@kici-dev/orchestrator 0.1.14 → 0.1.16

package/dist/storage/filesystem.d.ts

@@ -13,7 +13,7 @@
  * data file is byte-identical to what the agent receives over HTTP. TTL is
  * enforced lazily on access — same model as the S3 backend.
  */
-import type { CacheStorage } from './types.js';
+import type { CacheMetadata, CacheStorage } from './types.js';
 export interface FilesystemCacheStorageOptions {
     /** Absolute path to the cache root directory. Created on first write if missing. */
     basePath: string;
@@ -46,14 +46,24 @@ export declare class FilesystemCacheStorage implements CacheStorage {
     private readMeta;
     private writeMeta;
     put(key: string, data: Buffer | string): Promise<void>;
-    get(key: string): Promise<Buffer | null>;
-    has(key: string): Promise<boolean>;
+    get(key: string, ttlMsOverride?: number): Promise<Buffer | null>;
+    has(key: string, ttlMsOverride?: number): Promise<boolean>;
     delete(key: string): Promise<boolean>;
     touch(key: string): Promise<void>;
-    getUrl(key: string): Promise<string | null>;
+    getUrl(key: string, ttlMsOverride?: number): Promise<string | null>;
     getUploadUrl(key: string): Promise<string>;
     getInternalUploadUrl(key: string): Promise<string>;
     initMeta(key: string): Promise<void>;
+    list(subPrefix: string): Promise<string[]>;
+    getMetadata(key: string): Promise<CacheMetadata | null>;
+    copy(srcKey: string, destKey: string): Promise<void>;
+    /**
+     * Recursively collect data files under `dir`, returning each as a cache key
+     * relative to `basePath` paired with its mtime. Metadata sidecars
+     * (`*.meta.json`) and the atomic-write temp files (`*.tmp-*`) are skipped so
+     * `list()` only surfaces real cache objects.
+     */
+    private walkDataFiles;
     private signedUrl;
     private deleteFiles;
 }

package/dist/storage/s3.d.ts

@@ -11,7 +11,7 @@
  * TTL is enforced lazily: expired items are deleted on access.
  * Pre-signed URLs are generated for getUrl() with 15-minute expiry.
  */
-import type { CacheStorage } from './types.js';
+import type { CacheMetadata, CacheStorage } from './types.js';
 export interface S3CacheStorageOptions {
     bucket: string;
     prefix: string;
@@ -26,6 +26,15 @@ export interface S3CacheStorageOptions {
      * need a container-routable address (e.g., container DNS name).
      */
     externalEndpoint?: string;
+    /**
+     * Separate endpoint for the host-facing (CLI) pre-signed upload URL.
+     * The CLI running `kici run remote` is on the developer's host, which may
+     * reach the bucket at a different address than the orchestrator's own
+     * `endpoint` (e.g. an orchestrator in a container uses the compose DNS name
+     * while the host CLI uses localhost). When unset, `getInternalUploadUrl`
+     * falls back to the internal `endpoint` client (current behavior).
+     */
+    uploadEndpoint?: string;
     /** Use path-style access instead of virtual-hosted-style (required for most S3-compatible services) */
     forcePathStyle?: boolean;
 }
@@ -33,13 +42,15 @@ export declare class S3CacheStorage implements CacheStorage {
     private readonly client;
     /** Separate client for pre-signed URL generation (uses externalEndpoint if configured). */
     private readonly presignClient;
+    /** Separate client for the host CLI's pre-signed upload URL (uses uploadEndpoint if configured). */
+    private readonly uploadPresignClient;
     private readonly bucket;
     private readonly prefix;
     private readonly ttlMs;
     constructor(options: S3CacheStorageOptions);
     /** Build the full S3 object key from a cache key. */
     private objectKey;
-    /** Check if metadata indicates an expired item. */
+    /** Check if metadata indicates an expired item, honoring a per-op TTL override. */
     private isExpired;
     /**
      * Read metadata from an S3 object's custom headers.
@@ -54,14 +65,17 @@ export declare class S3CacheStorage implements CacheStorage {
     /** Check if an error is a "not found" error (NoSuchKey, NotFound, 404). */
     private isNotFoundError;
     put(key: string, data: Buffer | string): Promise<void>;
-    get(key: string): Promise<Buffer | null>;
-    has(key: string): Promise<boolean>;
+    get(key: string, ttlMsOverride?: number): Promise<Buffer | null>;
+    has(key: string, ttlMsOverride?: number): Promise<boolean>;
     delete(key: string): Promise<boolean>;
     touch(key: string): Promise<void>;
-    getUrl(key: string): Promise<string | null>;
+    getUrl(key: string, ttlMsOverride?: number): Promise<string | null>;
     getUploadUrl(key: string): Promise<string>;
     getInternalUploadUrl(key: string): Promise<string>;
     initMeta(key: string): Promise<void>;
+    list(subPrefix: string): Promise<string[]>;
+    getMetadata(key: string): Promise<CacheMetadata | null>;
+    copy(srcKey: string, destKey: string): Promise<void>;
     /** Delete an S3 object. Idempotent (doesn't error if missing). */
     private deleteObject;
 }

