger.info(`  Form: ${c.newIssueUrl}`);
 	logger.info(pc.gray(`  Or: kici feedback --open`));
+	logger.info(pc.gray(`  From a draft: ${c.draftCommand} (fields: kici feedback --json → draftFields)`));
 	logger.info("");
 	logger.info(pc.gray("Machine-readable: kici feedback --json"));
 }
@@ -118,25 +169,51 @@ function printContract() {
 *
 * The command reaches no network and files nothing. `--open` opens the
 * prefilled issue form; `--json` emits the same contract for an agent to
-* consume without parsing prose.
+* consume without parsing prose; `--draft <file>` builds the issue-form URL
+* with every field of a JSON draft prefilled.
 */
 async function feedbackCommand(options = {}) {
+	if (options.draft) return draftFromFile(options.draft, options.open === true);
 	if (options.json) {
 		process.stdout.write(`${JSON.stringify(FEEDBACK_CONTRACT, null, 2)}\n`);
 		return true;
 	}
 	printContract();
 	if (!options.open) return true;
+	return openOrExplain(FEEDBACK_NEW_ISSUE_URL);
+}
+/** Read a JSON draft, print its prefilled issue-form URL as the last stdout line, open it on request. */
+async function draftFromFile(file, openIt) {
+	let raw;
+	try {
+		raw = JSON.parse(await readFile(file, "utf8"));
+	} catch (error) {
+		logger.error(pc.red(`Could not read the draft at ${file}: ${toErrorMessage(error)}`));
+		return false;
+	}
+	const parsed = parseFeedbackDraft(raw);
+	if (!parsed.ok) {
+		for (const problem of parsed.problems) logger.error(pc.red(problem));
+		logger.info(pc.gray(`Fields: ${FEEDBACK_CONTRACT.draftFields.join(", ")} — see kici feedback --json`));
+		return false;
+	}
+	const url = draftIssueUrl(parsed.draft);
+	if (url.length > 6e3) logger.warn(pc.yellow(`The prefilled URL is ${url.length} bytes; GitHub may truncate it. Shorten the reproduction.`));
+	process.stdout.write(`${url}\n`);
+	if (!openIt) return true;
+	return openOrExplain(url);
+}
+async function openOrExplain(url) {
 	try {
-		await open(FEEDBACK_NEW_ISSUE_URL);
+		await open(url);
 		return true;
 	} catch (error) {
 		logger.error(pc.red(`Could not open a browser: ${toErrorMessage(error)}`));
-		logger.info(pc.gray(`Open ${FEEDBACK_NEW_ISSUE_URL} manually.`));
+		logger.info(pc.gray(`Open ${url} manually.`));
 		return false;
 	}
 }
 //#endregion
-export { FEEDBACK_CONTRACT, FEEDBACK_NEW_ISSUE_URL, FEEDBACK_SECURITY_ADVISORY_URL, FEEDBACK_TEMPLATE, FEEDBACK_TRACKER_URL, feedbackCommand };
+export { FEEDBACK_CONTRACT, FEEDBACK_DRAFT_COMMAND, FEEDBACK_NEW_ISSUE_URL, FEEDBACK_SECURITY_ADVISORY_URL, FEEDBACK_TEMPLATE, FEEDBACK_TRACKER_URL, FEEDBACK_URL_WARN_BYTES, draftIssueUrl, feedbackCommand, parseFeedbackDraft };
 
