v0.28.0

Features

• Add kici-admin db stats-check and kici-admin db analyze. stats-check reports tables with a GIN index whose row estimate (pg_class.reltuples) is NaN, infinite or larger than the table can hold, which a parallel GIN index build before PostgreSQL 18.6 could write. analyze --table <schema.table> runs ANALYZE on the named tables to fix them.

Standalone packages

The files below are the standalone packages of this release. A full package includes Node.js v24.22.1 and npm. A light package runs on Node.js v24.22.1 from a local cache. SHA256SUMS holds the SHA-256 checksum of each package. To download and verify a package, see the KiCI packaging guide.

v0.27.0

Features

• kici-admin orchestrator upgrade and kici-admin agent upgrade accept --node <path>. It moves a service that runs from an npm install to another Node.js runtime: the command installs the package with that runtime's npm, registers the service again, and restarts it. Use it to move a service to Node.js 24.22.1.

Fixes

• An npm-source kici-admin orchestrator upgrade (with --version, --restart-only or --node) now takes the pre-upgrade database dump and drains the coordinator before it stops the service, as an archive upgrade does. Before, it restarted the orchestrator with no dump and no drain. --skip-backup, --backup-dir, --no-drain and --drain-timeout apply as on an archive upgrade.

Standalone packages

The files below are the standalone packages of this release. A full package includes Node.js v24.22.1 and npm. A light package runs on Node.js v24.22.1 from a local cache. SHA256SUMS holds the SHA-256 checksum of each package. To download and verify a package, see the KiCI packaging guide.

v0.26.1

Fixes

• The orchestrator and agent container images, and the Node.js runtime that the agent mounts into job containers, now run Node.js 24.22.1. Node.js 24.22.1 blocks the compromised eMudhra intermediate certificates and fixes CVE-2026-111497, CVE-2026-105483, CVE-2026-106069, CVE-2026-106072 and CVE-2026-105482. The packages of this release run on Node.js 24.22.1: before you upgrade a light package, install Node.js 24.22.1 into its cache. If you run kici or kici-admin from npm, update the Node.js that runs them to 24.22.1 or a later Node.js 24 release.
• A cluster worker retrying a failed agent spawn for a rerouted job now always starts the retry when its backoff ends. Before, the retry could be skipped, and the coordinator then failed the job when its spawn window ran out.

Standalone packages

The files below are the standalone packages of this release. A full package includes Node.js v24.22.1 and npm. A light package runs on Node.js v24.22.1 from a local cache. SHA256SUMS holds the SHA-256 checksum of each package. To download and verify a package, see the KiCI packaging guide.

v0.26.0

Features

• Breaking: the dashboard now encrypts every secret value in your browser before it leaves the page, and the hosted Platform refuses a plaintext secret value. secrets.set accepts only the encrypted posture (the default) or disabled; kici-admin org-settings dashboard-writes set --op secrets.set=permissive is refused. Scripts that set secret values use kici-admin secret set.

Fixes

• The kici, kici-admin and kici-platform-admin commands now deliver all of their output to a pipe. Before, --json output piped to a slow reader could stop after 8192 bytes, with exit code 0.

Standalone packages

The files below are the standalone packages of this release. A full package includes Node.js v24.22.0 and npm. A light package runs on Node.js v24.22.0 from a local cache. SHA256SUMS holds the SHA-256 checksum of each package. To download and verify a package, see the KiCI packaging guide.

v0.25.0

Fixes

• On an orchestrator attached to the Platform, kici-admin source add github files the source under the attached org, so its runs read that org's contexts, secrets and trust policy. Existing sources keep their org; kici-admin source list, org list, orchestrator status and trust-policy show report a source outside the attached org. kici-admin runs show names the run's org. A refused git credential now reaches the job as a refusal instead of an internal error.
• kici runs rerun, the dashboard re-run and Run now buttons, and the MCP rerun_run and trigger_run tools return the new run id once the orchestrator accepts the request; a dispatch failure fails that run, and a timeout is reported as unconfirmed, not failed
• kici runs rerun and kici runs cancel accept the first characters of a run id, as kici runs show does, and kici runs show prints why a failed run failed when no init failure explains it
• A global workflow run that fails before any job starts now records its workflow commit, so you can re-run it.
• The orchestrator now flags a workflow lock compiled for a compile schema its agents do not implement. The workflows page, kici-admin workflow list, kici-admin diagnose, the startup log and kici-admin orchestrator upgrade show it. A single orchestrator fails such a run before any agent starts. The error names the repository that holds the lock, tells you which compiler to recompile with, and says that a re-run keeps the old lock. A global workflow's setup check now carries the workflow repository in its name, and a re-run that fails before its jobs start completes all of its checks.
• A re-run the Platform could not confirm in time now starts the short re-run cooldown, so retrying right away is refused instead of starting a second run
• A re-run or Run now retried after an unconfirmed start returns the run the first request started instead of starting a second one.
• The MCP rerun_run tool enforces the 5-second per-run re-run cooldown, as the dashboard and kici runs rerun do.
• Fleet bring-up retries an SSH connection that times out before the session starts, so a slow target (for example a small board that is unpacking the agent package) no longer fails the bring-up on one late connection.

