@automatalabs/workflows 0.54.1 → 0.56.0

package/dist/mcp-server.js

@@ -14,7 +14,7 @@ import { realpathSync as realpathSync4 } from "node:fs";
 import { pathToFileURL as pathToFileURL2 } from "node:url";
 
 // ../mcp-server/src/daemon/commands.ts
-import { readFileSync as readFileSync5 } from "node:fs";
+import { readFileSync as readFileSync7 } from "node:fs";
 
 // ../../node_modules/.pnpm/@modelcontextprotocol+server@2.0.0/node_modules/@modelcontextprotocol/server/dist/chunk-Br0eD_fh.mjs
 var __create = Object.create;
@@ -1419,8 +1419,8 @@ function formatError(error51, mapper = (issue2) => issue2.message) {
           let i = 0;
           while (i < fullpath.length) {
             const el = fullpath[i];
-            const terminal = i === fullpath.length - 1;
-            if (!terminal) {
+            const terminal2 = i === fullpath.length - 1;
+            if (!terminal2) {
               curr[el] = curr[el] || { _errors: [] };
             } else {
               curr[el] = curr[el] || { _errors: [] };
@@ -1457,7 +1457,7 @@ function treeifyError(error51, mapper = (issue2) => issue2.message) {
         let i = 0;
         while (i < fullpath.length) {
           const el = fullpath[i];
-          const terminal = i === fullpath.length - 1;
+          const terminal2 = i === fullpath.length - 1;
           if (typeof el === "string") {
             curr.properties ?? (curr.properties = {});
             (_a3 = curr.properties)[el] ?? (_a3[el] = { errors: [] });
@@ -1467,7 +1467,7 @@ function treeifyError(error51, mapper = (issue2) => issue2.message) {
             (_b = curr.items)[el] ?? (_b[el] = { errors: [] });
             curr = curr.items[el];
           }
-          if (terminal) {
+          if (terminal2) {
             curr.errors.push(mapper(issue2));
           }
           i++;
@@ -11559,8 +11559,8 @@ function process2(schema, ctx, _params = { path: [], schemaPath: [] }) {
   return _result.schema;
 }
 function extractDefs(ctx, schema) {
-  const root = ctx.seen.get(schema);
-  if (!root)
+  const root2 = ctx.seen.get(schema);
+  if (!root2)
     throw new Error("Unprocessed schema. This is a bug in Zod.");
   const idToSchema = /* @__PURE__ */ new Map();
   for (const entry of ctx.seen.entries()) {
@@ -11585,7 +11585,7 @@ function extractDefs(ctx, schema) {
       entry[1].defId = id;
       return { defId: id, ref: `${uriGenerator("__shared")}#/${defsSegment}/${id}` };
     }
-    if (entry[1] === root) {
+    if (entry[1] === root2) {
       return { ref: "#" };
     }
     const uriPrefix = `#`;
@@ -11649,8 +11649,8 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
   }
 }
 function finalize(ctx, schema) {
-  const root = ctx.seen.get(schema);
-  if (!root)
+  const root2 = ctx.seen.get(schema);
+  if (!root2)
     throw new Error("Unprocessed schema. This is a bug in Zod.");
   const flattenRef = (zodSchema) => {
     const seen = ctx.seen.get(zodSchema);
@@ -11733,7 +11733,7 @@ function finalize(ctx, schema) {
       throw new Error("Schema is missing an `id` property");
     result.$id = ctx.external.uri(id);
   }
-  Object.assign(result, root.def ?? root.schema);
+  Object.assign(result, root2.def ?? root2.schema);
   const rootMetaId = ctx.metadataRegistry.get(schema)?.id;
   if (rootMetaId !== void 0 && result.id === rootMetaId)
     delete result.id;
@@ -18579,8 +18579,8 @@ function decodeMcpParamValue(value) {
     return;
   }
 }
-function valueAtPath(root, path) {
-  let node = root;
+function valueAtPath(root2, path) {
+  let node = root2;
   for (const key of path) {
     if (node === null || typeof node !== "object") return void 0;
     node = node[key];
@@ -23206,24 +23206,24 @@ var require_compile = /* @__PURE__ */ __commonJSMin(((exports) => {
     }
   }
   exports.compileSchema = compileSchema;
-  function resolveRef2(root, baseId, ref) {
+  function resolveRef2(root2, baseId, ref) {
     var _a3;
     ref = (0, resolve_1.resolveUrl)(this.opts.uriResolver, baseId, ref);
-    const schOrFunc = root.refs[ref];
+    const schOrFunc = root2.refs[ref];
     if (schOrFunc) return schOrFunc;
-    let _sch = resolve.call(this, root, ref);
+    let _sch = resolve.call(this, root2, ref);
     if (_sch === void 0) {
-      const schema = (_a3 = root.localRefs) === null || _a3 === void 0 ? void 0 : _a3[ref];
+      const schema = (_a3 = root2.localRefs) === null || _a3 === void 0 ? void 0 : _a3[ref];
       const { schemaId } = this.opts;
       if (schema) _sch = new SchemaEnv({
         schema,
         schemaId,
-        root,
+        root: root2,
         baseId
       });
     }
     if (_sch === void 0) return;
-    return root.refs[ref] = inlineOrCompile.call(this, _sch);
+    return root2.refs[ref] = inlineOrCompile.call(this, _sch);
   }
   exports.resolveRef = resolveRef2;
   function inlineOrCompile(sch) {
@@ -23237,20 +23237,20 @@ var require_compile = /* @__PURE__ */ __commonJSMin(((exports) => {
   function sameSchemaEnv(s1, s2) {
     return s1.schema === s2.schema && s1.root === s2.root && s1.baseId === s2.baseId;
   }
-  function resolve(root, ref) {
+  function resolve(root2, ref) {
     let sch;
     while (typeof (sch = this.refs[ref]) == "string") ref = sch;
-    return sch || this.schemas[ref] || resolveSchema.call(this, root, ref);
+    return sch || this.schemas[ref] || resolveSchema.call(this, root2, ref);
   }
-  function resolveSchema(root, ref) {
+  function resolveSchema(root2, ref) {
     const p = this.opts.uriResolver.parse(ref);
     const refPath = (0, resolve_1._getFullPath)(this.opts.uriResolver, p);
-    let baseId = (0, resolve_1.getFullPath)(this.opts.uriResolver, root.baseId, void 0);
-    if (Object.keys(root.schema).length > 0 && refPath === baseId) return getJsonPointer.call(this, p, root);
+    let baseId = (0, resolve_1.getFullPath)(this.opts.uriResolver, root2.baseId, void 0);
+    if (Object.keys(root2.schema).length > 0 && refPath === baseId) return getJsonPointer.call(this, p, root2);
     const id = (0, resolve_1.normalizeId)(refPath);
     const schOrRef = this.refs[id] || this.schemas[id];
     if (typeof schOrRef == "string") {
-      const sch = resolveSchema.call(this, root, schOrRef);
+      const sch = resolveSchema.call(this, root2, schOrRef);
       if (typeof (sch === null || sch === void 0 ? void 0 : sch.schema) !== "object") return;
       return getJsonPointer.call(this, p, sch);
     }
@@ -23264,7 +23264,7 @@ var require_compile = /* @__PURE__ */ __commonJSMin(((exports) => {
       return new SchemaEnv({
         schema,
         schemaId,
-        root,
+        root: root2,
         baseId
       });
     }
@@ -23278,7 +23278,7 @@ var require_compile = /* @__PURE__ */ __commonJSMin(((exports) => {
     "dependencies",
     "definitions"
   ]);
-  function getJsonPointer(parsedRef, { baseId, schema, root }) {
+  function getJsonPointer(parsedRef, { baseId, schema, root: root2 }) {
     var _a3;
     if (((_a3 = parsedRef.fragment) === null || _a3 === void 0 ? void 0 : _a3[0]) !== "/") return;
     for (const part of parsedRef.fragment.slice(1).split("/")) {
@@ -23292,13 +23292,13 @@ var require_compile = /* @__PURE__ */ __commonJSMin(((exports) => {
     let env;
     if (typeof schema != "boolean" && schema.$ref && !(0, util_1.schemaHasRulesButRef)(schema, this.RULES)) {
       const $ref = (0, resolve_1.resolveUrl)(this.opts.uriResolver, baseId, schema.$ref);
-      env = resolveSchema.call(this, root, $ref);
+      env = resolveSchema.call(this, root2, $ref);
     }
     const { schemaId } = this.opts;
     env = env || new SchemaEnv({
       schema,
       schemaId,
-      root,
+      root: root2,
       baseId
     });
     if (env.schema !== env.root.schema) return env;
@@ -24163,11 +24163,11 @@ var require_core$3 = /* @__PURE__ */ __commonJSMin(((exports) => {
       while (typeof (sch = getSchEnv.call(this, keyRef)) == "string") keyRef = sch;
       if (sch === void 0) {
         const { schemaId } = this.opts;
-        const root = new compile_1.SchemaEnv({
+        const root2 = new compile_1.SchemaEnv({
           schema: {},
           schemaId
         });
-        sch = compile_1.resolveSchema.call(this, root, keyRef);
+        sch = compile_1.resolveSchema.call(this, root2, keyRef);
         if (!sch) return;
         this.refs[keyRef] = sch;
       }
@@ -24472,16 +24472,16 @@ var require_ref = /* @__PURE__ */ __commonJSMin(((exports) => {
     code(cxt) {
       const { gen, schema: $ref, it } = cxt;
       const { baseId, schemaEnv: env, validateName, opts, self } = it;
-      const { root } = env;
-      if (($ref === "#" || $ref === "#/") && baseId === root.baseId) return callRootRef();
-      const schOrEnv = compile_1.resolveRef.call(self, root, baseId, $ref);
+      const { root: root2 } = env;
+      if (($ref === "#" || $ref === "#/") && baseId === root2.baseId) return callRootRef();
+      const schOrEnv = compile_1.resolveRef.call(self, root2, baseId, $ref);
       if (schOrEnv === void 0) throw new ref_error_1.default(it.opts.uriResolver, baseId, $ref);
       if (schOrEnv instanceof compile_1.SchemaEnv) return callValidate(schOrEnv);
       return inlineRefSchema(schOrEnv);
       function callRootRef() {
-        if (env === root) return callRef(cxt, validateName, env, env.$async);
-        const rootName = gen.scopeValue("root", { ref: root });
-        return callRef(cxt, (0, codegen_1._)`${rootName}.validate`, root, root.$async);
+        if (env === root2) return callRef(cxt, validateName, env, env.$async);
+        const rootName = gen.scopeValue("root", { ref: root2 });
+        return callRef(cxt, (0, codegen_1._)`${rootName}.validate`, root2, root2.$async);
       }
       function callValidate(sch) {
         callRef(cxt, getValidate(cxt, sch), sch, sch.$async);
@@ -26196,12 +26196,12 @@ var require_dynamicAnchor = /* @__PURE__ */ __commonJSMin(((exports) => {
   exports.dynamicAnchor = dynamicAnchor;
   function _getValidate(cxt) {
     const { schemaEnv, schema, self } = cxt.it;
-    const { root, baseId, localRefs, meta: meta3 } = schemaEnv.root;
+    const { root: root2, baseId, localRefs, meta: meta3 } = schemaEnv.root;
     const { schemaId } = self.opts;
     const sch = new compile_1.SchemaEnv({
       schema,
       schemaId,
-      root,
+      root: root2,
       baseId,
       localRefs,
       meta: meta3
@@ -30640,15 +30640,16 @@ function createRequestStateCodec(options) {
 
 // ../mcp-server/src/server.ts
 import { createHash, randomBytes } from "node:crypto";
-import { readFileSync as readFileSync2 } from "node:fs";
+import { readFileSync as readFileSync3 } from "node:fs";
 import { createRequire } from "node:module";
 import {
   buildModelFilter,
   parseWorkflowScript,
-  probeHarnessConfig,
+  probeHarnessConfig as probeHarnessConfig2,
   redactText as redactText2,
   validateWorkflowScript,
   truncateUtf8 as truncateUtf83,
+  workflowMayUseDefaultModel,
   WorkflowError,
   WorkflowErrorCode,
   WorkflowManager as WorkflowManager3
@@ -30706,6 +30707,9 @@ var workflowToolInputShape = {
   callIndex: external_exports.number().int().nonnegative().safe().optional().describe(
     "With action=stop, cancel exactly this in-flight agent call without aborting the run. Forbidden for every other action."
   ),
+  forceOwner: external_exports.boolean().optional().describe(
+    "With whole-run action=stop, explicitly authorize terminating a superseded owner daemon when graceful cross-generation control cannot settle. Forbidden with callIndex and every other action."
+  ),
   lastN: external_exports.number().int().min(1).max(50).optional().describe("Latest matching calls. Default 20; range 1..50."),
   labelGlob: external_exports.string().refine((value) => [...value].length >= 1 && [...value].length <= 128, {
     message: "labelGlob must contain from 1 through 128 Unicode code points"
@@ -30724,7 +30728,7 @@ function invalid(message) {
 }
 function parseWorkflowToolInput(raw, options = {}) {
   if (raw.action === "config") {
-    if (raw.script !== void 0 || raw.scriptPath !== void 0 || raw.args !== void 0 || raw.maxAgents !== void 0 || raw.concurrency !== void 0 || raw.agentRetries !== void 0 || raw.agentTimeoutMs !== void 0 || raw.resumeFromRunId !== void 0 || raw.resumePolicy !== void 0 || raw.checkpointReplies !== void 0 || raw.background !== void 0 || raw.runId !== void 0 || raw.callIndex !== void 0 || raw.waitMs !== void 0 || raw.lastN !== void 0 || raw.labelGlob !== void 0 || raw.logLines !== void 0) {
+    if (raw.script !== void 0 || raw.scriptPath !== void 0 || raw.args !== void 0 || raw.maxAgents !== void 0 || raw.concurrency !== void 0 || raw.agentRetries !== void 0 || raw.agentTimeoutMs !== void 0 || raw.resumeFromRunId !== void 0 || raw.resumePolicy !== void 0 || raw.checkpointReplies !== void 0 || raw.background !== void 0 || raw.runId !== void 0 || raw.callIndex !== void 0 || raw.forceOwner !== void 0 || raw.waitMs !== void 0 || raw.lastN !== void 0 || raw.labelGlob !== void 0 || raw.logLines !== void 0) {
       invalid('action="config" accepts only projectDir, harnesses, modelSpecs, modelFilter, and probeTimeoutMs');
     }
     if (options.requireProjectDir === true && raw.projectDir === void 0) {
@@ -30743,7 +30747,7 @@ function parseWorkflowToolInput(raw, options = {}) {
   }
   if (raw.action === "inspect") {
     if (!raw.runId) invalid('action="inspect" requires runId');
-    if (hasExecutionFields(raw) || hasConfigFields(raw) || raw.waitMs !== void 0 || raw.callIndex !== void 0) {
+    if (hasExecutionFields(raw) || hasConfigFields(raw) || raw.waitMs !== void 0 || raw.callIndex !== void 0 || raw.forceOwner !== void 0) {
       invalid('action="inspect" cannot include execution fields');
     }
     return {
@@ -30756,7 +30760,7 @@ function parseWorkflowToolInput(raw, options = {}) {
   }
   if (raw.action === "await") {
     if (!raw.runId) invalid('action="await" requires runId');
-    if (hasExecutionFields(raw) || hasConfigFields(raw) || raw.callIndex !== void 0) {
+    if (hasExecutionFields(raw) || hasConfigFields(raw) || raw.callIndex !== void 0 || raw.forceOwner !== void 0) {
       invalid('action="await" cannot include execution fields');
     }
     return {
@@ -30773,16 +30777,20 @@ function parseWorkflowToolInput(raw, options = {}) {
     if (hasExecutionFields(raw) || hasConfigFields(raw) || raw.waitMs !== void 0) {
       invalid('action="stop" cannot include execution fields or waitMs');
     }
+    if (raw.callIndex !== void 0 && raw.forceOwner !== void 0) {
+      invalid('action="stop" forceOwner is forbidden with callIndex');
+    }
     return {
       action: "stop",
       runId: raw.runId,
       callIndex: raw.callIndex,
+      ...raw.forceOwner === void 0 ? {} : { forceOwner: raw.forceOwner },
       lastN: raw.lastN,
       labelGlob: raw.labelGlob,
       logLines: raw.logLines
     };
   }
-  if (raw.runId !== void 0 || raw.callIndex !== void 0 || raw.waitMs !== void 0 || raw.lastN !== void 0 || raw.labelGlob !== void 0 || raw.logLines !== void 0 || hasConfigFields(raw)) {
+  if (raw.runId !== void 0 || raw.callIndex !== void 0 || raw.forceOwner !== void 0 || raw.waitMs !== void 0 || raw.lastN !== void 0 || raw.labelGlob !== void 0 || raw.logLines !== void 0 || hasConfigFields(raw)) {
     invalid("run inputs cannot include inspection fields");
   }
   const hasScript = raw.script !== void 0;
@@ -30826,9 +30834,131 @@ function clampWorkflowInput(input) {
   };
 }
 
+// ../mcp-server/src/default-backend.ts
+import {
+  probeHarnessConfig
+} from "@automatalabs/workflows";
+var DEFAULT_BACKEND_ENV = "AGENTPRISM_DEFAULT_BACKEND";
+var BUILTIN_BACKENDS = /* @__PURE__ */ new Set(["claude", "codex", "opencode", "pi"]);
+var NoAutoDefaultBackendError = class extends Error {
+  constructor(candidates) {
+    super(
+      [
+        "No usable default ACP backend was found for workflow agent() calls that omit model/tier.",
+        ...candidates.map((candidate) => `- ${candidate.backendId}: ${candidate.reason}`),
+        `Authenticate or install a backend, set ${DEFAULT_BACKEND_ENV} explicitly, or pin model on each agent() call.`
+      ].join("\n")
+    );
+    this.candidates = candidates;
+    this.name = "NoAutoDefaultBackendError";
+  }
+  candidates;
+};
+function workflowNeedsPinnedDefault(report) {
+  return report.dryRun?.agentCalls.some((call) => call.model === void 0 && call.tier === void 0) === true;
+}
+function recordedDefaultModel(source) {
+  if (!source) return void 0;
+  if (typeof source.defaultModel === "string" && source.defaultModel.trim() !== "") return source.defaultModel;
+  const backends = new Set(
+    (source.calls ?? []).filter((call) => call.kind === "agent" && call.modelRequested === void 0 && call.backendId).map((call) => call.backendId)
+  );
+  return backends.size === 1 ? [...backends][0] : void 0;
+}
+function modelCatalogState(harness) {
+  const option = (harness.options ?? []).find(
+    (candidate) => candidate.id === "model" && candidate.type === "select"
+  );
+  if (!option || option.type !== "select") return "absent";
+  const current = typeof option.currentValue === "string" ? option.currentValue.trim() : "";
+  return current !== "" || option.options.length > 0 ? "usable" : "empty";
+}
+function classifyAutoDefaultCandidates(report, customBackendIds = []) {
+  const customs = new Set(customBackendIds.map((id) => id.toLowerCase()));
+  return report.harnessOptions.map((harness) => {
+    const backendId = harness.backendId.toLowerCase();
+    if (!harness.probed) {
+      return {
+        backendId: harness.backendId,
+        status: "unavailable",
+        reason: `probe failed${harness.error ? ` \u2014 ${harness.error}` : ""}`
+      };
+    }
+    const builtIn = BUILTIN_BACKENDS.has(backendId) && !customs.has(backendId);
+    const catalog = modelCatalogState(harness);
+    if (builtIn && catalog === "empty") {
+      return {
+        backendId: harness.backendId,
+        status: "unavailable",
+        reason: "session opened but the built-in advertised no usable default or selectable model"
+      };
+    }
+    if (builtIn && backendId === "codex") {
+      return {
+        backendId: harness.backendId,
+        status: "ready",
+        readiness: "ready",
+        reason: "session/config probe succeeded and Codex checks authorization during session creation"
+      };
+    }
+    if (builtIn && backendId === "pi" && catalog === "usable") {
+      return {
+        backendId: harness.backendId,
+        status: "ready",
+        readiness: "ready",
+        reason: "session/config probe succeeded with Pi's credential-filtered model catalog"
+      };
+    }
+    return {
+      backendId: harness.backendId,
+      status: "unknown",
+      readiness: "unknown",
+      reason: "session/config probe succeeded; zero-token authentication readiness is not universally observable"
+    };
+  });
+}
+function selectAutoDefaultBackend(report, customBackendIds = []) {
+  const candidates = classifyAutoDefaultCandidates(report, customBackendIds);
+  const selected = candidates.find((candidate) => candidate.status === "ready") ?? candidates.find((candidate) => candidate.status === "unknown");
+  if (!selected || selected.status === "unavailable") throw new NoAutoDefaultBackendError(candidates);
+  return { backendId: selected.backendId, readiness: selected.readiness, reason: selected.reason };
+}
+async function discoverProjectDefaultBackend(context, probeRunner, timeoutMs = 6e4) {
+  if (context.autoDefaultBackend) return context.autoDefaultBackend;
+  if (context.autoDefaultBackendPending) return context.autoDefaultBackendPending;
+  const backendIds = [...new Set(probeRunner.listBackends?.() ?? [])];
+  if (backendIds.length === 0) throw new NoAutoDefaultBackendError([]);
+  const pending = Promise.all(
+    backendIds.map(
+      (backendId) => probeHarnessConfig({
+        harnesses: [backendId],
+        cwd: context.projectDir,
+        timeoutMs,
+        probeRunner
+      })
+    )
+  ).then((reports) => {
+    const harnessOptions = reports.flatMap((report2) => report2.harnessOptions);
+    const report = {
+      ok: harnessOptions.every((harness) => harness.probed),
+      exitCode: harnessOptions.every((harness) => harness.probed) ? 0 : 1,
+      harnessOptions
+    };
+    const selected = selectAutoDefaultBackend(report, probeRunner.listCustomBackends?.() ?? []);
+    context.autoDefaultBackend = selected;
+    return selected;
+  });
+  context.autoDefaultBackendPending = pending;
+  try {
+    return await pending;
+  } finally {
+    context.autoDefaultBackendPending = void 0;
+  }
+}
+
 // ../mcp-server/src/project-registry.ts
-import { existsSync as existsSync2, readdirSync, readFileSync, realpathSync, statSync } from "node:fs";
-import { isAbsolute as isAbsolute2, join } from "node:path";
+import { existsSync as existsSync2, readdirSync as readdirSync2, readFileSync as readFileSync2, realpathSync, statSync } from "node:fs";
+import { isAbsolute as isAbsolute2, join as join2 } from "node:path";
 import {
   WORKFLOW_PROJECTS_SUBDIR,
   WorkflowManager,
@@ -31117,6 +31247,152 @@ async function resetReplProjectState(state, boundMs = SHUTDOWN_DEADLINE_MS) {
   state.drainError = null;
 }
 
