@bastani/atomic 0.9.12 → 0.9.13-alpha.2

package/dist/builtin/workflows/src/runs/foreground/stage-runner-types.ts

@@ -1,4 +1,4 @@
-import type { AgentSession, CreateAgentSessionOptions, PromptOptions } from "@bastani/atomic";
+import type { AgentSession, CreateAgentSessionOptions, PromptOptions, SettingsManager } from "@bastani/atomic";
 import type {
 	CompleteStageOpts,
 	StageContext,
@@ -18,9 +18,11 @@ export type WorkflowFastModeSettings = {
 	readonly chat: boolean;
 	readonly workflow: boolean;
 };
+export type WorkflowRetrySettings = ReturnType<SettingsManager["getRetrySettings"]>;
 
 export type WorkflowFastModeSettingsManager = {
 	getCodexFastModeSettings(): WorkflowFastModeSettings;
+	getRetrySettings?(): WorkflowRetrySettings;
 };
 
 export type StageUserMessageDeliveryAction = "prompt" | "steer" | "followUp" | "handled";

package/dist/builtin/workflows/src/runs/shared/model-fallback-failures.ts

@@ -1,514 +1,19 @@
-const RETRYABLE_MODEL_FAILURE_PATTERNS: readonly RegExp[] = [
-	/rate\s*limit/i,
-	/too\s*many\s*requests/i,
-	/\b429\b/,
-	/quota/i,
-	/usage[\s_-]*limit/i, // usage-limit exhaustion is a quota condition (accept space/underscore/hyphen/joined forms); next candidate may have headroom
-	/billing/i,
-	/credit/i,
-	/auth(?:entication|orization)?/i,
-	/unauthori[sz]ed/i,
-	/\b40[13]\b/,
-	/api\s*key/i,
-	/token\s*expired/i,
-	/forbidden/i,
-	/invalid\s*key/i,
-	/model.*(?:unavailable|disabled|not\s*found|unknown)/i,
-	/(?:unavailable|disabled|not\s*found|unknown).*model/i,
-	/overloaded/i,
-	/temporarily\s*unavailable/i,
-	/service\s*unavailable/i,
-	/network/i,
-	/fetch/i,
-	/socket/i,
-	/connection\s*refused/i,
-	/upstream/i,
-	/timeout/i,
-	/timed\s*out/i,
-	/\b50[0-4]\b/,
-];
-
-const NON_RETRYABLE_FAILURE_PATTERNS: readonly RegExp[] = [
-	/command failed/i,
-	/tests? failed/i,
-	/shell/i,
-	/missing file/i,
-	/no such file/i,
-	/cancel/i,
-	/abort/i,
-	/interrupted/i,
-];
-
-const CANCELLED_FAILURE_PATTERNS: readonly RegExp[] = [/cancel/i, /abort/i, /interrupted/i];
-
-export type ModelFallbackFailureKind =
-	| "auth_on_candidate_provider"
-	| "rate_limit"
-	| "provider_unavailable"
-	| "network_timeout"
-	| "transport_error"
-	| "model_unavailable"
-	| "request_incompatible"
-	| "cancelled"
-	| "task_failure"
-	| "unknown";
-
-export type ModelFallbackFailureSource =
-	| "assistant_message"
-	| "diagnostic"
-	| "throw"
-	| "structured"
-	| "string_fallback";
-
-export interface ModelFallbackFailureSignal {
-	readonly kind: ModelFallbackFailureKind;
-	readonly message: string;
-	readonly source: ModelFallbackFailureSource;
-	readonly stopReason?: string;
-	readonly status?: number;
-	readonly code?: string | number;
-	readonly name?: string;
-}
-
-const FALLBACKABLE_FAILURE_KINDS: ReadonlySet<ModelFallbackFailureKind> = new Set([
-	"auth_on_candidate_provider",
-	"rate_limit",
-	"provider_unavailable",
-	"network_timeout",
-	"transport_error",
-	"model_unavailable",
-	"request_incompatible",
-]);
-
-function asRecord(value: unknown): Record<string, unknown> | undefined {
-	return value !== null && typeof value === "object" ? (value as Record<string, unknown>) : undefined;
-}
-
-function field(value: unknown, key: string): unknown {
-	return asRecord(value)?.[key];
