@kici-dev/orchestrator 0.20.1 → 0.21.0

package/dist/cli/api-client.d.ts

@@ -491,6 +491,8 @@ export declare class AdminApiClient {
         workflowName?: string;
         repo?: string;
         since?: string;
+        /** Only runs whose id starts with these characters. */
+        runIdPrefix?: string;
         limit?: number;
         offset?: number;
     }): Promise<{

package/dist/cli/commands/runs.d.ts

@@ -7,6 +7,8 @@ import { type AgentStepLogs } from '@kici-dev/engine';
  * recorded, or a log is stored and holds nothing. `null` when the step has
  * lines, or when the orchestrator does not report which case applies.
  */
-export declare function emptyStepLogNote(stepIndex: number, logs: Pick<AgentStepLogs, 'totalLines' | 'recorded'>): string | null;
+export declare function emptyStepLogNote(
+/** The step index, or an init step's `init[<n>]` label. */
+step: number | string, logs: Pick<AgentStepLogs, 'totalLines' | 'recorded'>): string | null;
 export declare function registerRunsCommands(program: Command, getClient: () => AdminApiClient): void;
 //# sourceMappingURL=runs.d.ts.map

package/dist/cli/commands/shared/run-ref.d.ts

@@ -0,0 +1,4 @@
+import type { AdminApiClient } from '../../api-client.js';
+/** The full run id `ref` names; a prefix resolves through the run list. */
+export declare function resolveRunRef(client: AdminApiClient, ref: string): Promise<string>;
+//# sourceMappingURL=run-ref.d.ts.map

package/dist/cli/commands/source.d.ts

@@ -2,7 +2,7 @@
  * `kici-admin source` commands: webhook source CRUD. A secret flag takes a
  * literal value, `@/path/file`, `--from-env <VAR_NAME>` or `--stdin`.
  */
-import type { Command } from 'commander';
+import { type Command } from 'commander';
 import type { AdminApiClient } from '../api-client.js';
 /** Satisfied by both the HTTP `GenericSourceResponse` and the DB `GenericWebhookSource`. */
 interface ListableGenericRow {