+// ../mcp-server/src/daemon/run-control-store.ts
+import { randomUUID } from "node:crypto";
+import {
+  chmodSync,
+  linkSync,
+  mkdirSync,
+  readFileSync,
+  readdirSync,
+  rmSync,
+  writeFileSync
+} from "node:fs";
+import { join } from "node:path";
+var CONTROL_DIR = ".control";
+var RUN_ID = /^[a-z0-9]+-[a-z0-9]+$/;
+var OPERATION_ID = /^[0-9a-f-]{36}$/i;
+function root(manager) {
+  return join(manager.getPersistence().getRunsDir(), CONTROL_DIR);
+}
+function runDir(manager, runId) {
+  if (!RUN_ID.test(runId)) throw new Error(`Invalid run-control runId: ${runId}`);
+  return join(root(manager), runId);
+}
+function requestPath(manager, runId, operationId) {
+  if (!OPERATION_ID.test(operationId)) throw new Error(`Invalid run-control operationId: ${operationId}`);
+  return join(runDir(manager, runId), `${operationId}.request.json`);
+}
+function acknowledgementPath(manager, runId, operationId) {
+  if (!OPERATION_ID.test(operationId)) throw new Error(`Invalid run-control operationId: ${operationId}`);
+  return join(runDir(manager, runId), `${operationId}.ack.json`);
+}
+function ensureRunDir(manager, runId) {
+  const dir = runDir(manager, runId);
+  mkdirSync(dir, { recursive: true, mode: 448 });
+  chmodSync(root(manager), 448);
+  chmodSync(dir, 448);
+}
+function writeImmutableJson(path, value) {
+  const tmp = `${path}.${process.pid}.${randomUUID()}.tmp`;
+  try {
+    writeFileSync(tmp, `${JSON.stringify(value, null, 2)}
+`, { flag: "wx", mode: 384 });
+    linkSync(tmp, path);
+  } finally {
+    rmSync(tmp, { force: true });
+  }
+}
+function readJson(path) {
+  try {
+    return JSON.parse(readFileSync(path, "utf8"));
+  } catch {
+    return void 0;
+  }
+}
+function validIntent(value, runId) {
+  return value?.version === 1 && value.action === "stop" && OPERATION_ID.test(value.operationId) && RUN_ID.test(value.runId) && (runId === void 0 || value.runId === runId) && typeof value.requestedAt === "string" && typeof value.requestedByInstanceId === "string";
+}
+function validAcknowledgement(value, runId, operationId) {
+  return value?.version === 1 && value.runId === runId && value.operationId === operationId && typeof value.acknowledgedAt === "string" && typeof value.acknowledgedByInstanceId === "string" && (value.outcome === "stopped" || value.outcome === "already-terminal");
+}
+function findPendingWholeStopIntent(manager, runId) {
+  let files;
+  try {
+    files = readdirSync(runDir(manager, runId)).filter((file2) => file2.endsWith(".request.json")).sort();
+  } catch {
+    return void 0;
+  }
+  for (const file2 of files) {
+    const operationId = file2.slice(0, -".request.json".length);
+    if (!OPERATION_ID.test(operationId)) continue;
+    const intent = readJson(requestPath(manager, runId, operationId));
+    if (!validIntent(intent, runId)) continue;
+    const acknowledgement = readWholeStopAcknowledgement(manager, runId, operationId);
+    if (acknowledgement === void 0) return intent;
+  }
+  return void 0;
+}
+function createOrReuseWholeStopIntent(manager, runId, requesterInstanceId) {
+  const pending = findPendingWholeStopIntent(manager, runId);
+  if (pending) return pending;
+  ensureRunDir(manager, runId);
+  for (; ; ) {
+    const intent = {
+      version: 1,
+      operationId: randomUUID(),
+      runId,
+      action: "stop",
+      requestedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      requestedByInstanceId: requesterInstanceId
+    };
+    try {
+      writeImmutableJson(requestPath(manager, runId, intent.operationId), intent);
+      return intent;
+    } catch (error51) {
+      if (error51.code !== "EEXIST") throw error51;
+    }
+  }
+}
+function readWholeStopIntent(manager, runId, operationId) {
+  const value = readJson(requestPath(manager, runId, operationId));
+  return validIntent(value, runId) && value.operationId === operationId ? value : void 0;
+}
+function readWholeStopAcknowledgement(manager, runId, operationId) {
+  const value = readJson(acknowledgementPath(manager, runId, operationId));
+  return validAcknowledgement(value, runId, operationId) ? value : void 0;
+}
+function acknowledgeWholeStopIntent(manager, intent, ownerInstanceId, outcome) {
+  ensureRunDir(manager, intent.runId);
+  const acknowledgement = {
+    version: 1,
+    operationId: intent.operationId,
+    runId: intent.runId,
+    acknowledgedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    acknowledgedByInstanceId: ownerInstanceId,
+    outcome
+  };
+  const path = acknowledgementPath(manager, intent.runId, intent.operationId);
+  try {
+    writeImmutableJson(path, acknowledgement);
+    return acknowledgement;
+  } catch (error51) {
+    const existing = readWholeStopAcknowledgement(manager, intent.runId, intent.operationId);
+    if (existing) return existing;
+    throw error51;
+  }
+}
+function listPendingWholeStopIntents(manager) {
+  let runIds;
+  try {
+    runIds = readdirSync(root(manager)).filter((entry) => RUN_ID.test(entry));
+  } catch {
+    return [];
+  }
+  const intents = [];
+  for (const runId of runIds) {
+    const pending = findPendingWholeStopIntent(manager, runId);
+    if (pending) intents.push(pending);
+  }
+  return intents;
+}
+function deleteRunControlSidecars(manager, runId) {
+  try {
+    rmSync(runDir(manager, runId), { recursive: true, force: true });
+  } catch {
+  }
+}
+
 // ../mcp-server/src/project-registry.ts
 var MAX_BACKGROUND_RUNS = 4;
 var BackgroundRunRegistry = class {
@@ -31166,13 +31442,16 @@ function resolveProjectDir(raw) {
   }
 }
 var WorkflowProjectRegistry = class {
-  constructor(runner) {
+  constructor(runner, options = {}) {
     this.runner = runner;
+    this.options = options;
   }
   runner;
+  options;
   contexts = /* @__PURE__ */ new Map();
   deletionListeners = /* @__PURE__ */ new Set();
   persistedEventListeners = /* @__PURE__ */ new Set();
+  stoppedListeners = /* @__PURE__ */ new Set();
   /** Adopt an externally built manager as its project's context (composition back-compat). */
   adopt(manager, backgroundRuns) {
     const existing = this.contexts.get(manager.cwd);
@@ -31189,18 +31468,26 @@ var WorkflowProjectRegistry = class {
     if (existing !== void 0) return existing;
     return this.register({
       projectDir,
-      manager: new WorkflowManager({ agent: this.runner, cwd: projectDir }),
+      manager: new WorkflowManager({
+        agent: this.runner,
+        cwd: projectDir,
+        leaseOwnerId: this.options.leaseOwnerId
+      }),
       backgroundRuns: new BackgroundRunRegistry()
     });
   }
   register(context) {
     this.contexts.set(context.projectDir, context);
     context.manager.on("runDeleted", (event) => {
+      deleteRunControlSidecars(context.manager, event.runId);
       for (const listener of this.deletionListeners) listener(event);
     });
     context.manager.on("runEventPersisted", (record2) => {
       for (const listener of this.persistedEventListeners) listener(record2);
     });
+    context.manager.on("stopped", (event) => {
+      for (const listener of this.stoppedListeners) listener(event);
+    });
     return context;
   }
   storeFor(runId) {
@@ -31216,18 +31503,18 @@ var WorkflowProjectRegistry = class {
    * project's next engine construction).
    */
   locateOnDisk(runId) {
-    const projectsDir = join(workflowHomeDir(), WORKFLOW_PROJECTS_SUBDIR);
+    const projectsDir = join2(workflowHomeDir(), WORKFLOW_PROJECTS_SUBDIR);
     let keys;
     try {
-      keys = readdirSync(projectsDir);
+      keys = readdirSync2(projectsDir);
     } catch {
       return void 0;
     }
     for (const key of keys) {
-      const rootDir = join(projectsDir, key);
+      const rootDir = join2(projectsDir, key);
       try {
-        if (!existsSync2(join(rootDir, "runs", `${runId}.json`))) continue;
-        const manifest = JSON.parse(readFileSync(join(rootDir, "project.json"), "utf-8"));
+        if (!existsSync2(join2(rootDir, "runs", `${runId}.json`))) continue;
+        const manifest = JSON.parse(readFileSync2(join2(rootDir, "project.json"), "utf-8"));
         if (typeof manifest.projectDir !== "string" || !isAbsolute2(manifest.projectDir)) continue;
         return this.getOrCreate(manifest.projectDir);
       } catch {
@@ -31247,9 +31534,13 @@ var WorkflowProjectRegistry = class {
     this.persistedEventListeners.add(listener);
     return () => this.persistedEventListeners.delete(listener);
   }
+  onRunStopped(listener) {
+    this.stoppedListeners.add(listener);
+    return () => this.stoppedListeners.delete(listener);
+  }
   activeRunCount() {
     let total = 0;
-    for (const context of this.contexts.values()) total += context.backgroundRuns.activeCount();
+    for (const context of this.contexts.values()) total += context.manager.activeExecutionCount();
     return total;
   }
   /** Dispose every context's REPL workspace: each one DRAINS with the
@@ -31284,7 +31575,7 @@ var WorkflowProjectRegistry = class {
   snapshot() {
     return [...this.contexts.values()].map((context) => ({
       projectDir: context.projectDir,
-      activeRuns: context.backgroundRuns.activeCount()
+      activeRuns: context.manager.activeExecutionCount()
     }));
   }
 };
@@ -31301,6 +31592,10 @@ function singleStoreRouter(manager) {
     onRunEventPersisted: (listener) => {
       manager.on("runEventPersisted", listener);
       return () => manager.off("runEventPersisted", listener);
+    },
+    onRunStopped: (listener) => {
+      manager.on("stopped", listener);
+      return () => manager.off("stopped", listener);
     }
   };
 }
@@ -31728,6 +32023,19 @@ var discoveryOutputFields = [
   "omittedHarnesses",
   "models"
 ];
+var stopControlSchema = external_exports.object({
+  state: external_exports.literal("pending"),
+  operationId: external_exports.string(),
+  requestedAt: external_exports.string(),
+  owner: external_exports.object({
+    pid: external_exports.number().int().positive(),
+    instanceId: external_exports.string().optional(),
+    version: external_exports.string().optional(),
+    lameDuck: external_exports.boolean().optional(),
+    activeRuns: external_exports.number().int().nonnegative().optional(),
+    controlProtocol: external_exports.literal(1).optional()
+  }).optional()
+});
 var variantOutputFields = [
   ...executionDetailFields,
   "scriptSource",
@@ -31736,6 +32044,7 @@ var variantOutputFields = [
   "outcome",
   "stopped",
   "alreadyTerminal",
+  "control",
   ...discoveryOutputFields
 ];
 var forbidsRequired = (...fields) => ({
@@ -31777,23 +32086,26 @@ var workflowToolOutputShape = external_exports.object({
   wait: waitSchema.optional(),
   outcome: executionResultSchema.optional(),
   stopped: external_exports.boolean().optional(),
-  alreadyTerminal: external_exports.boolean().optional()
+  alreadyTerminal: external_exports.boolean().optional(),
+  control: stopControlSchema.optional()
 }).superRefine((value, context) => {
   const has = (field) => value[field] !== void 0;
   const inspectionComplete = inspectionRequired.every((field) => has(field));
   const runCommonComplete = has("runId") && has("status") && has("scriptUri");
-  const terminal = terminalStatuses.includes(value.status);
+  const terminal2 = terminalStatuses.includes(value.status);
   let valid;
   if (value.action === "config") {
     valid = has("ok") && has("harnessOptions") && has("omittedHarnesses") && has("models") && hasOnlyExactFields(value, ["action", "ok", "harnessOptions", "omittedHarnesses", "models"]);
   } else if (value.action === "run") {
     valid = value.status === "rejected" && has("validation") && hasOnlyExactFields(value, ["action", "status", "validation"]);
   } else if (has("scriptSource")) {
-    valid = runCommonComplete && has("limits") && (value.status === "running" ? hasOnlyFields(value, ["scriptSource"]) : terminal && hasOnlyFields(value, ["scriptSource", ...executionDetailFields]));
+    valid = runCommonComplete && has("limits") && (value.status === "running" ? hasOnlyFields(value, ["scriptSource"]) : terminal2 && hasOnlyFields(value, ["scriptSource", ...executionDetailFields]));
+  } else if (has("control")) {
+    valid = runCommonComplete && inspectionComplete && value.stopped === false && value.alreadyTerminal === false && (value.status === "pending" || value.status === "running") && hasOnlyFields(value, [...inspectionFields, "stopped", "alreadyTerminal", "control"]);
   } else if (has("stopped") || has("alreadyTerminal")) {
     valid = runCommonComplete && inspectionComplete && has("stopped") && has("alreadyTerminal") && (value.status === "completed" || value.status === "failed" || value.status === "aborted") && hasOnlyFields(value, [...inspectionFields, "stopped", "alreadyTerminal"]);
   } else if (has("wait")) {
-    valid = runCommonComplete && inspectionComplete && hasOnlyFields(value, [...inspectionFields, "wait", "tokenUsage", "outcome"]) && (terminal ? has("outcome") : !has("outcome"));
+    valid = runCommonComplete && inspectionComplete && hasOnlyFields(value, [...inspectionFields, "wait", "tokenUsage", "outcome"]) && (terminal2 ? has("outcome") : !has("outcome"));
   } else {
     valid = runCommonComplete && inspectionComplete && hasOnlyFields(value, inspectionFields);
   }
@@ -31817,7 +32129,8 @@ var workflowToolOutputShape = external_exports.object({
         "wait",
         "outcome",
         "stopped",
-        "alreadyTerminal"
+        "alreadyTerminal",
+        "control"
       )
     },
     {
@@ -31837,7 +32150,8 @@ var workflowToolOutputShape = external_exports.object({
         "wait",
         "outcome",
         "stopped",
-        "alreadyTerminal"
+        "alreadyTerminal",
+        "control"
       )
     },
     {
@@ -31877,6 +32191,16 @@ var workflowToolOutputShape = external_exports.object({
       required: [...runOutputRequired, ...inspectionRequired, "stopped", "alreadyTerminal"],
       properties: { status: { enum: ["completed", "failed", "aborted"] } },
       ...forbidsOutside([...inspectionFields, "stopped", "alreadyTerminal"])
+    },
+    {
+      title: "Workflow stop pending",
+      required: [...runOutputRequired, ...inspectionRequired, "stopped", "alreadyTerminal", "control"],
+      properties: {
+        status: { enum: nonterminalStatuses },
+        stopped: { const: false },
+        alreadyTerminal: { const: false }
+      },
+      ...forbidsOutside([...inspectionFields, "stopped", "alreadyTerminal", "control"])
     }
   ]
 });
@@ -32142,9 +32466,9 @@ var AUTHORING_DOC_TOPICS = [
       "workflow/run-lifecycle",
       "workflow/examples"
     ],
-    "bytes": 3978,
-    "sha256": "254e8a5612aa6dff27201accacce3d8dbe42af15b56ebdda165f5d23a7faac81",
-    "text": '# Workflow scripts: quickstart\n\n**Context:** JavaScript passed to the MCP `workflow` tool. This is not REPL code: workflow scripts use `agent(prompt, options?)`, allow top-level `return`, and start from a required metadata export.\n\nA workflow script is a deterministic orchestrator. Script code owns loops, fan-out, conditionals, aggregation, and checkpoints; `agent()` workers perform repository or research tasks. Workers start fresh sessions and do not share memory, so interpolate every prior result a later worker needs into its prompt.\n\n## Minimal valid script\n\n```js\nexport const meta = {\n  name: "review-target",\n  description: "Review a target and return concrete findings",\n  phases: [{ title: "Review" }],\n};\n\nphase("Review");\nconst report = await agent(\n  `Review ${args.target}. Read the relevant files and report concrete findings.`,\n  { label: "review" },\n);\nreturn { report };\n```\n\nThe metadata export must be the first statement and a pure object literal. `name` and `description` are required non-empty strings. `phases`, when present, is an array of objects shaped `{ title: string, detail?: string, model?: string }`, never strings.\n\nSubmit the source without Markdown fences using the `workflow` tool\'s run form, with an absolute `projectDir` on the shared daemon. `args` is the JSON value supplied by the tool call. Some hosts may carry caller data as a JSON string, so harden scripts that accept external input:\n\n```js\nconst raw = typeof args === "string" ? (() => {\n  try { return JSON.parse(args); } catch { return {}; }\n})() : args;\nconst input = raw && typeof raw === "object" && !Array.isArray(raw) ? raw : {};\n```\n\n## Core rules\n\n- The DSL primitives are injected globals; do not import them.\n- Top-level `await` and top-level `return` are supported.\n- Scripts are JavaScript, not TypeScript.\n- No `require`, imports, filesystem API, network API, timers, `Date.now()`, `Math.random()`, or no-argument `Date` construction. Pass nondeterministic values through `args`.\n- Every `agent()` call should have a stable descriptive `label`.\n- A recoverable worker failure resolves to `null` after retries. Null-check load-bearing results.\n- `parallel()` takes thunks, not already-started promises:\n\n```js\nconst results = (await parallel([\n  () => agent("Review correctness", { label: "review:correctness" }),\n  () => agent("Review test coverage", { label: "review:coverage" }),\n])).filter(Boolean);\n```\n\n- Use a plain JSON Schema object in `schema` when script control flow depends on a worker result.\n- Return a compact JSON-serializable result; do not return a transcript.\n\n## Model selection\n\nOmit `model` for the server default, or use a backend-only value such as `"codex"` to retain that backend\'s configured default model. Before pinning a model id, `mode`, or `configOptions`, call `workflow` with `action:"config"`. After choosing a model, use `modelSpecs` to read that exact model\'s option domain. Set `mode` only when that selected harness entry\'s `modes.availableModes` explicitly lists the exact id; `modes:null` means the backend/model supports no modes, so omit `mode`. Never infer a generic `"default"` and never guess model or option ids.\n\n## Validation and execution\n\nEvery run is statically parsed, mock-executed, and checked against no-prompt backend configuration before admission. A rejection creates no run ID, reserves no background slot, and spends no tokens. Read the diagnostic, correct the script, and submit it again.\n\nUse foreground execution for short work. Use `background:true` for work that may outlive one tool request; retain the returned `runId`, then use bounded `await`, `inspect`, or `stop` calls.\n\n## What to read next\n\n- `workflow/composition-and-failure` \u2014 metadata, fan-out, phases, and null semantics.\n- `workflow/api-agents` \u2014 every `agent()` option and structured output.\n- `workflow/run-lifecycle` \u2014 config, run, await, inspect, stop, and resume.\n- `workflow/examples` \u2014 complete composition patterns.\n'
+    "bytes": 4233,
+    "sha256": "42ce5da7c5f57960b4cee8e0901c5ae6542a77a17dc5c0e4db8b97cf72544130",
+    "text": '# Workflow scripts: quickstart\n\n**Context:** JavaScript passed to the MCP `workflow` tool. This is not REPL code: workflow scripts use `agent(prompt, options?)`, allow top-level `return`, and start from a required metadata export.\n\nA workflow script is a deterministic orchestrator. Script code owns loops, fan-out, conditionals, aggregation, and checkpoints; `agent()` workers perform repository or research tasks. Workers start fresh sessions and do not share memory, so interpolate every prior result a later worker needs into its prompt.\n\n## Minimal valid script\n\n```js\nexport const meta = {\n  name: "review-target",\n  description: "Review a target and return concrete findings",\n  phases: [{ title: "Review" }],\n};\n\nphase("Review");\nconst report = await agent(\n  `Review ${args.target}. Read the relevant files and report concrete findings.`,\n  { label: "review" },\n);\nreturn { report };\n```\n\nThe metadata export must be the first statement and a pure object literal. `name` and `description` are required non-empty strings. `phases`, when present, is an array of objects shaped `{ title: string, detail?: string, model?: string }`, never strings.\n\nSubmit the source without Markdown fences using the `workflow` tool\'s run form, with an absolute `projectDir` on the shared daemon. `args` is the JSON value supplied by the tool call. Some hosts may carry caller data as a JSON string, so harden scripts that accept external input:\n\n```js\nconst raw = typeof args === "string" ? (() => {\n  try { return JSON.parse(args); } catch { return {}; }\n})() : args;\nconst input = raw && typeof raw === "object" && !Array.isArray(raw) ? raw : {};\n```\n\n## Core rules\n\n- The DSL primitives are injected globals; do not import them.\n- Top-level `await` and top-level `return` are supported.\n- Scripts are JavaScript, not TypeScript.\n- No `require`, imports, filesystem API, network API, timers, `Date.now()`, `Math.random()`, or no-argument `Date` construction. Pass nondeterministic values through `args`.\n- Every `agent()` call should have a stable descriptive `label`.\n- A recoverable worker failure resolves to `null` after retries. Null-check load-bearing results.\n- `parallel()` takes thunks, not already-started promises:\n\n```js\nconst results = (await parallel([\n  () => agent("Review correctness", { label: "review:correctness" }),\n  () => agent("Review test coverage", { label: "review:coverage" }),\n])).filter(Boolean);\n```\n\n- Use a plain JSON Schema object in `schema` when script control flow depends on a worker result.\n- Return a compact JSON-serializable result; do not return a transcript.\n\n## Model selection\n\nOmit `model` for the server default, or use a backend-only value such as `"codex"` to retain that backend\'s configured default model. When `AGENTPRISM_DEFAULT_BACKEND` is truly unset, the MCP server probes backend readiness without prompting, pins one project default before validation/execution, and keeps that backend for the run and resume; an explicit environment default always wins. Before pinning a model id, `mode`, or `configOptions`, call `workflow` with `action:"config"`. After choosing a model, use `modelSpecs` to read that exact model\'s option domain. Set `mode` only when that selected harness entry\'s `modes.availableModes` explicitly lists the exact id; `modes:null` means the backend/model supports no modes, so omit `mode`. Never infer a generic `"default"` and never guess model or option ids.\n\n## Validation and execution\n\nEvery run is statically parsed, mock-executed, and checked against no-prompt backend configuration before admission. A rejection creates no run ID, reserves no background slot, and spends no tokens. Read the diagnostic, correct the script, and submit it again.\n\nUse foreground execution for short work. Use `background:true` for work that may outlive one tool request; retain the returned `runId`, then use bounded `await`, `inspect`, or `stop` calls.\n\n## What to read next\n\n- `workflow/composition-and-failure` \u2014 metadata, fan-out, phases, and null semantics.\n- `workflow/api-agents` \u2014 every `agent()` option and structured output.\n- `workflow/run-lifecycle` \u2014 config, run, await, inspect, stop, and resume.\n- `workflow/examples` \u2014 complete composition patterns.\n'
   },
   {
     "id": "workflow/run-lifecycle",
@@ -32157,9 +32481,9 @@ var AUTHORING_DOC_TOPICS = [
       "workflow/determinism-and-resume",
       "workflow/models-and-config"
     ],
-    "bytes": 6835,
-    "sha256": "85a1d7894a0a36953511810bce9d073c29868bc0e1de89939d912c8f4356fa8f",