 //# sourceMappingURL=feedback.js.map

package/dist/commands/index.d.ts

@@ -57,9 +57,9 @@ export type { WorkflowsListOptions } from './workflows.js';
 export { drainWorkerCommand } from './drain-worker.js';
 export type { DrainWorkerOptions } from './drain-worker.js';
 export { docsCommand, docsLlmCommand } from './docs.js';
-export { feedbackCommand, FEEDBACK_CONTRACT } from './feedback.js';
+export { feedbackCommand, FEEDBACK_CONTRACT, parseFeedbackDraft, draftIssueUrl, } from './feedback.js';
 export type { DocsOptions, DocsLlmOptions } from './docs.js';
-export type { FeedbackOptions, FeedbackContract, FeedbackField } from './feedback.js';
+export type { FeedbackOptions, FeedbackContract, FeedbackField, FeedbackDraft, } from './feedback.js';
 export { verifyAttestationCommand } from './verify-attestation.js';
 export type { VerifyAttestationOptions } from './verify-attestation.js';
 export { notificationsChannelsListCommand, notificationsChannelsAddCommand, notificationsChannelsRemoveCommand, notificationsSubscriptionsListCommand, notificationsSubscriptionsAddCommand, notificationsSubscriptionsRemoveCommand, notificationsRosterListCommand, notificationsRosterAddCommand, notificationsRosterRemoveCommand, } from './notifications.js';

package/dist/commands/index.js

@@ -6,7 +6,7 @@ import { docsCommand, docsLlmCommand } from "./docs.js";
 import { doctorCommand } from "./doctor.js";
 import { drainWorkerCommand } from "./drain-worker.js";
 import { endpointsCommand } from "./endpoints.js";
-import { FEEDBACK_CONTRACT, feedbackCommand } from "./feedback.js";
+import { FEEDBACK_CONTRACT, draftIssueUrl, feedbackCommand, parseFeedbackDraft } from "./feedback.js";
 import { fixtureCommand } from "./fixture.js";
 import { hookInstallCommand } from "./hook.js";
 import { watchCommand } from "./watch.js";
@@ -35,4 +35,4 @@ import { rejectCommand } from "./reject.js";
 import { workflowsListCommand } from "./workflows.js";
 import { verifyAttestationCommand } from "./verify-attestation.js";
 import { notificationsChannelsAddCommand, notificationsChannelsListCommand, notificationsChannelsRemoveCommand, notificationsRosterAddCommand, notificationsRosterListCommand, notificationsRosterRemoveCommand, notificationsSubscriptionsAddCommand, notificationsSubscriptionsListCommand, notificationsSubscriptionsRemoveCommand } from "./notifications.js";
-export { FEEDBACK_CONTRACT, approveCommand, compileCommand, diagnosticsCommand, docsCommand, docsLlmCommand, doctorCommand, drainWorkerCommand, endpointsCommand, feedbackCommand, fixtureCommand, hookInstallCommand, initCommand, localAttachCommand, localDetachCommand, localDownCommand, localLogsCommand, localStatusCommand, localTrustRootCommand, localUpCommand, loginCommand, logoutCommand, notificationsChannelsAddCommand, notificationsChannelsListCommand, notificationsChannelsRemoveCommand, notificationsRosterAddCommand, notificationsRosterListCommand, notificationsRosterRemoveCommand, notificationsSubscriptionsAddCommand, notificationsSubscriptionsListCommand, notificationsSubscriptionsRemoveCommand, orchestratorsListCommand, orchestratorsUseCommand, orgCurrentCommand, orgListCommand, orgUseCommand, patCreateCommand, previewCommand, previewEvent, rejectCommand, reportCommand, reportListCommand, reportWithdrawCommand, runRemoteCommand, runRoutedCommand, runsArtifactsDownloadCommand, runsArtifactsListCommand, runsCancelCommand, runsListCommand, runsLogsCommand, runsRerunCommand, runsShowCommand, secretsListCommand, typesCommand, verifyAttestationCommand, watchCommand, workflowsListCommand };
+export { FEEDBACK_CONTRACT, approveCommand, compileCommand, diagnosticsCommand, docsCommand, docsLlmCommand, doctorCommand, draftIssueUrl, drainWorkerCommand, endpointsCommand, feedbackCommand, fixtureCommand, hookInstallCommand, initCommand, localAttachCommand, localDetachCommand, localDownCommand, localLogsCommand, localStatusCommand, localTrustRootCommand, localUpCommand, loginCommand, logoutCommand, notificationsChannelsAddCommand, notificationsChannelsListCommand, notificationsChannelsRemoveCommand, notificationsRosterAddCommand, notificationsRosterListCommand, notificationsRosterRemoveCommand, notificationsSubscriptionsAddCommand, notificationsSubscriptionsListCommand, notificationsSubscriptionsRemoveCommand, orchestratorsListCommand, orchestratorsUseCommand, orgCurrentCommand, orgListCommand, orgUseCommand, parseFeedbackDraft, patCreateCommand, previewCommand, previewEvent, rejectCommand, reportCommand, reportListCommand, reportWithdrawCommand, runRemoteCommand, runRoutedCommand, runsArtifactsDownloadCommand, runsArtifactsListCommand, runsCancelCommand, runsListCommand, runsLogsCommand, runsRerunCommand, runsShowCommand, secretsListCommand, typesCommand, verifyAttestationCommand, watchCommand, workflowsListCommand };

