@kici-dev/shared 0.1.15 → 0.1.17

package/dist/cold-store/bucket.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 //#region src/cold-store/bucket.ts
 /**
 * Map a `ColdRetention` to a stable S3 prefix segment. Rounds

package/dist/cold-store/chunk-encoder.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { sha256 } from "@kici-dev/core";
 import { gzipSync } from "node:zlib";
 //#region src/cold-store/chunk-encoder.ts

package/dist/cold-store/chunk-id.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { sha256 } from "@kici-dev/core";
 //#region src/cold-store/chunk-id.ts
 /**

package/dist/cold-store/cold-store.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { createS3Client } from "../s3-client.js";
 import { chunkObjectKey, encodeKeySegment, tablePrefix, tenantDayPrefix } from "./key.js";
 import { coldDaysToBucket, isLongerColdRetention } from "./bucket.js";

package/dist/cold-store/config.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 //#region src/cold-store/config.ts
 /**
 * Reasonable defaults — matches the design doc's section 5 table.

package/dist/cold-store/index.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { chunkObjectKey, encodeKeySegment, tablePrefix, tenantDayBucketPrefix, tenantDayPrefix } from "./key.js";
 import { COLD_BUCKET_NAMES, coldDaysToBucket, isLongerColdRetention } from "./bucket.js";
 import { computeChunkId } from "./chunk-id.js";

package/dist/cold-store/key.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 //#region src/cold-store/key.ts
 /**
 * Key helpers for S3 object layouts.

package/dist/cold-store/lru.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 //#region src/cold-store/lru.ts
 var ChunkLru = class {
 	maxBytes;

package/dist/cold-store/manifest.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 //#region src/cold-store/manifest.ts
 /**
 * Required fields shared by v1 and v2 manifests. Order is the on-disk

package/dist/cold-store/metrics.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { createMeter } from "../telemetry/metrics.js";
 //#region src/cold-store/metrics.ts
 let _meter;

package/dist/cold-store/table-adapter.js

@@ -1,2 +1,2 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 export {};

package/dist/cold-store/types.js

@@ -1,2 +1,2 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 export {};

package/dist/db-admin.d.ts

@@ -553,8 +553,8 @@ export interface EmitKiciEventOpts {
  * e2e helpers to simulate what `agent ctx.emit()` does from inside a step
  * execution — but without needing an actual running step. Returns the event id.
  *
- * Fixed `chain_depth=0` and `expires_at=NOW() + 1h` match emitInternalEvent()
- * in e2e/helpers/internal-webhook.ts, which this helper supersedes.
+ * Fixed `chain_depth=0` and `expires_at=NOW() + 1h` match emitLocalEvent()
+ * in e2e/helpers/local-webhook.ts, which this helper supersedes.
  */
 export declare function emitKiciEventDirect(databaseUrl: string, opts: EmitKiciEventOpts): Promise<{
     eventId: string;
@@ -567,18 +567,23 @@ export interface SeedGenericWebhookSourceOpts {
     /** Pre-computed routing key (caller uses `generic:${orgId}:${name}`) */
     routingKey: string;
     verificationMethod?: string;
-    /** 'generic' (Stripe-shaped) or 'internal' (github-shaped via InternalWebhookNormalizer) */
-    providerType?: 'generic' | 'internal';
+    /** 'generic' (Stripe-shaped) or 'local' (github-shaped via LocalWebhookNormalizer,
+     *  a git repo present on the agent filesystem cloned via file://). */
+    providerType?: 'generic' | 'local';
+    /** For `providerType='local'`: the per-source `{ repoBasePath, cloneUrlBase? }`
+     *  stored in `git_config`. The orchestrator reads `repoBasePath` from this row
+     *  at registration time to build the local provider bundle. */
+    gitConfig?: Record<string, unknown>;
 }
 /**
- * Upsert a row into `generic_webhook_sources` for internal E2E tests. Uses
+ * Upsert a row into `generic_webhook_sources`. Uses
  * `ON CONFLICT (routing_key) DO UPDATE` so warm-start mode (where the source
  * may already exist from a prior run) is idempotent.
  *
  * IMPORTANT: callers must invoke this BEFORE the orchestrator starts, because
  * GenericSourceManager caches sources at boot and does not reload them later.
  * This helper supersedes seedGenericWebhookSource() in
- * e2e/helpers/internal-webhook.ts.
+ * e2e/helpers/local-webhook.ts.
  */
 export declare function seedGenericWebhookSourceDirect(databaseUrl: string, opts: SeedGenericWebhookSourceOpts): Promise<void>;
 /**