package/dist/cli.js

@@ -8,7 +8,7 @@ import fs, { chmodSync, closeSync, constants, createReadStream, createWriteStrea
 import { Command, Option } from "commander";
 import { AGENT_DEFAULT_PORT, LOGGER_ENV_VARS, ORCHESTRATOR_DEFAULT_PORT, defineEnv, validateUnknownKiciVars } from "@kici-dev/shared/env";
 import { AgentPlatform, BaseColdStore, ChunkLru, PgTableAdapterBase, ReadinessStatus, addLogsToArchive, clearDispatchQueueDirect, computeMigrationsHash, createColdStoreAdminOps, createContextTemplateDirect, createDb, createDbRole, createLogger, createPool, createReadOnlyDbUser, createS3Client, decrypt, deleteContextDirect, deriveKey, diagnoseExitCode, diffFingerprints, dropAndCreateDatabase, emitKiciEventDirect, encrypt, ensureDatabase, fingerprintSchema, formatBytes, formatDiffEntry, formatUptime, isSchemaCurrent, kiciMkdtemp, listCheckRunTrackingDirect, listContextsDirect, listExecutionRunsDirect, listQueueDirect, listRegistrationsDirect, maskDatabaseUrl, parseDatabaseUrl, prunePeerCredentialsDirect, purgeContextsDirect, purgeScopedSecretsDirect, purgeSecretBackendsDirect, purgeStaleExecutionDirect, purgeStaleSourcesDirect, registerWorkflowManualDirect, resetRaftStateDirect, seedContextBindingDirect, seedContextDirect, serializeError, setContextPolicyDirect, setContextSecretDirect, sha256, showContextDirect, showExecutionRunDirect, showQueueEntryDirect, showRegistrationDirect, splitAgentPlatform, storeMigrationContentHash, toCommandError, toErrorMessage } from "@kici-dev/shared";
-import { AccessLogSource, ApprovalDecision, CiTrustLevel, ContextType, ExecutionJobStatus, FleetHostWriteRefusal, ForkPolicy, HoldType, JOIN_PROTOCOL_UNSUPPORTED_MESSAGE, JOIN_PROTOCOL_VERSION, JoinErrorCode, KICI_AGENT_ENV_PREFIX, KNOWN_ROLES, MinimumTrustSchema, OrchRole, OrchestratorMode, PLATFORM_CONNECTED_MODES, PRIVILEGED_ROOT_LABEL, PROTOCOL_VERSION, PeerForgetOutcome, RuntimeFact, ScalerBackendType, ScalerEventType, ScalerReloadOutcome, ScalerVmStatus, ScalerVmStopOutcome, ScalerVmTracker, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, WS_MAX_PAYLOAD_BYTES, accessLogWarmSqlCase, agentLabelOf, assertValidSecretKey, attestationVerifyStatusSchema, canonicalizeLabel, canonicalizeLabels, canonicalizeMatcher, flattenActor, formatExpiryDuration, getAccessLogColdDays, getSecretAuditLogColdDays, joinResponseSchema, matcherSatisfiedBy, minAccessLogWarmDays, minSecretAuditLogWarmDays, parseExpiryDuration, parseHostPropertyAssignments, platformToTaints, resolveHeldRunId, resolveRoleLabels, resourceRequestNestedSchema, runtimeLabel, scalerAgentLabels, scalerPlatformSchema, secretAuditLogWarmSqlCase, shouldRecordAccess, sleep, toIsoString } from "@kici-dev/engine";
+import { AccessLogSource, ApprovalDecision, CiTrustLevel, ContextType, ExecutionJobStatus, FleetHostWriteRefusal, ForkPolicy, HoldType, JOIN_PROTOCOL_UNSUPPORTED_MESSAGE, JOIN_PROTOCOL_VERSION, JoinErrorCode, KICI_AGENT_ENV_PREFIX, KNOWN_ROLES, MinimumTrustSchema, OrchRole, OrchestratorMode, PLATFORM_CONNECTED_MODES, PRIVILEGED_ROOT_LABEL, PROTOCOL_VERSION, PeerForgetOutcome, RuntimeFact, ScalerBackendType, ScalerEventType, ScalerReloadOutcome, ScalerVmStatus, ScalerVmStopOutcome, ScalerVmTracker, StepPhase, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, WS_MAX_PAYLOAD_BYTES, accessLogWarmSqlCase, agentLabelOf, assertValidSecretKey, attestationVerifyStatusSchema, canonicalizeLabel, canonicalizeLabels, canonicalizeMatcher, compareStepsByPhase, flattenActor, formatExpiryDuration, getAccessLogColdDays, getSecretAuditLogColdDays, initStepIndex, initStepLabel, initStepType, invalidRunIdMessage, joinResponseSchema, matcherSatisfiedBy, minAccessLogWarmDays, minSecretAuditLogWarmDays, parseExpiryDuration, parseHostPropertyAssignments, parseInitStepRef, parseRunIdRef, pickRunIdMatch, platformToTaints, resolveHeldRunId, resolveRoleLabels, resourceRequestNestedSchema, runIdHasPrefix, runtimeLabel, scalerAgentLabels, scalerPlatformSchema, secretAuditLogWarmSqlCase, shouldRecordAccess, sleep, stepPhase, toIsoString } from "@kici-dev/engine";
 import crypto$1, { createDecipheriv, createHash, createHmac, createPublicKey, diffieHellman, generateKeyPairSync, hkdfSync, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import { createInterface } from "node:readline";
 import { access, chmod, constants as constants$1, copyFile, link, mkdir, open, readFile, readdir, rename, rm, stat, unlink, writeFile } from "node:fs/promises";
@@ -521,6 +521,7 @@ var AdminApiClient = class {
 			workflowName: opts?.workflowName,
 			repo: opts?.repo,
 			since: opts?.since,
+			runIdPrefix: opts?.runIdPrefix,
 			limit: opts?.limit || void 0,
 			offset: opts?.offset || void 0
 		});
@@ -18801,8 +18802,10 @@ function renderSourceListText(githubSources, genericSources, hasOrg, opts) {
 		console.log("Tip: use --org <orgId> to also list generic sources.");
 	}
 }
-/** Matches the kici-admin global `--url` default. */
-const DEFAULT_ORCH_URL = process.env.KICI_ADMIN_URL ?? DEFAULT_ADMIN_URL;
