@alan-ai-hq/agent-manager 0.1.113 → 0.1.115

package/dist/daemon-execute.js

@@ -0,0 +1,666 @@
+// AL-2472: agent.execute dispatch handler.
+import { mkdirSync } from "node:fs";
+import { resolve } from "node:path";
+import { isAlanDefaultWorkspace } from "@alan-ai/shared/constants";
+import { pickPrimaryReadinessIssue } from "@alan-ai/shared/runtime-runner-status";
+import { canInstallProviderCli, ensureProviderCliInstalled } from "./cli-ensure-install.js";
+import { getDaemonCliEnvironment, resolveBackendRuntimeCommand, revalidateBackendRuntimeCommand, } from "./cli-executable.js";
+import { inspectWorkspaceReadiness } from "./computer-readiness.js";
+import { CoreAgent } from "./core-agent.js";
+import { correlationLogFields, resolveWorkspaceRunLeaseTargets, } from "./daemon-helpers.js";
+import { readLocalDaemonMaintenanceLease } from "./daemon-local-control.js";
+import { normalizeBackendKind } from "./daemon-provider-scan.js";
+import { isProviderProcessAlive, summarizeRunnerStatus, } from "./daemon-runner-status.js";
+import { ensureSharedCheckoutBranch, resolveRuntimeCwd, resolveSharedCheckoutTargets, } from "./daemon-workspace.js";
+import { buildManagedAlanMcp } from "./managed-mcp.js";
+import { invalidateProviderAuthPreflight, looksLikeProviderAuthFailure, preflightProviderAuth, } from "./provider-auth-preflight.js";
+import { buildApplicationRunFailure, RuntimePresenter } from "./runtime-presenter.js";
+import { prepareSkillInvocationTask } from "./skills/skill-invocation.js";
+import { AGENT_VERSION } from "./version.js";
+import { discoverRelocatedWorkspace, workspaceMatchesExpectedRepositories, } from "./workspace-relocation.js";
+import { applicationCodeForWorkspaceLeaseFailure, hasGitWorkspaceMarker, WorkspaceRunLease, } from "./workspace-run-lease.js";
+export async function handleAgentExecute(ctx, payload) {
+    const { activeAgents, pendingRunStarts, pushLog, socket, runJournal, publishCapacityChange, runtimeId, runtimeSkillManager, getRuntimeToken, ensureRuntimeTokenForLaunch, eventOutbox, daemonSessionId, daemonEpoch, getHeartbeatSeq, endpointProfile, apiUrl, configPath, endpointMismatch, workspaceAccessTracker, getDisconnectedSinceMs, workspaceRelocations, persistWorkspaceRelocations, flushWorkspaceRelocations, recheckWorkspaceIssue, maintenanceReason, verifyActiveWorkspaceLease, } = ctx;
+    if (ctx.shutdownSignal.aborted)
+        return;
+    const heartbeatSeq = getHeartbeatSeq();
+    const disconnectedSinceMs = getDisconnectedSinceMs();
+    if (!payload?.runId || !payload.conversationId || typeof payload.content !== "string") {
+        return;
+    }
+    const tokenReadiness = ensureRuntimeTokenForLaunch();
+    const tokenReady = typeof tokenReadiness === "boolean" ? tokenReadiness : await tokenReadiness;
+    if (!tokenReady) {
+        socket.emit("agent.rejected", {
+            runId: payload.runId,
+            message: "This Computer could not renew its expired Alan credential. Run setup again.",
+            code: "runtime_token_expired",
+        });
+        return;
+    }
+    const runtimeToken = getRuntimeToken();
+    const isTaskWorkspacePayload = Boolean(payload.worktreeInfo?.worktreePath || payload.worktreeInfo?.allWorktrees?.length);
+    if ((payload.worktreeInfo?.allWorktrees?.length ?? 0) > 1 ||
+        (isTaskWorkspacePayload && (payload.repoLocalPaths?.length ?? 0) > 1)) {
+        socket.emit("agent.rejected", {
+            runId: payload.runId,
+            message: "A task worktree requires exactly one Git repository.",
+            code: "single_repository_worktree_required",
+        });
+        return;
+    }
+    const existingRun = activeAgents.get(payload.runId);
+    if (existingRun) {
+        if (existingRun.conversationId !== payload.conversationId) {
+            socket.emit("agent.rejected", {
+                runId: payload.runId,
+                message: "Run ID is already bound to another conversation",
+                code: "run_id_conflict",
+            });
+            return;
+        }
+        // The backend may redeliver after the original acceptance ACK is lost.