package/dist/storage/types.d.ts

@@ -29,10 +29,18 @@ export interface CacheMetadata {
 export interface CacheStorage {
     /** Store a value under the given key. Overwrites if key already exists. */
     put(key: string, data: Buffer | string): Promise<void>;
-    /** Retrieve a value by key. Returns null if not found or expired. */
-    get(key: string): Promise<Buffer | null>;
-    /** Check if a key exists and is not expired, without retrieving data. */
-    has(key: string): Promise<boolean>;
+    /**
+     * Retrieve a value by key. Returns null if not found or expired.
+     * `ttlMsOverride` applies a per-operation TTL instead of the backend's
+     * constructor-time default (lets per-org cache TTLs override the
+     * cluster-wide default without re-constructing the backend).
+     */
+    get(key: string, ttlMsOverride?: number): Promise<Buffer | null>;
+    /**
+     * Check if a key exists and is not expired, without retrieving data.
+     * `ttlMsOverride` applies a per-operation TTL (see `get`).
+     */
+    has(key: string, ttlMsOverride?: number): Promise<boolean>;
     /** Delete a key. Returns true if the key existed (even if expired). */
     delete(key: string): Promise<boolean>;
     /** Update lastAccessedAt to now, refreshing the TTL. No-op if key doesn't exist. */
@@ -40,8 +48,9 @@ export interface CacheStorage {
     /**
      * Get a pre-signed download URL for the cached item.
      * Returns null if not found or expired.
+     * `ttlMsOverride` applies a per-operation TTL (see `get`).
      */
-    getUrl(key: string): Promise<string | null>;
+    getUrl(key: string, ttlMsOverride?: number): Promise<string | null>;
     /**
      * Generate a pre-signed PUT URL for direct agent upload.
      * Uses the external endpoint (container-routable) when configured.
@@ -61,6 +70,22 @@ export interface CacheStorage {
      * Sets created-at and last-accessed-at to now.
      */
     initMeta(key: string): Promise<void>;
+    /**
+     * List object keys (relative to the configured prefix) under a sub-prefix,
+     * newest first (by createdAt/last-modified metadata; falls back to
+     * lexicographic when metadata is unavailable). Returns full cache keys
+     * (without the storage prefix). Returns an empty array when nothing matches.
+     */
+    list(subPrefix: string): Promise<string[]>;
+    /** Server-side copy from one cache key to another (used for atomic temp -> final commit). */
+    copy(srcKey: string, destKey: string): Promise<void>;
+    /**
+     * Read the stored metadata (createdAt + lastAccessedAt) for a key WITHOUT
+     * refreshing lastAccessedAt. Returns null when the key is missing or carries
+     * no metadata. A pure read (no TTL-expiry side effect) — used by quota
+     * eviction to order candidates by access recency.
+     */
+    getMetadata(key: string): Promise<CacheMetadata | null>;
 }
 import type { SharedS3Config } from '@kici-dev/shared';
 /**
@@ -70,6 +95,8 @@ import type { SharedS3Config } from '@kici-dev/shared';
 export type S3CacheStorageConfig = SharedS3Config & {
     type: 's3';
     ttlMs: number;
+    /** Host-facing pre-signed upload endpoint (see S3CacheStorageOptions.uploadEndpoint). */
+    uploadEndpoint?: string;
 };
 /**
  * Filesystem backend config. Stores blobs as files under `basePath` and