+/** Mirrors the kici-admin global `--url`: KICI_ADMIN_URL, read at parse time, else the default. */
+function baseUrlOption() {
+	return new Option("--base-url <url>", "Orchestrator base URL").env("KICI_ADMIN_URL").default(DEFAULT_ADMIN_URL);
+}
 /** Null when the row is not a valid local source. */
 function parseLocalConfig(s) {
 	if (s.provider_type !== "local" || !s.git_config) return null;
@@ -19414,7 +19417,7 @@ function registerSourceCommands(program, getClient) {
 		await getClient().disableGenericSource(id);
 		console.log(`Generic source disabled: ${id}`);
 	}));
-	src.command("trigger-local <id>").description("Trigger a run against a local source (reads HEAD when --ref/--sha omitted)").option("--event <event>", "push | pull_request", "push").option("--ref <ref>", "Git ref (default: repo HEAD branch)").option("--sha <sha>", "Commit SHA (default: repo HEAD)").option("--before <sha>", "Commit before the push; the changed files are before..sha (default: parent of --sha)").option("--repo-full-name <name>", "owner/name identifier used in the payload", "local/repo").option("--base-url <url>", "Orchestrator base URL", DEFAULT_ORCH_URL).action(cliAction(async (id, opts) => {
+	src.command("trigger-local <id>").description("Trigger a run against a local source (reads HEAD when --ref/--sha omitted)").option("--event <event>", "push | pull_request", "push").option("--ref <ref>", "Git ref (default: repo HEAD branch)").option("--sha <sha>", "Commit SHA (default: repo HEAD)").option("--before <sha>", "Commit before the push; the changed files are before..sha (default: parent of --sha)").option("--repo-full-name <name>", "owner/name identifier used in the payload", "local/repo").addOption(baseUrlOption()).action(cliAction(async (id, opts) => {
 		const { source } = await getClient().getGenericSource(id);
 		const cfg = parseLocalConfig(source);
 		if (!cfg) {
@@ -19441,7 +19444,7 @@ function registerSourceCommands(program, getClient) {
 		console.log(`Triggered local source ${id}: HTTP ${status}`);
 		if (status >= 400) process.exit(1);
 	}));
-	src.command("install-hook <id>").description("Install a post-receive hook in the local source repo that triggers runs on push").option("--repo <path>", "Repo path (default: the source repoBasePath)").option("--base-url <url>", "Orchestrator base URL", DEFAULT_ORCH_URL).action(cliAction(async (id, opts) => {
+	src.command("install-hook <id>").description("Install a post-receive hook in the local source repo that triggers runs on push").option("--repo <path>", "Repo path (default: the source repoBasePath)").addOption(baseUrlOption()).action(cliAction(async (id, opts) => {
 		const { source } = await getClient().getGenericSource(id);
 		const cfg = parseLocalConfig(source);
 		if (!cfg) {
@@ -19617,6 +19620,33 @@ function registerWorkflowCommands(program, getClient) {
 	}));
 }
 //#endregion
+//#region src/cli/commands/shared/run-ref.ts
+/** Resolve a `kici-admin runs` run id: a full id, or a unique prefix (like a git short SHA). */
+const AMBIGUOUS_SHOWN = 5;
+const FIND_HINT = "'kici-admin runs list' shows full run ids";
+/** The full run id `ref` names; a prefix resolves through the run list. */
+async function resolveRunRef(client, ref) {
+	const parsed = parseRunIdRef(ref);
+	if (parsed.kind === "uuid") return parsed.runId;
+	if (parsed.kind === "invalid") throw new Error(invalidRunIdMessage(ref, parsed.reason, FIND_HINT));
+	const { runs, total } = await client.listRuns({
+		runIdPrefix: parsed.hex,
+		limit: AMBIGUOUS_SHOWN
+	});
+	const ids = runs.map((r) => String(r.runId));
+	const matches = ids.filter((id) => runIdHasPrefix(id, parsed.hex));
+	if (matches.length < ids.length && total > ids.length) throw new Error(prefixUnsupported(ref));
+	return pickRunIdMatch({
+		ref,
+		matches,
+		unseen: total - ids.length,
+		findHint: FIND_HINT
+	});
+}
+function prefixUnsupported(ref) {
+	return `This orchestrator cannot look up the run id prefix '${ref}'; pass the full run id (${FIND_HINT}).`;
+}
+//#endregion
 //#region src/cli/commands/runs.ts
 function formatDuration(ms) {
 	if (ms == null) return "-";
@@ -19657,6 +19687,42 @@ function workflowProvenanceLines(run) {
 	if (run.workflowBranch) lines.push(`  Workflow branch: ${run.workflowBranch}`);
 	return lines;
 }
+/**
+* A job's steps in run order: setup and init pseudo-steps first, whatever order the
+* orchestrator sent. An older orchestrator orders init steps by their stored index, last.
+*/
+function stepsInRunOrder(steps) {
+	return [...steps].sort(compareStepsByPhase);
+}
+/**
+* The `#` cell of a step row: the step index, or `init[<n>]` for an init step, whose
+* stored index is a high internal value and not a position among the steps.
+*/
+function stepNumberCell(step) {
+	const initIndex = initStepIndex(step.stepType);
+	return initIndex === void 0 ? String(step.stepIndex) : initStepLabel(initIndex);
+}
+/** The `type` cell of a `runs show` step row: blank for a plain step, `init` for any init. */