+        // Re-acknowledge the existing execution without spawning a second agent.
+        pushLog(`duplicate dispatch re-acknowledged run=${payload.runId}`);
+        socket.emit("agent.accepted", { runId: payload.runId });
+        return;
+    }
+    const preflightingConversationId = pendingRunStarts.get(payload.runId);
+    if (preflightingConversationId) {
+        if (preflightingConversationId !== payload.conversationId) {
+            socket.emit("agent.rejected", {
+                runId: payload.runId,
+                message: "Run ID is already bound to another conversation",
+                code: "run_id_conflict",
+            });
+        }
+        return;
+    }
+    const recoveredRun = runJournal.get(payload.runId);
+    if (recoveredRun) {
+        if (recoveredRun.conversationId !== payload.conversationId) {
+            socket.emit("agent.rejected", {
+                runId: payload.runId,
+                message: "Run ID is already bound to another conversation",
+                code: "run_id_conflict",
+            });
+            return;
+        }
+        const recovery = runJournal.assessRecovery(payload.runId, (pid) => isProviderProcessAlive(pid));
+        pushLog(`recovered dispatch fenced run=${payload.runId} recovery=${recovery?.reason ?? "unknown"}${recovery && "providerPid" in recovery ? ` pid=${recovery.providerPid}` : ""}`);
+        socket.emit("agent.rejected", {
+            runId: payload.runId,
+            message: "This run was interrupted by a daemon restart and will not be executed twice.",
+            code: "run_interrupted_by_restart",
+        });
+        return;
+    }
+    const maintenanceLease = readLocalDaemonMaintenanceLease(configPath);
+    if (maintenanceLease) {
+        socket.emit("agent.rejected", {
+            runId: payload.runId,
+            message: maintenanceLease.reason === "credential_cleanup"
+                ? "This computer is finishing logout and cannot start another run."
+                : "This computer is under short-lived maintenance; retry shortly.",
+            code: maintenanceLease.reason === "credential_cleanup"
+                ? "runtime_logout_pending"
+                : "runtime_maintenance_pending",
+        });
+        return;
+    }
+    const backendKind = normalizeBackendKind(payload.backendKind);
+    let runtimeCommand = resolveBackendRuntimeCommand(backendKind ?? payload.backendKind);
+    if (ctx.shutdownSignal.aborted)
+        return;
+    if (!runtimeCommand && backendKind) {
+        // A cached negative resolution is never authoritative for a run: startup
+        // provider discovery can probe a CLI before the sandbox's deferred
+        // installer drops the binary, and that miss must not reject runs after
+        // the binary lands. Drop the cache entry and re-resolve from disk.
+        runtimeCommand = revalidateBackendRuntimeCommand(backendKind);
+    }
+    if (!runtimeCommand && backendKind && canInstallProviderCli(backendKind)) {
+        // Fresh sandboxes install provider CLIs DEFERRED (~40-90s after agents can
+        // start), so an early run can race the installer and hit a missing binary.
+        // Install the policy-bounded CLI on demand (at most once per daemon lifetime) and
+        // re-resolve before rejecting the run. No presenter exists pre-accept, so
+        // installation progress surfaces through the daemon log only. Fence the
+        // runId while awaiting so a backend redelivery of the same dispatch does
+        // not start a second execution once the install completes.