-    "text": '## Running workflows \u2014 the MCP `workflow` tool\n\n**Context:** JavaScript passed to the MCP `workflow` tool. Workflow scripts use `agent(prompt, options?)`; REPL evals use a different API.\n\nUse the connected `workflow` tool for deterministic batch orchestration. The shared server daemon owns execution, so admitted runs survive MCP client session churn and tool-request timeouts; only daemon exit can interrupt in-flight work. Any later session can await, inspect, or stop a run. Runs, journals, and logs persist per project namespace.\n\nEvery `config` and `run` call on the shared daemon names its project with the required `projectDir` argument \u2014 an absolute path, normally the workspace root. `inspect`/`await`/`stop` take only a `runId`; the run ID locates its project store automatically. In a single-project server, `projectDir` defaults to that server\'s project.\n\n### The `workflow` tool, by action\n\n- **Config** (`{ action: "config", projectDir, harnesses?, modelSpecs?, modelFilter? }`): discover live model, mode, effort, and `configOptions` values from no-prompt backend sessions. Use `harnesses` plus `modelFilter` to find ids, then `modelSpecs` to select exact models and read their model-specific option domains. Each successful entry reports `modes` explicitly: use only exact ids in `modes.availableModes`; `modes:null` means omit `mode`, never guess a default. It starts no workflow and spends zero tokens. Use it only when pinning those values; an omitted model or backend-only model uses configured defaults without discovery.\n- **Run** (default, no `action`): supply exactly one of `script` (the raw source string, no Markdown fences) or `scriptPath` (an absolute path on the server\'s filesystem), plus `projectDir`. The tool automatically performs static validation, a mocked dry run, and routed config checks before admission. Invalid scripts return bounded `status:"rejected"` diagnostics with no run ID, background slot, or token spend. A path is read once at admission and its content snapshotted; later edits affect only a new run. `args` arrives in the script as the `args` global; the run\'s base directory is the `cwd` global. Some hosts hand `args` through as a JSON **string** \u2014 tolerate both shapes (`typeof args === "string" ? JSON.parse(args) : args`). Foreground streams progress but is bound to the request and its timeout. Pass `background: true` for anything that may outlive one request; it acknowledges after durable admission with a `runId`.\n- **Await** (`{ action: "await", runId, waitMs }`): bounded collection for background runs. A timeout is progress, not failure \u2014 call again (`waitMs: 20000` is typical). At terminal status the response adds `outcome`: the authored result or pause context, plus `replayEligibility`, `resumeReport`, `fallbacks`, and `checkpointsTaken`.\n- **Inspect** (`{ action: "inspect", runId, lastN, labelGlob, logLines }`): a bounded snapshot \u2014 the latest matching calls with compact result previews plus the newest log lines. Use a narrow `labelGlob` to diagnose before deciding whether to resume, edit, or stop. Inspection never executes or resumes a script.\n- **Stop**: `{ action: "stop", runId }` durably aborts the whole run and returns its final snapshot; stopping a terminal run is a successful no-op. `{ action: "stop", runId, callIndex }` cancels exactly that in-flight agent: its slot settles to `null` with `AGENT_CANCELLED` and the run stays live. `labelGlob` only filters the returned snapshot; it never selects what to cancel.\n- **Resume**: a NEW run with `resumeFromRunId` plus the script content re-sent (the same `script` or `scriptPath`) and the desired `args` (+ `checkpointReplies` when answering a durable checkpoint). Read the returned `replayEligibility` for the predicted and observed replay prefix; never assume a prefix hit. Full semantics: **Determinism and resume**.\n\n### Operating rules\n\n- **Always retain the returned `runId`.** A paused, failed, or aborted response carries a redacted final-20 `logTail`. Read it before you change anything. Every admitted script is also an immutable resource at `workflow://runs/{runId}/script`, so a later session can recover a lost inline script.\n- **Two fingerprints control replay.** The identity hash covers the prompt, the resolved model, `mode` when set, non-empty sorted `configOptions`, `tier`, `phase`, `agentType`, the resolved agent definition, and the schema. The input fingerprint covers the resolved label, per-call `cwd` and isolation, `keepSession`, images, MCP servers, session/prompt metadata, and the approved script-backend digest.\n- **Operational bounds are not replay inputs.** Host `concurrency`, `agentRetries`, and `agentTimeoutMs`, plus per-call `timeoutMs` and `retries`, enter neither fingerprint. A resume does not inherit them from its source run; pass the values you want on every run. `agentTimeoutMs` caps the wall-clock time of each attempt; it is not an idle timer. A per-call `timeoutMs` can tighten that ceiling but cannot escape it. Each retry gets a fresh clock, so the envelope is `(resolved retries + 1) \xD7 resolved timeout`, with retries clamped to 3.\n- **Old journals stay usable.** Input formats below 2 replay positionally with `fallbackReason: "inputs-format-legacy"`. A current-format crash snapshot uses identity matching even without terminal-environment capture. Ancestor-scoped rows carried from \u22640.23 resume chains replay only while that ancestor run is still persisted. Journals resume across filesystem, environment, engine, Node, and V8 changes; `replayEligibility` reports those differences as diagnostics, never as gates.\n- **A background start returns immediately.** It sends no progress after it returns; collect progress with later bounded awaits. Background runs have no live checkpoint channel, so authored `headless` checkpoint modes apply. When a run\'s owner process dies, cold preflights reconcile stale `pending`/`running` state to `paused` with `pauseReason: "interrupted"`; a live owner is left alone.\n- A run paused with `reason: "auth_required"` resumes as a new run after that backend\'s credentials are configured.\n\n### Execution logs \u2014 the events resource\n\nEvery journaling run publishes an MCP resource at `workflow://runs/{runId}/events`. Subscribe to the canonical URI for advisory `resources/updated` hints, then read and paginate with `after`, `limit`, and `streamId`. Progress is coarse and redacted: `agentTranscript` rows are assistant/tool upserts partitioned by `(scope, callIndex, executionStartSeq)` and reduced by greatest revision per entry index. The durable cursor is authoritative when hints coalesce or a subscriber falls behind.\n\nEmbedding hosts can drive the same contract with `runDynamicWorkflow` / `WorkflowManager` from `@automatalabs/workflows`; the script contract is identical either way.\n'
+    "bytes": 7889,
+    "sha256": "3ad743e112881c25d4ac12e5f2795ec7e810c571a1141b492228a33ab4cc5276",
+    "text": '## Running workflows \u2014 the MCP `workflow` tool\n\n**Context:** JavaScript passed to the MCP `workflow` tool. Workflow scripts use `agent(prompt, options?)`; REPL evals use a different API.\n\nUse the connected `workflow` tool for deterministic batch orchestration. The shared server daemon owns execution, so admitted runs survive MCP client session churn and tool-request timeouts. During a version upgrade, the successor becomes the front door while a predecessor may remain the execution owner; signed run-control forwarding keeps later-session stop/cancel operations location-independent. Owner-process exit can still interrupt in-flight work. Any later session can await, inspect, or stop a run. Runs, journals, logs, and outstanding whole-stop intents persist per project namespace.\n\nEvery `config` and `run` call on the shared daemon names its project with the required `projectDir` argument \u2014 an absolute path, normally the workspace root. `inspect`/`await`/`stop` take only a `runId`; the run ID locates its project store automatically. In a single-project server, `projectDir` defaults to that server\'s project.\n\n### The `workflow` tool, by action\n\n- **Config** (`{ action: "config", projectDir, harnesses?, modelSpecs?, modelFilter? }`): discover live model, mode, effort, and `configOptions` values from no-prompt backend sessions. Use `harnesses` plus `modelFilter` to find ids, then `modelSpecs` to select exact models and read their model-specific option domains. Each successful entry reports `modes` explicitly: use only exact ids in `modes.availableModes`; `modes:null` means omit `mode`, never guess a default. It starts no workflow and spends zero tokens. Use it only when pinning those values; an omitted model or backend-only model uses configured defaults without discovery.\n- **Run** (default, no `action`): supply exactly one of `script` (the raw source string, no Markdown fences) or `scriptPath` (an absolute path on the server\'s filesystem), plus `projectDir`. The tool automatically performs static validation, a mocked dry run, and routed config checks before admission. Invalid scripts return bounded `status:"rejected"` diagnostics with no run ID, background slot, or token spend. A path is read once at admission and its content snapshotted; later edits affect only a new run. `args` arrives in the script as the `args` global; the run\'s base directory is the `cwd` global. Some hosts hand `args` through as a JSON **string** \u2014 tolerate both shapes (`typeof args === "string" ? JSON.parse(args) : args`). Foreground streams progress but is bound to the request and its timeout. Pass `background: true` for anything that may outlive one request; it acknowledges after durable admission with a `runId`.\n- **Await** (`{ action: "await", runId, waitMs }`): bounded collection for background runs. A timeout is progress, not failure \u2014 call again (`waitMs: 20000` is typical). At terminal status the response adds `outcome`: the authored result or pause context, plus `replayEligibility`, `resumeReport`, `fallbacks`, and `checkpointsTaken`.\n- **Inspect** (`{ action: "inspect", runId, lastN, labelGlob, logLines }`): a bounded snapshot \u2014 the latest matching calls with compact result previews plus the newest log lines. Use a narrow `labelGlob` to diagnose before deciding whether to resume, edit, or stop. Inspection never executes or resumes a script.\n- **Stop**: `{ action: "stop", runId }` durably aborts the whole run and normally returns its final snapshot; stopping a terminal run is a successful no-op. Across a daemon upgrade, the successor persists an idempotent stop intent and forwards to the predecessor that owns execution. If that owner does not settle within the bounded control wait, the successful response remains nonterminal with `control:{ state:"pending", operationId, requestedAt, owner? }`; retry stop, inspect, or await to observe settlement. `{ action: "stop", runId, callIndex }` synchronously routes to the live owner and cancels exactly that in-flight agent: its slot settles to `null` with `AGENT_CANCELLED` and the run stays live; call cancellation is never reconstructed after owner loss. Whole-run `{ action:"stop", runId, forceOwner:true }` explicitly authorizes terminating a superseded owner daemon when graceful control cannot settle and may interrupt sibling runs in that process; it is forbidden with `callIndex`. `labelGlob` only filters the returned snapshot; it never selects what to cancel.\n- **Resume**: a NEW run with `resumeFromRunId` plus the script content re-sent (the same `script` or `scriptPath`) and the desired `args` (+ `checkpointReplies` when answering a durable checkpoint). Read the returned `replayEligibility` for the predicted and observed replay prefix; never assume a prefix hit. Full semantics: **Determinism and resume**.\n\n### Operating rules\n\n- **Always retain the returned `runId`.** A paused, failed, or aborted response carries a redacted final-20 `logTail`. Read it before you change anything. Every admitted script is also an immutable resource at `workflow://runs/{runId}/script`, so a later session can recover a lost inline script.\n- **Two fingerprints control replay.** The identity hash covers the prompt, the resolved model, `mode` when set, non-empty sorted `configOptions`, `tier`, `phase`, `agentType`, the resolved agent definition, and the schema. The input fingerprint covers the resolved label, per-call `cwd` and isolation, `keepSession`, images, MCP servers, session/prompt metadata, and the approved script-backend digest.\n- **Operational bounds are not replay inputs.** Host `concurrency`, `agentRetries`, and `agentTimeoutMs`, plus per-call `timeoutMs` and `retries`, enter neither fingerprint. A resume does not inherit them from its source run; pass the values you want on every run. `agentTimeoutMs` caps the wall-clock time of each attempt; it is not an idle timer. A per-call `timeoutMs` can tighten that ceiling but cannot escape it. Each retry gets a fresh clock, so the envelope is `(resolved retries + 1) \xD7 resolved timeout`, with retries clamped to 3.\n- **Old journals stay usable.** Input formats below 2 replay positionally with `fallbackReason: "inputs-format-legacy"`. A current-format crash snapshot uses identity matching even without terminal-environment capture. Ancestor-scoped rows carried from \u22640.23 resume chains replay only while that ancestor run is still persisted. Journals resume across filesystem, environment, engine, Node, and V8 changes; `replayEligibility` reports those differences as diagnostics, never as gates.\n- **A background start returns immediately.** It sends no progress after it returns; collect progress with later bounded awaits. Background runs have no live checkpoint channel, so authored `headless` checkpoint modes apply. When a run\'s owner process dies, a pending whole-stop intent is applied under the reclaimed lease; otherwise cold preflights reconcile stale `pending`/`running` state to `paused` with `pauseReason:"interrupted"`. A live owner lease is never stolen because of a timeout.\n- A run paused with `reason: "auth_required"` resumes as a new run after that backend\'s credentials are configured.\n\n### Execution logs \u2014 the events resource\n\nEvery journaling run publishes an MCP resource at `workflow://runs/{runId}/events`. Subscribe to the canonical URI for advisory `resources/updated` hints, then read and paginate with `after`, `limit`, and `streamId`. Progress is coarse and redacted: `agentTranscript` rows are assistant/tool upserts partitioned by `(scope, callIndex, executionStartSeq)` and reduced by greatest revision per entry index. The durable cursor is authoritative when hints coalesce or a subscriber falls behind.\n\nEmbedding hosts can drive the same contract with `runDynamicWorkflow` / `WorkflowManager` from `@automatalabs/workflows`; the script contract is identical either way.\n'
   },
   {
     "id": "workflow/models-and-config",
@@ -32172,9 +32496,9 @@ var AUTHORING_DOC_TOPICS = [
       "workflow/environment-and-tools",
       "workflow/run-lifecycle"
     ],
-    "bytes": 8823,
-    "sha256": "bf309ca0b8858a255b6fbd549b1badb994a9447f32752e3f25c55c565492e789",
-    "text": '## Choosing the agent for each call\n\n**Context:** JavaScript passed to the MCP `workflow` tool. Workflow scripts use `agent(prompt, options?)`; REPL evals use a different API.\n\nThe backend is selected **per `agent()` call** from its effective `model` string. One script can plan on one vendor\'s agent, implement on another\'s, and review on a third\'s, handing structured results between them.\n\nThe built-in names (`claude`, `codex`, `opencode`, `pi`) come from the runtime backend registry. Registered custom names extend that set.\n\n- **Omit `model` entirely** for maximum portability \u2014 the call runs on whatever default backend the host configured (`AGENTPRISM_DEFAULT_BACKEND`, or the host\'s session model). A script with no model specs anywhere runs unchanged on any backend.\n- **Route by one registered first segment.** Split on the first `/`; ASCII-case-insensitive `claude`, `codex`, `opencode`, `pi`, or a registered custom backend name selects that harness and is stripped exactly once. A custom registration wins on a built-in-name collision.\n- **Use a backend name alone** (`claude`, `codex`, `opencode`, `pi`, or a custom name) to preserve the harness\'s configured default model. No model config call is made.\n- **Everything else goes intact to the default backend.** `anthropic/\u2026`, `openai/\u2026`, bare `opus`, and bare `gpt-\u2026` are not routing aliases. When an id remains after routing, it is sent byte-for-byte: no catalog matching, case folding, bracket parsing, effort/Fast option driving, retry, or fallback. Harness rejection is an agent error.\n- **`tier`** (`"small" | "medium" | "big"`) is a coarse alternative resolved from the host\'s tier config \u2014 use it for "a cheap model" without naming a vendor.\n\nThe published examples use ids verified against live harness catalogs: `claude/opus[1m]`, `codex/gpt-5.6-sol`, and `opencode/zai/glm-5.2`. For Pi, `pi/openrouter/vendor/model-id` strips only `pi/`; Pi then splits provider `openrouter` from model id `vendor/model-id`. Prefer backend-only forms when the desired model is configured inside the harness.\n\nNever guess model ids, mode ids, effort values, or option names from memory. With MCP, call the `workflow` tool using `action:"config"` and optional `harnesses` / `modelFilter`; it returns the live catalog without starting a workflow.\n\nOne no-prompt session per harness, zero tokens: each successful harness entry contains `modes` plus its config-option catalog. A non-null `modes` object carries `currentModeId` and `availableModes`; only those exact advertised ids are valid. `modes:null` explicitly means that backend/model supports no ACP session modes, so omit `mode`\u2014absence never licenses an invented generic `"default"`. Config options list model ids (including bracket variants like `opus[1m]`), effort levels, and every other negotiable option exactly as the installed harness advertises them. One caveat: the bare `config` probe reads each harness with its **default model** selected, and option domains are **model-specific**. An option can appear only after a particular model is selected. Ceilings differ per model. Provider-served variants of the same model can advertise different domains. The authoritative per-model probe is the validator run on your real script: it selects each authored model spec first and echoes that pair\'s advertised modes and options. Confirm every pinned value against its own echoed entry; do not read package internals to discover options.\n\n```js\nconst plan   = await agent(PLAN_PROMPT,          { label: "plan",      model: "opencode/zai/glm-5.2", schema: PLAN });\nconst impl   = await agent(implPrompt(plan),     { label: "implement", model: "codex/gpt-5.6-sol" });\nconst review = await agent(reviewPrompt(impl),   { label: "review",    model: "claude/opus[1m]", schema: REVIEW });\n```\n\nUse `configOptions` only for exact ACP session options advertised by that routed harness. With MCP, read the selected harness\'s `action:"config"` result before choosing ids or select values; catalogs vary by harness version, login, and machine.\n\n```js\nconst impl = await agent(implPrompt(plan), {\n  label: "implement",\n  model: "codex",\n  configOptions: { "fast-mode": true, reasoning_effort: "high" },\n});\n```\n\nIds and string/boolean values pass through verbatim in ascending id order, after model selection and before the prompt. There are no aliases, coercion, client-side vocabulary, defaults, or cached catalogs. Copy option ids character-for-character from the catalog, punctuation included \u2014 `"fast-mode"`, not `fast_mode` \u2014 and quote ids that are not valid identifiers. Never put `"model"` in `configOptions`; use the dedicated `model` field. A harness rejection follows the ordinary agent-error path.\n\nPi\'s thought-level option is named `thinkingLevel`, and its choices depend on the exact model in the same call:\n\n```js\nconst review = await agent(REVIEW_PROMPT, {\n  label: "pi-review",\n  model: "pi/openrouter/vendor/model-id",\n  configOptions: { thinkingLevel: "high" },\n});\n```\n\nValidation selects `openrouter/vendor/model-id` before reading Pi\'s choices. A listed value passes unchanged. A recognized value above an ordered model\'s ceiling, or in a model-specific gap, passes with a warning that names the effective clamp target. Pi advertises its SDK-derived domain directly. Claude and Codex are also ordered: when their options omit domain metadata, validation enumerates the advertised models and merges their per-model effort orders. A Claude model without an `effort` option does not support effort, and `default` never becomes a ceiling target. OpenCode and custom backends have no declared value order, so validation is exact-set. An unrecognized or unadvertised value fails with exit code `2`. Enumeration stops at 32 advertised models; a larger or inconsistently ordered catalog warns and falls back to exact advertised-value validation.\n\n**The harness is authoritative.** The client never substitutes a nearby model or silently falls back. A rejected id follows the existing agent-error path; a harness that accepts or ignores it determines the outcome. The public `fallbacks`/`onModelFallback` fields remain for compatibility but model resolution does not emit them.\n\n## Structured output\n\nPass `schema` \u2014 a **plain JSON Schema object literal** (no schema builders exist inside the realm) \u2014 and the call resolves to a **validated object** instead of text:\n\n```js\nconst FINDINGS = {\n  type: "object",\n  additionalProperties: false,\n  required: ["findings"],\n  properties: {\n    findings: {\n      type: "array",\n      items: {\n        type: "object",\n        additionalProperties: false,\n        required: ["file", "line", "summary"],\n        properties: {\n          file:    { type: "string", description: "Repo-relative path \u2014 copy it exactly, never invent one" },\n          line:    { type: "number", description: "1-indexed line the finding anchors to" },\n          summary: { type: "string", description: "One sentence stating the defect, grounded in code you actually read" },\n        },\n      },\n    },\n  },\n};\n\nconst report = await agent("Review the diff on this branch for correctness bugs.", {\n  label: "review", schema: FINDINGS,\n});\nreport.findings.forEach((f) => log(`${f.file}:${f.line} ${f.summary}`));\n```\n\nThe same schema works on **every** backend; only the fulfillment channel differs, and the runner picks it for you: Claude uses its `outputFormat`, Codex its strict `outputSchema`, while Pi, OpenCode, and eligible custom ACP agents receive a client-hosted `StructuredOutput` MCP tool when they advertise HTTP MCP support. Pi accepts stdio, Streamable HTTP, and SSE MCP servers. If no valid tool capture exists, Pi retains the runner\'s common prompt-embedded schema and validated final-text JSON fallback. In every channel the runner validates the value client-side (with type coercion) and re-prompts a bounded number of times before failing the call with non-recoverable `SCHEMA_NONCOMPLIANCE`.\n\nSchema authoring rules that keep all channels healthy:\n\n- Root must be an object; set `additionalProperties: false` and list every property in `required`.\n- Put a `description` on every field \u2014 descriptions are the per-field prompt.\n- Keep schemas structurally simple. Exotic keywords (`oneOf`, `patternProperties`, unusual `format`s, backreference regexes) are normalized or stripped on the wire for some backends \u2014 validation still enforces them client-side, which shows up as re-prompt churn. Prefer `anyOf`, `enum`, and plain types.\n- Keep free-text fields small (tens of lines). An oversized structured output can exhaust schema repair and fail the call.\n- Validation checks structure, not truth. Check load-bearing values in script code (for example, reject findings whose `file` is not in a known file list) before spending more agents on them.\n'
+    "bytes": 9604,
+    "sha256": "21ea6e619a1e0220c60cba74f8323fb5ae00db29b06fe2858d27e750d80c5795",