package/dist/db-admin.js

@@ -1,4 +1,4 @@
-import "./chunk-gOLHoazu.js";
+import "./chunk-BTugEXQM.js";
 import { createPool } from "./db.js";
 import { createHash } from "node:crypto";
 import pg from "pg";
@@ -992,8 +992,8 @@ async function resetRaftStateDirect(databaseUrl) {
 * e2e helpers to simulate what `agent ctx.emit()` does from inside a step
 * execution — but without needing an actual running step. Returns the event id.
 *
-* Fixed `chain_depth=0` and `expires_at=NOW() + 1h` match emitInternalEvent()
-* in e2e/helpers/internal-webhook.ts, which this helper supersedes.
+* Fixed `chain_depth=0` and `expires_at=NOW() + 1h` match emitLocalEvent()
+* in e2e/helpers/local-webhook.ts, which this helper supersedes.
 */
 async function emitKiciEventDirect(databaseUrl, opts) {
 	const pool = createPool(databaseUrl);
@@ -1016,14 +1016,14 @@ async function emitKiciEventDirect(databaseUrl, opts) {
 	}
 }
 /**
-* Upsert a row into `generic_webhook_sources` for internal E2E tests. Uses
+* Upsert a row into `generic_webhook_sources`. Uses
 * `ON CONFLICT (routing_key) DO UPDATE` so warm-start mode (where the source
 * may already exist from a prior run) is idempotent.
 *
 * IMPORTANT: callers must invoke this BEFORE the orchestrator starts, because
 * GenericSourceManager caches sources at boot and does not reload them later.
 * This helper supersedes seedGenericWebhookSource() in
-* e2e/helpers/internal-webhook.ts.
+* e2e/helpers/local-webhook.ts.
 */
 async function seedGenericWebhookSourceDirect(databaseUrl, opts) {
 	const pool = createPool(databaseUrl);
@@ -1033,14 +1033,15 @@ async function seedGenericWebhookSourceDirect(databaseUrl, opts) {
         verification_method, verification_config,
         event_type_header, dedup_window_seconds,
         max_payload_bytes, rate_limit_rpm, enabled,
-        provider_type
-      ) VALUES ($1, $2, $3, $4, $5, '{}', 'x-event-type', 300, 10485760, 600, true, $6)
+        provider_type, git_config
+      ) VALUES ($1, $2, $3, $4, $5, '{}', 'x-event-type', 300, 10485760, 600, true, $6, $7::jsonb)
       ON CONFLICT (routing_key) DO UPDATE SET
         customer_id = EXCLUDED.customer_id,
         name = EXCLUDED.name,
         verification_method = EXCLUDED.verification_method,
         verification_config = EXCLUDED.verification_config,
         provider_type = EXCLUDED.provider_type,
+        git_config = EXCLUDED.git_config,
         enabled = true,
         deleted_at = NULL,
         updated_at = NOW()`, [
@@ -1049,7 +1050,8 @@ async function seedGenericWebhookSourceDirect(databaseUrl, opts) {
 			opts.name,
 			opts.routingKey,
 			opts.verificationMethod ?? "none",
-			opts.providerType ?? "generic"
+			opts.providerType ?? "generic",
+			opts.gitConfig ? JSON.stringify(opts.gitConfig) : null
 		]);
 	} finally {
 		await pool.end();

package/dist/db-collation.js

@@ -1,4 +1,4 @@
-import "./chunk-gOLHoazu.js";
+import "./chunk-BTugEXQM.js";
 import pg from "pg";
 //#region src/db-collation.ts
 /**

package/dist/db.js

@@ -1,4 +1,4 @@
-import "./chunk-gOLHoazu.js";
+import "./chunk-BTugEXQM.js";
 import pg from "pg";
 import { Kysely, PostgresDialect } from "kysely";
 import { createLogger } from "@kici-dev/core";