+        try {
+            pendingRunStarts.set(payload.runId, payload.conversationId);
+        }
+        catch (error) {
+            socket.emit("agent.rejected", {
+                runId: payload.runId,
+                message: `Unable to reserve local runtime capacity: ${error instanceof Error ? error.message : String(error)}`,
+                code: "runner_reservation_failed",
+            });
+            return;
+        }
+        try {
+            const installed = await ensureProviderCliInstalled(backendKind, {
+                notify: (message) => {
+                    pushLog(message);
+                    console.info(`[alan-agent] ${message}`);
+                },
+            });
+            if (installed) {
+                runtimeCommand = revalidateBackendRuntimeCommand(backendKind);
+            }
+        }
+        finally {
+            if (!ctx.shutdownSignal.aborted)
+                pendingRunStarts.delete(payload.runId);
+        }
+    }
+    if (ctx.shutdownSignal.aborted)
+        return;
+    if (!runtimeCommand && backendKind) {
+        socket.emit("agent.rejected", {
+            runId: payload.runId,
+            message: `CLI command not found for ${backendKind}. Install the provider CLI and restart the daemon.`,
+            code: "provider_unavailable",
+        });
+        return;
+    }
+    let cwd = resolveRuntimeCwd(payload);
+    const explicitWorkspacePath = payload.worktreeInfo?.worktreePath ??
+        payload.worktreeInfo?.allWorktrees?.[0]?.worktreePath ??
+        payload.projectPath;
+    const workspaceRequired = Boolean(explicitWorkspacePath);
+    const workspacePathPinned = payload.workspacePathPinned === true || Boolean(payload.worktreeInfo);
+    if (isAlanDefaultWorkspace(payload.projectPath) && !workspacePathPinned) {
+        try {
+            mkdirSync(cwd, { recursive: true });
+        }
+        catch {
+            // inspectWorkspaceReadiness below preserves the filesystem cause.
+        }
+    }
+    let workspaceReadiness = inspectWorkspaceReadiness(workspaceRequired ? cwd : undefined);
+    const expectedRepoUrls = [
+        ...(payload.repoLocalPaths ?? [])
+            .filter((repo) => explicitWorkspacePath ? resolve(repo.localPath) === resolve(explicitWorkspacePath) : false)
+            .map((repo) => repo.repoUrl),
+        ...(payload.localRepoUrls ?? []),
+    ];
+    if (workspaceReadiness.code === "workspace_missing" &&
+        explicitWorkspacePath &&
+        !workspacePathPinned) {
+        const previousPath = resolve(explicitWorkspacePath);
+        const remembered = workspaceRelocations.get(previousPath);
+        const rememberedPath = remembered?.canonicalPath;
+        const relocated = rememberedPath &&
+            workspaceMatchesExpectedRepositories({
+                workspacePath: rememberedPath,
+                expectedRepoUrls,
+            })
+            ? resolve(rememberedPath)
+            : discoverRelocatedWorkspace({
+                missingPath: explicitWorkspacePath,
+                approvedWorkspacePaths: payload.approvedWorkspacePaths,
+                expectedRepoUrls,
+            });
+        if (relocated) {
+            if (!remembered || resolve(remembered.canonicalPath) !== relocated) {
+                workspaceRelocations.set(previousPath, {
+                    conversationId: payload.conversationId,
+                    runId: payload.runId,
+                    previousPath,
+                    canonicalPath: relocated,
+                });
+                try {
+                    persistWorkspaceRelocations();
+                }
+                catch (error) {
+                    workspaceRelocations.delete(previousPath);
+                    socket.emit("agent.rejected", {
+                        runId: payload.runId,
+                        message: `Recovered project path could not be saved safely: ${error.message}`,
+                        code: "workspace_relocation_persist_failed",
+                    });
+                    return;
+                }
+            }
+            cwd = relocated;
+            workspaceReadiness = inspectWorkspaceReadiness(cwd);
+            pushLog(`workspace-relocated run=${payload.runId} path=${relocated}`);
+            flushWorkspaceRelocations();
+        }
+    }
+    if (workspaceReadiness.ready && expectedRepoUrls.length > 0 && !isAlanDefaultWorkspace(cwd)) {
+        // For multi-worktree tasks the cwd is the non-git parent CONTAINER of the
+        // per-repo worktrees (resolveRuntimeCwd → dirname(allWorktrees[0])), so a
+        // git-identity check on the cwd itself always fails. Verify each worktree
+        // path instead — every one must resolve to an expected repository. Single
+        // (or no) worktree tasks fall back to checking the cwd directly.