package/dist/worker/in-memory-job-queue.d.ts

@@ -12,6 +12,10 @@
 import { DispatchQueueStatus, type QueuedJobInput, type QueuedJob } from '../queue/job-queue.js';
 export declare class InMemoryJobQueue {
     private readonly jobs;
+    /** Jobs handed to an agent, retained so requeue / lookups can restore them. */
+    private readonly dispatched;
+    /** Per-job re-dispatch counter (parity with dispatch_queue.dispatch_attempts). */
+    private readonly attempts;
     /** Enqueue a job in memory and return its ID. */
     enqueue(input: QueuedJobInput): Promise<string>;
     /**
@@ -40,20 +44,49 @@ export declare class InMemoryJobQueue {
     dequeueById(jobId: string, agentLabels: string[], agentMandatoryLabels?: string[]): Promise<QueuedJob | null>;
     /** Return count of pending jobs. */
     getDepth(): Promise<number>;
-    /** No-op — workers don't track dispatch status in a queue. */
+    /** No-op — the job is already tracked in `dispatched` from dequeue. */
     markDispatched(_jobId: string, _agentId: string): Promise<void>;
-    /** No-op. */
-    markFailed(_jobId: string, _reason: string): Promise<void>;
-    /** No-op. */
-    markCompleted(_jobId: string): Promise<void>;
+    /** Drop the dispatched entry — the job reached a terminal state. */
+    markFailed(jobId: string, _reason: string): Promise<void>;
+    /** Drop the dispatched entry — the job completed. */
+    markCompleted(jobId: string): Promise<void>;
     /** No-op. */
     markRecovering(_jobId: string): Promise<void>;
+    /**
+     * No-op. The worker's dispatch-ack deadline lives entirely in the
+     * in-memory timer; HA-safe persistence belongs to the coord's DB-backed
+     * queue, not the worker's in-memory queue.
+     */
+    setAckDeadline(_jobId: string, _deadline: Date, _agentId: string): Promise<void>;
+    /** No-op (see setAckDeadline). */
+    clearAckDeadline(_jobId: string): Promise<void>;
+    /** Always empty — the worker never rehydrates ack timers from a DB. */
+    getDispatchedAwaitingAck(): Promise<Array<{
+        id: string;
+        runId: string;
+        agentId: string | null;
+        deadline: Date;
+    }>>;
+    /** Always empty — the worker is never the leader running the ack sweep. */
+    listExpiredAckDeadlines(_now: Date): Promise<Array<{
+        id: string;
+        runId: string;
+        agentId: string | null;
+    }>>;
+    /**
+     * Return a dispatched job to pending for re-dispatch, bumping its attempt
+     * counter. Mirrors the DB-backed `JobQueue.requeue`. Returns the new
+     * attempt count, or null when the job is not currently dispatched.
+     */
+    requeue(jobId: string): Promise<number | null>;
+    /** Full job lookup across pending and dispatched jobs. */
+    getFullJobById(jobId: string): Promise<QueuedJob | null>;
     /** Return all pending jobs. */
     getPendingJobs(): Promise<QueuedJob[]>;
     /** Always returns empty array. */
     getDispatchedJobIdsByRunId(_runId: string): Promise<string[]>;
-    /** Always returns null. */
-    getJobById(_jobId: string): Promise<{
+    /** Lookup across pending and dispatched jobs (id / runId / status). */
+    getJobById(jobId: string): Promise<{
         id: string;
         runId: string;
         status: DispatchQueueStatus;