+function stepTypeCell(stepType) {
+	if (stepPhase(stepType) === StepPhase.enum.init) return StepPhase.enum.init;
+	return stepType === "step" ? "" : stepType;
+}
+/**
+* The stored step index `runs logs --step` names. An init step is shown as `init[<n>]`,
+* not by its stored index, so that label resolves through the job's steps; any other
+* value passes through for the server to validate.
+*/
+async function resolveStepRef(client, runId, jobId, step) {
+	const ref = String(step);
+	const initIndex = parseInitStepRef(ref);
+	if (initIndex === void 0) return ref;
+	const { jobs } = await client.getRunJobs(runId, { includeSteps: true });
+	const job = jobs.find((j) => j.jobId === jobId);
+	if (!job) throw new Error(`Job ${jobId} not found in run ${runId}`);
+	const match = (job.steps ?? []).find((s) => s.stepType === initStepType(initIndex));
+	if (!match) throw new Error(`Job ${jobId} has no ${initStepLabel(initIndex)} step`);
+	return String(match.stepIndex);
+}
 /** The step index of a job's setup log: the clone, the install and the module load. */
 const SETUP_LOG_STEP_INDEX = -1;
 /**
@@ -19664,11 +19730,12 @@ const SETUP_LOG_STEP_INDEX = -1;
 * recorded, or a log is stored and holds nothing. `null` when the step has
 * lines, or when the orchestrator does not report which case applies.
 */
-function emptyStepLogNote(stepIndex, logs) {
+function emptyStepLogNote(step, logs) {
 	if (logs.totalLines > 0 || logs.recorded === void 0) return null;
-	if (stepIndex === SETUP_LOG_STEP_INDEX) return logs.recorded ? "(the setup log for this job is empty)" : "(no setup log recorded for this job)";
-	return logs.recorded ? `(the log for step ${stepIndex} is empty)` : `(no log recorded for step ${stepIndex})`;
+	if (step === SETUP_LOG_STEP_INDEX) return logs.recorded ? "(the setup log for this job is empty)" : "(no setup log recorded for this job)";
+	return logs.recorded ? `(the log for step ${step} is empty)` : `(no log recorded for step ${step})`;
 }
+const RUN_ID_ARG_HELP = "Run id, or its first 4 or more characters";
 function registerRunsCommands(program, getClient) {
 	const runs = program.command("runs").description("Inspect execution runs, jobs, and steps");
 	runs.command("list").description("List execution runs (admin API: /api/v1/admin/runs)").option("--status <statuses>", "Filter by run status. Accepts a single value or a comma-separated list (e.g. success,failed)").option("--workflow-name <name>", "Filter by workflow name. A run that spans several workflows matches any of them").option("--repo <ownerRepo>", "Filter by repo identifier (owner/repo)").option("--since <iso8601>", "Only include runs with created_at strictly later than this ISO-8601 timestamp").option("--count", "Return only the count of matching runs, skipping the row listing").option("--limit <n>", "Max results (default 20, max 100)", "20").option("--offset <n>", "Skip first N results", "0").option("--json", "Emit raw JSON instead of a table").action(cliAction(async (opts) => {
@@ -19723,7 +19790,8 @@ function registerRunsCommands(program, getClient) {
 		console.log("");
 		console.log(`Showing ${data.runs.length} of ${data.total} (offset ${data.offset}, limit ${data.limit})`);
 	}));
-	runs.command("show <runId>").description("Show run detail with jobs and steps").option("--json", "Emit raw JSON instead of formatted output").action(cliAction(async (runId, opts) => {
+	runs.command("show").argument("<runId>", RUN_ID_ARG_HELP).description("Show run detail with jobs and steps").option("--json", "Emit raw JSON instead of formatted output").action(cliAction(async (runRef, opts) => {
+		const runId = await resolveRunRef(getClient(), runRef);
 		const client = getClient();
 		const [runRespRaw, jobsRespRaw] = await Promise.all([client.getRun(runId), client.getRunJobs(runId, { includeSteps: true })]);
 		const runResp = runRespRaw;
@@ -19800,18 +19868,19 @@ function registerRunsCommands(program, getClient) {
 				"duration",
 				"type"
 			];
-			const stepRows = (job.steps ?? []).map((s) => [
-				String(s.stepIndex),
+			const stepRows = stepsInRunOrder(job.steps ?? []).map((s) => [
+				stepNumberCell(s),
 				s.stepName,
 				s.status,
 				s.exitCode != null ? String(s.exitCode) : "-",
 				formatDuration(s.durationMs),
-				s.stepType === "step" ? "" : s.stepType
+				stepTypeCell(s.stepType)
 			]);
 			console.log(renderTable(stepHeaders, stepRows));
 		}
 	}));
-	runs.command("structured <runId>").description("Show the provenance-tagged structured run result (agent read path; /structured)").option("--json", "Emit the raw AgentRunResult (untrusted envelopes preserved)").action(cliAction(async (runId, opts) => {
+	runs.command("structured").argument("<runId>", RUN_ID_ARG_HELP).description("Show the provenance-tagged structured run result (agent read path; /structured)").option("--json", "Emit the raw AgentRunResult (untrusted envelopes preserved)").action(cliAction(async (runRef, opts) => {
+		const runId = await resolveRunRef(getClient(), runRef);
