@kici-dev/orchestrator 0.19.0 → 0.20.0

package/dist/cli/commands/shared/container-agent-image-check.d.ts

@@ -0,0 +1,67 @@
+/**
+ * The container-scaler agent image check `kici-admin orchestrator upgrade`
+ * runs before it restarts the service.
+ *
+ * A container scaler spawns each agent from the image its label set names, not
+ * from the upgraded orchestrator. So an upgrade leaves container agents on the
+ * old release when a label set pins an older `kici-agent:<version>`, or names
+ * the moving `:latest` tag with the default `imagePullPolicy: IfNotPresent`: a
+ * host that already pulled `:latest` keeps that image. The check only warns:
+ * it never rewrites the operator's scaler config and never stops the upgrade.
+ */
+import { type ScalerConfig } from '../../../scaler/types.js';
+/** Why a container label set keeps spawning an old agent after the upgrade. */
+export declare enum AgentImageIssue {
+    /** `:latest` (or no tag) with `IfNotPresent`: the host keeps the image it pulled. */
+    MovingTag = "moving-tag",
+    /** A `kici-agent:<version>` older than the release the upgrade installs. */
+    OlderPin = "older-pin"
+}
+export interface AgentImageFinding {
+    issue: AgentImageIssue;
+    scaler: string;
+    labels: string[];
+    image: string;
+    message: string;
+}
+/** An image reference split into its repository, tag and digest. */
+export interface ImageRefParts {
+    repository: string;
+    tag: string | null;
+    digest: string | null;
+}
+/**
+ * Split `[registry/]path/name[:tag][@digest]`. A `:` before the last `/` is a
+ * registry port, not a tag.
+ */
+export declare function parseImageRef(image: string): ImageRefParts;
+export interface CheckAgentImagesArgs {
+    config: ScalerConfig;
+    /** The release the upgrade installs, or null when the caller does not know it. */
+    targetVersion: string | null;
+    /** The main scaler config file, for the remedy text. */
+    scalerConfigPath: string;
+    /** The `KICI_SCALER_CONFIG_DIR` directory, when one is set. */
+    scalerConfigDir?: string;
+}
+/**
+ * Every container-scaler label set whose agent image an upgrade to
+ * `targetVersion` leaves unchanged. An empty result means each agent image is
+ * pinned to the target (or newer), pulled on every spawn, or not a KiCI agent.
+ */
+export declare function checkContainerAgentImages(args: CheckAgentImagesArgs): AgentImageFinding[];
+export interface WarnAgentImagesArgs {
+    envFilePath: string;
+    workingDirectory: string;
+    /** The release the upgrade installs, or null when the caller does not know it. */
+    targetVersion: string | null;
+    warn: (line: string) => void;
+}
+/**
+ * Print one warning per container label set whose agent image the upgrade
+ * leaves unchanged. Never throws, and stays silent when the env file or the
+ * scaler config cannot be read: the bare-metal `binaryPath` check, which runs
+ * first on the same files, already reports that.
+ */
+export declare function warnAboutContainerAgentImages(args: WarnAgentImagesArgs): Promise<void>;
+//# sourceMappingURL=container-agent-image-check.d.ts.map

package/dist/cli.js

@@ -22341,6 +22341,25 @@ function encryptPrivateKey(privateKey, secretKey) {
 	return encrypt(privateKey.toString("base64"), key, 1, PRIVATE_KEY_AAD).data;
 }
 createLogger({ prefix: "job-secret-seal" });
+//#endregion
+//#region src/agent/agent-version.ts
+/**
+* Parse `MAJOR.MINOR.PATCH`, or `null` for a non-version. The `-prerelease`
+* suffix is dropped rather than ordered: it is a build counter (`0.5.0-9159`),
+* and strict semver would order it BELOW `0.5.0`, reading every prerelease
+* agent as too old for a feature it carries.
+*/
+function parseVersionBase(version) {
+	const parts = version.trim().split("-")[0].split(".");
+	if (parts.length !== 3) return null;
+	const nums = parts.map((part) => /^\d+$/.test(part) ? Number(part) : NaN);
+	if (nums.some((n) => Number.isNaN(n))) return null;
+	return [
+		nums[0],
+		nums[1],
+		nums[2]
+	];
+}
 runtimeLabel(RuntimeFact.enum.docker), runtimeLabel(RuntimeFact.enum.podman);
 //#endregion
 //#region src/helpers/run-detached.ts
@@ -24132,6 +24151,117 @@ async function preflightBareMetalBinaryPaths(args) {
 Nothing was installed and the service was not restarted. Fix binaryPath and run the upgrade again, or pass ${SKIP_BINARY_PATH_CHECK_FLAG} to upgrade anyway.`);
 }
 //#endregion
+//#region src/cli/commands/shared/container-agent-image-check.ts
+/**
+* The container-scaler agent image check `kici-admin orchestrator upgrade`
+* runs before it restarts the service.