-}
-
-function stringField(value: unknown, key: string): string | undefined {
-	const raw = field(value, key);
-	return typeof raw === "string" && raw.trim().length > 0 ? raw : undefined;
-}
-
-function errorName(value: unknown): string | undefined {
-	return value instanceof Error ? value.name : stringField(value, "name");
-}
-
-function directMessageFrom(value: unknown): string | undefined {
-	return stringField(value, "errorMessage") ?? stringField(value, "message") ?? stringField(value, "statusText");
-}
-
-function integerFrom(value: unknown): number | undefined {
-	if (typeof value === "number" && Number.isInteger(value)) return value;
-	if (typeof value !== "string" || value.trim().length === 0) return undefined;
-	const parsed = Number(value.trim());
-	return Number.isInteger(parsed) ? parsed : undefined;
-}
-
-function statusFrom(value: unknown): number | undefined {
-	return (
-		integerFrom(field(value, "status")) ??
-		integerFrom(field(value, "statusCode")) ??
-		integerFrom(field(value, "httpStatus"))
-	);
-}
-
-function codeFrom(value: unknown): string | number | undefined {
-	const rawCode = field(value, "code");
-	return typeof rawCode === "string" || typeof rawCode === "number" ? rawCode : undefined;
-}
-
-function stopReasonFrom(value: unknown): string | undefined {
-	return stringField(value, "stopReason");
-}
-
-function finishReasonFrom(value: unknown): string | undefined {
-	return stringField(value, "finish_reason") ?? stringField(value, "finishReason");
-}
-
-function causeOf(value: unknown): unknown {
-	return value instanceof Error ? value.cause : field(value, "cause");
-}
-
-function diagnosticErrors(value: unknown): readonly unknown[] {
-	const diagnostics = field(value, "diagnostics");
-	if (!Array.isArray(diagnostics)) return [];
-	const errors: unknown[] = [];
-	for (const diagnostic of diagnostics) {
-		const diagnosticError = field(diagnostic, "error");
-		errors.push(diagnosticError ?? diagnostic);
-	}
-	return errors;
-}
-
-function normalizeCode(value: string | number | undefined): string | undefined {
-	if (value === undefined) return undefined;
-	const normalized = String(value)
-		.trim()
-		.toLowerCase()
-		.replace(/[^a-z0-9]+/g, "_")
-		.replace(/^_+|_+$/g, "");
-	return normalized.length > 0 ? normalized : undefined;
-}
-
-function kindFromStatus(status: number | undefined): ModelFallbackFailureKind | undefined {
-	switch (status) {
-		case 400:
-		case 413:
-		case 422:
-			return "request_incompatible";
-		case 401:
-		case 403:
-			return "auth_on_candidate_provider";
-		case 408:
-			return "network_timeout";
-		case 404:
-			return "model_unavailable";
-		case 429:
-			return "rate_limit";
-		default:
-			if (status !== undefined && status >= 500 && status <= 599) return "provider_unavailable";
-			return undefined;
-	}
-}
-
-function refusalKindFromCode(code: string | number | undefined): ModelFallbackFailureKind | undefined {
-	const normalizedCode = normalizeCode(code);
-	if (normalizedCode === undefined) return undefined;
-	if (normalizedCode.includes("content_filter") || normalizedCode.includes("contentfilter")) return "task_failure";
-	if (normalizedCode.includes("safety") || normalizedCode.includes("policy")) return "task_failure";