 		const result = await getClient().getRunStructured(runId);
 		if (opts.json) {
 			console.log(JSON.stringify(result, null, 2));
@@ -19854,8 +19923,8 @@ function registerRunsCommands(program, getClient) {
 				"exit",
 				"duration"
 			];
-			const stepRows = job.steps.map((s) => [
-				String(s.stepIndex),
+			const stepRows = stepsInRunOrder(job.steps).map((s) => [
+				stepNumberCell(s),
 				uv(s.stepName),
 				s.status,
 				s.exitCode != null ? String(s.exitCode) : "-",
@@ -19864,7 +19933,8 @@ function registerRunsCommands(program, getClient) {
 			console.log(renderTable(stepHeaders, stepRows));
 		}
 	}));
-	runs.command("jobs <runId>").description("List jobs for a run (admin API: /api/v1/admin/runs/:runId/jobs)").option("--include-steps", "Embed step list inside each job (default false)").option("--json", "Emit raw JSON instead of a table").action(cliAction(async (runId, opts) => {
+	runs.command("jobs").argument("<runId>", RUN_ID_ARG_HELP).description("List jobs for a run (admin API: /api/v1/admin/runs/:runId/jobs)").option("--include-steps", "Embed step list inside each job (default false)").option("--json", "Emit raw JSON instead of a table").action(cliAction(async (runRef, opts) => {
+		const runId = await resolveRunRef(getClient(), runRef);
 		const response = await getClient().getRunJobs(runId, { includeSteps: Boolean(opts.includeSteps) });
 		if (opts.json) {
 			console.log(JSON.stringify(response, null, 2));
@@ -19907,8 +19977,8 @@ function registerRunsCommands(program, getClient) {
 					"exit",
 					"duration"
 				];
-				const stepRows = steps.map((s) => [
-					String(s.stepIndex),
+				const stepRows = stepsInRunOrder(steps).map((s) => [
+					stepNumberCell(s),
 					s.stepName,
 					s.status,
 					s.exitCode != null ? String(s.exitCode) : "-",
@@ -19918,10 +19988,12 @@ function registerRunsCommands(program, getClient) {
 			}
 		}
 	}));
-	runs.command("logs <runId>").description("Print a page of a step log (admin API: /api/v1/admin/runs/:runId/jobs/:jobId/steps/:i/logs)").requiredOption("--job <jobId>", "Job id (the dispatch_queue row id for an eval round)").option("--step <n>", "Step index (default 0; -1 is the job setup log)", "0").option("--limit <n>", "Max lines to return (default 500, server caps at 2000)", "500").option("--cursor <c>", "Line-offset cursor from a previous page").option("--json", "Emit raw JSON instead of plain lines").action(cliAction(async (runId, opts) => {
+	runs.command("logs").argument("<runId>", RUN_ID_ARG_HELP).description("Print a page of a step log (admin API: /api/v1/admin/runs/:runId/jobs/:jobId/steps/:i/logs)").requiredOption("--job <jobId>", "Job id (the dispatch_queue row id for an eval round)").option("--step <n>", "Step index (default 0; -1 is the job setup log), or an init step as init[<n>]", "0").option("--limit <n>", "Max lines to return (default 500, server caps at 2000)", "500").option("--cursor <c>", "Line-offset cursor from a previous page").option("--json", "Emit raw JSON instead of plain lines").action(cliAction(async (runRef, opts) => {
+		const runId = await resolveRunRef(getClient(), runRef);
+		const stepIndex = await resolveStepRef(getClient(), runId, String(opts.job), opts.step);
 		const params = new URLSearchParams({ limit: String(opts.limit) });
 		if (opts.cursor) params.set("cursor", String(opts.cursor));
-		const path = `/api/v1/admin/runs/${encodeURIComponent(runId)}/jobs/${encodeURIComponent(String(opts.job))}/steps/${encodeURIComponent(String(opts.step))}/logs?${params.toString()}`;
+		const path = `/api/v1/admin/runs/${encodeURIComponent(runId)}/jobs/${encodeURIComponent(String(opts.job))}/steps/${encodeURIComponent(stepIndex)}/logs?${params.toString()}`;
 		const response = await getClient().get(path);
 		if (opts.json) {
 			console.log(JSON.stringify(response, null, 2));
@@ -19929,10 +20001,12 @@ function registerRunsCommands(program, getClient) {
 		}
 		for (const line of response.lines) console.log(line.value);
 		if (response.nextCursor) console.error(`(more: re-run with --cursor ${response.nextCursor})`);
-		const note = emptyStepLogNote(parseInt(String(opts.step), 10), response);
+		const initIndex = parseInitStepRef(String(opts.step));
+		const note = emptyStepLogNote(initIndex === void 0 ? parseInt(stepIndex, 10) : initStepLabel(initIndex), response);
 		if (note) console.error(note);
 	}));
-	runs.command("ephemeral-key <runId>").description("Show whether the run-ephemeral key has been scrubbed yet").option("--json", "Emit raw JSON instead of plain text").action(cliAction(async (runId, opts) => {
+	runs.command("ephemeral-key").argument("<runId>", RUN_ID_ARG_HELP).description("Show whether the run-ephemeral key has been scrubbed yet").option("--json", "Emit raw JSON instead of plain text").action(cliAction(async (runRef, opts) => {
+		const runId = await resolveRunRef(getClient(), runRef);
 		const response = await getClient().getRunEphemeralKey(runId);
 		if (opts.json) {