+*
+* A container scaler spawns each agent from the image its label set names, not
+* from the upgraded orchestrator. So an upgrade leaves container agents on the
+* old release when a label set pins an older `kici-agent:<version>`, or names
+* the moving `:latest` tag with the default `imagePullPolicy: IfNotPresent`: a
+* host that already pulled `:latest` keeps that image. The check only warns:
+* it never rewrites the operator's scaler config and never stops the upgrade.
+*/
+/** The repository name of the published agent image, under any registry or mirror. */
+const AGENT_IMAGE_NAME = "kici-agent";
+/** The moving tag an untagged image reference resolves to. */
+const LATEST_TAG = "latest";
+/**
+* Split `[registry/]path/name[:tag][@digest]`. A `:` before the last `/` is a
+* registry port, not a tag.
+*/
+function parseImageRef(image) {
+	const at = image.indexOf("@");
+	const named = at === -1 ? image : image.slice(0, at);
+	const digest = at === -1 ? null : image.slice(at + 1);
+	const colon = named.lastIndexOf(":");
+	if (colon > named.lastIndexOf("/")) return {
+		repository: named.slice(0, colon),
+		tag: named.slice(colon + 1),
+		digest
+	};
+	return {
+		repository: named,
+		tag: null,
+		digest
+	};
+}
+/** True when the repository is the KiCI agent image, from quay.io or a mirror. */
+function isAgentImage(repository) {
+	return repository.slice(repository.lastIndexOf("/") + 1) === AGENT_IMAGE_NAME;
+}
+/** -1, 0 or 1 as `a` is an older, the same or a newer release than `b`; null for a non-version. */
+function compareReleases(a, b) {
+	const left = parseVersionBase(a.replace(/^v/, ""));
+	const right = parseVersionBase(b.replace(/^v/, ""));
+	if (!left || !right) return null;
+	for (let i = 0; i < 3; i++) if (left[i] !== right[i]) return left[i] < right[i] ? -1 : 1;
+	return 0;
+}
+/**
+* Every container-scaler label set whose agent image an upgrade to
+* `targetVersion` leaves unchanged. An empty result means each agent image is
+* pinned to the target (or newer), pulled on every spawn, or not a KiCI agent.
+*/
+function checkContainerAgentImages(args) {
+	const { config } = args;
+	const bare = args.targetVersion?.trim().replace(/^v/, "") ?? null;
+	const targetVersion = bare && parseVersionBase(bare) ? bare : null;
+	const where = args.scalerConfigDir ? `${args.scalerConfigPath} (or the file under ${args.scalerConfigDir} that declares it)` : args.scalerConfigPath;
+	const findings = [];
+	for (const entry of config.scalers) {
+		if (entry.type !== ScalerBackendType.enum.container) continue;
+		for (const ls of entry.labelSets) {
+			if (!ls.image) continue;
+			const ref = parseImageRef(ls.image);
+			if (!isAgentImage(ref.repository)) continue;
+			const pinned = targetVersion ? `${ref.repository}:${targetVersion}` : null;
+			const prefix = `container scaler "${entry.name}", label set [${ls.labels.join(", ")}]: image ${ls.image}`;
+			const finding = (issue, message) => ({
+				issue,
+				scaler: entry.name,
+				labels: ls.labels,
+				image: ls.image,
+				message: `${prefix} ${message}`
+			});
+			const policy = ls.imagePullPolicy ?? ImagePullPolicy.enum.IfNotPresent;
+			if ((ref.tag === null || ref.tag === LATEST_TAG) && ref.digest === null && policy === ImagePullPolicy.enum.IfNotPresent) {
+				const pin = pinned ? `set "image: ${pinned}"` : `set image to the kici-agent release you upgrade to (${ref.repository}:<version>)`;
+				findings.push(finding("moving-tag", `with imagePullPolicy IfNotPresent keeps the agent image this host already pulled, so the upgrade does not change the container agents. In ${where}, ${pin} on this label set, or set "imagePullPolicy: Always" to pull ${LATEST_TAG} on every spawn.`));
+				continue;
+			}
+			if (!targetVersion || ref.tag === null) continue;
+			if (compareReleases(ref.tag, targetVersion) === -1) findings.push(finding("older-pin", `is older than the upgrade target ${targetVersion}, so the container agents keep running ${ref.tag}. In ${where}, set "image: ${pinned}" on this label set.`));
+		}
+	}
+	return findings;
+}
+/**
+* Print one warning per container label set whose agent image the upgrade
+* leaves unchanged. Never throws, and stays silent when the env file or the
+* scaler config cannot be read: the bare-metal `binaryPath` check, which runs
+* first on the same files, already reports that.