package/dist/diagnostics/bundle-archive.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Shared debug-bundle archive primitives.
+ *
+ * Allowlist config redaction and windowed log-file archiving, used by the
+ * orchestrator's in-process bundle writer, the kici-admin CLI's local bundle,
+ * and the agent's fleet mini-bundle assembler. Keeping one copy means a node
+ * cannot drift from the redaction posture of its peers.
+ */
+import type archiver from 'archiver';
+/** Maximum total log bytes to include in bundle (50MB). */
+export declare const MAX_LOG_BYTES: number;
+/**
+ * Redact config values using allowlist approach.
+ * Only known-safe fields are preserved; everything else becomes "****".
+ */
+export declare function redactConfig(obj: unknown, parentKey?: string): unknown;
+/**
+ * Add log files from logDir to the archive, respecting MAX_LOG_BYTES cap
+ * and the logWindow time filter. Matches any `*.log` file in the directory,
+ * so the per-instance filename pattern produced by
+ * `buildLogFilename()` is picked up without additional configuration.
+ *
+ * Exported for reuse by the `kici-admin debug-bundle` CLI command, which
+ * runs outside the orchestrator process but still needs to include the
+ * same log files in its locally-assembled bundle.
+ */
+export declare function addLogsToArchive(archive: archiver.Archiver, logDir: string, logWindowHours: number): Promise<void>;
+//# sourceMappingURL=bundle-archive.d.ts.map

package/dist/diagnostics/bundle-archive.js

@@ -0,0 +1,141 @@
+import "../chunk-BTugEXQM.js";
+import * as fs from "node:fs";
+import * as path from "node:path";
+//#region src/diagnostics/bundle-archive.ts
+/**
+* Shared debug-bundle archive primitives.
+*
+* Allowlist config redaction and windowed log-file archiving, used by the
+* orchestrator's in-process bundle writer, the kici-admin CLI's local bundle,
+* and the agent's fleet mini-bundle assembler. Keeping one copy means a node
+* cannot drift from the redaction posture of its peers.
+*/
+/** Maximum total log bytes to include in bundle (50MB). */
+const MAX_LOG_BYTES = 50 * 1024 * 1024;
+/**
+* Config field names that are safe to include unredacted.
+* Everything else gets replaced with "****".
+*/
+const SAFE_CONFIG_KEYS = new Set([
+	"mode",
+	"host",
+	"port",
+	"logLevel",
+	"region",
+	"environment",
+	"name",
+	"label",
+	"labels",
+	"enabled",
+	"disabled",
+	"timeout",
+	"interval",
+	"maxRetries",
+	"retries",
+	"workers",
+	"concurrency",
+	"maxConcurrency",
+	"batchSize",
+	"bufferSize",
+	"warmPool",
+	"cooldown",
+	"type",
+	"provider",
+	"scaler",
+	"driver",
+	"backend",
+	"protocol",
+	"scheme",
+	"path",
+	"basePath",
+	"metricsPath",
+	"healthPath",
+	"logFormat",
+	"logFile",
+	"logDir",
+	"dataDir",
+	"version",
+	"debug",
+	"verbose",
+	"quiet",
+	"tls",
+	"cors",
+	"rateLimiting",
+	"maxConnections",
+	"poolSize",
+	"minPool",
+	"maxPool",
+	"idleTimeout",
+	"connectTimeout",
+	"requestTimeout",
+	"shutdownTimeout",
+	"gracefulShutdown"
+]);
+/**
+* Redact config values using allowlist approach.
+* Only known-safe fields are preserved; everything else becomes "****".
+*/
+function redactConfig(obj, parentKey) {
+	if (obj === null || obj === void 0) return obj;
+	if (Array.isArray(obj)) return obj.map((item) => redactConfig(item, parentKey));
+	if (typeof obj === "object") {
+		const result = {};
+		for (const [key, value] of Object.entries(obj)) result[key] = redactConfig(value, key);
+		return result;
+	}
+	if (typeof obj === "string" && parentKey && !SAFE_CONFIG_KEYS.has(parentKey)) return "****";
+	if (typeof obj === "number" || typeof obj === "boolean") return obj;
+	if (typeof obj === "string" && parentKey && SAFE_CONFIG_KEYS.has(parentKey)) return obj;
+	if (typeof obj === "string") return "****";
+	return obj;
+}
+/**
+* Add log files from logDir to the archive, respecting MAX_LOG_BYTES cap
+* and the logWindow time filter. Matches any `*.log` file in the directory,
+* so the per-instance filename pattern produced by
+* `buildLogFilename()` is picked up without additional configuration.
+*
+* Exported for reuse by the `kici-admin debug-bundle` CLI command, which
+* runs outside the orchestrator process but still needs to include the
+* same log files in its locally-assembled bundle.
+*/
+async function addLogsToArchive(archive, logDir, logWindowHours) {
+	const cutoff = Date.now() - logWindowHours * 60 * 60 * 1e3;
+	const entries = fs.readdirSync(logDir).filter((f) => {
+		if (!f.endsWith(".log")) return false;
+		return fs.statSync(path.join(logDir, f)).mtimeMs >= cutoff;
+	});
+	entries.sort((a, b) => {
+		const aStat = fs.statSync(path.join(logDir, a));
+		return fs.statSync(path.join(logDir, b)).mtimeMs - aStat.mtimeMs;
+	});
+	let totalBytes = 0;
+	let totalLines = 0;
+	let errors = 0;
+	let warnings = 0;
+	for (const entry of entries) {
+		const filePath = path.join(logDir, entry);
+		const stat = fs.statSync(filePath);
+		if (totalBytes + stat.size > 52428800) break;
+		const content = fs.readFileSync(filePath, "utf-8");
+		archive.append(content, { name: `logs/${entry}` });
+		totalBytes += stat.size;
+		const lines = content.split("\n");
+		totalLines += lines.length;
+		for (const line of lines) {
+			if (/\berror\b/i.test(line)) errors++;
+			if (/\bwarn(ing)?\b/i.test(line)) warnings++;
+		}
+	}
+	const summary = {
+		totalLines,
+		errors,
+		warnings,
+		totalBytes
+	};
+	archive.append(JSON.stringify(summary, null, 2), { name: "logs/summary.json" });
+}
+//#endregion
+export { MAX_LOG_BYTES, addLogsToArchive, redactConfig };
+
+//# sourceMappingURL=bundle-archive.js.map