package/dist/commands/local.d.ts

@@ -5,7 +5,7 @@
  * orchestrator plus a local Postgres (embedded, with a podman fallback) that
  * `kici run --local` dispatches through. `up` boots or reuses the plane,
  * `status` reports it plus the control commands, `down` stops it, and `logs`
- * prints the orchestrator log path.
+ * prints the plane log paths and rotation policy.
  */
 import type { PlaneStatus, PlaneMode } from '../local-plane/plane-manager.js';
 import type { PlaneState } from '../local-plane/plane-liveness.js';
@@ -52,12 +52,20 @@ export declare function localStatusCommand(options?: {
 }): Promise<boolean>;
 /** Stop the local dev plane, reporting success only once the port is released. */
 export declare function localDownCommand(): Promise<boolean>;
-/** Print the local dev plane orchestrator log path. */
+/**
+ * Print the local dev plane orchestrator log path, plus the rotation policy.
+ *
+ * The path is the only line this command writes to stdout — the policy note
+ * goes to stderr — so a caller reading stdout never has to strip prose from
+ * it. The CLI version banner still precedes it, as for every command, so
+ * `$(kici local logs)` is NOT a bare path: read the last stdout line.
+ */
 export declare function localLogsCommand(): Promise<boolean>;
 /**
- * Attach the local dev plane to the hosted Platform so `kici run --local` uses
- * real Platform-minted OIDC + attestation. Mints an org-scoped orchestrator key
- * with the logged-in PAT, then (re)boots the plane hybrid.
+ * Attach the local dev plane to the hosted Platform so `kici run --local` mints
+ * OIDC + attestation with the plane's own signing key under its own issuer, as
+ * a deployed orchestrator does. Mints an org-scoped orchestrator key with the
+ * logged-in PAT, then (re)boots the plane hybrid.
  */
 export declare function localAttachCommand(): Promise<boolean>;
 /** Detach the local dev plane from the Platform and reboot it offline (independent). */