+    "text": '## Choosing the agent for each call\n\n**Context:** JavaScript passed to the MCP `workflow` tool. Workflow scripts use `agent(prompt, options?)`; REPL evals use a different API.\n\nThe backend is selected **per `agent()` call** from its effective `model` string. One script can plan on one vendor\'s agent, implement on another\'s, and review on a third\'s, handing structured results between them.\n\nThe built-in names (`claude`, `codex`, `opencode`, `pi`) come from the runtime backend registry. Registered custom names extend that set.\n\n- **Omit `model` entirely** for maximum portability. In the MCP server, an explicitly present `AGENTPRISM_DEFAULT_BACKEND` wins; when it is truly unset, the first model-less run for a project performs zero-token backend readiness probes, pins one effective backend before validation/execution, and reuses that pin for the run and resume. The SDK runner itself retains its configured default (`AGENTPRISM_DEFAULT_BACKEND`, historical fallback Claude). A script with no model specs remains backend-portable.\n- **Route by one registered first segment.** Split on the first `/`; ASCII-case-insensitive `claude`, `codex`, `opencode`, `pi`, or a registered custom backend name selects that harness and is stripped exactly once. A custom registration wins on a built-in-name collision.\n- **Use a backend name alone** (`claude`, `codex`, `opencode`, `pi`, or a custom name) to preserve the harness\'s configured default model. No model config call is made.\n- **Everything else goes intact to the default backend.** `anthropic/\u2026`, `openai/\u2026`, bare `opus`, and bare `gpt-\u2026` are not routing aliases. When an id remains after routing, it is sent byte-for-byte: no catalog matching, case folding, bracket parsing, effort/Fast option driving, retry, or fallback. Harness rejection is an agent error.\n- **`tier`** (`"small" | "medium" | "big"`) is a coarse alternative resolved from the host\'s tier config \u2014 use it for "a cheap model" without naming a vendor.\n\nThe published examples use ids verified against live harness catalogs: `claude/opus[1m]`, `codex/gpt-5.6-sol`, and `opencode/zai/glm-5.2`. For Pi, `pi/openrouter/vendor/model-id` strips only `pi/`; Pi then splits provider `openrouter` from model id `vendor/model-id`. Prefer backend-only forms when the desired model is configured inside the harness.\n\nNever guess model ids, mode ids, effort values, or option names from memory. With MCP, call the `workflow` tool using `action:"config"` and optional `harnesses` / `modelFilter`; it returns the live catalog without starting a workflow.\n\nOne no-prompt session per harness, zero tokens: each successful harness entry contains `modes` plus its config-option catalog. A non-null `modes` object carries `currentModeId` and `availableModes`; only those exact advertised ids are valid. `modes:null` explicitly means that backend/model supports no ACP session modes, so omit `mode`\u2014absence never licenses an invented generic `"default"`. Config options list model ids (including bracket variants like `opus[1m]`), effort levels, and every other negotiable option exactly as the installed harness advertises them. `probed:true` means session/config discovery succeeded, **not** that every backend has proven it can authenticate a first prompt: ACP has no universal zero-token auth-status method, and some agents defer that check. Automatic MCP default selection treats failed probes and explicitly empty built-in model catalogs as unavailable, prefers stronger session-open evidence (Codex authorization; Pi\'s credential-filtered catalog), then falls back to the first session-ready backend whose prompt readiness is unknown. One additional caveat: the bare `config` probe reads each harness with its **default model** selected, and option domains are **model-specific**. An option can appear only after a particular model is selected. Ceilings differ per model. Provider-served variants of the same model can advertise different domains. The authoritative per-model probe is the validator run on your real script: it selects each authored model spec first and echoes that pair\'s advertised modes and options. Confirm every pinned value against its own echoed entry; do not read package internals to discover options.\n\n```js\nconst plan   = await agent(PLAN_PROMPT,          { label: "plan",      model: "opencode/zai/glm-5.2", schema: PLAN });\nconst impl   = await agent(implPrompt(plan),     { label: "implement", model: "codex/gpt-5.6-sol" });\nconst review = await agent(reviewPrompt(impl),   { label: "review",    model: "claude/opus[1m]", schema: REVIEW });\n```\n\nUse `configOptions` only for exact ACP session options advertised by that routed harness. With MCP, read the selected harness\'s `action:"config"` result before choosing ids or select values; catalogs vary by harness version, login, and machine.\n\n```js\nconst impl = await agent(implPrompt(plan), {\n  label: "implement",\n  model: "codex",\n  configOptions: { "fast-mode": true, reasoning_effort: "high" },\n});\n```\n\nIds and string/boolean values pass through verbatim in ascending id order, after model selection and before the prompt. There are no aliases, coercion, client-side vocabulary, defaults, or cached catalogs. Copy option ids character-for-character from the catalog, punctuation included \u2014 `"fast-mode"`, not `fast_mode` \u2014 and quote ids that are not valid identifiers. Never put `"model"` in `configOptions`; use the dedicated `model` field. A harness rejection follows the ordinary agent-error path.\n\nPi\'s thought-level option is named `thinkingLevel`, and its choices depend on the exact model in the same call:\n\n```js\nconst review = await agent(REVIEW_PROMPT, {\n  label: "pi-review",\n  model: "pi/openrouter/vendor/model-id",\n  configOptions: { thinkingLevel: "high" },\n});\n```\n\nValidation selects `openrouter/vendor/model-id` before reading Pi\'s choices. A listed value passes unchanged. A recognized value above an ordered model\'s ceiling, or in a model-specific gap, passes with a warning that names the effective clamp target. Pi advertises its SDK-derived domain directly. Claude and Codex are also ordered: when their options omit domain metadata, validation enumerates the advertised models and merges their per-model effort orders. A Claude model without an `effort` option does not support effort, and `default` never becomes a ceiling target. OpenCode and custom backends have no declared value order, so validation is exact-set. An unrecognized or unadvertised value fails with exit code `2`. Enumeration stops at 32 advertised models; a larger or inconsistently ordered catalog warns and falls back to exact advertised-value validation.\n\n**The harness is authoritative.** The client never substitutes a nearby model or silently falls back. A rejected id follows the existing agent-error path; a harness that accepts or ignores it determines the outcome. The public `fallbacks`/`onModelFallback` fields remain for compatibility but model resolution does not emit them.\n\n## Structured output\n\nPass `schema` \u2014 a **plain JSON Schema object literal** (no schema builders exist inside the realm) \u2014 and the call resolves to a **validated object** instead of text:\n\n```js\nconst FINDINGS = {\n  type: "object",\n  additionalProperties: false,\n  required: ["findings"],\n  properties: {\n    findings: {\n      type: "array",\n      items: {\n        type: "object",\n        additionalProperties: false,\n        required: ["file", "line", "summary"],\n        properties: {\n          file:    { type: "string", description: "Repo-relative path \u2014 copy it exactly, never invent one" },\n          line:    { type: "number", description: "1-indexed line the finding anchors to" },\n          summary: { type: "string", description: "One sentence stating the defect, grounded in code you actually read" },\n        },\n      },\n    },\n  },\n};\n\nconst report = await agent("Review the diff on this branch for correctness bugs.", {\n  label: "review", schema: FINDINGS,\n});\nreport.findings.forEach((f) => log(`${f.file}:${f.line} ${f.summary}`));\n```\n\nThe same schema works on **every** backend; only the fulfillment channel differs, and the runner picks it for you: Claude uses its `outputFormat`, Codex its strict `outputSchema`, while Pi, OpenCode, and eligible custom ACP agents receive a client-hosted `StructuredOutput` MCP tool when they advertise HTTP MCP support. Pi accepts stdio, Streamable HTTP, and SSE MCP servers. If no valid tool capture exists, Pi retains the runner\'s common prompt-embedded schema and validated final-text JSON fallback. In every channel the runner validates the value client-side (with type coercion) and re-prompts a bounded number of times before failing the call with non-recoverable `SCHEMA_NONCOMPLIANCE`.\n\nSchema authoring rules that keep all channels healthy:\n\n- Root must be an object; set `additionalProperties: false` and list every property in `required`.\n- Put a `description` on every field \u2014 descriptions are the per-field prompt.\n- Keep schemas structurally simple. Exotic keywords (`oneOf`, `patternProperties`, unusual `format`s, backreference regexes) are normalized or stripped on the wire for some backends \u2014 validation still enforces them client-side, which shows up as re-prompt churn. Prefer `anyOf`, `enum`, and plain types.\n- Keep free-text fields small (tens of lines). An oversized structured output can exhaust schema repair and fail the call.\n- Validation checks structure, not truth. Check load-bearing values in script code (for example, reject findings whose `file` is not in a known file list) before spending more agents on them.\n'
   },
   {
     "id": "workflow/composition-and-failure",
@@ -32247,9 +32571,9 @@ var AUTHORING_DOC_TOPICS = [
       "workflow/environment-and-tools",
       "workflow/api-control-flow"
     ],
-    "bytes": 8375,
-    "sha256": "e960a826b46677f5b80260749cf6543b293a83dbad0f21235464e8e1b0159d9f",
-    "text": '# Workflow agent API reference\n\n**Context:** JavaScript passed to the MCP `workflow` tool. Workflow scripts use `agent(prompt, options?)`; REPL evals use a different API.\n\n## `agent(prompt, options?)` \u2014 full option table\n\nReturns the agent\'s final assistant text, or the schema-validated object when `schema` is set. Resolves to `null` when a *recoverable* failure survives all retries.\n\n| option | type | meaning |\n|---|---|---|\n| `label` | `string` | Display/telemetry name; also stamped on every live ACP event for this call. Always set it. Not part of the resume hash. |\n| `phase` | `string` | Assign this call to a phase explicitly (needed inside concurrent stages where the global `phase()` state would race). |\n| `schema` | JSON Schema object | Structured output. Plain object literal only \u2014 no schema builders exist in the realm. Part of the resume hash. |\n| `model` | `string` | Model spec: optional registered harness prefix plus a verbatim id, or a backend-only name. See [Model specs & routing](#model-specs--routing). Part of the resume hash. |\n| `tier` | `"small" \\| "medium" \\| "big"` | Coarse tier resolved from host config; beats phase/meta model, loses to explicit `model`. Part of the resume hash. |\n| `mode` | `string` | ACP session mode id advertised by the selected backend/model. **Strict**: unsupported/unadvertised ids fail before prompting (and automatic workflow preflight rejects them before admission). Read the selected `action:"config"` entry\'s `modes.availableModes` and copy only an exact id; `modes:null` means omit this field. Never infer a generic `"default"`. Part of the resume hash when set. |\n| `configOptions` | `Record<string, string \\| boolean>` | Exact ACP session option ids and authored values. Applied in ascending id order after model and before the prompt, with no aliases or coercion. `"model"` is reserved for the dedicated `model` field. Part of the resume hash only when non-empty, with sorted keys. With MCP, read the advertised-options table from `workflow` action `config` before choosing values. |\n| `agentType` | `string` | Bind a named subagent definition (tools allow/deny, model, isolation, role prompt). See [agentType definitions](#agenttype-definitions). Part of the resume hash. |\n| `isolation` | `"worktree"` | Run in a throwaway git worktree branched from the run cwd. **Always removed (worktree + branch) when the call ends** \u2014 edits are discarded; return work as data. Degrades to the shared tree outside a git repo (logged). |\n| `resume` | `{ filesystem: "read-only" }` | Deprecated compatibility annotation. It is recorded as legacy diagnostic provenance, is not sent to the runner or hashed, and has no effect on replay. New scripts should omit it. |\n| `cwd` | `string` | Per-session working directory; relative resolves against the run\'s base cwd. Overridden by worktree isolation. Not hashed. |\n| `timeoutMs` | `number \\| null` | Total wall-clock cap for each attempt. A finite value may tighten a finite host `agentTimeoutMs` ceiling but cannot raise or disable it. With no host ceiling, a finite value applies and `null`/omitted is uncapped. |\n| `retries` | `number` | Retries after *recoverable* failures (default 0, host-overridable). Exhausted retries \u21D2 the call resolves `null`. |\n| `mcpServers` | `McpServerConfig[]` | MCP servers attached to this session. Stdio shape: `{ name, command, args: [], env: [{ name, value }] }` (`args`/`env` required, `env` is name/value pairs, not a map); `{ type: "http" \\| "sse", name, url, headers: [] }` also accepted. Not hashed. |\n| `images` | `PromptImage[]` | Base64 image blocks appended to the prompt; backends without image support get a bracketed text note. Not hashed. |\n| `meta` | `object` | ACP `_meta` merged into `session/new` \u2014 session-scoped extension passthrough (pairs with custom backends). Not hashed. |\n| `promptMeta` | `object` | ACP `_meta` merged into `session/prompt` \u2014 turn-scoped passthrough. Backend-computed keys win on conflict. Not hashed. |\n| `keepSession` | `boolean` | Skip release-time best-effort `session/close`; the non-secret re-attach record lands in `WorkflowRunResult.agentSessions` for host-side `loadSession()` / `resumeSession()`. Usage/auth pause failures are kept open automatically for managed continuation. Not identity-hashed; included in the input fingerprint. |\n\nThe timeout clock measures the whole attempt, including backend startup, model/config setup, tool\nwork, and streamed output; it is not an idle timer. Each retry starts a fresh clock, so the maximum\ntimeout envelope is `(retries + 1) \xD7 resolved timeoutMs` (retries are clamped to 3). An exhausted\ntimeout is recoverable `AGENT_TIMEOUT`: the call resolves to `null`, releases its concurrency slot,\nand asks the ACP session to cancel. A session that keeps running after the cancellation grace is\nclosed where supported and its pooled child is recycled.\n\nEvery new run, including one admitted with `resumeFromRunId`, resolves host limits from that run\'s\nrequest. It does not inherit `agentTimeoutMs`, retries, concurrency, or agent-count values from\nits source, so pass every operational bound the resumed execution should use.\n\n## Model specs & routing\n\nA `model` string is resolved solely from its first segment, then delegated to the harness:\n\n| spec shape | routes to | notes |\n|---|---|---|\n| *(omitted)* | host default backend | `AGENTPRISM_DEFAULT_BACKEND` (`claude` \\| `codex` \\| `opencode` \\| `pi` \\| custom name; default `claude`), session default model. Most portable. |\n| `claude`, `codex`, `opencode`, `pi`, or `<custom-name>` | that registered harness | Backend-only: no model config call; the harness default remains active. |\n| `claude/<id>`, `codex/<id>`, `opencode/<id>`, `pi/<id>`, or `<custom-name>/<id>` | that registered harness | Match the first segment ASCII-case-insensitively and strip exactly one segment. Custom names take priority on collision. The remaining `<id>` is sent verbatim, including further `/` characters. For Pi, that remainder is its `<provider>/<model-id>` and Pi preserves any further slashes in the model id. |\n| any other string, including `anthropic/\u2026`, `openai/\u2026`, bare `opus`, or bare `gpt-\u2026` | host default backend | The **entire** authored string is sent verbatim; these are not routing aliases. |\n\nSelection is a single `session/set_config_option` with `configId: "model"` and the exact remaining string. There is no catalog matching, case folding, normalization, bracket parsing, nearest-neighbor selection, sibling effort/Fast option driving, retry, or echo verification. Brackets, dots, and provider-style prefixes are ordinary model-id characters.\n\nWhatever the harness returns is the outcome. A rejection follows the existing agent-error path with no resolution-specific code or model fallback event. `onModelFallback` and `WorkflowRunResult.fallbacks` remain public compatibility surfaces; model resolution does not emit entries, while pause recovery emits `kind: "continuation"` reattach/skip notices.\n\n## Structured output channels\n\nOne author API (`schema`), four fulfillment paths \u2014 chosen automatically per backend:\n\n| backend | channel |\n|---|---|\n| Claude | native `outputFormat`, schema normalized to Anthropic\'s structured-outputs subset (e.g. `oneOf` \u2192 `anyOf`; unsupported keywords/formats stripped on the wire) |\n| Codex | native strict `outputSchema` (OpenAI strict subset normalization) |\n| Pi | a client-hosted `StructuredOutput` MCP tool injected when the agent advertises HTTP MCP support; common prompt-embedded schema and validated final-text JSON fallback |\n| OpenCode / custom ACP | a client-hosted **`StructuredOutput` MCP tool** injected into the session when the agent advertises HTTP MCP support (an agent may show it as `structured_output_StructuredOutput`); otherwise prompt-embedded schema + JSON parse of the final message. Custom backends can opt out of tool injection with `structuredOutputTool: false`. |\n\nPi accepts stdio, Streamable HTTP, and SSE MCP servers; ACP-transport MCP hosting remains client-side.\n\nIn every channel the runner coerces + validates client-side and re-prompts a bounded number of times; the final miss fails the call with non-recoverable `SCHEMA_NONCOMPLIANCE`. Constraints stripped from the wire are still enforced client-side \u2014 an exotic schema keyword shows up as re-prompt churn, so keep schemas simple.\n'
+    "bytes": 8551,
+    "sha256": "84d2cb5639a385074b815fa8e13214138d1d59fa3f7fd34f206e4f9ce19d37d0",
+    "text": '# Workflow agent API reference\n\n**Context:** JavaScript passed to the MCP `workflow` tool. Workflow scripts use `agent(prompt, options?)`; REPL evals use a different API.\n\n## `agent(prompt, options?)` \u2014 full option table\n\nReturns the agent\'s final assistant text, or the schema-validated object when `schema` is set. Resolves to `null` when a *recoverable* failure survives all retries.\n\n| option | type | meaning |\n|---|---|---|\n| `label` | `string` | Display/telemetry name; also stamped on every live ACP event for this call. Always set it. Not part of the resume hash. |\n| `phase` | `string` | Assign this call to a phase explicitly (needed inside concurrent stages where the global `phase()` state would race). |\n| `schema` | JSON Schema object | Structured output. Plain object literal only \u2014 no schema builders exist in the realm. Part of the resume hash. |\n| `model` | `string` | Model spec: optional registered harness prefix plus a verbatim id, or a backend-only name. See [Model specs & routing](#model-specs--routing). Part of the resume hash. |\n| `tier` | `"small" \\| "medium" \\| "big"` | Coarse tier resolved from host config; beats phase/meta model, loses to explicit `model`. Part of the resume hash. |\n| `mode` | `string` | ACP session mode id advertised by the selected backend/model. **Strict**: unsupported/unadvertised ids fail before prompting (and automatic workflow preflight rejects them before admission). Read the selected `action:"config"` entry\'s `modes.availableModes` and copy only an exact id; `modes:null` means omit this field. Never infer a generic `"default"`. Part of the resume hash when set. |\n| `configOptions` | `Record<string, string \\| boolean>` | Exact ACP session option ids and authored values. Applied in ascending id order after model and before the prompt, with no aliases or coercion. `"model"` is reserved for the dedicated `model` field. Part of the resume hash only when non-empty, with sorted keys. With MCP, read the advertised-options table from `workflow` action `config` before choosing values. |\n| `agentType` | `string` | Bind a named subagent definition (tools allow/deny, model, isolation, role prompt). See [agentType definitions](#agenttype-definitions). Part of the resume hash. |\n| `isolation` | `"worktree"` | Run in a throwaway git worktree branched from the run cwd. **Always removed (worktree + branch) when the call ends** \u2014 edits are discarded; return work as data. Degrades to the shared tree outside a git repo (logged). |\n| `resume` | `{ filesystem: "read-only" }` | Deprecated compatibility annotation. It is recorded as legacy diagnostic provenance, is not sent to the runner or hashed, and has no effect on replay. New scripts should omit it. |\n| `cwd` | `string` | Per-session working directory; relative resolves against the run\'s base cwd. Overridden by worktree isolation. Not hashed. |\n| `timeoutMs` | `number \\| null` | Total wall-clock cap for each attempt. A finite value may tighten a finite host `agentTimeoutMs` ceiling but cannot raise or disable it. With no host ceiling, a finite value applies and `null`/omitted is uncapped. |\n| `retries` | `number` | Retries after *recoverable* failures (default 0, host-overridable). Exhausted retries \u21D2 the call resolves `null`. |\n| `mcpServers` | `McpServerConfig[]` | MCP servers attached to this session. Stdio shape: `{ name, command, args: [], env: [{ name, value }] }` (`args`/`env` required, `env` is name/value pairs, not a map); `{ type: "http" \\| "sse", name, url, headers: [] }` also accepted. Not hashed. |\n| `images` | `PromptImage[]` | Base64 image blocks appended to the prompt; backends without image support get a bracketed text note. Not hashed. |\n| `meta` | `object` | ACP `_meta` merged into `session/new` \u2014 session-scoped extension passthrough (pairs with custom backends). Not hashed. |\n| `promptMeta` | `object` | ACP `_meta` merged into `session/prompt` \u2014 turn-scoped passthrough. Backend-computed keys win on conflict. Not hashed. |\n| `keepSession` | `boolean` | Skip release-time best-effort `session/close`; the non-secret re-attach record lands in `WorkflowRunResult.agentSessions` for host-side `loadSession()` / `resumeSession()`. Usage/auth pause failures are kept open automatically for managed continuation. Not identity-hashed; included in the input fingerprint. |\n\nThe timeout clock measures the whole attempt, including backend startup, model/config setup, tool\nwork, and streamed output; it is not an idle timer. Each retry starts a fresh clock, so the maximum\ntimeout envelope is `(retries + 1) \xD7 resolved timeoutMs` (retries are clamped to 3). An exhausted\ntimeout is recoverable `AGENT_TIMEOUT`: the call resolves to `null`, releases its concurrency slot,\nand asks the ACP session to cancel. A session that keeps running after the cancellation grace is\nclosed where supported and its pooled child is recycled.\n\nEvery new run, including one admitted with `resumeFromRunId`, resolves host limits from that run\'s\nrequest. It does not inherit `agentTimeoutMs`, retries, concurrency, or agent-count values from\nits source, so pass every operational bound the resumed execution should use.\n\n## Model specs & routing\n\nA `model` string is resolved solely from its first segment, then delegated to the harness:\n\n| spec shape | routes to | notes |\n|---|---|---|\n| *(omitted)* | host-pinned/default backend | MCP: explicit `AGENTPRISM_DEFAULT_BACKEND` wins; when truly unset, zero-token readiness discovery pins one project default before validation/execution and preserves it across resume. SDK runner: configured default, historical fallback `claude`. The selected harness keeps its session default model. Most portable. |\n| `claude`, `codex`, `opencode`, `pi`, or `<custom-name>` | that registered harness | Backend-only: no model config call; the harness default remains active. |\n| `claude/<id>`, `codex/<id>`, `opencode/<id>`, `pi/<id>`, or `<custom-name>/<id>` | that registered harness | Match the first segment ASCII-case-insensitively and strip exactly one segment. Custom names take priority on collision. The remaining `<id>` is sent verbatim, including further `/` characters. For Pi, that remainder is its `<provider>/<model-id>` and Pi preserves any further slashes in the model id. |\n| any other string, including `anthropic/\u2026`, `openai/\u2026`, bare `opus`, or bare `gpt-\u2026` | host default backend | The **entire** authored string is sent verbatim; these are not routing aliases. |\n\nSelection is a single `session/set_config_option` with `configId: "model"` and the exact remaining string. There is no catalog matching, case folding, normalization, bracket parsing, nearest-neighbor selection, sibling effort/Fast option driving, retry, or echo verification. Brackets, dots, and provider-style prefixes are ordinary model-id characters.\n\nWhatever the harness returns is the outcome. A rejection follows the existing agent-error path with no resolution-specific code or model fallback event. `onModelFallback` and `WorkflowRunResult.fallbacks` remain public compatibility surfaces; model resolution does not emit entries, while pause recovery emits `kind: "continuation"` reattach/skip notices.\n\n## Structured output channels\n\nOne author API (`schema`), four fulfillment paths \u2014 chosen automatically per backend:\n\n| backend | channel |\n|---|---|\n| Claude | native `outputFormat`, schema normalized to Anthropic\'s structured-outputs subset (e.g. `oneOf` \u2192 `anyOf`; unsupported keywords/formats stripped on the wire) |\n| Codex | native strict `outputSchema` (OpenAI strict subset normalization) |\n| Pi | a client-hosted `StructuredOutput` MCP tool injected when the agent advertises HTTP MCP support; common prompt-embedded schema and validated final-text JSON fallback |\n| OpenCode / custom ACP | a client-hosted **`StructuredOutput` MCP tool** injected into the session when the agent advertises HTTP MCP support (an agent may show it as `structured_output_StructuredOutput`); otherwise prompt-embedded schema + JSON parse of the final message. Custom backends can opt out of tool injection with `structuredOutputTool: false`. |\n\nPi accepts stdio, Streamable HTTP, and SSE MCP servers; ACP-transport MCP hosting remains client-side.\n\nIn every channel the runner coerces + validates client-side and re-prompts a bounded number of times; the final miss fails the call with non-recoverable `SCHEMA_NONCOMPLIANCE`. Constraints stripped from the wire are still enforced client-side \u2014 an exotic schema keyword shows up as re-prompt churn, so keep schemas simple.\n'
   },
   {
     "id": "workflow/api-control-flow",
@@ -33430,11 +33754,13 @@ var WorkflowScriptResources = class {
     this.modernNotifier = modernNotifier;
     this.router = source instanceof WorkflowManager2 ? singleStoreRouter(source) : source.router;
     this.detachRunDeleted = this.router.onRunDeleted(this.onRunDeleted);
+    this.detachRunStopped = this.router.onRunStopped(({ runId }) => this.cancelPendingElicitation(runId));
     const previousOnClose = this.mcp.server.onclose;
     this.mcp.server.onclose = () => {
       for (const controller of this.elicitationControllers.values()) controller.abort();
       this.elicitationControllers.clear();
       for (const uri of [...this.eventSubscriptions.keys()]) this.closeEventSubscription(uri);
+      this.detachRunStopped();
       this.detachRunDeleted();
       previousOnClose?.();
     };
@@ -33444,6 +33770,7 @@ var WorkflowScriptResources = class {
   modernNotifier;
   router;
   detachRunDeleted;
+  detachRunStopped;
   subscriptions = /* @__PURE__ */ new Set();
   externalReaders = /* @__PURE__ */ new Map();
   eventSubscriptions = /* @__PURE__ */ new Map();
@@ -33832,6 +34159,43 @@ var WorkflowScriptResources = class {
   }
 };
 