package/dist/diagnostics/bundle-archive.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=bundle-archive.test.d.ts.map

package/dist/diagnostics/bundle-chunks.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Channel-agnostic chunked transfer for fleet bundle ZIPs.
+ *
+ * The WS frame cap (WS_MAX_PAYLOAD_BYTES = 25 MiB) forbids shipping a whole
+ * bundle in one frame, so a bundle Buffer is split into ordered base64 frames
+ * (~85 KiB raw each, matching the webhook-relay frame size) and reassembled by
+ * the receiver. Used on both the orchestrator-agent and peer channels.
+ */
+/** Raw bytes per chunk before base64 (matches webhook-relay's ~85 KiB frames). */
+export declare const FLEET_CHUNK_BYTES: number;
+export interface BundleChunkFrame {
+    seq: number;
+    dataB64: string;
+    isLast: boolean;
+}
+/** Split a Buffer into ordered base64 frames. An empty buffer yields one final frame. */
+export declare function chunkBuffer(buf: Buffer, chunkBytes?: number): BundleChunkFrame[];
+/**
+ * Correlation core for any "send a request, await a chunked response" channel.
+ *
+ * Key-agnostic so both the orchestrator-agent channel (keyed by requestId) and
+ * the peer channel (keyed by messageId) share one implementation. Pending
+ * requests reject on timeout, on an error frame, or on disconnect. No
+ * orchestrator-initiated request/response primitive existed before fleet
+ * collection; this is it.
+ */
+export declare class ChunkRequestWaiter {
+    private pending;
+    /** Register a pending request `id` that rejects after `timeoutMs`. */
+    add(id: string, timeoutMs: number): Promise<Buffer>;
+    /** Accumulate a chunk; resolves the pending request on the final frame. */
+    onChunk(id: string, seq: number, dataB64: string, isLast: boolean): void;
+    /** Reject the pending request `id` with `message`. */
+    onError(id: string, message: string): void;
+    /** Reject every pending request — used when the underlying connection drops. */
+    rejectAll(reason: string): void;
+}
+/** Reassembles ordered frames into a Buffer. Throws on gaps/reordering. */
+export declare class BundleChunkAssembler {
+    private parts;
+    private next;
+    private done;
+    /** Returns the assembled Buffer on the final frame, otherwise undefined. */
+    accept(seq: number, dataB64: string, isLast: boolean): Buffer | undefined;
+}
+//# sourceMappingURL=bundle-chunks.d.ts.map