package/dist/commands/local.js

@@ -1,5 +1,6 @@
 import "../rolldown-runtime-ClRpJifh.js";
 import { loadGlobalConfig } from "../remote/config.js";
+import "../local-plane/plane-log.js";
 import { attachPlane, detachPlane, planeDown, planeLogPath, planeStatus } from "../local-plane/plane-manager.js";
 import { resolvePlaneForRun } from "../local-plane/resolve-plane.js";
 import pc from "picocolors";
@@ -12,14 +13,14 @@ import { toErrorMessage } from "@kici-dev/core";
 * orchestrator plus a local Postgres (embedded, with a podman fallback) that
 * `kici run --local` dispatches through. `up` boots or reuses the plane,
 * `status` reports it plus the control commands, `down` stops it, and `logs`
-* prints the orchestrator log path.
+* prints the plane log paths and rotation policy.
 */
 /** Print the control commands a user needs once the plane is running. */
 function printControlHints() {
 	console.log("");
 	console.log(pc.dim("Control commands:"));
 	console.log(`  ${pc.cyan("kici local status")}   Show plane status`);
-	console.log(`  ${pc.cyan("kici local logs")}     Print the orchestrator log path`);
+	console.log(`  ${pc.cyan("kici local logs")}     Print the plane log paths and rotation policy`);
 	console.log(`  ${pc.cyan("kici local down")}     Stop the plane`);
 }
 /**
@@ -147,15 +148,25 @@ async function localDownCommand() {
 	console.log(pc.green("✓") + " Local dev plane stopped.");
 	return true;
 }
-/** Print the local dev plane orchestrator log path. */
+/**
+* Print the local dev plane orchestrator log path, plus the rotation policy.
+*
+* The path is the only line this command writes to stdout — the policy note
+* goes to stderr — so a caller reading stdout never has to strip prose from
+* it. The CLI version banner still precedes it, as for every command, so
+* `$(kici local logs)` is NOT a bare path: read the last stdout line.
+*/
 async function localLogsCommand() {
-	console.log(planeLogPath());
+	const logFile = planeLogPath();
+	console.log(logFile);
+	console.error(pc.dim(`Rotated to ${logFile}.1 when it reaches 50 MB, at the next plane start. When the plane runs embedded PostgreSQL, its log sits beside it at ${logFile}.pg and rotates the same way.`));
 	return true;
 }
 /**
-* Attach the local dev plane to the hosted Platform so `kici run --local` uses
-* real Platform-minted OIDC + attestation. Mints an org-scoped orchestrator key
-* with the logged-in PAT, then (re)boots the plane hybrid.
+* Attach the local dev plane to the hosted Platform so `kici run --local` mints
+* OIDC + attestation with the plane's own signing key under its own issuer, as
+* a deployed orchestrator does. Mints an org-scoped orchestrator key with the
+* logged-in PAT, then (re)boots the plane hybrid.
 */
 async function localAttachCommand() {
 	const config = await loadGlobalConfig();
@@ -180,7 +191,7 @@ async function localAttachCommand() {
 			orgId
 		});
 		console.log(pc.green("✓") + ` Local dev plane attached (hybrid) at ${pc.bold(status.url ?? "")} ` + pc.dim(`(org: ${orgId})`));
-		console.log(pc.dim("`kici run --local` now uses real Platform OIDC + attestation. Detach: ") + pc.cyan("kici local detach"));
+		console.log(pc.dim("`kici run --local` now mints OIDC + attestation with this plane's own key against the real Platform org. Detach: ") + pc.cyan("kici local detach"));
 		return true;
 	} catch (err) {
 		console.error(pc.red(`Attach failed: ${toErrorMessage(err)}`));

package/dist/commands/report/identity.js

@@ -19,7 +19,7 @@ import { PROTOCOL_VERSION } from "@kici-dev/engine";
 */
 function collectIdentity(probe) {
 	const identity = {
-		kiciCliVersion: "0.7.0",
+		kiciCliVersion: "0.9.0",
 		nodeVersion: process.version,
 		platform: process.platform,
 		arch: process.arch,

package/dist/commands/run-banner.d.ts

@@ -6,7 +6,7 @@
  *
  * Three variants:
  * - `offline`  — independent plane, local secrets, dev-signed identity.
- * - `attached` — hybrid plane, real Platform-minted OIDC + attestation.
+ * - `attached` — hybrid plane, OIDC + attestation signed by the plane's own key.
  * - `fallback` — wanted attached but the Platform was unreachable, so the run
  *   fell back to offline; a LOUD first line makes the degradation obvious.
  */

package/dist/commands/run-banner.js

@@ -5,7 +5,7 @@ function renderRunBanner(input) {
 	const title = input.mode === "attached" ? "kici run --local (connected)" : "kici run --local";
 	const rows = [];
 	if (input.mode === "fallback") rows.push(["⚠", `Platform unreachable — fell back to OFFLINE${input.fallbackReason ? ` (${input.fallbackReason})` : ""}`]);
-	if (input.mode === "attached") rows.push(["plane", "local dev orchestrator (hybrid, attached)"], ["agent", "this machine (bare-metal)"], ["secrets", `REAL scoped${input.orgId ? ` (org: ${input.orgId})` : ""}`], ["identity", "real Platform OIDC + attestation"], ["control", `kici local status | logs | detach   (${input.planeUrl})`], ["force", "--offline (local plane) · --in-place (ambient)"]);
+	if (input.mode === "attached") rows.push(["plane", "local dev orchestrator (hybrid, attached)"], ["agent", "this machine (bare-metal)"], ["secrets", `REAL scoped${input.orgId ? ` (org: ${input.orgId})` : ""}`], ["identity", `plane-signed OIDC + attestation (iss=${input.planeUrl})`], ["control", `kici local status | logs | detach   (${input.planeUrl})`], ["force", "--offline (local plane) · --in-place (ambient)"]);
 	else rows.push(["plane", "local dev orchestrator (independent, offline)"], ["agent", "this machine (bare-metal)"], ["secrets", "LOCAL files (.kici/.secrets, .env.local, --env)"], ["identity", "DEV-SIGNED (iss=kici-local — NOT prod)"], ["control", `kici local status | logs | down   (${input.planeUrl})`], ["force", "--connected (attach to Platform) · --in-place (ambient)"]);
 	if (input.trusted) rows.push(["execution", "TRUSTED — host env passthrough (NOT sandboxed)"]);
 	const labelWidth = Math.max(...rows.map(([label]) => label.length));