+*/
+async function warnAboutContainerAgentImages(args) {
+	let location;
+	let config;
+	try {
+		location = scalerConfigLocation(fs.readFileSync(args.envFilePath, "utf-8"), args.workingDirectory);
+		if (!location) return;
+		config = await loadScalerConfig(location.configPath, location.configDir);
+	} catch {
+		return;
+	}
+	const findings = checkContainerAgentImages({
+		config,
+		targetVersion: args.targetVersion,
+		scalerConfigPath: location.configPath,
+		...location.configDir ? { scalerConfigDir: location.configDir } : {}
+	});
+	for (const f of findings) args.warn(`Warning: ${f.message}`);
+}
+//#endregion
 //#region src/cli/commands/shared/versioned-upgrade.ts
 /**
 * Versioned-directory upgrade shared by the kici-admin upgrade commands: each
@@ -24141,14 +24271,16 @@ Nothing was installed and the service was not restarted. Fix binaryPath and run
 */
 init_service();
 /**
-* Check every bare-metal `binaryPath` of an orchestrator before the upgrade
-* installs or restarts anything. `spec` is the unit's launch command: the
-* `kici-agent` installed with its runtime is the one each `binaryPath` should
+* Check an orchestrator's scaler config before the upgrade installs or
+* restarts anything. `spec` is the unit's launch command: the `kici-agent`
+* installed with its runtime is the one each bare-metal `binaryPath` should
 * name. `expectedVersion` is what that agent runs after the upgrade, when the
 * caller knows it. Throws when a `binaryPath` would stop the restarted service,
-* unless `skip` is set: then every finding is a warning.
+* unless `skip` is set: then every finding is a warning. Then warns about each
+* container label set whose agent image stays behind `targetVersion`, the
+* release the service runs after the upgrade.
 */
-async function checkBareMetalBinaryPathsBeforeUpgrade(args) {
+async function checkScalersBeforeUpgrade(args) {
 	if (args.component !== "orchestrator" || args.platform === "compose") return;
 	const expectedAgent = args.spec ? agentBinaryFromLaunch(args.spec, isWindows(args.platform)) : null;
 	await preflightBareMetalBinaryPaths({
@@ -24161,6 +24293,12 @@ async function checkBareMetalBinaryPathsBeforeUpgrade(args) {
 		skip: args.skip,
 		warn: (line) => console.warn(line)
 	});
+	await warnAboutContainerAgentImages({
+		envFilePath: args.config.envFilePath,
+		workingDirectory: args.config.workingDirectory,
+		targetVersion: args.targetVersion,
+		warn: (line) => console.warn(line)
+	});
 }
 /**
 * Resolve the upgrade target through {@link resolveInstanceTarget}: `instanceDir`,
@@ -24748,12 +24886,13 @@ async function performVersionedUpgrade(component, opts, hooks = {}) {
 			console.error(`Error: service "${config.name}" is not installed`);
 			process.exit(1);
 		}
-		await checkBareMetalBinaryPathsBeforeUpgrade({
+		await checkScalersBeforeUpgrade({
 			component,
 			config,
 			platform,
 			spec: await manager.readLaunchSpec(config),
 			expectedVersion: null,
+			targetVersion: version,
 			willInstall: false,
 			skip: opts.skipBinaryPathCheck ?? false
 		});
@@ -24909,12 +25048,13 @@ async function restartOnlyUpgrade(args) {
 		console.error(`Error: ${verdict.reason}`);
 		process.exit(1);
 	}
-	await checkBareMetalBinaryPathsBeforeUpgrade({
+	await checkScalersBeforeUpgrade({
 		component: args.component,
 		config,
 		platform,
 		spec,
 		expectedVersion: null,
+		targetVersion: verdict.version,
 		willInstall: false,
 		skip: opts.skipBinaryPathCheck ?? false
 	});
@@ -24945,12 +25085,13 @@ async function restartOnlyUpgrade(args) {
 async function performSelfDrivingInstall(args) {
 	const { component, config, resolvedInstance, manager, action, opts, platform, spec } = args;
 	const { target, version } = action;
-	await checkBareMetalBinaryPathsBeforeUpgrade({
+	await checkScalersBeforeUpgrade({
 		component,
 		config,
 		platform,
 		spec,
 		expectedVersion: `${target.owningPackage}@${version}`,
+		targetVersion: version,
 		willInstall: true,
 		skip: opts.skipBinaryPathCheck ?? false
 	});
@@ -25108,7 +25249,7 @@ async function switchToInstalledVersion(args) {
 		action: `switch "${config.name}" to ${targetVersion}`,
 		config
 	});
-	await warnAboutBareMetalBinaryPaths(args);
+	await warnAboutScalers(args);
 	if (!await assertSchemaAllowsSwitch({
 		component,
 		targetVersion,
@@ -25142,18 +25283,20 @@ async function switchToInstalledVersion(args) {
 	});
 }
 /**
-* Print the bare-metal `binaryPath` diagnosis before `--rollback` or `--pick`
-* restarts the service. Never refuses and never throws: both are recovery
-* paths, and a check that cannot run must not block a recovery.