-	switch (normalizedCode) {
-		case "blocked":
-		case "blocked_by_provider":
-		case "blocked_by_safety":
-		case "blocked_by_policy":
-		case "provider_refusal":
-		case "refusal":
-		case "tool_refusal":
-		case "tool_call_refusal":
-		case "tool_use_refusal":
-			return "task_failure";
-		default:
-			return undefined;
-	}
-}
-
-const REQUEST_INCOMPATIBLE_CODES: ReadonlySet<string> = new Set([
-	"invalid_request",
-	"invalid_request_error",
-	"bad_request",
-	"context_length_exceeded",
-	"request_too_large",
-	"too_large",
-	"request_entity_too_large",
-	"max_tokens",
-	"max_context_length",
-	"context_window_exceeded",
-]);
-function requestIncompatibleKindFromCode(code: string | number | undefined): ModelFallbackFailureKind | undefined {
-	const normalizedCode = normalizeCode(code);
-	return normalizedCode !== undefined && REQUEST_INCOMPATIBLE_CODES.has(normalizedCode)
-		? "request_incompatible"
-		: undefined;
-}
-function kindFromCode(code: string | number | undefined): ModelFallbackFailureKind | undefined {
-	const normalizedCode = normalizeCode(code);
-	if (normalizedCode === undefined) return undefined;
-	const refusalKind = refusalKindFromCode(code);
-	if (refusalKind !== undefined) return refusalKind;
-	const httpStatusKind = kindFromStatus(integerFrom(code));
-	if (httpStatusKind !== undefined) return httpStatusKind;
-	const requestIncompatibleKind = requestIncompatibleKindFromCode(code);
-	if (requestIncompatibleKind !== undefined) return requestIncompatibleKind;
-
-	switch (normalizedCode) {
-		case "auth":
-		case "auth_required":
-		case "authentication_required":
-		case "unauthorized":
-		case "forbidden":
-		case "invalid_api_key":
-		case "missing_api_key":
-		case "invalid_key":
-			return "auth_on_candidate_provider";
-		case "etimedout":
-		case "econnreset":
-		case "econnrefused":
-		case "enotfound":
-		case "eai_again":
-		case "fetch_failed":
-		case "network_error":
-		case "timeout":
-		case "timeout_error":
-		case "und_err_connect_timeout":
-			return "network_timeout";
-		case "rate_limit":
-		case "rate_limit_exceeded":
-		case "too_many_requests":
-		case "quota_exceeded":
-		case "insufficient_quota":
-		case "usage_limit":
-		case "usage_limit_reached":
-		case "usage_limit_exceeded":
-			return "rate_limit";
-		case "aborterror":
-		case "aborted":
-		case "cancelled":
-		case "canceled":
-			return "cancelled";
-		case "model_not_found":
-		case "model_unavailable":
-		case "model_disabled":
-		case "unknown_model":
-			return "model_unavailable";
-		case "provider_error":
-		case "api_error":
-		case "service_unavailable":
-		case "temporarily_unavailable":
-		case "overloaded":
-			return "provider_unavailable";
-		default:
-			return undefined;
-	}
-}
-
-const REQUEST_INCOMPATIBLE_FAILURE_PATTERNS: readonly RegExp[] = [
-	/\bcontext[_\s-]?length(?:[_\s-]?exceeded)?\b/i,
-	/\bcontext[_\s-]?window(?:[_\s-]?exceeded)?\b/i,
-	/\bmax[_\s-]?context\b/i,
-	/\bmax[_\s-]?tokens?\b/i,
-	/\brequest(?:[_\s-]?entity)?[_\s-]?too[_\s-]?large\b/i,
-	/\btoo[_\s-]?large\b/i,
-	/\b(?:unsupported|unknown|invalid)\s+(?:tool|parameter|function)\b/i,
-	/\b(?:tool|parameter|function)\s+(?:not\s+(?:supported|found|allowed)|unknown|invalid)\b/i,