package/dist/ws/agent-handler.d.ts

@@ -23,12 +23,15 @@ import type { AgentTokenStore } from '../agent/token-store.js';
 import type { OwnershipTracker } from '../agent/ownership-tracker.js';
 import type { SourceCache } from '../cache/source-cache.js';
 import type { DepCache } from '../cache/dep-cache.js';
+import type { UserCache } from '../cache/user-cache.js';
+import type { DispatchCacheRefTracker } from '../cache/dispatch-cache-ref-tracker.js';
 import type { PendingBuildTracker } from '../cache/pending-builds.js';
 import type { PendingInitTracker } from '../cache/pending-inits.js';
 import type { PendingDynamicTracker } from '../cache/pending-dynamics.js';
 import type { CacheStorage } from '../storage/types.js';
 import type { AgentMetricsAggregator } from '../metrics/agent-metrics-aggregator.js';
 import type { AgentApiRegistry } from './agent-api-registry.js';
+import type { FleetAgentCollector } from './fleet-agent-collector.js';
 /**
  * Run the three token-bound authorization gates against a wire-supplied
  * `agent.register` payload. The gates are identical at first register
@@ -166,6 +169,17 @@ export interface AgentWsHandlerDeps {
     sourceCache?: SourceCache;
     /** Dep cache for generating pre-signed upload URLs. */
     depCache?: DepCache;
+    /** User-facing cache for serving restore/save requests from the sandbox. */
+    userCache?: UserCache;
+    /**
+     * Server-side jobId -> user-cache-namespace store. The orchestrator records
+     * `{orgId, repoId, cacheRefScope, runId}` per job at dispatch time; the
+     * `cache.user.*` handlers resolve the ref from HERE (keyed by the wire jobId),
+     * NEVER from the wire message body — a `cache.user.*` message carries only a
+     * `jobId` + `key`, so an agent can name a job it owns but can never influence
+     * which org/repo/scope that job resolves to.
+     */
+    dispatchCacheRefs?: DispatchCacheRefTracker;
     /** Cache storage for setting metadata after upload completion. */
     cacheStorage?: CacheStorage;
     /** Optional rate limiter configuration. */
@@ -195,6 +209,30 @@ export interface AgentWsHandlerDeps {
         action: 'proceed' | 'wait' | 'cancel';
         reason?: string;
     }>;
+    /**
+     * Optional callback when an agent blocks a `requireApproval` step. The server
+     * creates a step-scoped hold from the carried clauses and returns a promise
+     * that resolves when the hold is approved, rejected, or expired. The handler
+     * relays the resolution back to the originating agent as a
+     * `step.approval-resolved` message. The `agentId` lets the server drop the
+     * pending resolver when the agent disconnects.
+     */
+    onStepApproval?: (agentId: string, msg: {
+        runId: string;
+        jobId: string;
+        stepIndex: number;
+        stepName: string;
+        clauses: Array<{
+            team: string;
+        } | {
+            user: string;
+        }>;
+        reason: string;
+        timeoutSeconds?: number;
+    }) => Promise<{
+        outcome: 'approved' | 'rejected' | 'expired';
+        reason?: string;
+    }>;
     /**
      * Optional callback fired when an agent's WS connection closes, after the
      * dispatcher's own cleanup has run. Used by the long-poll concurrency
@@ -204,6 +242,13 @@ export interface AgentWsHandlerDeps {
     onConcurrencyAgentDisconnect?: (agentId: string) => void | Promise<void>;
     /** Agent private API registry for handling agent.api.request messages. */
     agentApiRegistry?: AgentApiRegistry;
+    /**
+     * Orchestrator-scoped collector that correlates fleet.logs.request with the
+     * agent's chunked fleet.bundle.chunk / fleet.bundle.error response. Routed to
+     * from the incoming-message switch; pending requests for a given agent are
+     * rejected when that agent's WS closes.
+     */
+    fleetAgentCollector?: FleetAgentCollector;
 }
 export declare function createAgentWsHandler(deps: AgentWsHandlerDeps): WSEvents;
 //# sourceMappingURL=agent-handler.d.ts.map