+        const worktreePaths = payload.worktreeInfo?.allWorktrees
+            ?.map((worktree) => worktree.worktreePath)
+            .filter((worktreePath) => Boolean(worktreePath));
+        const repositoryMismatch = worktreePaths && worktreePaths.length > 0
+            ? worktreePaths.some((worktreePath) => !workspaceMatchesExpectedRepositories({
+                workspacePath: worktreePath,
+                expectedRepoUrls,
+            }))
+            : !workspaceMatchesExpectedRepositories({ workspacePath: cwd, expectedRepoUrls });
+        if (repositoryMismatch) {
+            socket.emit("agent.rejected", {
+                runId: payload.runId,
+                message: "This folder belongs to a different repository. Choose the correct project folder and try again.",
+                code: "workspace_repository_mismatch",
+            });
+            return;
+        }
+    }
+    if (workspaceRequired)
+        workspaceAccessTracker.track(cwd, workspaceReadiness);
+    const runnerSummary = summarizeRunnerStatus({
+        connected: socket.connected,
+        activeAgents,
+        disconnectedSinceMs,
+        daemonSessionId,
+        daemonEpoch,
+        heartbeatSeq,
+        interruptedRunIds: runJournal.recoveredRunIds(),
+        endpointProfile,
+        configPath,
+        runtimeId,
+        runtimeAuthValid: Boolean(runtimeToken),
+        endpointMismatchDetail: endpointMismatch?.detail ?? null,
+        workspacePath: recheckWorkspaceIssue(),
+        maintenanceReason: maintenanceReason(),
+        reservedStartCount: pendingRunStarts.size,
+        nowMs: Date.now(),
+    });
+    if (!socket.connected) {
+        socket.emit("agent.rejected", {
+            runId: payload.runId,
+            message: "Daemon is disconnected from backend",
+            code: "ws_disconnected",
+        });
+        return;
+    }
+    if (!runnerSummary.acceptingRuns) {
+        const capacityExhausted = typeof runnerSummary.runnerStatus.availableSlots === "number" &&
+            runnerSummary.runnerStatus.availableSlots <= 0 &&
+            !maintenanceReason();
+        const primaryIssue = pickPrimaryReadinessIssue(runnerSummary.runnerStatus.computerReadiness ?? []);
+        socket.emit("agent.rejected", {
+            runId: payload.runId,
+            message: runnerSummary.runnerStatus.overloadReason ??
+                primaryIssue?.message ??
+                (capacityExhausted
+                    ? "Local runtime has no available run slots"
+                    : runnerSummary.activeRunCount > 0
+                        ? "Daemon is busy with an active run"
+                        : "Daemon is not ready to accept runs"),
+            code: capacityExhausted
+                ? "runner_capacity"
+                : (primaryIssue?.code ??
+                    (runnerSummary.activeRunCount > 0 ? "runner_busy" : "runner_not_ready")),
+        });
+        return;
+    }
+    if (!workspaceReadiness.ready) {
+        socket.emit("agent.rejected", {
+            runId: payload.runId,
+            message: workspaceReadiness.message,
+            code: workspaceReadiness.code ?? "workspace_missing",
+        });
+        return;
+    }
+    // Reserve capacity before any async preflight. JS is single-threaded, so the
+    // check+set without an await between them is race-safe against other executes.