+// ../mcp-server/src/workflow-stop.ts
+function requireDurableStoppedRun(manager, runId) {
+  const persistence = manager.getPersistence();
+  const persisted = persistence.load(runId);
+  if (persisted?.status !== "aborted") {
+    throw new ProtocolError(
+      ProtocolErrorCode.InternalError,
+      `Workflow stop for runId "${runId}" could not be durably acknowledged: the persisted status is ${persisted?.status ?? "missing"}, not aborted.`
+    );
+  }
+  if (persisted.eventLogIncomplete || persisted.eventStreamId === void 0 || persisted.eventSeq === void 0 || persisted.eventSeq < 1) {
+    throw new ProtocolError(
+      ProtocolErrorCode.InternalError,
+      `Workflow stop for runId "${runId}" could not be durably acknowledged: its stopped event is not durably readable.`
+    );
+  }
+  let stoppedEventIsDurable = false;
+  try {
+    const events = persistence.readEvents(runId, {
+      after: persisted.eventSeq - 1,
+      streamId: persisted.eventStreamId,
+      limit: 1
+    });
+    stoppedEventIsDurable = events.events.some(
+      (record2) => record2.seq === persisted.eventSeq && record2.event.type === "stopped"
+    );
+  } catch {
+    stoppedEventIsDurable = false;
+  }
+  if (!stoppedEventIsDurable) {
+    throw new ProtocolError(
+      ProtocolErrorCode.InternalError,
+      `Workflow stop for runId "${runId}" could not be durably acknowledged: its terminal stopped event is missing.`
+    );
+  }
+}
+
 // ../mcp-server/src/server.ts
 var SERVER_NAME = "agentprism-workflow";
 var DEFAULT_REQUEST_STATE_CODEC = createRequestStateCodec({
@@ -33839,7 +34203,7 @@ var DEFAULT_REQUEST_STATE_CODEC = createRequestStateCodec({
   bind: (ctx) => ctx.mcpReq.method
 });
 var require2 = createRequire(import.meta.url);
-var SERVER_VERSION = true ? "0.34.1" : require2("../package.json").version;
+var SERVER_VERSION = true ? "0.36.0" : require2("../package.json").version;
 var SERVER_INSTRUCTIONS = [
   "This server exposes three model-facing tools for authoring and orchestrating multi-agent work. workflow and repl spawn subagents over the same ACP backends \u2014 the registry built-ins Claude, Codex, OpenCode, and pi, plus any registered custom agents \u2014 and key their durable state by an absolute projectDir (required on the shared daemon; defaults to the server's own project in single-project mode). Backend credentials come from each agent's own login (claude, codex, opencode, pi), so there is nothing auth-shaped to configure here.",
   '\u2022 docs \u2014 SELECTIVE VERSION-MATCHED REFERENCE. Omit topic or use topic:"index" for the bounded catalog, then read exactly one workflow/* or repl/* topic. It embeds the selected text/markdown resource, runs no code, opens no backend, and needs no projectDir. Use it when the compact tool descriptions do not contain enough syntax or lifecycle detail.',
@@ -34426,6 +34790,17 @@ function formatStopSummary(result) {
   }
   return truncateUtf83(lines.join("\n"), 8192, "\u2026[text truncated]");
 }
+function formatPendingStopSummary(result) {
+  const lines = inspectionSummaryLines(result);
+  const owner = result.control.owner;
+  lines.splice(
+    2,
+    0,
+    `Stop request ${result.control.operationId} is durably pending; retry stop, inspect, or await to observe settlement.`,
+    owner === void 0 ? "No live execution owner is currently discoverable; a later lease holder will apply the intent." : `Execution owner: daemon pid ${owner.pid}${owner.version ? ` v${owner.version}` : ""}${owner.lameDuck ? " (draining)" : ""}.`
+  );
+  return truncateUtf83(lines.join("\n"), 8192, "\u2026[text truncated]");
+}
 function formatAgentCancellationSummary(status, cancellation) {
   const lines = inspectionSummaryLines(status);
   lines.splice(
@@ -34437,7 +34812,7 @@ function formatAgentCancellationSummary(status, cancellation) {
 }
 function readScriptAtAdmission(scriptPath) {
   try {
-    return readFileSync2(scriptPath, "utf8");
+    return readFileSync3(scriptPath, "utf8");
   } catch (error51) {
     const cause = error51 instanceof Error ? error51.message : String(error51);
     throw new ProtocolError(
@@ -34482,41 +34857,6 @@ async function settleForegroundRun(manager, started) {
     throw error51;
   }
 }
-function requireDurableStoppedRun(manager, runId) {
-  const persistence = manager.getPersistence();
-  const persisted = persistence.load(runId);
-  if (persisted?.status !== "aborted") {
-    throw new ProtocolError(
-      ProtocolErrorCode.InternalError,
-      `Workflow stop for runId "${runId}" could not be durably acknowledged: the persisted status is ${persisted?.status ?? "missing"}, not aborted.`
-    );
-  }
-  if (persisted.eventLogIncomplete || persisted.eventStreamId === void 0 || persisted.eventSeq === void 0 || persisted.eventSeq < 1) {
-    throw new ProtocolError(
-      ProtocolErrorCode.InternalError,
-      `Workflow stop for runId "${runId}" could not be durably acknowledged: its stopped event is not durably readable.`
-    );
-  }
-  let stoppedEventIsDurable = false;
-  try {
-    const events = persistence.readEvents(runId, {
-      after: persisted.eventSeq - 1,
-      streamId: persisted.eventStreamId,
-      limit: 1
-    });
-    stoppedEventIsDurable = events.events.some(
-      (record2) => record2.seq === persisted.eventSeq && record2.event.type === "stopped"
-    );
-  } catch {
-    stoppedEventIsDurable = false;
-  }
-  if (!stoppedEventIsDurable) {
-    throw new ProtocolError(
-      ProtocolErrorCode.InternalError,
-      `Workflow stop for runId "${runId}" could not be durably acknowledged: its terminal stopped event is missing.`
-    );
-  }
-}
 function normalizeTokenUsage(usage) {
   if (!usage) return void 0;
   return {
@@ -34797,7 +35137,7 @@ function createWorkflowServer(runner, options = {}) {
   const workflowToolOutputSchema = workflowToolOutputShape;
   const workflowToolConfig = {
     title: "Discover, validate, run, inspect, await, stop, or narrow-cancel an agent workflow",
-    description: 'Author and operate JavaScript agent workflows through one project-scoped tool. A script\'s first statement must be `export const meta = { name, description, phases? }`. When present, phases must be an array of objects shaped `{ title: string, detail?: string, model?: string }`, never an array of strings. Inside the deterministic script realm use agent(prompt, options?) for one subagent; parallel([thunks]) for a barrier; pipeline(items, ...stages) for streaming stages; checkpoint(prompt, options?) for a human gate; phase(title) and log(message) for progress; and return the final JSON-serializable value. Top-level await is supported. Imports, require, network APIs, Date.now(), and Math.random() are unavailable. Always label agent calls; schema is a plain JSON Schema object for structured results. The only agent option keys are label, phase, model, tier, mode, configOptions, schema, cwd, timeoutMs, retries, isolation:"worktree", resume, agentType, mcpServers, images, meta, promptMeta, and keepSession; unknown keys reject before admission. Every parallel entry must be a thunk: parallel([() => agent(...), () => agent(...)]). For deeper syntax, read docs topic workflow/quickstart and then one related workflow/* topic. Minimal script: `export const meta = { name: "review", description: "Review a target", phases: [{ title: "Review" }] }; phase("Review"); const report = await agent("Review " + args.target, { label: "review" }); return { report };`. Omit model for the server default, or use a backend name alone to preserve that backend\'s configured default. Before choosing a pinned model, mode, or configOptions, call action:"config" with projectDir and optional harnesses/modelFilter; after choosing a model, pass modelSpecs to read its model-specific options. Set mode only when that selected harness entry\'s modes.availableModes explicitly lists the exact id; modes:null means unsupported, so omit mode\u2014never infer a default from an absent value. Config opens no-prompt sessions, spends zero tokens, and starts no workflow. action:"run" automatically performs static validation, a mocked dry run, and routed config checks before admission. Invalid scripts return bounded diagnostics with status:"rejected" and create no run ID, reserve no background slot, and spend no tokens. Run, resume, inspect, await, or stop an admitted workflow through the same tool. The script orchestrates agent() subagents (and optional checkpoint() gates) over registry built-ins\u2014currently Claude, Codex, OpenCode, and pi\u2014ACP backends, plus registered custom agents. Supply exactly one of inline script or absolute scriptPath; path content is read once and snapshotted at admission. ' + (requireProjectDir ? "config and run REQUIRE projectDir (absolute): it is the discovery cwd and selects the project-scoped run store/default execution cwd. " : "run optionally takes projectDir (absolute) to select the project-scoped run store; default is this server's own project. ") + 'inspect/await/stop take only a runId \u2014 it locates its project store automatically. Foreground is the default and streams progress; background:true returns a durable runId for bounded action:"await" calls. run and await honor _meta.progressToken with notifications/progress while they block. Pass resumeFromRunId to execute a new run from a prior journal prefix. In hosts that render MCP Apps, every call of this tool shows a live self-updating run-monitor panel and the panel reports phase starts, pauses, and terminal outcomes on its own \u2014 do NOT poll action:"inspect" to check on a run there; prefer a single bounded action:"await". Use action:"inspect" with a runId when you need machine-readable status data: a safe bounded status, log tail, and attributed call previews. Use action:"stop" to durably abort a live run; add callIndex to cancel only that in-flight agent and keep the run live. labelGlob remains an output filter in both forms. A whole-run stop returns the final run fate; resume is safe immediately, and only agent-session wind-down can remain asynchronous. Every admitted script is readable at workflow://runs/{runId}/script and results include resource links. Background runs are tracked per project, capped at four active/starting runs, and use headless checkpoint semantics; checkpointReplies continue a checkpoint pause in a new run.',
+    description: 'Author and operate JavaScript agent workflows through one project-scoped tool. A script\'s first statement must be `export const meta = { name, description, phases? }`. When present, phases must be an array of objects shaped `{ title: string, detail?: string, model?: string }`, never an array of strings. Inside the deterministic script realm use agent(prompt, options?) for one subagent; parallel([thunks]) for a barrier; pipeline(items, ...stages) for streaming stages; checkpoint(prompt, options?) for a human gate; phase(title) and log(message) for progress; and return the final JSON-serializable value. Top-level await is supported. Imports, require, network APIs, Date.now(), and Math.random() are unavailable. Always label agent calls; schema is a plain JSON Schema object for structured results. The only agent option keys are label, phase, model, tier, mode, configOptions, schema, cwd, timeoutMs, retries, isolation:"worktree", resume, agentType, mcpServers, images, meta, promptMeta, and keepSession; unknown keys reject before admission. Every parallel entry must be a thunk: parallel([() => agent(...), () => agent(...)]). For deeper syntax, read docs topic workflow/quickstart and then one related workflow/* topic. Minimal script: `export const meta = { name: "review", description: "Review a target", phases: [{ title: "Review" }] }; phase("Review"); const report = await agent("Review " + args.target, { label: "review" }); return { report };`. Omit model for the server default (explicit AGENTPRISM_DEFAULT_BACKEND, else a zero-token auto-selected project pin), or use a backend name alone to preserve that backend\'s configured default. Before choosing a pinned model, mode, or configOptions, call action:"config" with projectDir and optional harnesses/modelFilter; after choosing a model, pass modelSpecs to read its model-specific options. Set mode only when that selected harness entry\'s modes.availableModes explicitly lists the exact id; modes:null means unsupported, so omit mode\u2014never infer a default from an absent value. Config opens no-prompt sessions, spends zero tokens, and starts no workflow. action:"run" automatically performs static validation, a mocked dry run, and routed config checks before admission. Invalid scripts return bounded diagnostics with status:"rejected" and create no run ID, reserve no background slot, and spend no tokens. Run, resume, inspect, await, or stop an admitted workflow through the same tool. The script orchestrates agent() subagents (and optional checkpoint() gates) over registry built-ins\u2014currently Claude, Codex, OpenCode, and pi\u2014ACP backends, plus registered custom agents. Supply exactly one of inline script or absolute scriptPath; path content is read once and snapshotted at admission. ' + (requireProjectDir ? "config and run REQUIRE projectDir (absolute): it is the discovery cwd and selects the project-scoped run store/default execution cwd. " : "run optionally takes projectDir (absolute) to select the project-scoped run store; default is this server's own project. ") + `inspect/await/stop locate the project store from runId and never accept projectDir. Foreground is the default and streams progress; background:true returns a durable runId for bounded action:"await" calls. run and await honor _meta.progressToken with notifications/progress while they block. Pass resumeFromRunId to execute a new run from a prior journal prefix. In hosts that render MCP Apps, every call of this tool shows a live self-updating run-monitor panel and the panel reports phase starts, pauses, and terminal outcomes on its own \u2014 do NOT poll action:"inspect" to check on a run there; prefer a single bounded action:"await". Use action:"inspect" with a runId when you need machine-readable status data: a safe bounded status, log tail, and attributed call previews. Use action:"stop" to durably abort through the run's execution owner; cross-generation control may return a durable pending operationId before final settlement. Add callIndex to cancel only that live agent and keep the run live. forceOwner explicitly authorizes terminating a superseded owner and is forbidden with callIndex. labelGlob remains an output filter. A final whole-run stop makes resume safe immediately; pending control must be retried or observed with inspect/await. Every admitted script is readable at workflow://runs/{runId}/script and results include resource links. Background runs are tracked per project, capped at four active/starting runs, and use headless checkpoint semantics; checkpointReplies continue a checkpoint pause in a new run.`,
     inputSchema: workflowToolInputSchema,
     outputSchema: workflowToolOutputSchema,
     annotations: void 0
@@ -34849,7 +35189,7 @@ function createWorkflowServer(runner, options = {}) {
           );
         }
       }
-      const report = await probeHarnessConfig({
+      const report = await probeHarnessConfig2({
         harnesses: parsedInput.harnesses,
         modelSpecs: parsedInput.modelSpecs,
         cwd,
@@ -35021,20 +35361,34 @@ function createWorkflowServer(runner, options = {}) {
             `Workflow run "${parsedInput.runId}" is already terminal (${persisted.status}); no agent call is in flight to cancel. Whole-run stop without callIndex is a successful no-op for terminal runs.`
           );
         }
-        if (!manager.getRun(parsedInput.runId)) {
-          throw new ProtocolError(
-            ProtocolErrorCode.InvalidParams,
-            `Workflow run "${parsedInput.runId}" is persisted as ${persisted.status}, but there is nothing live to cancel in this server process.`
-          );
-        }
         let cancellation;
-        try {
-          cancellation = await manager.cancelAgentCall(parsedInput.runId, parsedInput.callIndex);
-        } catch (error51) {
-          throw new ProtocolError(
-            error51 instanceof WorkflowError && error51.code === WorkflowErrorCode.PERSISTENCE_ERROR ? ProtocolErrorCode.InternalError : ProtocolErrorCode.InvalidParams,
-            error51 instanceof Error ? error51.message : String(error51)
-          );
+        if (!manager.getRun(parsedInput.runId)) {
+          if (!options.runControl) {
+            throw new ProtocolError(
+              ProtocolErrorCode.InvalidParams,
+              `Workflow run "${parsedInput.runId}" is persisted as ${persisted.status}, but there is nothing live to cancel in this server process.`
+            );
+          }
+          const routed = await options.runControl.control(manager, {
+            runId: parsedInput.runId,
+            callIndex: parsedInput.callIndex
+          });
+          if (routed.kind !== "agent") {
+            throw new ProtocolError(
+              ProtocolErrorCode.InternalError,
+              `Workflow agent cancellation returned an invalid routed outcome for runId "${parsedInput.runId}".`
+            );
+          }
+          cancellation = routed.cancellation;
+        } else {
+          try {
+            cancellation = await manager.cancelAgentCall(parsedInput.runId, parsedInput.callIndex);
+          } catch (error51) {
+            throw new ProtocolError(
+              error51 instanceof WorkflowError && error51.code === WorkflowErrorCode.PERSISTENCE_ERROR ? ProtocolErrorCode.InternalError : ProtocolErrorCode.InvalidParams,
+              error51 instanceof Error ? error51.message : String(error51)
+            );
+          }
         }
         const status2 = manager.inspectRun(parsedInput.runId, inspectionOptions);
         if (!status2) {
@@ -35066,22 +35420,97 @@ function createWorkflowServer(runner, options = {}) {
       if (!alreadyTerminal) {
         const live = manager.getRun(parsedInput.runId);
         if (!live) {
-          throw new ProtocolError(
-            ProtocolErrorCode.InvalidParams,
-            `Workflow run "${parsedInput.runId}" is persisted as ${persisted.status}, but there is nothing live to stop in this server process. Resume it with resumeFromRunId instead.`
-          );
-        }
-        stopped = manager.stop(parsedInput.runId);
-        if (!stopped) {
-          const current = manager.getPersistence().load(parsedInput.runId);
-          alreadyTerminal = current !== null && isAlreadyTerminalForStop(current.status);
-          if (!alreadyTerminal) {
-            throw new ProtocolError(
-              ProtocolErrorCode.InvalidParams,
-              `Workflow run "${parsedInput.runId}" could not be stopped; its persisted status is ${current?.status ?? persisted.status}.`
-            );
+          if (options.runControl) {
+            const routed = await options.runControl.control(manager, {
+              runId: parsedInput.runId,
+              forceOwner: parsedInput.forceOwner
+            });
+            if (routed.kind !== "whole") {
+              throw new ProtocolError(
+                ProtocolErrorCode.InternalError,
+                `Workflow stop returned an invalid routed outcome for runId "${parsedInput.runId}".`
+              );
+            }
+            if (routed.state === "pending") {
+              const pendingStatus = manager.inspectRun(parsedInput.runId, inspectionOptions);
+              if (!pendingStatus) {
+                throw new ProtocolError(
+                  ProtocolErrorCode.InvalidParams,
+                  `No workflow run found for runId "${parsedInput.runId}" in this server's project-scoped run store.`
+                );
+              }
+              if (pendingStatus.status !== "pending" && pendingStatus.status !== "running") {
+                throw new ProtocolError(
+                  ProtocolErrorCode.InternalError,
+                  `Workflow stop intent ${routed.operationId} remained pending but runId "${parsedInput.runId}" is ${pendingStatus.status}.`
+                );
+              }
+              const lineage2 = scriptResources.lineage(parsedInput.runId);
+              const projected2 = addInspectionResourceFields(
+                pendingStatus,
+                {
+                  scriptUri: workflowScriptUri(parsedInput.runId),
+                  lineage: lineage2,
+                  stopped: false,
+                  alreadyTerminal: false,
+                  control: {
+                    state: "pending",
+                    operationId: routed.operationId,
+                    requestedAt: routed.requestedAt,
+                    ...routed.owner === void 0 ? {} : { owner: routed.owner }
+                  }
+                },
+                inspectionRetentionMetadata(manager, parsedInput.runId, pendingStatus)
+              );
+              const result2 = {
+                ...projected2,
+                status: pendingStatus.status
+              };
+              const currentLink2 = scriptResources.links(lineage2).filter((link) => link.uri === workflowScriptUri(parsedInput.runId));
+              return {
+                structuredContent: { ...result2 },
+                content: [{ type: "text", text: formatPendingStopSummary(result2) }, ...currentLink2],
+                isError: false
+              };
+            }
+            stopped = routed.stopped;
+            alreadyTerminal = routed.alreadyTerminal;
+          } else {
+            const cold = manager.stopPersistedRun(parsedInput.runId);
+            stopped = cold.outcome === "stopped";
+            alreadyTerminal = cold.outcome === "already-terminal";
+            if (cold.outcome === "owned-elsewhere") {
+              throw new ProtocolError(
+                ProtocolErrorCode.InvalidParams,
+                `Workflow run "${parsedInput.runId}" is persisted as ${persisted.status} and is owned by another live process; this server has no daemon run-control router.`
+              );
+            }
+            if (cold.outcome === "missing") {
+              throw new ProtocolError(
+                ProtocolErrorCode.InvalidParams,
+                `No workflow run found for runId "${parsedInput.runId}" in this server's project-scoped run store.`
+              );
+            }
           }
         } else {
+          stopped = manager.stop(parsedInput.runId);
+          if (!stopped) {
+            const current = manager.getPersistence().load(parsedInput.runId);
+            alreadyTerminal = current !== null && isAlreadyTerminalForStop(current.status);
+            if (!alreadyTerminal) {
+              const cold = manager.stopPersistedRun(parsedInput.runId);
+              stopped = cold.outcome === "stopped";
+              alreadyTerminal = cold.outcome === "already-terminal";
+            }
+            if (!stopped && !alreadyTerminal) {
+              throw new ProtocolError(
+                ProtocolErrorCode.InvalidParams,
+                `Workflow run "${parsedInput.runId}" could not be stopped; its persisted status is ${current?.status ?? persisted.status}.`
+              );
+            }
+          }
+        }
+        if (stopped) {
           scriptResources.cancelPendingElicitation(parsedInput.runId);
           requireDurableStoppedRun(manager, parsedInput.runId);
         }
@@ -35306,12 +35735,49 @@ function createWorkflowServer(runner, options = {}) {
           isError: true
         };
       }
+      const routingDiscovery = await validateWorkflowScript(admittedScript, {
+        args: input.args,
+        cwd: context.projectDir,
+        maxAgents: input.maxAgents,
+        timeoutMs: 3e4,
+        probeConfig: false,
+        loadSavedWorkflow: (name) => context.manager.resolveSavedWorkflow(name)
+      });
+      let defaultModel;
+      let defaultBackendWarning;
+      if (workflowNeedsPinnedDefault(routingDiscovery) || workflowMayUseDefaultModel(admittedScript)) {
+        const explicitDefault = process.env[DEFAULT_BACKEND_ENV] !== void 0;
+        if (explicitDefault) {
+          defaultModel = probeRunner.defaultBackendId?.();
+        } else {
+          const source = input.resumeFromRunId ? context.manager.getPersistence().load(input.resumeFromRunId) : null;
+          defaultModel = recordedDefaultModel(source);
+          if (defaultModel) {
+            defaultBackendWarning = `Model-less agent calls inherit pinned backend ${JSON.stringify(defaultModel)} from the resume source; the run will not switch providers automatically.`;
+          } else if (probeRunner.defaultBackendId && probeRunner.listBackends) {
+            try {
+              const selected = await discoverProjectDefaultBackend(context, probeRunner);
+              defaultModel = selected.backendId;
+              defaultBackendWarning = `Model-less agent calls use auto-selected backend ${JSON.stringify(selected.backendId)} for this run (${selected.reason}); the run will not switch providers automatically.`;
+            } catch (error51) {
+              if (error51 instanceof NoAutoDefaultBackendError) {
+                return {
+                  content: [{ type: "text", text: truncateUtf83(error51.message, 8192, "\u2026[backend diagnostics truncated]") }],
+                  isError: true
+                };
+              }
+              throw error51;
+            }
+          }
+        }
+      }
       const preflight = await validateWorkflowScript(admittedScript, {
         args: input.args,
         cwd: context.projectDir,
         maxAgents: input.maxAgents,
         timeoutMs: 3e4,
         probeTimeoutMs: 6e4,
+        defaultModel,
         probeRunner,
         loadSavedWorkflow: (name) => context.manager.resolveSavedWorkflow(name)
       });
@@ -35323,10 +35789,14 @@ function createWorkflowServer(runner, options = {}) {
           isError: true
         };
       }
-      if (preflight.warnings.length > 0) {
-        const lines = preflight.warnings.slice(0, 20).map((warning) => `- ${warning}`);
-        if (preflight.warnings.length > lines.length) {
-          lines.push(`- \u2026 ${preflight.warnings.length - lines.length} more warning(s) omitted`);
+      const admissionWarnings = [
+        ...defaultBackendWarning ? [defaultBackendWarning] : [],
+        ...preflight.warnings
+      ];
+      if (admissionWarnings.length > 0) {
+        const lines = admissionWarnings.slice(0, 20).map((warning) => `- ${warning}`);
+        if (admissionWarnings.length > lines.length) {
+          lines.push(`- \u2026 ${admissionWarnings.length - lines.length} more warning(s) omitted`);
         }
         preflightWarningText = truncateUtf83(
           `
@@ -35353,6 +35823,7 @@ ${lines.join("\n")}`,
       const exec = {
         agent: runner,
         executionAdmission: executionLatch.decision,
+        defaultModel,
         scriptBackends: backendsGate.backends,
         maxAgents: input.maxAgents,
         concurrency: input.concurrency,
@@ -35528,24 +35999,24 @@ runId: ${started2.runId}
 }
 