+* Print the bare-metal `binaryPath` and container agent image diagnoses before
+* `--rollback` or `--pick` restarts the service. Never refuses and never
+* throws: both are recovery paths, and a check that cannot run must not block
+* a recovery.
 */
-async function warnAboutBareMetalBinaryPaths(args) {
+async function warnAboutScalers(args) {
 	try {
-		await checkBareMetalBinaryPathsBeforeUpgrade({
+		await checkScalersBeforeUpgrade({
 			component: args.component,
 			config: args.config,
 			platform: args.platform,
 			spec: await args.manager.readLaunchSpec(args.config).catch(() => null),
 			expectedVersion: null,
+			targetVersion: args.targetVersion,
 			willInstall: false,
 			skip: true
 		});
@@ -26677,7 +26820,7 @@ init_manifest();
 const ALL_PLATFORMS = AgentPlatform.options;
 /** The orchestrator's own version (single-version invariant) = the packaged agent version. */
 function resolveKiciVersion() {
-	return "0.19.0";
+	return "0.20.0";
 }
 /** Parse the --platform value: default set | single | CSV | `all`. */
 function parsePlatforms(raw) {
@@ -36926,7 +37069,7 @@ function routeRootArgs(root, args) {
 * build entry; the fallback covers a source run (tests, `tsx`), the same shape
 * `server.ts` and `standalone.ts` use for `ORCHESTRATOR_VERSION`.
 */
-const CLI_VERSION = "0.19.0";
+const CLI_VERSION = "0.20.0";
 /**
 * Root command whose option parsing first routes argv through
 * {@link routeRootArgs}: a leading `--version` prints the CLI version, and an

package/dist/server.js

@@ -44036,7 +44036,10 @@ async function resolveLockFileForTest(input, deps, runId) {
 function selectMatchedDecisions(input, fullLockFile, simulatedEvent) {
 	let decisions;
 	if (input.workflowName) {
-		if (!fullLockFile.workflows.find((w) => w.name === input.workflowName)) return { rejected: `Workflow '${input.workflowName}' not found in lock file` };
+		if (!fullLockFile.workflows.find((w) => w.name === input.workflowName)) {
+			const available = fullLockFile.workflows.map((w) => w.name).join(", ");
+			return { rejected: `Workflow '${input.workflowName}' not found in lock file. Available workflows: ${available || "(none)"}` };
+		}
 		decisions = [createWorkflowDecision(input.workflowName, true, [], void 0, "Direct test run")];
 	} else decisions = matchAllWorkflows(fullLockFile.workflows, simulatedEvent);
 	const matched = decisions.filter((d) => d.matched);
@@ -48960,13 +48963,13 @@ function createHealthRoutes$1(deps = {}) {
 	return createHealthRoutes({
 		livenessInfo: () => {
 			return {
-				version: "0.19.0",
-				buildDate: "2026-10-16T22:00:26.244Z",
-				sdkVersion: "0.19.0",
+				version: "0.20.0",
+				buildDate: "2026-10-17T08:12:16.425Z",
+				sdkVersion: "0.20.0",
 				sdkBundleHash: "b012bd8bace3df9e574252bf290c652bc39766da617acf51729a08586756266d",
-				sharedVersion: "0.19.0",
+				sharedVersion: "0.20.0",
 				sharedBundleHash: "23378ace59973f47203be3ff171bb7d5e66702eaa335927b390f94b9771a1f8b",
-				engineVersion: "0.19.0",
+				engineVersion: "0.20.0",
 				engineBundleHash: "406208ee50766cd0d4ce3ab1fd5dec4501d5117a74acd294b25736d9bd6e89bd"
 			};
 		},
@@ -48999,7 +49002,7 @@ function createCapabilitiesRoutes() {
 	const app = new Hono();
 	app.get("/api/v1/capabilities", (c) => {
 		const manifest = {
-			orchestratorVersion: "0.19.0",
+			orchestratorVersion: "0.20.0",
 			protocolVersion: PROTOCOL_VERSION,
 			minProtocolVersion: MIN_PROTOCOL_VERSION
 		};
@@ -59636,7 +59639,7 @@ var init_app = __esmMin((() => {
 	init_agent_metrics_aggregator();
 	init_run_detached();
 	logger$66 = createLogger({ prefix: "app" });
-	ORCHESTRATOR_VERSION$2 = "0.19.0";
+	ORCHESTRATOR_VERSION$2 = "0.20.0";
 	SourceLocationStore = class {
 		cache = /* @__PURE__ */ new Map();
 		key(workflowName, jobName) {
@@ -68727,7 +68730,7 @@ var init_peer_client = __esmMin((() => {
 		PeerDialOrigin["Discovered"] = "discovered";
 		return PeerDialOrigin;
 	}({});
-	SOFTWARE_VERSION$1 = "0.19.0";
+	SOFTWARE_VERSION$1 = "0.20.0";
 	PeerClient$1 = class {
 		ws = null;
 		_state = "disconnected";
@@ -71198,7 +71201,7 @@ var init_peer_handler = __esmMin((() => {
 	init_join_token();
 	init_run_detached();
 	logger$46 = createLogger({ prefix: "peer-handler" });
-	SOFTWARE_VERSION = "0.19.0";
+	SOFTWARE_VERSION = "0.20.0";
 	ADVERTISED_PEER_AUTH_SCHEMES = [PeerAuthScheme.enum["mutual-v2"]];
 	MAX_TOKEN_CANDIDATES = 8;
 	RATE_LIMIT_MAX = 5;
@@ -100380,12 +100383,12 @@ var init_worker_core = __esmMin((() => {
 	init_app_on_error();