package/dist/diagnostics/bundle-chunks.js

@@ -0,0 +1,111 @@
+import "../chunk-BTugEXQM.js";
+//#region src/diagnostics/bundle-chunks.ts
+/**
+* Channel-agnostic chunked transfer for fleet bundle ZIPs.
+*
+* The WS frame cap (WS_MAX_PAYLOAD_BYTES = 25 MiB) forbids shipping a whole
+* bundle in one frame, so a bundle Buffer is split into ordered base64 frames
+* (~85 KiB raw each, matching the webhook-relay frame size) and reassembled by
+* the receiver. Used on both the orchestrator-agent and peer channels.
+*/
+/** Raw bytes per chunk before base64 (matches webhook-relay's ~85 KiB frames). */
+const FLEET_CHUNK_BYTES = 85 * 1024;
+/** Split a Buffer into ordered base64 frames. An empty buffer yields one final frame. */
+function chunkBuffer(buf, chunkBytes = FLEET_CHUNK_BYTES) {
+	const frames = [];
+	if (buf.length === 0) return [{
+		seq: 0,
+		dataB64: "",
+		isLast: true
+	}];
+	for (let offset = 0, seq = 0; offset < buf.length; offset += chunkBytes, seq++) {
+		const slice = buf.subarray(offset, Math.min(offset + chunkBytes, buf.length));
+		frames.push({
+			seq,
+			dataB64: slice.toString("base64"),
+			isLast: offset + chunkBytes >= buf.length
+		});
+	}
+	return frames;
+}
+/**
+* Correlation core for any "send a request, await a chunked response" channel.
+*
+* Key-agnostic so both the orchestrator-agent channel (keyed by requestId) and
+* the peer channel (keyed by messageId) share one implementation. Pending
+* requests reject on timeout, on an error frame, or on disconnect. No
+* orchestrator-initiated request/response primitive existed before fleet
+* collection; this is it.
+*/
+var ChunkRequestWaiter = class {
+	pending = /* @__PURE__ */ new Map();
+	/** Register a pending request `id` that rejects after `timeoutMs`. */
+	add(id, timeoutMs) {
+		return new Promise((resolve, reject) => {
+			const timer = setTimeout(() => {
+				this.pending.delete(id);
+				reject(/* @__PURE__ */ new Error(`chunk request ${id} timed out after ${timeoutMs}ms`));
+			}, timeoutMs);
+			this.pending.set(id, {
+				asm: new BundleChunkAssembler(),
+				resolve,
+				reject,
+				timer
+			});
+		});
+	}
+	/** Accumulate a chunk; resolves the pending request on the final frame. */
+	onChunk(id, seq, dataB64, isLast) {
+		const p = this.pending.get(id);
+		if (!p) return;
+		try {
+			const done = p.asm.accept(seq, dataB64, isLast);
+			if (done) {
+				clearTimeout(p.timer);
+				this.pending.delete(id);
+				p.resolve(done);
+			}
+		} catch (err) {
+			clearTimeout(p.timer);
+			this.pending.delete(id);
+			p.reject(err instanceof Error ? err : new Error(String(err)));
+		}
+	}
+	/** Reject the pending request `id` with `message`. */
+	onError(id, message) {
+		const p = this.pending.get(id);
+		if (!p) return;
+		clearTimeout(p.timer);
+		this.pending.delete(id);
+		p.reject(new Error(message));
+	}
+	/** Reject every pending request — used when the underlying connection drops. */
+	rejectAll(reason) {
+		for (const [, p] of this.pending) {
+			clearTimeout(p.timer);
+			p.reject(new Error(reason));
+		}
+		this.pending.clear();
+	}
+};
+/** Reassembles ordered frames into a Buffer. Throws on gaps/reordering. */
+var BundleChunkAssembler = class {
+	parts = [];
+	next = 0;
+	done = false;
+	/** Returns the assembled Buffer on the final frame, otherwise undefined. */
+	accept(seq, dataB64, isLast) {
+		if (this.done) throw new Error("bundle chunk received after final frame");
+		if (seq !== this.next) throw new Error(`out-of-order bundle chunk: expected ${this.next}, got ${seq}`);
+		this.next++;
+		this.parts.push(Buffer.from(dataB64, "base64"));
+		if (isLast) {
+			this.done = true;
+			return Buffer.concat(this.parts);
+		}
+	}
+};
+//#endregion
+export { BundleChunkAssembler, ChunkRequestWaiter, FLEET_CHUNK_BYTES, chunkBuffer };
+
+//# sourceMappingURL=bundle-chunks.js.map