 // ../mcp-server/src/shim/ensure-daemon.ts
-import { closeSync, mkdirSync as mkdirSync2, openSync } from "node:fs";
+import { closeSync, mkdirSync as mkdirSync3, openSync } from "node:fs";
 import { homedir } from "node:os";
 import { dirname as dirname2 } from "node:path";
 import { spawn } from "node:child_process";
 
 // ../mcp-server/src/daemon/daemon-info.ts
-import { randomUUID } from "node:crypto";
+import { randomUUID as randomUUID2 } from "node:crypto";
 import { createHash as createHash2 } from "node:crypto";
 import {
-  chmodSync,
-  mkdirSync,
-  readdirSync as readdirSync2,
-  readFileSync as readFileSync3,
+  chmodSync as chmodSync2,
+  mkdirSync as mkdirSync2,
+  readdirSync as readdirSync3,
+  readFileSync as readFileSync4,
   renameSync as renameSync2,
-  rmSync,
-  writeFileSync
+  rmSync as rmSync2,
+  writeFileSync as writeFileSync2
 } from "node:fs";
-import { dirname, join as join2 } from "node:path";
+import { dirname, join as join3 } from "node:path";
 import { workflowHomeDir as workflowHomeDir2 } from "@automatalabs/workflows";
 async function probeHealthz(port, timeoutMs = 2e3) {
   try {
@@ -35561,22 +36032,22 @@ async function probeHealthz(port, timeoutMs = 2e3) {
   }
 }
 function daemonsDir() {
-  return join2(workflowHomeDir2(), "daemons");
+  return join3(workflowHomeDir2(), "daemons");
 }
 function daemonInfoPath(fingerprint = envFingerprint()) {
-  return join2(daemonsDir(), `${fingerprint}.json`);
+  return join3(daemonsDir(), `${fingerprint}.json`);
 }
 function daemonLockPath(fingerprint = envFingerprint()) {
-  return join2(daemonsDir(), `${fingerprint}.lock`);
+  return join3(daemonsDir(), `${fingerprint}.lock`);
 }
 function daemonInstancePath(pid) {
-  return join2(daemonsDir(), "instances", `${pid}.json`);
+  return join3(daemonsDir(), "instances", `${pid}.json`);
 }
 function legacyDaemonInfoPath() {
-  return join2(workflowHomeDir2(), "daemon.json");
+  return join3(workflowHomeDir2(), "daemon.json");
 }
 function daemonLogPath() {
-  return join2(workflowHomeDir2(), "logs", "daemon.log");
+  return join3(workflowHomeDir2(), "logs", "daemon.log");
 }
 function pidIsAlive(pid) {
   if (!Number.isInteger(pid) || pid <= 0) return false;
@@ -35590,7 +36061,7 @@ function pidIsAlive(pid) {
 }
 function readInfoFile(path) {
   try {
-    const parsed = JSON.parse(readFileSync3(path, "utf-8"));
+    const parsed = JSON.parse(readFileSync4(path, "utf-8"));
     if (parsed.name !== DAEMON_NAME || typeof parsed.pid !== "number" || typeof parsed.port !== "number" || typeof parsed.url !== "string" || typeof parsed.version !== "string") {
       return void 0;
     }
@@ -35602,12 +36073,15 @@ function readInfoFile(path) {
 function readDaemonInfo(fingerprint = envFingerprint()) {
   return readInfoFile(daemonInfoPath(fingerprint));
 }
+function readDaemonInstance(pid) {
+  return readInfoFile(daemonInstancePath(pid));
+}
 function writeInfoFile(path, info) {
-  mkdirSync(dirname(path), { recursive: true });
-  const tmp = `${path}.${info.pid}.${randomUUID().slice(0, 8)}.tmp`;
-  writeFileSync(tmp, `${JSON.stringify(info, null, 2)}
+  mkdirSync2(dirname(path), { recursive: true });
+  const tmp = `${path}.${info.pid}.${randomUUID2().slice(0, 8)}.tmp`;
+  writeFileSync2(tmp, `${JSON.stringify(info, null, 2)}
 `, { mode: 384 });
-  chmodSync(tmp, 384);
+  chmodSync2(tmp, 384);
   renameSync2(tmp, path);
 }
 function writeDaemonInfo(info) {
@@ -35619,11 +36093,11 @@ function clearDaemonInfo(pid) {
   const fingerprint = instance?.envFingerprint ?? envFingerprint();
   const current = readDaemonInfo(fingerprint);
   try {
-    if (current !== void 0 && current.pid === pid) rmSync(daemonInfoPath(fingerprint), { force: true });
+    if (current !== void 0 && current.pid === pid) rmSync2(daemonInfoPath(fingerprint), { force: true });
   } catch {
   }
   try {
-    rmSync(daemonInstancePath(pid), { force: true });
+    rmSync2(daemonInstancePath(pid), { force: true });
   } catch {
   }
 }
@@ -35634,20 +36108,20 @@ function isSupersededBy(ownPid, fingerprint = envFingerprint()) {
 function listDaemonInstances() {
   const instances = [];
   const seen = /* @__PURE__ */ new Set();
-  const dir = join2(daemonsDir(), "instances");
+  const dir = join3(daemonsDir(), "instances");
   let files = [];
   try {
-    files = readdirSync2(dir);
+    files = readdirSync3(dir);
   } catch {
     files = [];
   }
   for (const file2 of files) {
     if (!file2.endsWith(".json")) continue;
-    const path = join2(dir, file2);
+    const path = join3(dir, file2);
     const info = readInfoFile(path);
     if (info === void 0 || !pidIsAlive(info.pid)) {
       try {
-        rmSync(path, { force: true });
+        rmSync2(path, { force: true });
       } catch {
       }
       continue;
@@ -35690,23 +36164,23 @@ function compareVersions(a, b) {
 }
 function claimSpawnLock(fingerprint = envFingerprint()) {
   const path = daemonLockPath(fingerprint);
-  mkdirSync(dirname(path), { recursive: true });
-  const lock = { pid: process.pid, startedAt: (/* @__PURE__ */ new Date()).toISOString(), token: randomUUID() };
+  mkdirSync2(dirname(path), { recursive: true });
+  const lock = { pid: process.pid, startedAt: (/* @__PURE__ */ new Date()).toISOString(), token: randomUUID2() };
   for (let attempt = 0; attempt < 2; attempt++) {
     try {
-      writeFileSync(path, JSON.stringify(lock), { flag: "wx", mode: 384 });
+      writeFileSync2(path, JSON.stringify(lock), { flag: "wx", mode: 384 });
       return lock;
     } catch (err) {
       if (err.code !== "EEXIST") return null;
       let holder = null;
       try {
-        holder = JSON.parse(readFileSync3(path, "utf-8"));
+        holder = JSON.parse(readFileSync4(path, "utf-8"));
       } catch {
         holder = null;
       }
       if (holder !== null && pidIsAlive(holder.pid)) return null;
       try {
-        rmSync(path, { force: true });
+        rmSync2(path, { force: true });
       } catch {
         return null;
       }
@@ -35717,9 +36191,9 @@ function claimSpawnLock(fingerprint = envFingerprint()) {
 function releaseSpawnLock(lock, fingerprint = envFingerprint()) {
   const path = daemonLockPath(fingerprint);
   try {
-    const holder = JSON.parse(readFileSync3(path, "utf-8"));
+    const holder = JSON.parse(readFileSync4(path, "utf-8"));
     if (holder.token !== lock.token) return;
-    rmSync(path, { force: true });
+    rmSync2(path, { force: true });
   } catch {
   }
 }
@@ -35733,7 +36207,14 @@ async function probeLiveDaemon(fingerprint) {
   if (info === void 0 || !pidIsAlive(info.pid)) return void 0;
   const health = await probeHealthz(info.port);
   if (health === void 0 || health.pid !== info.pid) return void 0;
-  return { info, sessions: health.sessions, activeRuns: health.activeRuns, version: health.version };
+  return {
+    info,
+    sessions: health.sessions,
+    activeRuns: health.activeRuns,
+    inflightRequests: health.inflightRequests ?? 0,
+    controlProtocol: health.controlProtocol === 1 ? 1 : void 0,
+    version: health.version
+  };
 }
 async function waitForCurrentDaemon(fingerprint, timeoutMs) {
   const start = Date.now();
@@ -35759,7 +36240,7 @@ async function stopDaemon(pid, timeoutMs = 5e3) {
 }
 function spawnDetachedDaemon(args) {
   const logPath = daemonLogPath();
-  mkdirSync2(dirname2(logPath), { recursive: true });
+  mkdirSync3(dirname2(logPath), { recursive: true });
   const logFd = openSync(logPath, "a");
   const argv = [args.bundlePath, "--daemon-run"];
   if (args.port !== void 0) argv.push("--port", String(args.port));
@@ -35786,6 +36267,12 @@ async function ensureDaemonRunning(options) {
   };
   const live = await probeLiveDaemon(fingerprint);
   if (live !== void 0 && !isStale(live)) return adopt(live);
+  if (live !== void 0 && live.controlProtocol !== 1 && (live.activeRuns > 0 || live.inflightRequests > 0)) {
+    options.log(
+      `[${DAEMON_NAME}] compatibility drain: temporarily adopting stale daemon pid ${live.info.pid} (v${live.version}, ${live.activeRuns} run(s), ${live.inflightRequests} request(s) in flight) because it predates run-control v1`
+    );
+    return { ...live.info, compatibilityDrain: true };
+  }
   if (live !== void 0) {
     options.log(
       `[${DAEMON_NAME}] superseding stale daemon (pid ${live.info.pid}, ${live.sessions} session(s), ${live.activeRuns} run(s)): version v${live.version} \u2192 v${SERVER_VERSION} \u2014 spawning a successor and repointing discovery`
@@ -35802,6 +36289,12 @@ async function ensureDaemonRunning(options) {
   try {
     const raced = await probeLiveDaemon(fingerprint);
     if (raced !== void 0 && !isStale(raced)) return adopt(raced);
+    if (raced !== void 0 && raced.controlProtocol !== 1 && (raced.activeRuns > 0 || raced.inflightRequests > 0)) {
+      options.log(
+        `[${DAEMON_NAME}] compatibility drain retained under the spawn lock for stale daemon pid ${raced.info.pid}`
+      );
+      return { ...raced.info, compatibilityDrain: true };
+    }
     const superseding = raced !== void 0;
     spawnDaemon({ bundlePath: options.bundlePath, port: options.port, supersede: superseding });
     const info = await waitForCurrentDaemon(fingerprint, SPAWN_HEALTH_TIMEOUT_MS);
@@ -35822,6 +36315,7 @@ async function ensureDaemonRunning(options) {
 }
 