package/dist/commands/run-routed.js

@@ -151,6 +151,9 @@ async function runRouted(options) {
 				action: dispatch.action,
 				clientPayload: dispatch.clientPayload
 			}
+		}, {
+			repoBasePath: workdir.dir,
+			logPath: planeLogPath()
 		});
 		if (!quiet) logger.info(pc.green(`Run started: ${runId}`));
 		const outcome = await followRun(plane.url, plane.adminToken, runId, {

package/dist/commands/run.js

@@ -9,6 +9,7 @@ import { buildEncryptedSecrets } from "../remote/secret-upload.js";
 import { createOverlayTarball, getSizeWarning, uploadTarball } from "../remote/uploader.js";
 import { formatJsonResult } from "../remote/output/json.js";
 import { formatJunitResult } from "../remote/output/junit.js";
+import { unwrapStoredLogLine } from "../remote/output/streaming.js";
 import { formatErrorHighlight, formatMultiFixtureSummary, formatSummary } from "../remote/output/summary.js";
 import { compileFixtures, filterFixtures } from "../fixtures/compiler.js";
 import { describeEvent } from "../fixtures/describe-event.js";
@@ -500,7 +501,8 @@ async function pollRunToCompletion(ctx, runId, fixtureId, options) {
 				throw err;
 			}
 			runSeen = true;
-			for (const line of logs.lines) {
+			for (const raw of logs.lines) {
+				const line = unwrapStoredLogLine(raw);
 				if (!options.quiet) process.stdout.write(line + "\n");
 				tailLines.push(line);
 				while (tailLines.length > MAX_TAIL) tailLines.shift();
@@ -585,7 +587,8 @@ function jobsFromStatus(status) {
 	if (!status) return [];
 	return status.jobs.map((j) => ({
 		name: j.jobName,
-		status: j.status
+		status: j.status,
+		...typeof j.durationMs === "number" && { durationMs: j.durationMs }
 	}));
 }
 /**

package/dist/commands/runs/logs.js

@@ -1,6 +1,7 @@
 import "../../rolldown-runtime-ClRpJifh.js";
 import { DashboardClient, DashboardClientError } from "../../remote/dashboard-client.js";
 import { colorStatus } from "../../remote/render.js";
+import { unwrapStoredLogLine } from "../../remote/output/streaming.js";
 import pc from "picocolors";
 import { logger, toErrorMessage } from "@kici-dev/core";
 import { TERMINAL_RUN_STATES } from "@kici-dev/engine";
@@ -31,7 +32,7 @@ async function printAllLogs(client, runId, jobs, jobFilter) {
 	for (const j of selectJobs(jobs, jobFilter)) for (const s of j.steps ?? []) {
 		console.log(pc.bold(`\n=== ${j.jobName} › ${s.stepName} `) + colorStatus(s.status) + pc.bold(" ==="));
 		const logs = await client.getStepLogs(runId, j.jobId, s.stepIndex);
-		for (const line of logs.lines) console.log(line);
+		for (const line of logs.lines) console.log(unwrapStoredLogLine(line));
 	}
 }
 async function collectAllLogs(client, runId, jobs, jobFilter) {
@@ -50,7 +51,7 @@ async function followLogs(client, runId, jobFilter) {
 			const seen = printed[key] ?? 0;
 			if (logs.lines.length > seen) {
 				if (seen === 0) console.log(pc.bold(`\n=== ${j.jobName} › ${s.stepName} ===`));
-				for (const line of logs.lines.slice(seen)) console.log(line);
+				for (const line of logs.lines.slice(seen)) console.log(unwrapStoredLogLine(line));
 				printed[key] = logs.lines.length;
 			}
 		}