+    try {
+        pendingRunStarts.set(payload.runId, payload.conversationId);
+    }
+    catch (error) {
+        socket.emit("agent.rejected", {
+            runId: payload.runId,
+            message: `Unable to reserve local runtime capacity: ${error instanceof Error ? error.message : String(error)}`,
+            code: "runner_reservation_failed",
+        });
+        return;
+    }
+    publishCapacityChange();
+    const releaseCapacity = () => {
+        if (ctx.shutdownSignal.aborted)
+            return;
+        if (!pendingRunStarts.delete(payload.runId))
+            return;
+        publishCapacityChange();
+    };
+    const alanMcp = buildManagedAlanMcp({
+        apiUrl,
+        runtimeToken,
+        runId: payload.runId,
+    });
+    if (!socket.connected) {
+        releaseCapacity();
+        socket.emit("agent.rejected", {
+            runId: payload.runId,
+            message: "Daemon disconnected while preparing the provider",
+            code: "ws_disconnected",
+        });
+        return;
+    }
+    const correlation = correlationLogFields({
+        taskId: payload.taskId ?? payload.taskMeta?.id,
+        conversationId: payload.conversationId,
+        runId: payload.runId,
+        messageId: payload.messageId,
+        cloudEnvironmentId: payload.cloudEnvironmentId,
+        backendKind,
+        agentVersion: AGENT_VERSION,
+    });
+    const authPromise = backendKind && runtimeCommand && !payload.providerApiKey
+        ? preflightProviderAuth({
+            backendKind,
+            executable: runtimeCommand,
+            env: getDaemonCliEnvironment(),
+        }).catch(() => ({ status: "unknown" }))
+        : Promise.resolve({ status: "unknown" });
+    const skillTaskPromise = prepareSkillInvocationTask({
+        manager: runtimeSkillManager,
+        runtimeId,
+        invocations: payload.skillInvocations,
+        invocation: payload.skillInvocation,
+        userRequest: payload.content,
+    });
+    let providerAuth;
+    let preparedTask;
+    try {
+        [providerAuth, preparedTask] = await Promise.all([authPromise, skillTaskPromise]);
+    }
+    catch (error) {
+        releaseCapacity();
+        socket.emit("agent.rejected", {
+            runId: payload.runId,
+            message: error instanceof Error ? error.message : "Selected Skill could not be resolved",
+            code: "skill_invocation_unavailable",
+        });
+        return;
+    }
+    if (ctx.shutdownSignal.aborted) {
+        releaseCapacity();
+        return;
+    }
+    if (providerAuth.status === "auth_required") {
+        releaseCapacity();
+        socket.emit("agent.rejected", {
+            runId: payload.runId,
+            message: providerAuth.message ?? "The selected provider requires sign-in.",
+            code: "provider_auth_required",
+        });
+        return;
+    }
+    // Close the TOCTOU window for a dispatch that began preflight just before
+    // an external watchdog acquired maintenance. No journal/provider side
+    // effects have started yet, so it is safe to reject here.
+    const maintenanceLeaseBeforeJournal = readLocalDaemonMaintenanceLease(configPath);
+    if (maintenanceLeaseBeforeJournal) {
+        releaseCapacity();
+        socket.emit("agent.rejected", {
+            runId: payload.runId,
+            message: maintenanceLeaseBeforeJournal.reason === "credential_cleanup"
+                ? "This computer is finishing logout and cannot start another run."
+                : "This computer is under short-lived maintenance; retry shortly.",
+            code: maintenanceLeaseBeforeJournal.reason === "credential_cleanup"
+                ? "runtime_logout_pending"
+                : "runtime_maintenance_pending",
+        });
+        return;
+    }
+    try {
+        runJournal.record({
+            runId: payload.runId,
+            conversationId: payload.conversationId,
+            acceptedAtMs: Date.now(),
+        });
+    }
+    catch {
+        releaseCapacity();
+        pushLog(`run-journal-write-failed run=${payload.runId}`);
+        socket.emit("agent.rejected", {
+            runId: payload.runId,
+            message: "Alan could not safely record this run before starting it. Check disk access.",
+            code: "run_journal_unavailable",
+        });
+        return;
+    }
+    socket.emit("agent.accepted", { runId: payload.runId });
+    pushLog(`accepted run=${payload.runId}`);
+    console.info("[alan-agent] Agent run accepted", correlation);
+    // Shared-checkout runs (no worktree): put the checkout(s) onto the task's
+    // working branch cut from base, so the agent never commits onto the base
+    // branch directly. Best-effort — a dirty tree is left untouched.
+    if (!payload.worktreeInfo?.worktreePath && payload.sharedCheckout?.branchName) {
+        const repoTargets = resolveSharedCheckoutTargets({
+            cwd,
+            sharedCheckout: payload.sharedCheckout,
+        });
+        for (const { repoPath, baseBranch } of repoTargets) {
+            try {
+                const result = ensureSharedCheckoutBranch({
+                    repoPath,
+                    branchName: payload.sharedCheckout.branchName,
+                    baseBranch,
+                });
+                if (!result.checkedOut) {
+                    pushLog(`shared-branch skipped run=${payload.runId} ${repoPath}: ${result.reason}`);
+                }
+            }
+            catch (error) {
+                pushLog(`shared-branch error run=${payload.runId} ${repoPath} ${error.message}`);
+            }
+        }
+    }
+    // Preserved/imported folders may have no server-side repository URL metadata.