 // ../mcp-server/src/daemon/run-daemon.ts
+import { randomUUID as randomUUID5 } from "node:crypto";
 import { createAcpRunner } from "@automatalabs/workflows";
 
 // ../mcp-server/src/daemon/daemon-lifecycle.ts
@@ -35841,6 +36335,7 @@ function installDaemonLifecycle(options) {
   const reaper = setInterval(() => {
     const daemon = options.daemon;
     const superseded = daemon.isSuperseded();
+    void daemon.processPendingControlIntents?.();
     if (superseded) {
       if (!supersessionAnnounced) {
         supersessionAnnounced = true;
@@ -35848,11 +36343,9 @@ function installDaemonLifecycle(options) {
           `[agentprism-daemon] superseded by a newer daemon; draining \u2014 ${daemon.sessions.size} session(s), ${daemon.activeRunCount()} run(s), ${daemon.inflightRequestCount()} request(s) in flight`
         );
       }
-      if (daemon.activeRunCount() === 0) {
-        const migrated = daemon.evictDrainableSessions();
-        if (migrated.length > 0) {
-          log(`[agentprism-daemon] migrated ${migrated.length} idle session(s) to the successor: ${migrated.join(", ")}`);
-        }
+      const migrated = daemon.evictDrainableSessions();
+      if (migrated.length > 0) {
+        log(`[agentprism-daemon] migrated ${migrated.length} idle session(s) to the successor: ${migrated.join(", ")}`);
       }
     } else {
       supersessionAnnounced = false;
@@ -35861,7 +36354,7 @@ function installDaemonLifecycle(options) {
         log(`[agentprism-daemon] evicted ${evicted.length} idle session(s): ${evicted.join(", ")}`);
       }
     }
-    const busy = daemon.sessions.size > 0 || daemon.activeRunCount() > 0 || daemon.activeReplDrainCount() > 0;
+    const busy = daemon.sessions.size > 0 || daemon.activeRunCount() > 0 || daemon.inflightRequestCount() > 0 || daemon.activeReplDrainCount() > 0;
     if (busy) {
       idleSince = void 0;
       return;
@@ -35904,7 +36397,7 @@ function installDaemonLifecycle(options) {
 
 // ../mcp-server/src/daemon/http-daemon.ts
 import http from "node:http";
-import { randomUUID as randomUUID2 } from "node:crypto";
+import { randomUUID as randomUUID4 } from "node:crypto";
 
 // ../../node_modules/.pnpm/@hono+node-server@1.19.14_hono@4.12.27/node_modules/@hono/node-server/dist/index.mjs
 import { Http2ServerRequest as Http2ServerRequest2, constants as h2constants } from "http2";
@@ -36867,16 +37360,16 @@ function validateRequest(headers, boundPort, env = process.env) {
 
 // ../mcp-server/src/daemon/request-state.ts
 import { randomBytes as randomBytes2 } from "node:crypto";
-import { chmodSync as chmodSync2, mkdirSync as mkdirSync3, readFileSync as readFileSync4, writeFileSync as writeFileSync2 } from "node:fs";
-import { dirname as dirname3, join as join3 } from "node:path";
+import { chmodSync as chmodSync3, mkdirSync as mkdirSync4, readFileSync as readFileSync5, writeFileSync as writeFileSync3 } from "node:fs";
+import { dirname as dirname3, join as join4 } from "node:path";
 import { workflowHomeDir as workflowHomeDir3 } from "@automatalabs/workflows";
 function requestStateKeyPath(fingerprint) {
-  return join3(workflowHomeDir3(), "daemons", `${fingerprint}.request-state-key.json`);
+  return join4(workflowHomeDir3(), "daemons", `${fingerprint}.request-state-key.json`);
 }
 function decodeStoredKey(path) {
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync4(path, "utf8"));
+    parsed = JSON.parse(readFileSync5(path, "utf8"));
   } catch (error51) {
     throw new Error(`Unable to read the daemon requestState key at ${path}: ${String(error51)}`);
   }
@@ -36885,18 +37378,18 @@ function decodeStoredKey(path) {
   }
   const key = Buffer.from(parsed.key, "base64");
   if (key.byteLength !== 32) throw new Error(`Invalid daemon requestState key length at ${path}`);
-  chmodSync2(path, 384);
+  chmodSync3(path, 384);
   return key;
 }
 function loadOrCreateRequestStateKey(fingerprint) {
   const path = requestStateKeyPath(fingerprint);
-  mkdirSync3(dirname3(path), { recursive: true });
+  mkdirSync4(dirname3(path), { recursive: true });
   const key = randomBytes2(32);
   const stored = { version: 1, key: key.toString("base64") };
   try {
-    writeFileSync2(path, `${JSON.stringify(stored)}
+    writeFileSync3(path, `${JSON.stringify(stored)}
 `, { flag: "wx", mode: 384 });
-    chmodSync2(path, 384);
+    chmodSync3(path, 384);
     return key;
   } catch (error51) {
     if (error51.code !== "EEXIST") throw error51;
@@ -36904,6 +37397,337 @@ function loadOrCreateRequestStateKey(fingerprint) {
   }
 }
 