package/dist/commands/verify-attestation.js

@@ -78,7 +78,7 @@ async function verifyAttestationCommand(artifact, options = {}) {
 			if (c.source_origin === "run-remote") logger.info(pc.bold(pc.yellow("  SOURCE: kici run remote (local working-tree overlay — repository/ref/sha are caller-supplied, not a triggered VCS commit)")));
 			else logger.info(pc.gray(`  source: ${c.source_origin ?? "triggered"}`));
 			const origin = result.attestationOrigin ?? "live";
-			if (origin === "deferred") logger.info(pc.bold(pc.yellow("  ATTESTATION: deferred — the build facts were sealed at build time; the identity token was minted later (after a transient Platform outage), bound to the frozen statement by hash.")));
+			if (origin === "deferred") logger.info(pc.bold(pc.yellow("  ATTESTATION: deferred — the build facts were sealed at build time; the identity token was minted later (once the orchestrator's signing key was available), bound to the frozen statement by hash.")));
 			else if (origin === "offline-backfill") logger.info(pc.bold(pc.yellow("  ATTESTATION: offline-backfill — the run was ingested while the Platform was down; its run/job rows were backfilled and the token minted later. The org id is the authoritative anchor; the temporal gap is disclosed.")));
 			logger.info(pc.gray(`  repository=${c.repository} ref=${c.ref} sha=${c.sha} provider=${c.provider ?? "unknown"} run=${c.kici_run_id} job=${c.kici_job_id}`));
 		} else logger.error(`${pc.red("FAIL")} provenance NOT verified: ${result.failures.join(", ")}`);

package/dist/llm-context/llms-architecture.txt

@@ -411,7 +411,7 @@ Orchestrator                         Agent                    Sandbox (child pro
     |                                  |                          |
     |-- job.dispatch (WS) ------------>|                          |
     |   (jobConfig, sourceTarUrl,      |                          |
-    |    sourceTarHash, depsUrl,       |-- Create sandbox ------->|
+    |    sourceTarDigest, depsUrl,     |-- Create sandbox ------->|
     |    depsHash)                     |   (container/bare-metal/ |
     |                                  |    firecracker)          |
     |                                  |                          |-- Restore .kici/ source (tarball)
@@ -593,6 +593,8 @@ Dep cache misses alone do **not** trigger a build job. Deps are platform-specifi
 
 When multiple webhooks trigger simultaneously for the same repository state, the `BuildCoordinator` coalesces concurrent build requests using a combined key (`contentHash:lockfileHash`). Only one build job runs; all waiting dispatches share the result.
 
+The coalescing map is per coordinator. The build job itself sits on the cluster-wide dispatch queue, so an agent connected to a sibling coordinator can claim it. That sibling persists the terminal `job.status` to the shared `execution_jobs` row (`precursor_result`), and the dispatching coordinator's `PendingPrecursorDbWatcher` reads the row back and settles the pending build through `settlePendingPrecursor()`. The local agent socket goes through the same function. See [runs that span coordinators](https://docs.kici.dev/operator/orchestrator/clustering/#runs-that-span-coordinators).
+
 ### Graceful degradation
 