 			console.log(JSON.stringify(response, null, 2));
@@ -19946,7 +20020,8 @@ function registerRunsCommands(program, getClient) {
 			console.log(`created_at: -`);
 		}
 	}));
-	runs.command("secret-outputs <runId>").description("List per-job secret outputs (masked by default; --reveal decrypts and audits)").option("--output-key <key>", "Filter to a single output_key").option("--reveal", "Decrypt and print plaintext values. Audited with actor=secret-outputs.reveal; requires secret.reveal permission").option("--json", "Emit raw JSON instead of a table").action(cliAction(async (runId, opts) => {
+	runs.command("secret-outputs").argument("<runId>", RUN_ID_ARG_HELP).description("List per-job secret outputs (masked by default; --reveal decrypts and audits)").option("--output-key <key>", "Filter to a single output_key").option("--reveal", "Decrypt and print plaintext values. Audited with actor=secret-outputs.reveal; requires secret.reveal permission").option("--json", "Emit raw JSON instead of a table").action(cliAction(async (runRef, opts) => {
+		const runId = await resolveRunRef(getClient(), runRef);
 		if (opts.reveal) process.stderr.write("⚠  --reveal will decrypt secret values; this call is recorded in secret_audit_log.\n");
 		const response = await getClient().getRunSecretOutputs(runId, {
 			outputKey: opts.outputKey,
@@ -26881,7 +26956,7 @@ init_manifest();
 const ALL_PLATFORMS = AgentPlatform.options;
 /** The orchestrator's own version (single-version invariant) = the packaged agent version. */
 function resolveKiciVersion() {
-	return "0.20.1";
+	return "0.21.0";
 }
 /** Parse the --platform value: default set | single | CSV | `all`. */
 function parsePlatforms(raw) {
@@ -30591,6 +30666,16 @@ function registerQueueCommands(program, getClient) {
 }
 //#endregion
 //#region src/cli/commands/execution.ts
+/**
+* The full run id `execution show` was given. Over the admin API a prefix resolves
+* like `kici-admin runs show`; the direct-database path takes a full id only.
+*/
+async function resolveExecutionRunRef(ref, client) {
+	if (client) return resolveRunRef(client, ref);
+	const parsed = parseRunIdRef(ref);
+	if (parsed.kind === "uuid") return parsed.runId;
+	throw new Error(`Invalid run id '${ref}': --database-url needs a full run id. Drop --database-url to look up a prefix over the admin API ('kici-admin execution list' shows full run ids).`);
+}
 function printRunsTable(runs) {
 	if (runs.length === 0) {
 		console.log("No execution runs found.");
@@ -30662,8 +30747,9 @@ function registerExecutionCommands(program, getClient) {
 			printJsonOr(opts.json, result, (r) => printRunsTable(r.runs));
 		}
 	}));
-	exec.command("show <runId>").description("Show one run + its jobs (by run_id)").option(DIRECT_DB_URL_FLAG, DIRECT_DB_URL_HELP).option("--json", "Emit JSON output").action(cliAction(async (runId, opts) => {
+	exec.command("show <runId>").description("Show one run + its jobs (by run_id, or its first 4+ characters)").option(DIRECT_DB_URL_FLAG, DIRECT_DB_URL_HELP).option("--json", "Emit JSON output").action(cliAction(async (runRef, opts) => {
 		const dbUrl = resolveDirectDbUrl(opts.databaseUrl);
+		const runId = await resolveExecutionRunRef(runRef, dbUrl ? void 0 : getClient());
 		const result = dbUrl ? await showExecutionRunDirect(dbUrl, { runId }) : await getClient().get(`/api/v1/admin/executions/${encodeURIComponent(runId)}`);
 		printJsonOr(opts.json, result, (r) => printRunShow(r.run, r.jobs));
 	}));
@@ -37130,7 +37216,7 @@ function routeRootArgs(root, args) {
 * build entry; the fallback covers a source run (tests, `tsx`), the same shape
 * `server.ts` and `standalone.ts` use for `ORCHESTRATOR_VERSION`.
 */
-const CLI_VERSION = "0.20.1";
+const CLI_VERSION = "0.21.0";
 /**
 * Root command whose option parsing first routes argv through
 * {@link routeRootArgs}: a leading `--version` prints the CLI version, and an
@@ -37153,7 +37239,7 @@ var KiciAdminProgram = class extends Command {
 */
 function buildProgram() {
 	const program = new KiciAdminProgram();
-	program.name("kici-admin").description("KiCI orchestrator admin CLI for managing config, secrets, and tokens").version(CLI_VERSION, `-V, ${ROOT_VERSION_FLAG}`, "output the version number (--version also works before a command)").option("-u, --url <url>", "Orchestrator URL", process.env.KICI_ADMIN_URL ?? DEFAULT_ADMIN_URL).option("-t, --token <token>", "Admin API token", process.env.KICI_ADMIN_TOKEN);
+	program.name("kici-admin").description("KiCI orchestrator admin CLI for managing config, secrets, and tokens").version(CLI_VERSION, `-V, ${ROOT_VERSION_FLAG}`, "output the version number (--version also works before a command)").addOption(new Option("-u, --url <url>", "Orchestrator URL").env("KICI_ADMIN_URL").default(DEFAULT_ADMIN_URL)).addOption(new Option("-t, --token <token>", "Admin API token").env("KICI_ADMIN_TOKEN"));
 	/** Lazy, so --help works without --token. */
 	function getClient() {
 		const opts = program.opts();