 	init_run_detached();
 	init_peer_job_cancel();
-	ORCHESTRATOR_VERSION$1 = "0.19.0";
-	WORKER_SDK_VERSION = "0.19.0";
+	ORCHESTRATOR_VERSION$1 = "0.20.0";
+	WORKER_SDK_VERSION = "0.20.0";
 	WORKER_SDK_BUNDLE_HASH = "b012bd8bace3df9e574252bf290c652bc39766da617acf51729a08586756266d";
-	WORKER_SHARED_VERSION = "0.19.0";
+	WORKER_SHARED_VERSION = "0.20.0";
 	WORKER_SHARED_BUNDLE_HASH = "23378ace59973f47203be3ff171bb7d5e66702eaa335927b390f94b9771a1f8b";
-	WORKER_ENGINE_VERSION = "0.19.0";
+	WORKER_ENGINE_VERSION = "0.20.0";
 	WORKER_ENGINE_BUNDLE_HASH = "406208ee50766cd0d4ce3ab1fd5dec4501d5117a74acd294b25736d9bd6e89bd";
 	logger$2 = createLogger({ prefix: "worker" });
 	DRAIN_TIMEOUT_MS = 3e5;
@@ -100413,12 +100416,12 @@ init_run_detached();
 init_dashboard_access();
 init_peer_job_cancel();
 init_orphan_requests();
-const ORCHESTRATOR_VERSION = "0.19.0";
-const SDK_VERSION = "0.19.0";
+const ORCHESTRATOR_VERSION = "0.20.0";
+const SDK_VERSION = "0.20.0";
 const SDK_BUNDLE_HASH = "b012bd8bace3df9e574252bf290c652bc39766da617acf51729a08586756266d";
-const SHARED_VERSION = "0.19.0";
+const SHARED_VERSION = "0.20.0";
 const SHARED_BUNDLE_HASH = "23378ace59973f47203be3ff171bb7d5e66702eaa335927b390f94b9771a1f8b";
-const ENGINE_VERSION = "0.19.0";
+const ENGINE_VERSION = "0.20.0";
 const ENGINE_BUNDLE_HASH = "406208ee50766cd0d4ce3ab1fd5dec4501d5117a74acd294b25736d9bd6e89bd";
 const otelSdk = initTelemetry({
 	serviceName: "kici-orchestrator",

package/dist/standalone.js

@@ -5979,7 +5979,7 @@ var init_peer_client = __esmMin((() => {
 		PeerDialOrigin["Discovered"] = "discovered";
 		return PeerDialOrigin;
 	}({});
-	SOFTWARE_VERSION$1 = "0.19.0";
+	SOFTWARE_VERSION$1 = "0.20.0";
 	PeerClient$1 = class {
 		ws = null;
 		_state = "disconnected";
@@ -8450,7 +8450,7 @@ var init_peer_handler = __esmMin((() => {
 	init_join_token();
 	init_run_detached();
 	logger$154 = createLogger({ prefix: "peer-handler" });
-	SOFTWARE_VERSION = "0.19.0";
+	SOFTWARE_VERSION = "0.20.0";
 	ADVERTISED_PEER_AUTH_SCHEMES = [PeerAuthScheme.enum["mutual-v2"]];
 	MAX_TOKEN_CANDIDATES = 8;
 	RATE_LIMIT_MAX = 5;
@@ -63630,7 +63630,10 @@ async function resolveLockFileForTest(input, deps, runId) {
 function selectMatchedDecisions(input, fullLockFile, simulatedEvent) {
 	let decisions;
 	if (input.workflowName) {
-		if (!fullLockFile.workflows.find((w) => w.name === input.workflowName)) return { rejected: `Workflow '${input.workflowName}' not found in lock file` };
+		if (!fullLockFile.workflows.find((w) => w.name === input.workflowName)) {
+			const available = fullLockFile.workflows.map((w) => w.name).join(", ");
+			return { rejected: `Workflow '${input.workflowName}' not found in lock file. Available workflows: ${available || "(none)"}` };
+		}
 		decisions = [createWorkflowDecision(input.workflowName, true, [], void 0, "Direct test run")];
 	} else decisions = matchAllWorkflows(fullLockFile.workflows, simulatedEvent);
 	const matched = decisions.filter((d) => d.matched);
@@ -68523,13 +68526,13 @@ function createHealthRoutes$1(deps = {}) {
 	return createHealthRoutes({
 		livenessInfo: () => {
 			return {
-				version: "0.19.0",
-				buildDate: "2026-10-16T22:00:26.244Z",
-				sdkVersion: "0.19.0",
+				version: "0.20.0",
+				buildDate: "2026-10-17T08:12:16.425Z",
+				sdkVersion: "0.20.0",
 				sdkBundleHash: "b012bd8bace3df9e574252bf290c652bc39766da617acf51729a08586756266d",
-				sharedVersion: "0.19.0",
+				sharedVersion: "0.20.0",
 				sharedBundleHash: "23378ace59973f47203be3ff171bb7d5e66702eaa335927b390f94b9771a1f8b",
-				engineVersion: "0.19.0",
+				engineVersion: "0.20.0",
 				engineBundleHash: "406208ee50766cd0d4ce3ab1fd5dec4501d5117a74acd294b25736d9bd6e89bd"
 			};
 		},
@@ -68562,7 +68565,7 @@ function createCapabilitiesRoutes() {
 	const app = new Hono();
 	app.get("/api/v1/capabilities", (c) => {
 		const manifest = {
-			orchestratorVersion: "0.19.0",
+			orchestratorVersion: "0.20.0",
 			protocolVersion: PROTOCOL_VERSION,
 			minProtocolVersion: MIN_PROTOCOL_VERSION
 		};
@@ -71796,7 +71799,7 @@ var init_app = __esmMin((() => {
 	init_agent_metrics_aggregator();
 	init_run_detached();
 	logger$38 = createLogger({ prefix: "app" });
-	ORCHESTRATOR_VERSION$2 = "0.19.0";
+	ORCHESTRATOR_VERSION$2 = "0.20.0";
 	SourceLocationStore = class {
 		cache = /* @__PURE__ */ new Map();
 		key(workflowName, jobName) {
@@ -91411,12 +91414,12 @@ var init_worker_core = __esmMin((() => {
 	init_app_on_error();
 	init_run_detached();
 	init_peer_job_cancel();