-	/\binvalid[_\s-]?request(?:[_\s-]?error)?\b/i,
-	/\bbad[_\s-]?request\b/i,
-];
-const PROVIDER_REFUSAL_FAILURE_PATTERNS: readonly RegExp[] = [
-	/\bfinish[_\s-]?reason\b[^\n]*\bcontent[_\s-]?filter\b/i,
-	/\bcontent[_\s-]?filter(?:ed|ing)?\b/i,
-	/\b(?:safety|policy)\b[^\n]*\b(?:refus(?:e|al|ed|es|ing)?|block(?:ed|ing)?|filter(?:ed|ing)?|violat(?:e|ion|ed|ing)?|disallow(?:ed|ing)?|reject(?:ed|ion|ing)?)\b/i,
-	/\b(?:refus(?:e|al|ed|es|ing)?|block(?:ed|ing)?|filter(?:ed|ing)?|violat(?:e|ion|ed|ing)?|disallow(?:ed|ing)?|reject(?:ed|ion|ing)?)\b[^\n]*\b(?:safety|policy)\b/i,
-	/\btool[_\s-]?(?:call|use)?[_\s-]?refus(?:e|al|ed|es|ing)?\b/i,
-	/\btool(?:\s+call|\s+use)?\b[^\n]*\brefus(?:e|al|ed|es|ing)?\b/i,
-	/\brefus(?:e|al|ed|es|ing)?\b[^\n]*\btool(?:\s+call|\s+use)?\b/i,
-	/\bprovider[_\s-]?refus(?:e|al|ed|es|ing)?\b/i,
-	/\bprovider\b[^\n]*\brefus(?:e|al|ed|es|ing)?\b[^\n]*\b(?:prompt|request|content|policy|safety)\b/i,
-];
-
-const TRANSPORT_OUTAGE_FAILURE_PATTERNS: readonly RegExp[] = [/^connection\s+error\.?$/i, /^fetch\s+failed\.?$/i];
-
-function transportOutageKindFromMessage(message: string): ModelFallbackFailureKind | undefined {
-	return TRANSPORT_OUTAGE_FAILURE_PATTERNS.some((pattern) => pattern.test(message.trim()))
-		? "transport_error"
-		: undefined;
-}
-
-function refusalKindFromMessage(message: string): ModelFallbackFailureKind | undefined {
-	if (CANCELLED_FAILURE_PATTERNS.some((pattern) => pattern.test(message))) return "cancelled";
-	if (NON_RETRYABLE_FAILURE_PATTERNS.some((pattern) => pattern.test(message))) return "task_failure";
-	if (PROVIDER_REFUSAL_FAILURE_PATTERNS.some((pattern) => pattern.test(message))) return "task_failure";
-	return undefined;
-}
-
-function fallbackKindFromMessage(message: string, name: string | undefined): ModelFallbackFailureKind | undefined {
-	const refusalKind = refusalKindFromMessage(message);
-	if (refusalKind !== undefined) return refusalKind;
-	const transportOutageKind = transportOutageKindFromMessage(message);
-	if (transportOutageKind !== undefined) return transportOutageKind;
-	if (REQUEST_INCOMPATIBLE_FAILURE_PATTERNS.some((pattern) => pattern.test(message))) return "request_incompatible";
-	const nameKind = kindFromCode(name);
-	if (nameKind !== undefined) return nameKind;
-	if (!RETRYABLE_MODEL_FAILURE_PATTERNS.some((pattern) => pattern.test(message))) return undefined;
-	if (/rate\s*limit|too\s*many\s*requests|\b429\b|quota|usage[\s_-]*limit|billing|credit/i.test(message))
-		return "rate_limit";
-	if (/auth|unauthori[sz]ed|\b40[13]\b|api\s*key|token\s*expired|forbidden|invalid\s*key/i.test(message))
-		return "auth_on_candidate_provider";
-	if (
-		/model.*(?:unavailable|disabled|not\s*found|unknown)|(?:unavailable|disabled|not\s*found|unknown).*model/i.test(
-			message,
-		)
-	)
-		return "model_unavailable";
-	if (/network|fetch|socket|connection\s*refused|timeout|timed\s*out/i.test(message)) return "network_timeout";
-	return "provider_unavailable";
-}
-
-function signalSource(value: unknown, fallback: ModelFallbackFailureSource | undefined): ModelFallbackFailureSource {
-	if (fallback !== undefined) return fallback;
-	if (stopReasonFrom(value) !== undefined || diagnosticErrors(value).length > 0) return "assistant_message";