package/dist/db/types.d.ts

@@ -652,9 +652,9 @@ export interface ExecutionJobTable {
     /** Job name (e.g. "test", "test[node-18]") */
     job_name: string;
     /**
-     * The workflow that defines the job. A run can span several workflows (a
-     * fixture run with no `--workflow`), so the run's own `workflow_name` does not
-     * name it. NULL on a row written before the column existed.
+     * The workflow that defines the job. A run can span several workflows (an older `kici`'s shared
+     * fixture run), so the run's own
+     * `workflow_name` does not name it. NULL on a row written before the column existed.
      */
     workflow_name: ColumnType<string | null, string | null | undefined, string | null>;
     /** Job status: an `ExecutionJobStatus` value (engine). */

package/dist/index.js

@@ -2793,6 +2793,7 @@ var AdminApiClient = class {
 			workflowName: opts?.workflowName,
 			repo: opts?.repo,
 			since: opts?.since,
+			runIdPrefix: opts?.runIdPrefix,
 			limit: opts?.limit || void 0,
 			offset: opts?.offset || void 0
 		});

package/dist/pipeline/dispatch-matched-workflow.d.ts

@@ -199,9 +199,10 @@ export interface WorkflowDispatchContext {
      */
     runRegisteredBeforeDispatch?: boolean;
     /**
-     * Called each time this dispatch registers the run with the tracker. A
-     * fixture run dispatches several workflows under one run id, and holds the
-     * run open from the first registration until every workflow has registered.
+     * Called each time this dispatch registers the run with the tracker. An older `kici`'s shared
+     * fixture run dispatches several
+     * workflows under one run id, and holds the run open from the first
+     * registration until every workflow has registered.
      */
     onRunRegistered?: () => void;
     /**
@@ -433,7 +434,8 @@ interface JobEnvEvalResult {
  * Synthetic job-id prefix every needs-gate site stamps on a held-back job. The
  * release path (`dispatchReadyJob` → `findSyntheticJobId` → `addJobsToRun`)
  * keys on it, so it soundly recovers the gated set without threading a parallel
- * list through both the single-orch and cluster paths. Owned by `db/synthetic-job-ids.ts` so the `contexts/`
+ * list through both the single-orch and cluster paths. Owned by `db/synthetic-job-ids.ts` so the
+ * `contexts/`
  * concurrency sweep need not import this module.
  */
 export { NEEDS_PENDING_JOB_ID_PREFIX };

package/dist/pipeline/test-pipeline.d.ts

@@ -20,6 +20,10 @@
  *   decorating secret resolver), and the fixture's `secrets` context mapping
  *   resolves into namespaced secrets;
  * - direct workflow execution (bypass trigger matching) is supported.
+ *
+ * Like a webhook, it creates one run per matched workflow. A caller that
+ * follows a single run (no `acceptsMultipleRuns`) gets one shared run instead,
+ * and only when the workflows' job names cannot collide in it.
  */
 import { type ProcessingDeps } from './processor.js';
 import { type ActorPrincipal } from '@kici-dev/engine';
@@ -79,9 +83,18 @@ export interface TestTriggerInput {
      * here against the matched workflow's lock dispatch descriptor.
      */
     dispatchInputs?: Record<string, string>;
+    /**
+     * The caller follows every run in the result's `runs`. Without it, several
+     * matched workflows share one run, or the trigger is refused when their job
+     * names collide.
+     */
+    acceptsMultipleRuns?: boolean;
 }
 interface TestTriggerResult {
+    /** The first run's id: the only run when the caller follows one. */
     runId: string;
+    /** One entry per run, each executing one matched workflow. Absent for a shared run. */
+    runs?: TestTriggeredRun[];
     status: 'accepted' | 'rejected';
     reason?: string;
     jobIds: string[];
@@ -100,9 +113,16 @@ export declare function repoIdentityFromInlineInput(input: TestTriggerInput): {
     repoIdentifier: string;
     provider: string;
 };
+/** One run the trigger created, with the matched workflow it executes. */
+export interface TestTriggeredRun {
+    runId: string;
+    workflowName: string;
+    jobIds: string[];
+}
 /**
  * Process a test trigger through the shared dispatch core: one
- * `WorkflowDispatchContext` per matched workflow, into `dispatchMatchedWorkflow`.
+ * `WorkflowDispatchContext` per matched workflow, into `dispatchMatchedWorkflow`,
+ * each under its own run id.
  */
 export declare function processTestTrigger(input: TestTriggerInput, deps: ProcessingDeps): Promise<TestTriggerResult>;
 export {};

package/dist/reporting/check-run-reporter.d.ts

@@ -192,6 +192,8 @@ interface UpdateStepProgressOptions {
     jobName: string;
     stepIndex: number;
     stepName: string;
+    /** The step's `step_type`, when the agent sent one. */
+    stepType?: string;
     state: 'running' | 'success' | 'failed' | 'skipped' | 'cancelled';
     durationMs?: number;
     installationId?: number;