-	ORCHESTRATOR_VERSION$1 = "0.19.0";
-	WORKER_SDK_VERSION = "0.19.0";
+	ORCHESTRATOR_VERSION$1 = "0.20.0";
+	WORKER_SDK_VERSION = "0.20.0";
 	WORKER_SDK_BUNDLE_HASH = "b012bd8bace3df9e574252bf290c652bc39766da617acf51729a08586756266d";
-	WORKER_SHARED_VERSION = "0.19.0";
+	WORKER_SHARED_VERSION = "0.20.0";
 	WORKER_SHARED_BUNDLE_HASH = "23378ace59973f47203be3ff171bb7d5e66702eaa335927b390f94b9771a1f8b";
-	WORKER_ENGINE_VERSION = "0.19.0";
+	WORKER_ENGINE_VERSION = "0.20.0";
 	WORKER_ENGINE_BUNDLE_HASH = "406208ee50766cd0d4ce3ab1fd5dec4501d5117a74acd294b25736d9bd6e89bd";
 	logger$2 = createLogger({ prefix: "worker" });
 	DRAIN_TIMEOUT_MS = 3e5;
@@ -91446,12 +91449,12 @@ init_webhook_url_resolvers();
 init_run_detached();
 init_peer_job_cancel();
 init_orphan_requests();
-const ORCHESTRATOR_VERSION = "0.19.0";
-const SDK_VERSION = "0.19.0";
+const ORCHESTRATOR_VERSION = "0.20.0";
+const SDK_VERSION = "0.20.0";
 const SDK_BUNDLE_HASH = "b012bd8bace3df9e574252bf290c652bc39766da617acf51729a08586756266d";
-const SHARED_VERSION = "0.19.0";
+const SHARED_VERSION = "0.20.0";
 const SHARED_BUNDLE_HASH = "23378ace59973f47203be3ff171bb7d5e66702eaa335927b390f94b9771a1f8b";
-const ENGINE_VERSION = "0.19.0";
+const ENGINE_VERSION = "0.20.0";
 const ENGINE_BUNDLE_HASH = "406208ee50766cd0d4ce3ab1fd5dec4501d5117a74acd294b25736d9bd6e89bd";
 const otelSdk = initTelemetry({
 	serviceName: "kici-orchestrator",

package/installer-image-digests.json

@@ -1,7 +1,7 @@
 {
-  "version": "0.19.0",
+  "version": "0.20.0",
   "images": {
-    "kici-agent": "sha256:6948358a9f43843e1ef61fab37253d4d50ea2f4e16cc19810d029cec8117c5a7",
-    "kici-orchestrator": "sha256:f5d101af3e4dca37e68387168cbb3d241da71f86e11ee448ac87c038bf923580"
+    "kici-agent": "sha256:860c84bf420d76ce0900b0e41fe9fde0a7dfe47862d933028ff48da7efb7d1a4",
+    "kici-orchestrator": "sha256:b2bd35ee87b94f2612622d47d2e7c0bf6fdb8487e9631366e91bf48920f698fb"
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kici-dev/orchestrator",
-  "version": "0.19.0",
+  "version": "0.20.0",
   "description": "Customer-deployable orchestrator for the KiCI CI/CD stack. Receives webhook events (direct or via Platform relay), matches triggers against the lock file, and dispatches jobs to connected agents.",
   "keywords": [
     "ci",
@@ -90,8 +90,8 @@
     "ws": "^8.21.3",
     "yaml": "^2.9.1",
     "zod": "^4.6.5",
-    "@kici-dev/shared": "0.19.0",
-    "@kici-dev/engine": "0.19.0"
+    "@kici-dev/engine": "0.20.0",
+    "@kici-dev/shared": "0.20.0"
   },
   "kici": {
     "metrics": {
@@ -106,8 +106,8 @@
     "@types/dockerode": "^4.0.1",
     "@types/ws": "^8.18.1",
     "kysely-ctl": "^0.21.0",
-    "@kici-dev/test-support": "0.0.0",
-    "@kici-dev/agent": "0.19.0"
+    "@kici-dev/agent": "0.20.0",
+    "@kici-dev/test-support": "0.0.0"
   },
   "scripts": {
     "build": "node ../../scripts/build-service.mjs && tsc -p tsconfig.build.json --emitDeclarationOnly",

package/sbom.spdx.json

@@ -2,10 +2,10 @@
   "spdxVersion": "SPDX-2.3",
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "@kici-dev/orchestrator@0.19.0",
-  "documentNamespace": "https://kici.dev/sbom/%40kici-dev%2Forchestrator/0.19.0/40dd3338-67e9-407a-bb25-3c919db547ce",
+  "name": "@kici-dev/orchestrator@0.20.0",
+  "documentNamespace": "https://kici.dev/sbom/%40kici-dev%2Forchestrator/0.20.0/5a49c6d3-45cd-4b94-8d53-78bd4bffd04d",
   "creationInfo": {
-    "created": "2026-10-17T04:16:13Z",
+    "created": "2026-10-17T10:01:06Z",
     "creators": [
       "Tool: kici-sbom-generator"
     ]
@@ -964,9 +964,9 @@
       "homepage": "https://ericsmekens.github.io/jsep/tree/master/packages/regex#readme"
     },
     {
-      "SPDXID": "SPDXRef-Package--kici-dev-core-0.19.0",
+      "SPDXID": "SPDXRef-Package--kici-dev-core-0.20.0",
       "name": "@kici-dev/core",
-      "versionInfo": "0.19.0",
+      "versionInfo": "0.20.0",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
@@ -977,16 +977,16 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40kici-dev/core@0.19.0"
+          "referenceLocator": "pkg:npm/%40kici-dev/core@0.20.0"
         }
       ],
       "description": "Light shared utilities for the KiCI stack (logging, errors, formatting, crypto, zx init, the TypeScript ESM loader hook). No server-side dependencies.",
       "homepage": "https://kici.dev"
     },
     {
-      "SPDXID": "SPDXRef-Package--kici-dev-engine-0.19.0",
+      "SPDXID": "SPDXRef-Package--kici-dev-engine-0.20.0",
       "name": "@kici-dev/engine",