package/dist/diagnostics/bundle-chunks.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=bundle-chunks.test.d.ts.map

package/dist/env/allowlist.d.ts

@@ -39,7 +39,8 @@
  *   - `KICI_*`            — every project-internal env var.
  *   - OS basics           — NODE_ENV, HOME, PATH, TZ, LANG, TMPDIR,
  *                           USER, USERNAME, SHELL, COMSPEC, PWD, OLDPWD,
- *                           HOSTNAME.
+ *                           HOSTNAME, PROCESSOR_ARCHITECTURE (Windows arch
+ *                           hint the agent reads to pick the mise zip).
  *   - Terminal / display  — COLUMNS, LINES, TERM, COLORTERM, DISPLAY,
  *                           WAYLAND_DISPLAY, LOCALAPPDATA.
  *   - XDG basedir spec    — XDG_*.
@@ -48,6 +49,9 @@
  *                           GITHUB_PATH, GITHUB_STEP_SUMMARY, GITLAB_CI.
  *   - Cloud / SDK names   — AWS_*, REDIS_*, OTEL_*, STRIPE_*, DOCKER_*,
  *                           CONTAINER_HOST.
+ *   - git tooling         — GIT_* (git's own env-var family, e.g.
+ *                           GIT_CONFIG_GLOBAL / GIT_SSH_COMMAND, that KiCI
+ *                           sets to drive cloned / overlay workspaces).
  *   - Postgres libpq      — PGHOST, PGPORT, PGUSER, PGPASSWORD,
  *                           PGDATABASE, PGSERVICEFILE, PGSSLMODE.
  *   - Forgejo dev server  — FORGEJO_URL, FORGEJO_CONTAINER (read by the

package/dist/env/allowlist.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 //#region src/env/allowlist.ts
 /**
 * Source of truth for the env-var allowlist.
@@ -41,7 +41,8 @@ import "../chunk-gOLHoazu.js";
 *   - `KICI_*`            — every project-internal env var.
 *   - OS basics           — NODE_ENV, HOME, PATH, TZ, LANG, TMPDIR,
 *                           USER, USERNAME, SHELL, COMSPEC, PWD, OLDPWD,
-*                           HOSTNAME.
+*                           HOSTNAME, PROCESSOR_ARCHITECTURE (Windows arch
+*                           hint the agent reads to pick the mise zip).
 *   - Terminal / display  — COLUMNS, LINES, TERM, COLORTERM, DISPLAY,
 *                           WAYLAND_DISPLAY, LOCALAPPDATA.
 *   - XDG basedir spec    — XDG_*.
@@ -50,6 +51,9 @@ import "../chunk-gOLHoazu.js";
 *                           GITHUB_PATH, GITHUB_STEP_SUMMARY, GITLAB_CI.
 *   - Cloud / SDK names   — AWS_*, REDIS_*, OTEL_*, STRIPE_*, DOCKER_*,
 *                           CONTAINER_HOST.
+*   - git tooling         — GIT_* (git's own env-var family, e.g.
+*                           GIT_CONFIG_GLOBAL / GIT_SSH_COMMAND, that KiCI
+*                           sets to drive cloned / overlay workspaces).
 *   - Postgres libpq      — PGHOST, PGPORT, PGUSER, PGPASSWORD,
 *                           PGDATABASE, PGSERVICEFILE, PGSSLMODE.
 *   - Forgejo dev server  — FORGEJO_URL, FORGEJO_CONTAINER (read by the
@@ -70,7 +74,7 @@ import "../chunk-gOLHoazu.js";
 *                           the dev proxy), HEADED (Playwright convention
 *                           for `--headed` runs).
 */
-const OS_SDK_ALLOWLIST_REGEX = /^(KICI_.*|NODE_ENV|HOME|PATH|TZ|LANG|TMPDIR|USER|USERNAME|SHELL|COMSPEC|PWD|OLDPWD|HOSTNAME|COLUMNS|LINES|TERM|COLORTERM|DISPLAY|WAYLAND_DISPLAY|LOCALAPPDATA|XDG_CACHE_HOME|XDG_CONFIG_HOME|XDG_DATA_HOME|XDG_RUNTIME_DIR|XDG_STATE_HOME|INIT_CWD|npm_.*|SSH_.*|CI|GITHUB_ACTIONS|GITHUB_ENV|GITHUB_OUTPUT|GITHUB_PATH|GITHUB_STEP_SUMMARY|GITLAB_CI|AWS_.*|REDIS_.*|OTEL_.*|STRIPE_.*|DOCKER_.*|CONTAINER_HOST|container|PGHOST|PGPORT|PGUSER|PGPASSWORD|PGDATABASE|PGSERVICEFILE|PGSSLMODE|FORGEJO_URL|FORGEJO_CONTAINER|KEYCLOAK_.*|VITE_.*|PLAYWRIGHT|HEADED)$/;
+const OS_SDK_ALLOWLIST_REGEX = /^(KICI_.*|NODE_ENV|HOME|PATH|TZ|LANG|TMPDIR|USER|USERNAME|SHELL|COMSPEC|PWD|OLDPWD|HOSTNAME|PROCESSOR_ARCHITECTURE|COLUMNS|LINES|TERM|COLORTERM|DISPLAY|WAYLAND_DISPLAY|LOCALAPPDATA|XDG_CACHE_HOME|XDG_CONFIG_HOME|XDG_DATA_HOME|XDG_RUNTIME_DIR|XDG_STATE_HOME|INIT_CWD|npm_.*|SSH_.*|CI|GITHUB_ACTIONS|GITHUB_ENV|GITHUB_OUTPUT|GITHUB_PATH|GITHUB_STEP_SUMMARY|GITLAB_CI|AWS_.*|REDIS_.*|OTEL_.*|STRIPE_.*|DOCKER_.*|GIT_.*|CONTAINER_HOST|container|PGHOST|PGPORT|PGUSER|PGPASSWORD|PGDATABASE|PGSERVICEFILE|PGSSLMODE|FORGEJO_URL|FORGEJO_CONTAINER|KEYCLOAK_.*|VITE_.*|PLAYWRIGHT|HEADED)$/;
 /**
 * Returns true when `name` is allowed under the KiCI env-var convention:
 * it matches the OS/SDK allowlist regex (which includes the `KICI_*`