Other

• The quickstart examples now run SeaweedFS 4.48, which fixes GHSA-2v4p-qf9q-27wj.
• The orchestrator and agent container images now run Node.js 24.22.0.
• The agent image bakes pnpm 11.28.6, which the agent's isolated dependency install now runs.
• The orchestrator and agent now resolve @grpc/grpc-js 1.14.6 and axios 1.20.0, which clear GHSA-m9gg-hp2v-232j and seven axios advisories.
• The published packages resolve moment 2.31.0 for daily log rotation, which clears GHSA-4p3w-j4w9-5jqw.
• Runtime dependency update in the published packages: oxc-transform 0.154.0, the TypeScript transform under the kici CLI's workflow loader and the agent.
• Trigger JSONPath matching (match/not, content requirements, changed-files paths) now runs on jsonpath-plus 11.2.1, which fixes a nested-filter bypass that let a filter expression write to Object.prototype. An explicit zero slice end such as [0:0] now selects nothing instead of the whole array, and a bare @ filter such as [?(@)] is accepted.
• Runtime dependency updates in the published packages: zod 4.6.7 (all), hono 4.13.13 and @hono/node-server 2.1.5 (agent, orchestrator, shared), ws 8.22.0 (kici CLI, agent, orchestrator), kysely 0.29.7 and pg 8.23.1 (orchestrator, shared), @aws-sdk/* 3.1152.0 (orchestrator and shared storage client), @inquirer/prompts 8.7.3, lru-cache 11.5.3, nanoid 6.0.2 and wsl-utils 1.0.1. kici-admin downloads rolldown 1.2.14 for its lazy-dep @rolldown/binding-* entries.
• The Node.js runtime that the agent mounts into job containers is now 24.22.0, the same release the agent runs.

Standalone packages

The files below are the standalone packages of this release. A full package includes Node.js v24.22.0 and npm. A light package runs on Node.js v24.22.0 from a local cache. SHA256SUMS holds the SHA-256 checksum of each package. To download and verify a package, see the KiCI packaging guide.

v0.24.0

Fixes

• A re-run now goes through the same dispatch steps as the run it repeats. Its jobs can upload and download artifacts and use the user cache: before, an artifact upload from a re-run failed with the run for this job could not be resolved on the orchestrator. A re-run also keeps needs order (before, every job of a re-run started at once), applies contexts with their secrets and approval gates, runs container jobs in their container, and resolves the same trust tier from the same event as the original run. A re-run of an untrusted fork pull request reads the lock file from the base branch, as the original run did, and goes through the organization trust policy again: a fork pull request the policy holds is held again. This also applies to a re-run of an organization-wide workflow. A run that an internal event started can be re-run only while that event is still stored. A re-run of a re-run of an organization-wide workflow no longer fails to read its payload. A schedule fired by hand from the dashboard had the same faults and now runs as a scheduled fire does.
• A job whose rule returns false now records each of its steps as skipped, as its check summary shows. kici runs show no longer says such a job ran on an agent with no steps. A step whose rule returns false no longer shows success when its start and its skip reach the orchestrator out of order.
• kici runs show --json now gives each step a phase: setup, init or steps. An init command also gets initIndex, its position in the job's init list, so a script no longer needs the stored step index to find it. The steps are in the order they ran, also for a run that an older orchestrator recorded. The MCP get_run tool and kici-admin runs structured --json give each step the same fields. kici runs show also names a failed init command init[n] in its error line.
• kici-agent --version prints the installed version and kici-agent --help lists the required environment variables; before, both started the agent. Any other argument stops the agent with exit status 2. A configuration error names the environment variable to set, without a stack trace, and the orchestrator's startup error does the same. In a terminal, a startup failure prints its reason.