-      "versionInfo": "0.19.0",
+      "versionInfo": "0.20.0",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
@@ -997,7 +997,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40kici-dev/engine@0.19.0"
+          "referenceLocator": "pkg:npm/%40kici-dev/engine@0.20.0"
         }
       ],
       "description": "Shared business logic for the KiCI CI/CD stack: protocol, triggers, state machine, and provider interfaces used by the Platform relay, orchestrator, and compiler.",
@@ -1006,7 +1006,7 @@
     {
       "SPDXID": "SPDXRef-RootPackage",
       "name": "@kici-dev/orchestrator",
-      "versionInfo": "0.19.0",
+      "versionInfo": "0.20.0",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
@@ -1017,16 +1017,16 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40kici-dev/orchestrator@0.19.0"
+          "referenceLocator": "pkg:npm/%40kici-dev/orchestrator@0.20.0"
         }
       ],
       "description": "Customer-deployable orchestrator for the KiCI CI/CD stack. Receives webhook events (direct or via Platform relay), matches triggers against the lock file, and dispatches jobs to connected agents.",
       "homepage": "https://kici.dev"
     },
     {
-      "SPDXID": "SPDXRef-Package--kici-dev-shared-0.19.0",
+      "SPDXID": "SPDXRef-Package--kici-dev-shared-0.20.0",
       "name": "@kici-dev/shared",
-      "versionInfo": "0.19.0",
+      "versionInfo": "0.20.0",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
@@ -1037,7 +1037,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40kici-dev/shared@0.19.0"
+          "referenceLocator": "pkg:npm/%40kici-dev/shared@0.20.0"
         }
       ],
       "description": "Shared utilities for the KiCI CI/CD stack — logging, zx setup, crypto, telemetry, health and metrics routes. No business logic.",
@@ -7676,62 +7676,62 @@
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.19.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.20.0",
       "relatedSpdxElement": "SPDXRef-Package-oxc-transform-0.150.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.19.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.20.0",
       "relatedSpdxElement": "SPDXRef-Package-picocolors-1.1.1",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.19.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.20.0",
       "relatedSpdxElement": "SPDXRef-Package-winston-daily-rotate-file-5.0.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.19.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.20.0",
       "relatedSpdxElement": "SPDXRef-Package-winston-3.19.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.19.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.20.0",
       "relatedSpdxElement": "SPDXRef-Package-zod-4.6.5",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.19.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.20.0",
       "relatedSpdxElement": "SPDXRef-Package-zx-8.8.5",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.19.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.20.0",
       "relatedSpdxElement": "SPDXRef-Package-jose-6.2.12",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.19.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.20.0",
       "relatedSpdxElement": "SPDXRef-Package-jsonpath-plus-10.4.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.19.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.20.0",
       "relatedSpdxElement": "SPDXRef-Package-picomatch-4.0.7",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.19.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.20.0",
       "relatedSpdxElement": "SPDXRef-Package-safe-regex-2.1.1",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.19.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.20.0",
       "relatedSpdxElement": "SPDXRef-Package-yaml-2.9.1",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.19.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.20.0",
       "relatedSpdxElement": "SPDXRef-Package-zod-4.6.5",
       "relationshipType": "DEPENDS_ON"
     },
@@ -7767,12 +7767,12 @@
     },
     {
       "spdxElementId": "SPDXRef-RootPackage",
-      "relatedSpdxElement": "SPDXRef-Package--kici-dev-engine-0.19.0",
+      "relatedSpdxElement": "SPDXRef-Package--kici-dev-engine-0.20.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
       "spdxElementId": "SPDXRef-RootPackage",
-      "relatedSpdxElement": "SPDXRef-Package--kici-dev-shared-0.19.0",
+      "relatedSpdxElement": "SPDXRef-Package--kici-dev-shared-0.20.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