package/dist/env/define-env.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 //#region src/env/define-env.ts
 /** Read an env value following the alias precedence (first non-undefined wins). */
 function readEnv(envMap, env) {

package/dist/env/index.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { RESERVED_NON_SCHEMA_KICI_PREFIXES, RESERVED_NON_SCHEMA_KICI_VARS, defineEnv, validateUnknownKiciVars } from "./define-env.js";
 import { LOGGER_ENV_FIELD_SPECS, LOGGER_ENV_VARS, LoggerEnvSchema } from "./logger-env.js";
 export { LOGGER_ENV_FIELD_SPECS, LOGGER_ENV_VARS, LoggerEnvSchema, RESERVED_NON_SCHEMA_KICI_PREFIXES, RESERVED_NON_SCHEMA_KICI_VARS, defineEnv, validateUnknownKiciVars };

package/dist/env/logger-env.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { z } from "zod";
 //#region src/env/logger-env.ts
 /**

package/dist/graceful-shutdown.js

@@ -1,4 +1,4 @@
-import "./chunk-gOLHoazu.js";
+import "./chunk-BTugEXQM.js";
 import { toErrorMessage } from "@kici-dev/core";
 //#region src/graceful-shutdown.ts
 /**

package/dist/idempotency-env-diff.js

@@ -1,4 +1,4 @@
-import "./chunk-gOLHoazu.js";
+import "./chunk-BTugEXQM.js";
 //#region src/idempotency-env-diff.ts
 /**
 * Env-file semantic diff for the idempotent-step preview path.

package/dist/idempotency-files.js

@@ -1,4 +1,4 @@
-import "./chunk-gOLHoazu.js";
+import "./chunk-BTugEXQM.js";
 import { diffEnvFiles, renderEnvDiff } from "./idempotency-env-diff.js";
 import { createTwoFilesPatch } from "diff";
 //#region src/idempotency-files.ts

package/dist/idempotency-yaml-diff.js

@@ -1,4 +1,4 @@
-import "./chunk-gOLHoazu.js";
+import "./chunk-BTugEXQM.js";
 import { setYamlDiffRenderer } from "./idempotency-files.js";
 import { parse } from "yaml";
 //#region src/idempotency-yaml-diff.ts

package/dist/idempotency.js

@@ -1,3 +1,3 @@
-import "./chunk-gOLHoazu.js";
+import "./chunk-BTugEXQM.js";
 export * from "@kici-dev/core/idempotency";
 export {};