Standalone packages

The files below are the standalone packages of this release. A full package includes Node.js v24.21.0 and npm. A light package runs on Node.js v24.21.0 from a local cache. SHA256SUMS holds the SHA-256 checksum of each package. To download and verify a package, see the KiCI packaging guide.

v0.23.0

Fixes

• A job whose rule returns false now ends skipped instead of success. Its GitHub check reports skipped, and the check summary names the rule. Every skipped job's check now reports skipped instead of cancelled, so a skipped job does not block a required check. This includes a job that a needs edge skipped after its upstream failed: to block a pull request when any job fails, require the workflow check kici/<workflow>. A job that needs a rule-skipped job now follows its when condition: the default skips it, and when: 'on-skip' runs it. A step whose rule returns false is now reported skipped, not failed. Job notifications and job_complete triggers see a rule-skipped job as skipped, so a trigger that filters on success no longer fires for it. A rule-skipped job no longer sends a job.completed webhook event.
• kici preview names every step the way a run does: a run: shorthand step, a bare function step and a step() with no name show their step-N name instead of an empty bullet, and a parallel() group lists its steps under the group. A step layout that kici compile rejects, such as an empty parallel() group, now also fails kici preview with the same error.
• kici init scaffolds pr-checks to target the repository's default branch (origin/HEAD, else the HEAD the origin remote reports, else main), never the branch you have checked out, and writes it in single quotes. The sample fixture uses the branch you have checked out. In a repository with no src/ directory, pr-checks has no paths filter and no require-src-changes rule, so it runs on every pull request.
• A universal-git SSH clone now finds its known_hosts file when the temporary directory path contains a space; ssh read such a path as two files and failed host-key verification.
• repo.identifier now reads owner/repo for a checkout cloned over SSH (git@host:owner/repo.git or ssh://host/owner/repo.git); it used to return the whole clone URL.
• repo.withWrite now opens a write window for the job's own checkout when it was cloned over SSH or from a file:// URL; the write fence used to refuse it as outside the source repository's organisation.
• repo.withWrite({ credential: 'name' }) now pushes with the named git credential; git used the job's default credential inside the window even though the window checked the named one.
• With KICI_RUNNER_USER set, a bare-metal job can now use the git credential helper; the helper and its socket were owned by the agent user, so the runner user could not reach them and git push had no credential.
• A job that declares an SSH-key git credential now fails before its first step when no ssh client is on PATH, with an error that names the fix (init: { apt: { packages: ['openssh-client'] } }); it used to fail at push time, inside repo.withWrite.
• Under the bubblewrap sandbox (KICI_SANDBOX=true), a bare-metal job can now reach the git credential helper; the sandbox's private /tmp hid the helper, so git push and repo.withWrite had no credential.
• An SSH-key git credential (kind: 'ssh') now works inside repo.withWrite: git commands in the checkout push to SSH URLs with the key, and host keys are checked strictly against the published GitHub, GitLab and Bitbucket Cloud keys plus ~/.ssh/known_hosts. The universal-git docs now say that sshHostKeyPolicy accept-new accepts any host key.
• GitHub check runs now link to the run's page in the KiCI dashboard. An orchestrator connected to the KiCI Platform gets the dashboard address from the Platform, so it needs no configuration; KICI_DASHBOARD_URL overrides it.

Documentation

• The dynamic values guide no longer says kici preview lists the injected init job; preview does not show it.

Standalone packages

The files below are the standalone packages of this release. A full package includes Node.js v24.21.0 and npm. A light package runs on Node.js v24.21.0 from a local cache. SHA256SUMS holds the SHA-256 checksum of each package. To download and verify a package, see the KiCI packaging guide.

v0.22.0

Fixes

• kici-admin --help states each option default once. Some options showed their default twice, as in Vault mount path (default: secret) (default: "secret"). These options are fixed: - backend add: --auth-method, --mount-path, --scope-filter and --sync-interval. - runs list, attestations list, event-log list, access-log list and event-dlq list: --limit. - runs logs: --step and --limit. - db backup: --keep and --schedule. - workflow register-manual: --provider-context. - context create-template: --type. The options and their defaults work as before.
• kici-admin runs show, runs jobs --include-steps, runs structured and runs logs --step init[], kici runs show, kici runs logs and the dashboard now also list an init step recorded by an orchestrator older than 0.21.0 first, as init[], instead of last with step number 1000000. That orchestrator stored init steps with no step type; they are recognized from their stored index and their init: name. In --json, such a step reports phase init and its initIndex.
• kici-admin orchestrator upgrade now reads the cache storage config and the S3 credentials for the agent package upload from the env file of the instance that it upgrades, not from the shell. An upgrade from a shell that exports no KICI_STORAGE_* variables no longer skips the upload. kici-admin agent package --upload takes --env-file to read the same config.