+    // Their Git identity still needs the same lease as an ordinary Project checkout.
+    const hasRepository = expectedRepoUrls.length > 0 ||
+        (workspaceRequired && !isAlanDefaultWorkspace(cwd) && (await hasGitWorkspaceMarker(cwd)));
+    const workspaceLeaseCapture = await WorkspaceRunLease.capture(resolveWorkspaceRunLeaseTargets(payload, cwd, hasRepository));
+    if (ctx.shutdownSignal.aborted) {
+        releaseCapacity();
+        // Keep the accepted journal binding: recovery must fence redelivery.
+        return;
+    }
+    if (workspaceLeaseCapture.failure) {
+        const failure = workspaceLeaseCapture.failure;
+        const runFailure = buildApplicationRunFailure({
+            conversationId: payload.conversationId,
+            runId: payload.runId,
+            // A run dispatched onto the wrong branch is also not a missing workspace.
+            code: applicationCodeForWorkspaceLeaseFailure(failure.code),
+            detail: failure.message,
+            component: "agent-manager-workspace-lease",
+            phase: "dispatch",
+        });
+        for (const event of runFailure.events) {
+            eventOutbox.enqueue(payload.conversationId, payload.runId, event);
+        }
+        eventOutbox.flush(socket);
+        releaseCapacity();
+        try {
+            runJournal.remove(payload.runId);
+        }
+        catch {
+            pushLog(`run-journal-remove-failed run=${payload.runId}`);
+        }
+        pushLog(`workspace-lease-unavailable run=${payload.runId} code=${failure.code}`);
+        return;
+    }
+    const nowMs = Date.now();
+    const touchActivity = () => {
+        const entry = activeAgents.get(payload.runId);
+        if (entry)
+            entry.lastActivityAtMs = Date.now();
+    };
+    let agent;
+    const releaseActiveRun = () => {
+        if (activeAgents.get(payload.runId)?.agent !== agent)
+            return;
+        activeAgents.delete(payload.runId);
+        console.info("[alan-agent] Agent run finished", correlation);
+        publishCapacityChange();
+    };
+    let finalization = null;
+    const finalizeRun = () => {
+        if (finalization)
+            return finalization;
+        const entry = activeAgents.get(payload.runId);
+        if (entry)
+            entry.cleanupState = "stopping";
+        finalization = (async () => {
+            if (!(await agent.cleanup())) {
+                const entry = activeAgents.get(payload.runId);
+                if (entry)
+                    entry.cleanupState = "failed";
+                pushLog(`provider-cleanup-failed run=${payload.runId}; ownership retained`);
+                return;
+            }
+            if (ctx.shutdownSignal.aborted) {
+                return;
+            }
+            try {
+                runJournal.remove(payload.runId);
+            }
+            catch {
+                pushLog(`run-journal-remove-failed run=${payload.runId}`);
+            }
+            releaseActiveRun();
+        })().catch((error) => {
+            if (entry)
+                entry.cleanupState = "failed";
+            pushLog(`provider-finalization-failed run=${payload.runId} ${String(error)}; ownership retained`);
+        });
+        return finalization;
+    };
+    const presenter = new RuntimePresenter(socket, payload.conversationId, payload.runId, eventOutbox, cwd, touchActivity, (result) => {
+        // Aborts still need the backend's finally path; retaining its accepted
+        // journal entry fences redelivery if the daemon exits first.