-	if (value instanceof Error) return "throw";
-	return "structured";
-}
-
-function makeSignal(
-	kind: ModelFallbackFailureKind,
-	value: unknown,
-	source: ModelFallbackFailureSource | undefined,
-): ModelFallbackFailureSignal {
-	const status = statusFrom(value);
-	const code = codeFrom(value);
-	const name = errorName(value);
-	const stopReason = stopReasonFrom(value);
-	return {
-		kind,
-		message: errorMessage(value),
-		source: signalSource(value, source),
-		...(stopReason !== undefined ? { stopReason } : {}),
-		...(status !== undefined ? { status } : {}),
-		...(code !== undefined ? { code } : {}),
-		...(name !== undefined ? { name } : {}),
-	};
-}
-
-function fallbackSignalFromDirectMessage(
-	value: unknown,
-	source: ModelFallbackFailureSource | undefined,
-): ModelFallbackFailureSignal | undefined {
-	const message = directMessageFrom(value);
-	if (message === undefined) return undefined;
-	const kind = fallbackKindFromMessage(message, errorName(value));
-	return kind === undefined ? undefined : makeSignal(kind, value, source);
-}
-
-function fallbackSignalFromMessage(
-	value: unknown,
-	source: ModelFallbackFailureSource | undefined,
-): ModelFallbackFailureSignal | undefined {
-	const message = errorMessage(value);
-	if (!message.trim()) return undefined;
-	const kind = fallbackKindFromMessage(message, errorName(value));
-	return kind === undefined ? undefined : makeSignal(kind, value, source);
-}
-
-function classifyAssistantRefusalSignal(
-	value: unknown,
-	source: ModelFallbackFailureSource | undefined,
-): ModelFallbackFailureSignal | undefined {
-	const codeRefusalKind =
-		refusalKindFromCode(codeFrom(value)) ??
-		refusalKindFromCode(errorName(value)) ??
-		refusalKindFromCode(finishReasonFrom(value));
-	if (codeRefusalKind !== undefined) return makeSignal(codeRefusalKind, value, source);
-
-	const messageRefusalKind = refusalKindFromMessage(directMessageFrom(value) ?? "");
-	return messageRefusalKind === undefined ? undefined : makeSignal(messageRefusalKind, value, source);
-}
-
-function isRefusalSignal(signal: ModelFallbackFailureSignal): boolean {
-	return signal.kind === "cancelled" || signal.kind === "task_failure";
-}
-
-function structuredSignal(
-	value: unknown,
-	seen: Set<unknown>,
-	source?: ModelFallbackFailureSource,
-): ModelFallbackFailureSignal | undefined {
-	if (value === undefined || value === null || seen.has(value)) return undefined;
-	if (typeof value === "object") seen.add(value);
-
-	const stopReason = stopReasonFrom(value)?.toLowerCase();
-	if (stopReason === "aborted") return makeSignal("cancelled", value, source);
-
-	const directRefusalSignal = classifyAssistantRefusalSignal(value, source);
-	if (directRefusalSignal !== undefined) return directRefusalSignal;
-
-	const codeKind = kindFromCode(codeFrom(value));
-	const nameKind = kindFromCode(errorName(value));
-	if (codeKind === "cancelled" || nameKind === "cancelled") return makeSignal("cancelled", value, source);
-
-	let firstNestedFallbackSignal: ModelFallbackFailureSignal | undefined;
-	const nestedSeen = new Set(seen);
-	for (const diagnosticError of diagnosticErrors(value)) {
-		const diagnosticSignal =
-			structuredSignal(diagnosticError, nestedSeen, "diagnostic") ??