 If cache storage is unavailable or a download fails:
@@ -667,7 +669,7 @@ Agent                         Orchestrator                    S3
   |                                |    for deps integrity)    |
 ```
 
-The two-phase metadata approach (`upload via PUT` then `initMeta via CopyObject`) works around the limitation that S3 pre-signed URLs cannot include custom metadata headers. For dependency tarballs, the agent also reports the SHA-256 content hash in `cache.upload.complete`; the orchestrator stores it as a companion `.hash` file alongside the tarball. When dispatching execution jobs, the orchestrator reads this hash and includes it as `depsHash` in `job.dispatch`, enabling agent-side integrity verification on download. Source tarballs do not use a companion `.hash` file — the workflow `contentHash` carried in `sourceTarHash` is used to verify the extracted source against the lock file after extraction, which covers drift end-to-end.
+The two-phase metadata approach (`upload via PUT` then `initMeta via CopyObject`) works around the limitation that S3 pre-signed URLs cannot include custom metadata headers. For dependency tarballs, the agent also reports the SHA-256 content hash in `cache.upload.complete`; the orchestrator stores it as a companion `.hash` file alongside the tarball. When dispatching execution jobs, the orchestrator reads this hash and includes it as `depsHash` in `job.dispatch`, enabling agent-side integrity verification on download. Source tarballs carry their own SHA-256 as `sourceTarDigest` in `job.dispatch`, verified before extraction; the workflow `contentHash` is then re-computed against the extracted source to verify it against the lock file, which covers drift end-to-end.
 
 ### URL delivery (downloads)
 
@@ -1166,7 +1168,7 @@ The compiler processes the workflow definition:
 
 When `kici run <event> --local` runs a workflow:
 
-1. **SDK module resolution:** The runner resolves `setStepOutputsMap` / `setJobOutputsMap` from the same `@kici-dev/sdk` module instance that the workflow uses (ensures the proxy reads from the same map)
+1. **SDK module resolution:** The runner resolves `setStepOutputsMap` / `setJobOutputsMap` from the `@kici-dev/sdk/internal` subpath of the same SDK copy that the workflow uses (ensures the proxy reads from the same map)
 2. **Map injection:** Fresh `OutputsMap` and `StepRefMap` are created and injected via `setStepOutputsMap()` / `setStepRefMap()` before each job
 3. **Step execution:** Each step runs sequentially. If the step returns a value, it is stored in the `OutputsMap` keyed by step name
 4. **Bare function normalization:** Bare functions in the steps array are assigned counter names and registered in the `StepRefMap` (maps function reference to step name)
@@ -1301,7 +1303,7 @@ The Platform never processes, stores, or executes customer code, and never sees
 
 The orchestrator is the execution brain. It decides what to run and dispatches work to agents.
 
-- **Trigger matching** -- Evaluates lock file triggers against webhook payloads to determine which jobs to run. Uses branch, path, and event matching via picomatch.
+- **Trigger matching** -- Evaluates lock file triggers against webhook payloads to determine which jobs to run. Uses glob-based branch, path, and event matching.
 - **Lock file caching** -- Fetches `kici.lock.json` via the configured source's fetcher (GitHub API, universal-git clone for generic webhook sources backed by a git URL, or the local filesystem for `file://` sources). An LRU cache wraps the per-provider fetcher, keyed by `{provider}:{repo}:{ref}` so cross-provider fallback resolutions stay isolated.
 - **Agent registry** -- Tracks connected agents with label-based routing for job dispatch.
 - **Job queue** -- PostgreSQL-backed FIFO queue for reliable dispatch.
@@ -1333,7 +1335,7 @@ The agent is the execution worker. It runs on customer infrastructure and has fu
 Shared business logic used by all three tiers. Single source of truth for cross-tier concerns. Has no internal `@kici-dev/*` dependencies -- only a handful of third-party libraries.
 
 - Protocol message schemas (Zod-based, direction-specific unions including dashboard REST-over-WS, browser live streaming, the test-relay control plane, log pull, run events, peer-to-peer, cluster join, and source registration)
-- Provider interfaces (WebhookNormalizer, LockFileFetcher, ChangedFilesFetcher, FileContentsFetcher, CloneTokenProvider, RepoUrlBuilder, CheckStatusPoster), plus the deprecated `ContributorResolver` the pipeline no longer calls
+- Provider interfaces (WebhookNormalizer, LockFileFetcher, ChangedFilesFetcher, FileContentsFetcher, CloneTokenProvider, RepoUrlBuilder, CheckStatusPoster)