+        if (result?.success)
+            void finalizeRun();
+    }, () => {
+        const entry = activeAgents.get(payload.runId);
+        if (entry)
+            entry.stage = "running";
+    }, async () => {
+        const entry = activeAgents.get(payload.runId);
+        return entry ? verifyActiveWorkspaceLease(payload.runId, entry, Date.now(), true) : false;
+    }, () => {
+        if (backendKind && runtimeCommand) {
+            invalidateProviderAuthPreflight(backendKind, runtimeCommand);
+        }
+    }, backendKind);
+    try {
+        agent = new CoreAgent(presenter, {
+            backendKind,
+            runtimeCommand,
+            runId: payload.runId,
+            runtimeToken,
+            providerApiKey: payload.providerApiKey,
+            onProviderSpawned: (pid) => {
+                const entry = activeAgents.get(payload.runId);
+                if (!entry)
+                    return;
+                entry.providerPid = pid;
+                entry.stage = "provider_started";
+                entry.lastActivityAtMs = Date.now();
+                try {
+                    runJournal.recordProviderSpawned(payload.runId, pid, entry.lastActivityAtMs);
+                }
+                catch {
+                    // The accepted binding is already durable and continues to fence
+                    // redelivery. PID evidence is diagnostic only, so never kill or
+                    // fail a running provider because this optional update failed.
+                    pushLog(`run-journal-provider-evidence-write-failed run=${payload.runId}`);
+                }
+            },
+        });
+    }
+    catch (error) {
+        releaseCapacity();
+        try {
+            runJournal.remove(payload.runId);
+        }
+        catch {
+            pushLog(`run-journal-remove-failed run=${payload.runId}`);
+        }
+        const message = error instanceof Error ? error.message : String(error);
+        socket.emit("agent.rejected", {
+            runId: payload.runId,
+            message: `Provider startup failed: ${message}`,
+            code: "provider_start_failed",
+        });
+        return;
+    }
+    activeAgents.set(payload.runId, {
+        agent,
+        presenter,
+        lastActivityAtMs: nowMs,
+        acceptedAtMs: nowMs,
+        stage: "provider_starting",
+        providerPid: null,
+        conversationId: payload.conversationId,
+        workspaceLease: workspaceLeaseCapture.lease,
+    });
+    // Slot moves from reserved → active; publish so heartbeats advertise correctly.
+    releaseCapacity();
+    void agent
+        .run({
+        task: preparedTask,
+        maxIterations: payload.maxIterations ?? 50,
+        teamPath: cwd,
+        cwd,
+        backendKind,
+        runtimeCommand,
+        agentId: payload.agentId,
+        agentPrompt: payload.agentPrompt,
+        mode: (payload.mode ?? "agent"),
+        selectedModel: payload.model,
+        selectedContextWindow: payload.selectedContextWindow ?? null,
+        selectedEffortLevel: payload.selectedEffortLevel ?? null,
+        providerSessionId: payload.providerSessionId,
+        resumeFallbackContext: payload.resumeFallbackContext,
+        taskMeta: payload.taskMeta,
+        prMeta: payload.prMeta,
+        conversationId: payload.conversationId,
+        alanMcp,
+        externalMcpServers: payload.externalMcpServers,
+        taskId: payload.taskId ?? payload.taskMeta?.id,
+        teamId: payload.teamId,
+        currentUser: payload.currentUser,
+        workflowTools: payload.workflowTools,
+        workflowId: payload.workflowId,
+        workflowExecutionId: payload.workflowExecutionId,
+        images: payload.images,
+        files: payload.files,
+        parsedAttachments: payload.parsedAttachments,
+    })
+        .catch((error) => {
+        if (presenter.isTerminalFenced())
+            return;
+        const message = error instanceof Error ? error.message : String(error);
+        pushLog(`failed run=${payload.runId} ${message}`);
+        console.error("[alan-agent] Agent run failed", {
+            ...correlation,
+            error: message,
+        });
+        // Mid-run sign-out (or expired CLI session) must drop sticky ready so
+        // the next send re-probes and surfaces provider_auth_required cleanly
+        // instead of accepting again and failing the same way.
+        if (backendKind && runtimeCommand && looksLikeProviderAuthFailure(message)) {
+            invalidateProviderAuthPreflight(backendKind, runtimeCommand);
+        }
+        presenter.failApplicationProblem({
+            code: "app.internal",
+            detail: message,
+            component: "agent-manager-daemon",
+            phase: "delivery",
+        });
+    })
+        .finally(finalizeRun);
+}
+//# sourceMappingURL=daemon-execute.js.map