package/dist/ws/dashboard-env-handler.d.ts

@@ -11,6 +11,8 @@
  * 3. Returns a response message with requestId and data (or error)
  */
 import { type Kysely } from 'kysely';
+import type { HeldRunStore, ReleaseSignal } from '../environments/held-runs.js';
+import type { TeamMembershipLookup } from '../approvals/approval-resolver.js';
 import type { DashboardPlatformToOrchMessage } from '@kici-dev/engine';
 import type { EnvironmentStore } from '../environments/environment-store.js';
 import type { VariableStore } from '../environments/variable-store.js';
@@ -44,6 +46,26 @@ export interface DashboardEnvHandlerDeps {
     accessLog?: AccessLogWriter;
     /** Routing key for access_log rows (null when not run-scoped). */
     routingKey?: string | null;
+    /**
+     * Held-run store + resume hook for the approve/reject flow. When present, the
+     * approve/reject handlers route through the shared `applyDecision` applier
+     * (eligibility check, real attribution, multi-clause accumulation, and the
+     * resume-after-approval re-dispatch). When absent (legacy / tests), the
+     * handlers fall back to the direct status flip.
+     */
+    approvals?: ApprovalHandlerDeps;
+}
+/** Dependencies enabling the resolver-backed approve/reject + resume path. */
+export interface ApprovalHandlerDeps {
+    store: HeldRunStore;
+    /** Team name → member user ids (Plan-1 trust-policy cache). */
+    teamMembershipLookup: TeamMembershipLookup;
+    /** Re-dispatch a released job/workflow hold (consumes its pending context). */
+    resumeJob: (signal: ReleaseSignal) => Promise<void>;
+    /** Notify a waiting agent that a step hold released (step scope). */
+    resumeStep?: (signal: ReleaseSignal) => Promise<void>;
+    /** Notify a waiting agent that a step hold was rejected (step scope). */
+    rejectStep?: (heldRunId: string, reason?: string) => Promise<void> | void;
 }
 /**
  * Handler for all dashboard environment and held run WS messages.
@@ -81,6 +103,7 @@ export declare class DashboardEnvHandler {
     private handleEnvGet;
     private handleEnvCreate;
     private handleEnvUpdate;
+    private handleTestAccessSet;
     private handleEnvDelete;
     private handleVarsList;
     private handleVarSet;
@@ -106,6 +129,19 @@ export declare class DashboardEnvHandler {
     private handleScopeDelete;
     private handleEnvHistory;
     private handleHeldRunsList;
+    /**
+     * Resolve the actor's Keycloak sub for approval attribution. Only `user` and
+     * `platform_operator` actors carry a `sub`; others fall back to a stable id.
+     */
+    private actorSub;
+    /** Read org_settings.allow_self_approval (default true). */
+    private readAllowSelfApproval;
+    /**
+     * Route an approve/reject through the shared `applyDecision` applier:
+     * eligibility check, real attribution, multi-clause accumulation, and the
+     * resume-after-approval re-dispatch. Sends the matching response message.
+     */
+    private applyApprovalDecision;
     private handleHeldRunApprove;
     private handleHeldRunReject;
     private sendError;

package/dist/ws/fleet-agent-collector.d.ts

@@ -0,0 +1,23 @@
+export interface FleetAgentCollectorOptions {
+    timeoutMs: number;
+}
+export declare class FleetAgentCollector {
+    private readonly opts;
+    private readonly waiter;
+    /** requestId -> owning agentId, so a disconnect rejects only that agent's requests. */
+    private readonly requestAgent;
+    constructor(opts: FleetAgentCollectorOptions);
+    /**
+     * Register the pending request `requestId` (owned by `agentId`), invoke
+     * `send` to dispatch the fleet.logs.request envelope, and await the
+     * reassembled bundle Buffer.
+     */
+    request(requestId: string, agentId: string, send: () => void): Promise<Buffer>;
+    onChunk(requestId: string, seq: number, dataB64: string, isLast: boolean): void;
+    onError(requestId: string, message: string): void;
+    /** Reject every pending request owned by `agentId` (called on its disconnect). */
+    rejectAgent(agentId: string, reason: string): void;
+    /** Reject every pending request regardless of owner (orchestrator shutdown). */
+    rejectAll(reason: string): void;
+}
+//# sourceMappingURL=fleet-agent-collector.d.ts.map