 - Git credential vocabulary (forge names plus the credential reference, grant, request, and result shapes the SDK declares and the orchestrator's broker resolves) and the agent→orchestrator relay protocol its credential helper calls. See [Git credentials](https://docs.kici.dev/user/patterns/git-credentials/)
 - Trigger matching engine (branch, path, event evaluation)
 - Content-requirement matcher (the declarative `requires` filter -- pure data describing a query over the bytes of one source file at the event's ref, interpreted by the orchestrator via the `FileContentsFetcher` so no author code runs there) and the shared text-match vocabulary (`contains` / `notContains` / `matches` / `notMatches`) it shares with the commit-message trigger filter
@@ -1383,7 +1385,7 @@ It also runs the **local dev plane** -- an on-demand, fully local execution stac
 
 ### `@kici-dev/core`
 
-Light shared utilities with no server-side dependencies. It provides JSON-structured logging, error helpers, async-local-storage request context, and human-readable formatting (`formatBytes`/`formatDuration`/`formatUptime`). It also provides cryptographic helpers (`sha256`/`sha256File`/`deriveSharedSecret` plus symmetric encrypt/decrypt), retry-backoff computation, and the shared diagnostics-result contract. The rest of its surface ships as subpath entry points: the temp-directory allocator and its garbage collector, package-manager detection, CI-environment detection, and the idempotent-step runner (the check / confirm / apply primitive behind idempotent steps). One further subpath holds the `.kici/` source digest: the single content-hash definition the compiler writes into the lock file and the agent recomputes as its drift gate. Finally it supplies zx initialization (`initZx()`) and the TypeScript loader hook that transforms TypeScript on import. It is the dependency-light core that the SDK, compiler, and `kici` CLI consume directly so they stay free of heavier server-only dependencies. `@kici-dev/shared` re-exports it, so existing `@kici-dev/shared` import paths keep working.
+Light shared utilities with no server-side dependencies. It provides JSON-structured logging, error helpers, async-local-storage request context, and human-readable formatting (`formatBytes`/`formatDuration`/`formatUptime`). It also provides cryptographic helpers (`sha256`/`sha256File`/`deriveSharedSecret` plus symmetric encrypt/decrypt), retry-backoff computation, and the shared diagnostics-result contract. The rest of its surface ships as subpath entry points: the temp-directory allocator and its garbage collector, package-manager detection, CI-environment detection, and the idempotent-step runner (the check / confirm / apply primitive behind idempotent steps). One further subpath holds the `.kici/` source digest: the single content-hash definition the compiler writes into the lock file and the agent recomputes as its drift gate. It also owns the published docs host: `docsUrl()` builds every docs link a CLI prints or a template scaffolds from one `DOCS_SITE_URL` constant, so no other package spells the host. Finally it supplies zx initialization (`initZx()`) and the TypeScript loader hook that transforms TypeScript on import. It is the dependency-light core that the SDK, compiler, and `kici` CLI consume directly so they stay free of heavier server-only dependencies. `@kici-dev/shared` re-exports it, so existing `@kici-dev/shared` import paths keep working.
 
 > Source: `packages/core/src/`
 
@@ -1465,7 +1467,7 @@ KiCI uses three WebSocket layers for real-time communication.
 
 ### Platform ↔ Orchestrator
 
-The orchestrator connects outbound to the Platform WebSocket endpoint. After authentication (API key validated via SHA-256 hash lookup), the connection is used for webhook relay, execution telemetry (events, status, logs), source registration, and peer discovery. The Platform can also relay `job.reroute` messages between orchestrators that cannot reach each other directly.
+The orchestrator connects outbound to the Platform WebSocket endpoint. After authentication (API key validated via SHA-256 hash lookup), the connection is used for webhook relay, execution telemetry (events, status, logs), source registration, and peer discovery. Peer discovery is matchmaking only: the Platform pushes a `peer.update` membership list to every orchestrator sharing a routing key, and the orchestrators then connect to each other directly. Inter-orchestrator traffic such as `job.reroute` never transits the Platform.
 
 ### Orchestrator ↔ Orchestrator (P2P)