Standalone packages

The files below are the standalone packages of this release. A full package includes Node.js v24.21.0 and npm. A light package runs on Node.js v24.21.0 from a local cache. SHA256SUMS holds the SHA-256 checksum of each package. To download and verify a package, see the KiCI packaging guide.

v0.21.0

Features

• kici run remote <fixture> creates one run per matched workflow, as a webhook does, so two workflows that define a job of the same name no longer collide in one run. A kici older than this release still gets one shared run when the matched workflows' job names cannot collide, and a clear refusal naming the shared job names when they can.
• kici run remote follows every run a fixture creates, one per matched workflow. It labels each job <workflow> / <job> in the summary table, the error blocks and the JUnit report when the runs span workflows, gives each failed job its own error block with only its own output, and passes only when every run passed. --json adds runs and each job's workflowName; the top-level runId is deprecated.

Fixes

• A job waiting on needs is no longer swapped for the placeholder of another job whose name starts with its own (build and build-and-push).
• kici-admin --help no longer prints the admin token. When KICI_ADMIN_TOKEN was set, the help showed its value as the default of --token, so shared help output leaked the token. The help now shows the name of the environment variable, as in (env: KICI_ADMIN_TOKEN), and never its value. KICI_ADMIN_URL and the --base-url option of source trigger-local and source install-hook show their environment variable the same way. The options and environment variables work as before.
• kici runs show prints an error: line for a job that failed in a step, naming the step and its exit code, even when the job records no error message of its own.
• A job that builds its container image and also runs init commands no longer loses its image-build step: the two used the same step number, so the init step overwrote the image-build step and their logs mixed.
• kici-admin runs show, runs jobs --include-steps and runs structured list a job's init steps first, as init[0], init[1] and so on, instead of last with a step number of 1000000. kici runs show, kici runs logs and the dashboard also list init steps before the steps they ran ahead of. kici-admin runs logs --step accepts init[]. In --json, stepIndex is unchanged, and each step adds phase (setup, init or steps) and, for an init step, initIndex.
• kici run --local follows every run an event creates, one per matched workflow, and fails when any of them fails. It followed only the first run before, so a failure in a second matched workflow went unreported.
• The orchestrator now records the type of hook, cache and init steps. It stored them as plain steps, so the dashboard showed no hook badge on an onCancel or cleanup step, and readers could not tell these steps from the job's own steps.
• A GitHub check run's progress summary no longer fills with placeholder 'Step N' lines for a job with init commands, an image build, or cache steps. The summary lists each step that reported, init steps first.
• kici-admin runs show, jobs, logs, structured, ephemeral-key and secret-outputs, kici-admin execution show, and kici runs show and logs, accept a run id prefix of at least 4 characters, like a git short SHA. An ambiguous prefix fails and lists its matches; an unknown prefix or a value that cannot be a run id fails with a message that names it, instead of 'HTTP 400: Invalid request: malformed value for a typed field'. The orchestrator admin API (run reads, execution show and cancel) answers a run id that is not a full UUID with a 400 that names it (cancel answered it with a 500). The orchestrator and Platform run lists accept ?runIdPrefix=.
• Cancelling a run through the orchestrator admin API with its run id in uppercase now cancels its jobs too. It marked the run cancelled but sent no cancel to the agents running its jobs.

Standalone packages

The files below are the standalone packages of this release. A full package includes Node.js v24.21.0 and npm. A light package runs on Node.js v24.21.0 from a local cache. SHA256SUMS holds the SHA-256 checksum of each package. To download and verify a package, see the KiCI packaging guide.

v0.20.1

Fixes

• kici run remote <fixture> now sends the event on the branch you have checked out and your HEAD commit, unless the fixture sets branch or sha. A push({ branches }) filter in a fixture no longer stands in for the event branch, and pr() and other non-push fixtures are sent as their own event type instead of a push. With an orchestrator at this version, the run records the real commit SHA, not a branch name.
• kici run <event> --local now runs on the branch you have checked out in its default isolated mode, so a push({ branches }) filter matches as it does with --in-place. A detached HEAD runs on kici-local.
• kici init now sets branch on its sample fixture, so kici run remote push-<branch> simulates a push to the default branch from any checkout.
• A fixture run that matches several workflows now names every one of them. kici-admin runs list, runs show and runs jobs, kici runs list and runs show, and the dashboard show each workflow of the run and the workflow of each job, and the failure summary names each failed job with its workflow. The --json output adds workflowNames on the run and workflowName on each job, and the workflow filter matches a run that spans the named workflow.

Standalone packages

The files below are the standalone packages of this release. A full package includes Node.js v24.21.0 and npm. A light package runs on Node.js v24.21.0 from a local cache. SHA256SUMS holds the SHA-256 checksum of each package. To download and verify a package, see the KiCI packaging guide.