+// ../mcp-server/src/daemon/run-control-auth.ts
+import { createHash as createHash3, createHmac, randomBytes as randomBytes3, timingSafeEqual } from "node:crypto";
+import { chmodSync as chmodSync4, mkdirSync as mkdirSync5, readFileSync as readFileSync6, writeFileSync as writeFileSync4 } from "node:fs";
+import { dirname as dirname4, join as join5 } from "node:path";
+import { workflowHomeDir as workflowHomeDir4 } from "@automatalabs/workflows";
+var RUN_CONTROL_PATH = "/_agentprism/control/v1/run";
+var RUN_CONTROL_PROTOCOL = 1;
+var RUN_CONTROL_MAX_CLOCK_SKEW_MS = 3e4;
+function runControlKeyPath() {
+  return join5(workflowHomeDir4(), "daemons", "run-control-key.json");
+}
+function decodeStoredKey2(path) {
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync6(path, "utf8"));
+  } catch (error51) {
+    throw new Error(`Unable to read the daemon run-control key at ${path}: ${String(error51)}`);
+  }
+  if (parsed.version !== 1 || typeof parsed.key !== "string") {
+    throw new Error(`Invalid daemon run-control key file at ${path}`);
+  }
+  const key = Buffer.from(parsed.key, "base64");
+  if (key.byteLength !== 32) throw new Error(`Invalid daemon run-control key length at ${path}`);
+  chmodSync4(path, 384);
+  return key;
+}
+function loadOrCreateRunControlKey() {
+  const path = runControlKeyPath();
+  mkdirSync5(dirname4(path), { recursive: true });
+  const key = randomBytes3(32);
+  const stored = { version: 1, key: key.toString("base64") };
+  try {
+    writeFileSync4(path, `${JSON.stringify(stored)}
+`, { flag: "wx", mode: 384 });
+    chmodSync4(path, 384);
+    return key;
+  } catch (error51) {
+    if (error51.code !== "EEXIST") throw error51;
+    return decodeStoredKey2(path);
+  }
+}
+function signaturePayload(method, path, timestamp, operationId, body) {
+  const bodyHash = createHash3("sha256").update(body).digest("hex");
+  return `${method.toUpperCase()}
+${path}
+${timestamp}
+${operationId}
+${bodyHash}`;
+}
+function signRunControlRequest(key, method, path, operationId, body, now = Date.now()) {
+  const timestamp = String(now);
+  const signature = createHmac("sha256", key).update(signaturePayload(method, path, timestamp, operationId, body)).digest("hex");
+  return {
+    "x-agentprism-control-timestamp": timestamp,
+    "x-agentprism-control-operation": operationId,
+    "x-agentprism-control-signature": signature
+  };
+}
+function verifyRunControlRequest(key, input) {
+  if (!input.timestamp || !input.operationId || !input.signature) return false;
+  const timestamp = Number(input.timestamp);
+  const now = input.now ?? Date.now();
+  if (!Number.isSafeInteger(timestamp) || Math.abs(now - timestamp) > RUN_CONTROL_MAX_CLOCK_SKEW_MS) return false;
+  if (!/^[0-9a-f]{64}$/i.test(input.signature)) return false;
+  const expected = createHmac("sha256", key).update(signaturePayload(input.method, input.path, input.timestamp, input.operationId, input.body)).digest();
+  const actual = Buffer.from(input.signature, "hex");
+  return actual.byteLength === expected.byteLength && timingSafeEqual(actual, expected);
+}
+
+// ../mcp-server/src/daemon/run-control.ts
+import { randomUUID as randomUUID3 } from "node:crypto";
+var FORWARD_TIMEOUT_MS = 5e3;
+var FORCE_TERM_WAIT_MS = 5e3;
+var FORCE_KILL_WAIT_MS = 2e3;
+function terminal(status) {
+  return status === "completed" || status === "failed" || status === "aborted";
+}
+function ownerView(owner) {
+  if (!owner) return void 0;
+  return {
+    pid: owner.pid,
+    ...owner.daemon?.instanceId === void 0 ? {} : { instanceId: owner.daemon.instanceId },
+    ...owner.daemon?.version === void 0 ? {} : { version: owner.daemon.version },
+    ...owner.health?.lameDuck === void 0 ? {} : { lameDuck: owner.health.lameDuck },
+    ...owner.health?.activeRuns === void 0 ? {} : { activeRuns: owner.health.activeRuns },
+    ...owner.daemon?.controlProtocol === 1 ? { controlProtocol: 1 } : {}
+  };
+}
+function actionableOwnerMessage(runId, owner, action) {
+  if (!owner) return `Workflow run "${runId}" has no discoverable live execution owner for ${action}.`;
+  const version2 = owner.daemon?.version ? ` v${owner.daemon.version}` : "";
+  const draining = owner.health?.lameDuck ? ", draining" : "";
+  const control = owner.daemon?.controlProtocol === 1 ? "control v1" : "no compatible run-control endpoint";
+  return `Workflow run "${runId}" is executing in daemon pid ${owner.pid}${version2} (${control}${draining}); ${action} could not be delivered.`;
+}
+async function waitForPidExit(pid, timeoutMs, alive) {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    if (!alive(pid)) return true;
+    await new Promise((resolve) => setTimeout(resolve, 50));
+  }
+  return !alive(pid);
+}
+var DaemonRunControl = class {
+  constructor(options) {
+    this.options = options;
+    this.log = options.log ?? (() => void 0);
+    this.fetchImpl = options.fetch ?? fetch;
+    this.killProcess = options.kill ?? ((pid, signal) => process.kill(pid, signal));
+    this.isPidAlive = options.isPidAlive ?? pidIsAlive;
+  }
+  options;
+  log;
+  fetchImpl;
+  killProcess;
+  isPidAlive;
+  processingPending;
+  async resolveOwner(manager, runId) {
+    const lease = manager.getPersistence().inspectRunLease?.(runId);
+    if (!lease || !this.isPidAlive(lease.pid)) return void 0;
+    const daemon = readDaemonInstance(lease.pid);
+    if (daemon?.instanceId !== void 0 && lease.ownerId !== void 0 && daemon.instanceId !== lease.ownerId) {
+      return { pid: lease.pid, ownerId: lease.ownerId };
+    }
+    const health = daemon === void 0 ? void 0 : await probeHealthz(daemon.port, 1e3);
+    const verifiedHealth = health !== void 0 && health.pid === lease.pid && (lease.ownerId === void 0 || health.instanceId === void 0 || health.instanceId === lease.ownerId) ? health : void 0;
+    return { pid: lease.pid, ownerId: lease.ownerId, ...daemon ? { daemon } : {}, ...verifiedHealth ? { health: verifiedHealth } : {} };
+  }
+  controlCapable(owner) {
+    return owner.daemon?.controlProtocol === 1 && typeof owner.daemon.controlUrl === "string" && (owner.ownerId === void 0 || owner.daemon.instanceId === owner.ownerId);
+  }
+  async post(owner, request) {
+    const body = JSON.stringify(request);
+    const headers = signRunControlRequest(
+      this.options.key,
+      "POST",
+      RUN_CONTROL_PATH,
+      request.operationId,
+      body
+    );
+    const response = await this.fetchImpl(owner.daemon.controlUrl, {
+      method: "POST",
+      headers: { "content-type": "application/json", ...headers },
+      body,
+      signal: AbortSignal.timeout(FORWARD_TIMEOUT_MS)
+    });
+    const value = await response.json();
+    if (!response.ok && value.ok !== false) throw new Error(`run-control owner returned HTTP ${response.status}`);
+    return value;
+  }
+  settledWhole(manager, runId) {
+    const current = manager.getPersistence().load(runId);
+    if (!current || !terminal(current.status)) return void 0;
+    if (current.status === "aborted") {
+      try {
+        requireDurableStoppedRun(manager, runId);
+        return { stopped: true, alreadyTerminal: false };
+      } catch {
+        return { stopped: false, alreadyTerminal: true };
+      }
+    }
+    return { stopped: false, alreadyTerminal: true };
+  }
+  applyWholeIntent(manager, intent) {
+    const before = manager.getPersistence().load(intent.runId);
+    if (!before) return { ok: false, code: "UNKNOWN_RUN", message: `No workflow run found for ${intent.runId}` };
+    if (terminal(before.status)) {
+      acknowledgeWholeStopIntent(manager, intent, this.options.ownInstanceId, "already-terminal");
+      return { ok: true, outcome: "already-terminal" };
+    }
+    const stopped = manager.getRun(intent.runId) ? manager.stop(intent.runId) ? { outcome: "stopped" } : { outcome: "owned-elsewhere" } : manager.stopPersistedRun(intent.runId);
+    if (stopped.outcome === "owned-elsewhere") {
+      return { ok: false, code: "NOT_OWNER", message: `Daemon no longer owns run ${intent.runId}` };
+    }
+    if (stopped.outcome === "missing") {
+      return { ok: false, code: "UNKNOWN_RUN", message: `No workflow run found for ${intent.runId}` };
+    }
+    if (stopped.outcome === "already-terminal") {
+      acknowledgeWholeStopIntent(manager, intent, this.options.ownInstanceId, "already-terminal");
+      return { ok: true, outcome: "already-terminal" };
+    }
+    requireDurableStoppedRun(manager, intent.runId);
+    acknowledgeWholeStopIntent(manager, intent, this.options.ownInstanceId, "stopped");
+    return { ok: true, outcome: "stopped" };
+  }
+  async applyLocal(request) {
+    const context = this.options.projects.storeFor(request.runId);
+    if (!context) return { ok: false, code: "UNKNOWN_RUN", message: `No workflow run found for ${request.runId}` };
+    const manager = context.manager;
+    if (request.action === "stop") {
+      const intent = readWholeStopIntent(manager, request.runId, request.operationId);
+      if (!intent) return { ok: false, code: "INVALID_OPERATION", message: "Durable stop intent is missing" };
+      return this.applyWholeIntent(manager, intent);
+    }
+    if (!manager.getRun(request.runId)) {
+      return { ok: false, code: "NOT_OWNER", message: `Daemon has no live run ${request.runId}` };
+    }
+    try {
+      const cancellation = await manager.cancelAgentCall(request.runId, request.callIndex);
+      return { ok: true, outcome: "agent-cancelled", cancellation };
+    } catch (error51) {
+      return {
+        ok: false,
+        code: "INVALID_OPERATION",
+        message: error51 instanceof Error ? error51.message : String(error51)
+      };
+    }
+  }
+  processPendingIntents() {
+    if (this.processingPending) return this.processingPending;
+    this.processingPending = (async () => {
+      for (const context of this.options.projects.stores()) {
+        for (const intent of listPendingWholeStopIntents(context.manager)) {
+          try {
+            const response = this.applyWholeIntent(context.manager, intent);
+            if (response.ok) {
+              this.log(`[agentprism-daemon] run-control ${intent.operationId} for ${intent.runId}: ${response.outcome}`);
+            }
+          } catch (error51) {
+            this.log(`[agentprism-daemon] run-control ${intent.operationId} for ${intent.runId} failed: ${String(error51)}`);
+          }
+        }
+      }
+    })().finally(() => {
+      this.processingPending = void 0;
+    });
+    return this.processingPending;
+  }
+  async forceOwner(manager, runId, owner) {
+    const lease = manager.getPersistence().inspectRunLease?.(runId);
+    const instance = readDaemonInstance(owner.pid);
+    if (!lease || lease.pid !== owner.pid || !instance || instance.pid !== owner.pid) {
+      throw new ProtocolError(ProtocolErrorCode.InvalidParams, `Refusing force stop for run "${runId}": owner identity changed.`);
+    }
+    if (owner.pid === this.options.ownPid) {
+      throw new ProtocolError(ProtocolErrorCode.InvalidParams, `Refusing force stop for run "${runId}": owner is this daemon.`);
+    }
+    if (lease.ownerId !== void 0 && instance.instanceId !== lease.ownerId) {
+      throw new ProtocolError(ProtocolErrorCode.InvalidParams, `Refusing force stop for run "${runId}": owner instance identity does not match the lease.`);
+    }
+    const current = readDaemonInfo(instance.envFingerprint);
+    if (!current || current.pid === owner.pid || !this.isPidAlive(current.pid)) {
+      throw new ProtocolError(ProtocolErrorCode.InvalidParams, `Refusing force stop for run "${runId}": owner is not a superseded daemon with a live successor.`);
+    }
+    const health = await probeHealthz(instance.port, 1e3);
+    if (lease.ownerId === void 0 && (health?.pid !== owner.pid || health.startedAt !== instance.startedAt)) {
+      throw new ProtocolError(ProtocolErrorCode.InvalidParams, `Refusing force stop for run "${runId}": legacy owner identity could not be revalidated.`);
+    }
+    this.log(
+      `[agentprism-daemon] force-stopping superseded owner pid ${owner.pid} for run ${runId}; ${health?.activeRuns ?? "unknown"} owned run(s) may be interrupted`
+    );
+    try {
+      this.killProcess(owner.pid, "SIGTERM");
+    } catch {
+    }
+    if (!await waitForPidExit(owner.pid, FORCE_TERM_WAIT_MS, this.isPidAlive)) {
+      this.killProcess(owner.pid, "SIGKILL");
+      if (!await waitForPidExit(owner.pid, FORCE_KILL_WAIT_MS, this.isPidAlive)) {
+        throw new ProtocolError(ProtocolErrorCode.InternalError, `Forced owner pid ${owner.pid} did not exit.`);
+      }
+    }
+  }
+  async control(manager, input) {
+    let owner = await this.resolveOwner(manager, input.runId);
+    if (input.callIndex !== void 0) {
+      if (!owner || !this.controlCapable(owner)) {
+        throw new ProtocolError(
+          ProtocolErrorCode.InvalidParams,
+          `${actionableOwnerMessage(input.runId, owner, "agent cancellation")} Per-agent cancellation requires the live control-capable owner.`
+        );
+      }
+      let response;
+      try {
+        response = await this.post(owner, {
+          operationId: randomUUID3(),
+          runId: input.runId,
+          action: "cancel-agent",
+          callIndex: input.callIndex
+        });
+      } catch (error51) {
+        throw new ProtocolError(
+          ProtocolErrorCode.InternalError,
+          `${actionableOwnerMessage(input.runId, owner, "agent cancellation")} ${String(error51)}`
+        );
+      }
+      if (!response.ok || response.outcome !== "agent-cancelled") {
+        throw new ProtocolError(
+          response.ok || response.code === "INTERNAL_ERROR" ? ProtocolErrorCode.InternalError : ProtocolErrorCode.InvalidParams,
+          response.ok ? "Owner returned an invalid agent-cancellation response." : response.message
+        );
+      }
+      return { kind: "agent", cancellation: response.cancellation };
+    }
+    const intent = createOrReuseWholeStopIntent(manager, input.runId, this.options.ownInstanceId);
+    if (owner && this.controlCapable(owner)) {
+      try {
+        await this.post(owner, { operationId: intent.operationId, runId: input.runId, action: "stop" });
+      } catch (error51) {
+        this.log(`[agentprism-daemon] run-control ${intent.operationId} forwarding to pid ${owner.pid} failed: ${String(error51)}`);
+      }
+      const settled = this.settledWhole(manager, input.runId);
+      if (settled) return { kind: "whole", state: "settled", ...settled };
+      owner = await this.resolveOwner(manager, input.runId);
+    }
+    if (input.forceOwner && owner) {
+      await this.forceOwner(manager, input.runId, owner);
+      owner = await this.resolveOwner(manager, input.runId);
+    }
+    if (!owner) {
+      const result = manager.stopPersistedRun(input.runId);
+      if (result.outcome === "stopped") {
+        requireDurableStoppedRun(manager, input.runId);
+        acknowledgeWholeStopIntent(manager, intent, this.options.ownInstanceId, "stopped");
+      } else if (result.outcome === "already-terminal") {
+        acknowledgeWholeStopIntent(manager, intent, this.options.ownInstanceId, "already-terminal");
+      } else if (result.outcome === "owned-elsewhere") {
+        owner = await this.resolveOwner(manager, input.runId);
+      }
+      const settled = this.settledWhole(manager, input.runId);
+      if (settled) return { kind: "whole", state: "settled", ...settled };
+    }
+    return {
+      kind: "whole",
+      state: "pending",
+      operationId: intent.operationId,
+      requestedAt: intent.requestedAt,
+      owner: ownerView(owner)
+    };
+  }
+};
+
 // ../mcp-server/src/daemon/session-registry.ts
 var SessionRegistry = class {
   sessions = /* @__PURE__ */ new Map();
@@ -37041,6 +37865,7 @@ function writeJsonRpcError(res, status, message, code = -32e3) {
   res.end(JSON.stringify({ jsonrpc: "2.0", error: { code, message }, id: null }));
 }
 var MAX_MCP_BODY_BYTES = 4 * 1024 * 1024;
+var MAX_CONTROL_BODY_BYTES = 64 * 1024;
 var BODY_REJECTED = /* @__PURE__ */ Symbol("body-rejected");
 async function readMcpJsonBody(req, res) {
   if (req.method !== "POST") return void 0;
@@ -37068,17 +37893,103 @@ async function readMcpJsonBody(req, res) {
     return BODY_REJECTED;
   }
 }
+function controlHeader(req, name) {
+  const value = req.headers[name];
+  return Array.isArray(value) ? value[0] : value;
+}
+function writeControlResponse(res, status, body) {
+  res.writeHead(status, { "Content-Type": "application/json" });
+  res.end(JSON.stringify(body));
+}
+function isInternalRunControlRequest(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
+  const row = value;
+  const keys = Object.keys(row).sort();
+  if (typeof row.operationId !== "string" || !/^[0-9a-f-]{36}$/i.test(row.operationId) || typeof row.runId !== "string" || !/^[a-z0-9]+-[a-z0-9]+$/.test(row.runId)) return false;
+  if (row.action === "stop") {
+    return keys.join(",") === "action,operationId,runId";
+  }
+  return row.action === "cancel-agent" && Number.isSafeInteger(row.callIndex) && row.callIndex >= 0 && keys.join(",") === "action,callIndex,operationId,runId";
+}
+async function handleRunControlRequest(req, res, key, runControl) {
+  if (req.method !== "POST") {
+    writeControlResponse(res, 405, { ok: false, code: "INVALID_REQUEST", message: "Method Not Allowed" });
+    return;
+  }
+  const contentType = controlHeader(req, "content-type")?.split(";", 1)[0]?.trim().toLowerCase();
+  if (contentType !== "application/json") {
+    writeControlResponse(res, 415, { ok: false, code: "INVALID_REQUEST", message: "Content-Type must be application/json" });
+    return;
+  }
+  const chunks = [];
+  let bytes = 0;
+  for await (const chunk of req) {
+    const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+    bytes += buffer.byteLength;
+    if (bytes > MAX_CONTROL_BODY_BYTES) {
+      writeControlResponse(res, 413, { ok: false, code: "INVALID_REQUEST", message: "Run-control body exceeds 64 KiB" });
+      return;
+    }
+    chunks.push(buffer);
+  }
+  const body = Buffer.concat(chunks).toString("utf8");
+  const operationId = controlHeader(req, "x-agentprism-control-operation");
+  if (!verifyRunControlRequest(key, {
+    method: req.method,
+    path: RUN_CONTROL_PATH,
+    body,
+    timestamp: controlHeader(req, "x-agentprism-control-timestamp"),
+    operationId,
+    signature: controlHeader(req, "x-agentprism-control-signature")
+  })) {
+    writeControlResponse(res, 401, { ok: false, code: "UNAUTHORIZED", message: "Invalid run-control signature" });
+    return;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(body);
+  } catch {
+    writeControlResponse(res, 400, { ok: false, code: "INVALID_REQUEST", message: "Invalid JSON" });
+    return;
+  }
+  if (!isInternalRunControlRequest(parsed) || parsed.operationId !== operationId) {
+    writeControlResponse(res, 400, { ok: false, code: "INVALID_REQUEST", message: "Invalid run-control request" });
+    return;
+  }
+  let response;
+  try {
+    response = await runControl.applyLocal(parsed);
+  } catch (error51) {
+    writeControlResponse(res, 500, {
+      ok: false,
+      code: "INTERNAL_ERROR",
+      message: error51 instanceof Error ? error51.message : String(error51)
+    });
+    return;
+  }
+  const status = response.ok ? 200 : response.code === "UNKNOWN_RUN" ? 404 : response.code === "NOT_OWNER" ? 409 : response.code === "INTERNAL_ERROR" ? 500 : 400;
+  writeControlResponse(res, status, response);
+}
 async function createDaemon(options) {
   const host = options.host ?? "127.0.0.1";
   const env = options.env ?? process.env;
   const log = options.log ?? ((line) => console.error(line));
   const startedAt = (/* @__PURE__ */ new Date()).toISOString();
   const ownPid = options.ownPid ?? process.pid;
+  const ownInstanceId = options.ownInstanceId ?? randomUUID4();
   const version2 = options.version ?? SERVER_VERSION;
   const isSuperseded = options.isSuperseded ?? (() => isSupersededBy(ownPid));
   const familyFingerprint = envFingerprint(env);
   const sessions = new SessionRegistry();
-  const projects = new WorkflowProjectRegistry(options.runner);
+  const projects = new WorkflowProjectRegistry(options.runner, { leaseOwnerId: ownInstanceId });
+  const runControlKey = loadOrCreateRunControlKey();
+  const runControl = new DaemonRunControl({
+    projects,
+    ownPid,
+    ownInstanceId,
+    key: runControlKey,
+    log
+  });
   const replDrainBoundMs = options.replDrainBoundMs ?? options.sessionTtlMs ?? REPL_DRAIN_BOUND_MS;
   const replPresence = new ReplPresenceLedger(replDrainBoundMs);
   sessions.onConnectionOpened = (sessionId) => replPresence.reconnect(sessionId);
@@ -37099,7 +38010,7 @@ async function createDaemon(options) {
   };
   modernHandler = createMcpHandler(
     () => {
-      const clientId = `modern:${randomUUID2()}`;
+      const clientId = `modern:${randomUUID4()}`;
       return createWorkflowServer(options.runner, {
         projects,
         requireProjectDir: true,
@@ -37111,7 +38022,8 @@ async function createDaemon(options) {
         protocolEra: "modern",
         requestStateCodec,
         disconnectReplClientOnClose: true,
-        modernNotifier
+        modernNotifier,
+        runControl
       });
     },
     {
@@ -37167,7 +38079,7 @@ async function createDaemon(options) {
       return;
     }
     const transport = new NodeStreamableHTTPServerTransport({
-      sessionIdGenerator: () => randomUUID2(),
+      sessionIdGenerator: () => randomUUID4(),
       eventStore: new BoundedEventStore(),
       onsessioninitialized: (sid) => {
         sessions.add({
@@ -37189,7 +38101,8 @@ async function createDaemon(options) {
       replPresence,
       replClientId: () => transport.sessionId,
       replDrainBoundMs,
-      replEvalBreakChannel: options.evalBreakChannel
+      replEvalBreakChannel: options.evalBreakChannel,
+      runControl
     });
     await server.connect(transport);
     const protocolOnClose = transport.onclose;
@@ -37216,6 +38129,10 @@ async function createDaemon(options) {
         return;
       }
       const url2 = new URL(req.url ?? "/", `http://${host}:${boundPort}`);
+      if (url2.pathname === RUN_CONTROL_PATH) {
+        await handleRunControlRequest(req, res, runControlKey, runControl);
+        return;
+      }
       if (url2.pathname === HEALTHZ_PATH && req.method === "GET") {
         res.writeHead(200, { "Content-Type": "application/json" });
         res.end(
@@ -37229,6 +38146,8 @@ async function createDaemon(options) {
             activeRuns: projects.activeRunCount(),
             envFingerprint: familyFingerprint,
             projects: projects.snapshot(),
+            instanceId: ownInstanceId,
+            controlProtocol: RUN_CONTROL_PROTOCOL,
             lameDuck: isSuperseded(),
             inflightRequests: sessions.inflightCount() + modernInflight
           })
@@ -37261,6 +38180,8 @@ async function createDaemon(options) {
     port: boundPort,
     url: `http://${host}:${boundPort}${MCP_ENDPOINT_PATH}`,
     startedAt,
+    instanceId: ownInstanceId,
+    controlUrl: `http://${host}:${boundPort}${RUN_CONTROL_PATH}`,
     sessions,
     projects,
     activeRunCount: () => projects.activeRunCount(),
@@ -37268,6 +38189,7 @@ async function createDaemon(options) {
     inflightRequestCount: () => sessions.inflightCount() + modernInflight,
     isSuperseded,
     evictDrainableSessions: () => sessions.evictDrainable((sessionId) => replPresence.sessionHasBusyWorkspace(sessionId)),
+    processPendingControlIntents: () => runControl.processPendingIntents(),
     async close() {
       const closed = new Promise((resolvePromise) => {
         httpServer.close(() => resolvePromise());
@@ -37305,6 +38227,7 @@ async function runDaemon(options = {}) {
   const log = (line) => console.error(line);
   const runner = createAcpRunner();
   const supersede = options.supersede ?? false;
+  const instanceId = randomUUID5();
   let daemon;
   const sessionTtlMs = envInt(SESSION_IDLE_TTL_ENV, SESSION_IDLE_TTL_MS);
   const replDrainBoundMs = envInt(REPL_DRAIN_BOUND_ENV, REPL_DRAIN_BOUND_MS);
@@ -37314,7 +38237,7 @@ async function runDaemon(options = {}) {
     return `port ${port} is still held by ${holder.legacy ? "a legacy " : ""}daemon pid ${holder.info.pid} (v${holder.info.version}, started ${holder.info.startedAt})`;
   };
   const evalBreakChannel = createEvalBreakChannel2();
-  const daemonOptions = { runner, log, replDrainBoundMs, evalBreakChannel };
+  const daemonOptions = { runner, log, replDrainBoundMs, evalBreakChannel, ownInstanceId: instanceId };
   if (supersede) {
     let port = options.port ?? 0;
     try {
@@ -37348,6 +38271,9 @@ async function runDaemon(options = {}) {
     url: daemon.url,
     startedAt: daemon.startedAt,
     envFingerprint: envFingerprint(),
+    instanceId: daemon.instanceId,
+    controlUrl: daemon.controlUrl,
+    controlProtocol: 1,
     ...await evalBreakChannel.breakUrl().then((url2) => ({ replBreakUrl: url2 })).catch(() => ({}))
   });
   installDaemonLifecycle({
@@ -37410,7 +38336,9 @@ function formatInstance(instance, currentPid) {
     `${DAEMON_NAME} v${health?.version ?? info.version}`,
     `  pid:         ${info.pid}`,
     `  url:         ${info.url}`,
-    `  role:        ${role}`
+    `  role:        ${role}`,
+    `  instance:    ${health?.instanceId ?? info.instanceId ?? "legacy/unknown"}`,
+    `  run control: ${health?.controlProtocol === 1 || info.controlProtocol === 1 ? "v1" : "unavailable"}`
   ];
   if (health === void 0) {
     lines.push("  health:      not responding (pid alive, /healthz unreachable)");
@@ -37508,7 +38436,7 @@ async function runDaemonCommand(args, options) {
       const count = Number.isFinite(lines) && lines > 0 ? lines : 100;
       let content;
       try {
-        content = readFileSync5(daemonLogPath(), "utf-8");
+        content = readFileSync7(daemonLogPath(), "utf-8");
       } catch {
         console.log(`no daemon log at ${daemonLogPath()}`);
         return 0;
@@ -44475,24 +45403,24 @@ var require_compile2 = /* @__PURE__ */ __commonJSMin2(((exports) => {
     }
   }
   exports.compileSchema = compileSchema;
-  function resolveRef2(root, baseId, ref) {
+  function resolveRef2(root2, baseId, ref) {
     var _a3;
     ref = (0, resolve_1.resolveUrl)(this.opts.uriResolver, baseId, ref);
-    const schOrFunc = root.refs[ref];
+    const schOrFunc = root2.refs[ref];
     if (schOrFunc) return schOrFunc;
-    let _sch = resolve.call(this, root, ref);
+    let _sch = resolve.call(this, root2, ref);
     if (_sch === void 0) {
-      const schema = (_a3 = root.localRefs) === null || _a3 === void 0 ? void 0 : _a3[ref];
+      const schema = (_a3 = root2.localRefs) === null || _a3 === void 0 ? void 0 : _a3[ref];
       const { schemaId } = this.opts;
       if (schema) _sch = new SchemaEnv({
         schema,
         schemaId,
-        root,
+        root: root2,
         baseId
       });
     }
     if (_sch === void 0) return;
-    return root.refs[ref] = inlineOrCompile.call(this, _sch);
+    return root2.refs[ref] = inlineOrCompile.call(this, _sch);
   }
   exports.resolveRef = resolveRef2;
   function inlineOrCompile(sch) {
@@ -44506,20 +45434,20 @@ var require_compile2 = /* @__PURE__ */ __commonJSMin2(((exports) => {
   function sameSchemaEnv(s1, s2) {
     return s1.schema === s2.schema && s1.root === s2.root && s1.baseId === s2.baseId;
   }
-  function resolve(root, ref) {
+  function resolve(root2, ref) {
     let sch;
     while (typeof (sch = this.refs[ref]) == "string") ref = sch;
-    return sch || this.schemas[ref] || resolveSchema.call(this, root, ref);
+    return sch || this.schemas[ref] || resolveSchema.call(this, root2, ref);
   }
-  function resolveSchema(root, ref) {
+  function resolveSchema(root2, ref) {
     const p = this.opts.uriResolver.parse(ref);
     const refPath = (0, resolve_1._getFullPath)(this.opts.uriResolver, p);
-    let baseId = (0, resolve_1.getFullPath)(this.opts.uriResolver, root.baseId, void 0);
-    if (Object.keys(root.schema).length > 0 && refPath === baseId) return getJsonPointer.call(this, p, root);
+    let baseId = (0, resolve_1.getFullPath)(this.opts.uriResolver, root2.baseId, void 0);
+    if (Object.keys(root2.schema).length > 0 && refPath === baseId) return getJsonPointer.call(this, p, root2);
     const id = (0, resolve_1.normalizeId)(refPath);
     const schOrRef = this.refs[id] || this.schemas[id];
     if (typeof schOrRef == "string") {
-      const sch = resolveSchema.call(this, root, schOrRef);
+      const sch = resolveSchema.call(this, root2, schOrRef);
       if (typeof (sch === null || sch === void 0 ? void 0 : sch.schema) !== "object") return;
       return getJsonPointer.call(this, p, sch);
     }
@@ -44533,7 +45461,7 @@ var require_compile2 = /* @__PURE__ */ __commonJSMin2(((exports) => {
       return new SchemaEnv({
         schema,
         schemaId,
-        root,
+        root: root2,
         baseId
       });
     }
@@ -44547,7 +45475,7 @@ var require_compile2 = /* @__PURE__ */ __commonJSMin2(((exports) => {
     "dependencies",
     "definitions"
   ]);
-  function getJsonPointer(parsedRef, { baseId, schema, root }) {
+  function getJsonPointer(parsedRef, { baseId, schema, root: root2 }) {
     var _a3;
     if (((_a3 = parsedRef.fragment) === null || _a3 === void 0 ? void 0 : _a3[0]) !== "/") return;
     for (const part of parsedRef.fragment.slice(1).split("/")) {
@@ -44561,13 +45489,13 @@ var require_compile2 = /* @__PURE__ */ __commonJSMin2(((exports) => {
     let env;
     if (typeof schema != "boolean" && schema.$ref && !(0, util_1.schemaHasRulesButRef)(schema, this.RULES)) {
       const $ref = (0, resolve_1.resolveUrl)(this.opts.uriResolver, baseId, schema.$ref);
-      env = resolveSchema.call(this, root, $ref);
+      env = resolveSchema.call(this, root2, $ref);
     }
     const { schemaId } = this.opts;
     env = env || new SchemaEnv({
       schema,
       schemaId,
-      root,
+      root: root2,
       baseId
     });
     if (env.schema !== env.root.schema) return env;
@@ -45432,11 +46360,11 @@ var require_core$32 = /* @__PURE__ */ __commonJSMin2(((exports) => {
       while (typeof (sch = getSchEnv.call(this, keyRef)) == "string") keyRef = sch;
       if (sch === void 0) {
         const { schemaId } = this.opts;
-        const root = new compile_1.SchemaEnv({
+        const root2 = new compile_1.SchemaEnv({
           schema: {},
           schemaId
         });
-        sch = compile_1.resolveSchema.call(this, root, keyRef);
+        sch = compile_1.resolveSchema.call(this, root2, keyRef);
         if (!sch) return;
         this.refs[keyRef] = sch;
       }
@@ -45741,16 +46669,16 @@ var require_ref2 = /* @__PURE__ */ __commonJSMin2(((exports) => {
     code(cxt) {
       const { gen, schema: $ref, it } = cxt;
       const { baseId, schemaEnv: env, validateName, opts, self } = it;
-      const { root } = env;
-      if (($ref === "#" || $ref === "#/") && baseId === root.baseId) return callRootRef();
-      const schOrEnv = compile_1.resolveRef.call(self, root, baseId, $ref);
+      const { root: root2 } = env;
+      if (($ref === "#" || $ref === "#/") && baseId === root2.baseId) return callRootRef();
+      const schOrEnv = compile_1.resolveRef.call(self, root2, baseId, $ref);
       if (schOrEnv === void 0) throw new ref_error_1.default(it.opts.uriResolver, baseId, $ref);
       if (schOrEnv instanceof compile_1.SchemaEnv) return callValidate(schOrEnv);
       return inlineRefSchema(schOrEnv);
       function callRootRef() {
-        if (env === root) return callRef(cxt, validateName, env, env.$async);
-        const rootName = gen.scopeValue("root", { ref: root });
-        return callRef(cxt, (0, codegen_1._)`${rootName}.validate`, root, root.$async);
+        if (env === root2) return callRef(cxt, validateName, env, env.$async);
+        const rootName = gen.scopeValue("root", { ref: root2 });
+        return callRef(cxt, (0, codegen_1._)`${rootName}.validate`, root2, root2.$async);
       }
       function callValidate(sch) {
         callRef(cxt, getValidate(cxt, sch), sch, sch.$async);
@@ -47465,12 +48393,12 @@ var require_dynamicAnchor2 = /* @__PURE__ */ __commonJSMin2(((exports) => {
   exports.dynamicAnchor = dynamicAnchor;
   function _getValidate(cxt) {
     const { schemaEnv, schema, self } = cxt.it;
-    const { root, baseId, localRefs, meta: meta3 } = schemaEnv.root;
+    const { root: root2, baseId, localRefs, meta: meta3 } = schemaEnv.root;
     const { schemaId } = self.opts;
     const sch = new compile_1.SchemaEnv({
       schema,
       schemaId,
-      root,
+      root: root2,
       baseId,
       localRefs,
       meta: meta3
@@ -48867,8 +49795,8 @@ async function random(size) {
   const evenDistCutoff = Math.pow(2, 8) - Math.pow(2, 8) % mask.length;
   let result = "";
   while (result.length < size) {
-    const randomBytes3 = await getRandomValues(size - result.length);
-    for (const randomByte of randomBytes3) {
+    const randomBytes4 = await getRandomValues(size - result.length);
+    for (const randomByte of randomBytes4) {
       if (randomByte < evenDistCutoff) {
         result += mask[randomByte % mask.length];
       }
@@ -50992,6 +51920,7 @@ async function runShim(options) {
   const info = await ensureDaemonRunning({ bundlePath: options.bundlePath, port: options.port, log });
   let replBreakUrl = info.replBreakUrl;
   let exiting = false;
+  let compatibilityDrainTimer;
   function fireOutOfBandBreak(projectDir) {
     if (typeof projectDir !== "string" || replBreakUrl === void 0) return;
     let key;
@@ -51112,6 +52041,27 @@ async function runShim(options) {
     log(`[${DAEMON_NAME} shim] fatal: ${reason}`);
     void shutdown(1);
   }
+  function armCompatibilityDrain(candidate) {
+    if (compatibilityDrainTimer !== void 0) {
+      clearInterval(compatibilityDrainTimer);
+      compatibilityDrainTimer = void 0;
+    }
+    if (candidate.compatibilityDrain !== true) return;
+    compatibilityDrainTimer = setInterval(() => {
+      void (async () => {
+        if (exiting || reinitializing) return;
+        const health = await probeHealthz(candidate.port, 1e3);
+        if (health === void 0 || health.pid !== candidate.pid || health.activeRuns === 0 && (health.inflightRequests ?? 0) === 0) {
+          if (compatibilityDrainTimer !== void 0) clearInterval(compatibilityDrainTimer);
+          compatibilityDrainTimer = void 0;
+          await startReinitialize(
+            health === void 0 ? "compatibility-drain predecessor became unavailable" : "compatibility-drain predecessor became idle"
+          );
+        }
+      })().catch((error51) => log(`[${DAEMON_NAME} shim] compatibility-drain monitor failed: ${String(error51)}`));
+    }, 1e3);
+    compatibilityDrainTimer.unref();
+  }
   async function startReinitialize(reason) {
     if (reinitializing || exiting) return;
     if (!recoveryAllowed()) {
@@ -51127,6 +52077,7 @@ async function runShim(options) {
       retireTransport(http2, reason);
       const fresh = await ensureDaemonRunning({ bundlePath: options.bundlePath, port: options.port, log });
       replBreakUrl = fresh.replBreakUrl;
+      armCompatibilityDrain(fresh);
       http2 = makeHttpTransport(fresh.url);
       await http2.start();
       if (cachedInitialize === void 0) {
@@ -51218,6 +52169,8 @@ async function runShim(options) {
   async function shutdown(code) {
     if (exiting) return;
     exiting = true;
+    if (compatibilityDrainTimer !== void 0) clearInterval(compatibilityDrainTimer);
+    compatibilityDrainTimer = void 0;
     await http2.terminateSession().catch(() => void 0);
     await http2.close().catch(() => void 0);
     await stdio.close().catch(() => void 0);
@@ -51226,6 +52179,7 @@ async function runShim(options) {
   stdio.onclose = () => void shutdown(0);
   process.once("SIGINT", () => void shutdown(0));
   process.once("SIGTERM", () => void shutdown(0));
+  armCompatibilityDrain(info);
   await http2.start();
   await stdio.start();
 }