package/dist/ws/platform-client.d.ts

@@ -1,4 +1,4 @@
-import { type OrchestratorToPlatformMessage, type WebhookRelay, type WebhookRelayResult, type TrustPolicyUpdate, type StaleCheckrunCleanup, type DashboardRunDetailRequest, type DashboardStepLogsRequest, type DashboardOrchLogsRequest, type RunRerunRequest, type ManualScheduleRequest, type RunCancelRequest, type DashboardPayloadRequest, type DashboardPlatformToOrchMessage, type DashboardDiagnosticsRequest, type DashboardScalerCapacityRequest, type DashboardScalerAgentsRequest, type JoinRequest, type JoinResponse, type OrchCapabilities, type OrchRole } from '@kici-dev/engine';
+import { type OrchestratorToPlatformMessage, type WebhookRelay, type WebhookRelayResult, type TrustPolicyUpdate, type StaleCheckrunCleanup, type DashboardRunDetailRequest, type DashboardRunsListRequest, type DashboardRunsFiltersRequest, type DashboardSourcesListRequest, type DashboardStepLogsRequest, type DashboardOrchLogsRequest, type RunRerunRequest, type ManualScheduleRequest, type RunCancelRequest, type DashboardPayloadRequest, type DashboardPlatformToOrchMessage, type DashboardDiagnosticsRequest, type DashboardScalerCapacityRequest, type DashboardScalerAgentsRequest, type JoinRequest, type JoinResponse, type OrchCapabilities, type OrchRole } from '@kici-dev/engine';
 import { RelayBufferRegistry, type RelayStartMeta } from '../webhook/relay-buffer.js';
 /**
  * Verification + processing outcome returned by the chunked relay path's
@@ -89,6 +89,12 @@ export interface PlatformClientOptions {
     onAuthenticated?: () => void;
     /** Optional callback for dashboard run detail requests from Platform. */
     onDashboardRunDetail?: (msg: DashboardRunDetailRequest) => void;
+    /** Optional callback for dashboard runs.list (operator console) requests from Platform. */
+    onDashboardRunsList?: (msg: DashboardRunsListRequest) => void;
+    /** Optional callback for dashboard runs.filters (operator console) requests from Platform. */
+    onDashboardRunsFilters?: (msg: DashboardRunsFiltersRequest) => void;
+    /** Optional callback for dashboard sources.list (operator console) requests from Platform. */
+    onDashboardSourcesList?: (msg: DashboardSourcesListRequest) => void;
     /** Optional callback for dashboard step logs requests from Platform. */
     onDashboardStepLogs?: (msg: DashboardStepLogsRequest) => void;
     /** Optional callback for run re-run requests from Platform (dashboard action). */
@@ -175,6 +181,9 @@ export declare class PlatformClient {
     private readonly onPeerDiscover?;
     private readonly onAuthenticated?;
     private readonly onDashboardRunDetail?;
+    private readonly onDashboardRunsList?;
+    private readonly onDashboardRunsFilters?;
+    private readonly onDashboardSourcesList?;
     private readonly onDashboardStepLogs?;
     private readonly onRunRerun?;
     private readonly onManualSchedule?;

package/installer-image-digests.json

@@ -0,0 +1,7 @@
+{
+  "version": "0.1.16",
+  "images": {
+    "kici-agent": "sha256:817dfadfe941eb9e9096724c58d7af6d53665d813de0bc952c31090347b959da",
+    "kici-orchestrator": "sha256:85dd71ae39df06dad94defc19cc9152621640a5324e2008a83813cac001d979e"
+  }
+}

package/package.json

@@ -1,19 +1,22 @@
 {
   "name": "@kici-dev/orchestrator",
-  "version": "0.1.14",
+  "version": "0.1.16",
   "description": "Customer-deployable orchestrator for the KiCI CI/CD stack. Receives webhook events (direct or via Platform relay), matches triggers against the lock file, and dispatches jobs to connected agents.",
   "keywords": [
-    "kici",
     "ci",
-    "cd",
-    "ci-cd",
+    "cicd",
+    "continuous-integration",
     "typescript",
-    "workflows",
-    "devops",
+    "workflow",
     "orchestrator",
-    "webhook",
     "self-hosted"
   ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/kici-dev/kici-public.git",
+    "directory": "packages/orchestrator"
+  },
+  "bugs": "https://github.com/kici-dev/kici-public/issues",
   "homepage": "https://kici.dev",
   "author": {
     "name": "KiCI",
@@ -27,7 +30,8 @@
   "files": [
     "dist",
     "!dist/**/*.map",
-    "sbom.spdx.json"
+    "sbom.spdx.json",
+    "installer-image-digests.json"
   ],
   "publishConfig": {
     "registry": "https://registry.npmjs.org/",
@@ -82,8 +86,8 @@
     "ws": "^8.20.0",
     "yaml": "^2.8.3",
     "zod": "^4.3.6",
-    "@kici-dev/engine": "0.1.14",
-    "@kici-dev/shared": "0.1.14"
+    "@kici-dev/engine": "0.1.16",
+    "@kici-dev/shared": "0.1.16"
   },
   "kici": {
     "metrics": {
@@ -97,7 +101,7 @@
     "@types/archiver": "^7.0.0",
     "@types/dockerode": "^4.0.1",
     "kysely-ctl": "^0.21.0",
-    "@kici-dev/agent": "0.1.14"
+    "@kici-dev/agent": "0.1.16"
   },
   "scripts": {
     "build": "node ../../scripts/build-service.mjs && tsc --emitDeclarationOnly",