package/dist/reporting/check-run-summary.d.ts

@@ -42,7 +42,19 @@ export interface StepProgressEntry {
     name: string;
     status: 'pending' | 'running' | 'success' | 'failed' | 'skipped' | 'cancelled';
     durationMs?: number;
+    /** The step's stored index. An entry without one is read by its position (defensive). */
+    stepIndex?: number;
+    /** The step's `step_type`; places setup and init pseudo-steps first. */
+    stepType?: string;
 }
+/**
+ * Record one step's progress: replace the entry for its index, or add it in display
+ * order. Pseudo-steps have high indices (init at 1_000_000 + n), so the list is keyed
+ * by index rather than position; a positional list would pad every gap up to it.
+ */
+export declare function applyStepProgress(steps: StepProgressEntry[], entry: StepProgressEntry & {
+    stepIndex: number;
+}): StepProgressEntry[];
 interface BuildCheckRunSummaryOptions {
     jobName: string;
     stepResults: StepResultData[];

package/dist/reporting/execution-tracker.d.ts

@@ -285,9 +285,9 @@ export interface TrackedJobRow {
     jobId: string;
     jobName: string;
     /**
-     * The workflow that defines the job. A fixture run with no `--workflow` runs
-     * every matched workflow under one run id, so the run's own workflow does not
-     * name it. `onExecutionStarted` stamps its own workflow on a job without one;
+     * The workflow that defines the job. An older `kici`'s shared fixture run holds every matched
+     * workflow, so the run's own workflow
+     * does not name it. `onExecutionStarted` stamps its own workflow on a job without one;
      * `addJobsToRun` inherits it from the placeholder the job replaces.
      */
     workflowName?: string;
@@ -830,6 +830,13 @@ export declare class ExecutionTracker {
         dispatchedByFailureLifecycle?: boolean;
         /** Re-run lineage, when this run re-runs another. */
         rerunLineage?: RerunLineage;
+        /**
+         * Set for a `kici run` test run, so its init failure stays readable on the
+         * test-run status and log routes, which serve only test runs.
+         */
+        testRun?: {
+            fixtureId: string;
+        };
     }): Promise<void>;
     /**
      * Write one `failed` execution_runs row for a global eval round that never
@@ -946,6 +953,10 @@ export declare class ExecutionTracker {
          * {@link ExecutionTracker.recordGlobalEvalRoundFailureRun}).
          */
         dispatchRoutingKey?: string;
+        /** Set for a `kici run` test run, as on {@link ExecutionTracker.recordInitFailureRun}. */
+        testRun?: {
+            fixtureId: string;
+        };
     }): Promise<void>;
     /**
      * Claim a held global evaluation round for release (`held` → `pending`).

package/dist/reporting/run-workflow-names.d.ts

@@ -1,8 +1,8 @@
 /**
  * The workflows a run spans, read from its job rows.
  *
- * A fixture run with no `--workflow` runs every matched workflow under one run
- * id. `execution_runs.workflow_name` holds the first of them; each job row
+ * An older `kici`'s shared fixture run holds every
+ * matched workflow. `execution_runs.workflow_name` holds the first of them; each job row
  * records its own in `execution_jobs.workflow_name`.
  */
 import type { Kysely } from 'kysely';

package/dist/reporting/step-display-order.d.ts

@@ -3,26 +3,28 @@
  *
  * Sorting `execution_steps` by `step_index` alone puts a pseudo-step where its index landed,
  * not where it ran. That suits the cache pseudo-steps (indices above the real steps, mostly
- * bracketing the work), but a job's image build runs strictly FIRST.
+ * bracketing the work), but a job's image build and its init commands run strictly FIRST.
  *
  * The index cannot express this: `step.status` rejects a negative index (an agent sending one
  * to an older orchestrator is disconnected mid-job), and the check-run reporter
  * (`steps[stepIndex]`) and the dashboard (log fetching gated on `stepIndex >= 0`) treat a
- * negative index as absent. So the ordering is expressed by TYPE, here, once.
+ * negative index as absent. So the ordering is expressed by TYPE, as the engine's
+ * `StepPhase`, here, once.
  */
 import { type Expression } from 'kysely';
 /**
- * Sort key placing setup pseudo-steps (run before the job's real steps) first. Apply BEFORE
- * the `step_index` sort:
+ * Sort key placing steps by `StepPhase`: setup pseudo-steps, then init commands, then the
+ * job's steps. Apply BEFORE the `step_index` sort:
  *
  * ```ts
  * qb.orderBy(setupStepsFirst()).orderBy('step_index', 'asc')
  * ```
  *
  * Untyped steps and every real step share one key, so `step_index` alone orders each group.
+ * The init pattern matches `initStepIndex`: the prefix followed by digits only.
  */
 export declare function setupStepsFirst(): Expression<number>;
-/** In-memory equivalent, kept beside the SQL so the two agree on what "setup" means. */
+/** In-memory equivalent over DB rows, kept beside the SQL so the two agree on the phases. */
 export declare function compareStepsForDisplay(a: {
     step_type?: string | null;
     step_index: number;
@@ -30,4 +32,6 @@ export declare function compareStepsForDisplay(a: {
     step_type?: string | null;
     step_index: number;
 }): number;
+/** {@link compareStepsForDisplay} over untyped rows, such as cold-store rows read back from S3. */
+export declare function compareStepRowsForDisplay(a: Record<string, unknown>, b: Record<string, unknown>): number;
 //# sourceMappingURL=step-display-order.d.ts.map