@@ -7881,117 +7881,117 @@
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.19.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.20.0",
       "relatedSpdxElement": "SPDXRef-Package--aws-sdk-client-s3-3.1135.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.19.0",
-      "relatedSpdxElement": "SPDXRef-Package--kici-dev-core-0.19.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.20.0",
+      "relatedSpdxElement": "SPDXRef-Package--kici-dev-core-0.20.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.19.0",
-      "relatedSpdxElement": "SPDXRef-Package--kici-dev-engine-0.19.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.20.0",
+      "relatedSpdxElement": "SPDXRef-Package--kici-dev-engine-0.20.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.19.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.20.0",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-api-1.9.1",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.19.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.20.0",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-exporter-metrics-otlp-http-0.222.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.19.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.20.0",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-exporter-prometheus-0.222.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.19.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.20.0",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-exporter-trace-otlp-http-0.222.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.19.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.20.0",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-instrumentation-runtime-node-0.35.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.19.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.20.0",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-resources-2.11.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.19.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.20.0",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-sdk-node-0.222.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.19.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.20.0",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-semantic-conventions-1.43.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.19.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.20.0",
       "relatedSpdxElement": "SPDXRef-Package-archiver-8.0.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.19.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.20.0",
       "relatedSpdxElement": "SPDXRef-Package-diff-9.0.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.19.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.20.0",
       "relatedSpdxElement": "SPDXRef-Package-hono-4.13.7",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.19.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.20.0",
       "relatedSpdxElement": "SPDXRef-Package-kysely-0.29.4",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.19.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.20.0",
       "relatedSpdxElement": "SPDXRef-Package-oxc-transform-0.150.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.19.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.20.0",
       "relatedSpdxElement": "SPDXRef-Package-pg-8.23.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.19.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.20.0",
       "relatedSpdxElement": "SPDXRef-Package-picocolors-1.1.1",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.19.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.20.0",
       "relatedSpdxElement": "SPDXRef-Package-winston-daily-rotate-file-5.0.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.19.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.20.0",
       "relatedSpdxElement": "SPDXRef-Package-winston-3.19.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.19.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.20.0",
       "relatedSpdxElement": "SPDXRef-Package-yaml-2.9.1",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.19.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.20.0",
       "relatedSpdxElement": "SPDXRef-Package-zod-4.6.5",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.19.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.20.0",
       "relatedSpdxElement": "SPDXRef-Package-zx-8.8.5",
       "relationshipType": "DEPENDS_ON"
     },