-			fallbackSignalFromMessage(diagnosticError, "diagnostic");
-		if (diagnosticSignal === undefined) continue;
-		if (isRefusalSignal(diagnosticSignal)) return diagnosticSignal;
-		firstNestedFallbackSignal ??= diagnosticSignal;
-	}
-	const cause = causeOf(value);
-	const causeSignal = structuredSignal(cause, nestedSeen, source) ?? fallbackSignalFromMessage(cause, source);
-	if (causeSignal !== undefined) {
-		if (isRefusalSignal(causeSignal)) return causeSignal;
-		firstNestedFallbackSignal ??= causeSignal;
-	}
-
-	// Direct-message classification runs after nested traversal so a generic wrapper
-	// ("invalid request"/"400 bad request") cannot mask a non-retryable nested signal.
-	const directMessageSignal = fallbackSignalFromDirectMessage(value, source);
-	if (directMessageSignal !== undefined) return directMessageSignal;
-
-	const statusKind = kindFromStatus(statusFrom(value));
-	if (statusKind !== undefined) return makeSignal(statusKind, value, source);
-	if (codeKind !== undefined) return makeSignal(codeKind, value, source);
-	if (nameKind !== undefined) return makeSignal(nameKind, value, source);
-
-	if (firstNestedFallbackSignal !== undefined) return firstNestedFallbackSignal;
-
-	if (stopReason === "error") return makeSignal("provider_unavailable", value, source);
-
-	return undefined;
-}
-
-function messageFromUnknown(value: unknown, seen: Set<unknown>): string | undefined {
-	if (value === undefined || value === null || seen.has(value)) return undefined;
-	if (typeof value === "string") return value.trim().length > 0 ? value : undefined;
-	if (typeof value === "number" || typeof value === "boolean" || typeof value === "bigint") return String(value);
-	if (typeof value === "symbol" || typeof value === "function") return undefined;
-	seen.add(value);
-
-	if (value instanceof Error && value.message.trim().length > 0) return value.message;
-	const directMessage = directMessageFrom(value);
-	if (directMessage !== undefined) return directMessage;
-
-	for (const diagnosticError of diagnosticErrors(value)) {
-		const diagnosticMessage = messageFromUnknown(diagnosticError, seen);
-		if (diagnosticMessage !== undefined) return diagnosticMessage;
-	}
-
-	const causeMessage = messageFromUnknown(causeOf(value), seen);
-	if (causeMessage !== undefined) return causeMessage;
-
-	const stopReason = stopReasonFrom(value);
-	if (stopReason !== undefined) return `Assistant message ended with stopReason:${stopReason}`;
-	const finishReason = finishReasonFrom(value);
-	if (finishReason !== undefined) return `Model request finished with finish_reason:${finishReason}`;
-	const status = statusFrom(value);
-	if (status !== undefined) return `Model request failed with status ${status}`;
-	const code = codeFrom(value);
-	if (code !== undefined) return `Model request failed with code ${String(code)}`;
-
-	return undefined;
-}
-
-export function errorMessage(error: unknown): string {
-	const structuredMessage = messageFromUnknown(error, new Set());
-	if (structuredMessage !== undefined) return structuredMessage;
-	const rendered = String(error);
-	return rendered === "[object Object]" ? "Model request failed" : rendered;
-}
-
-export function normalizeModelFailureSignal(error: unknown): ModelFallbackFailureSignal {
-	const structured = structuredSignal(error, new Set());
-	if (structured !== undefined) return structured;
-
-	const message = errorMessage(error);
-	const name = errorName(error);
-	const fallbackKind = message.trim().length > 0 ? fallbackKindFromMessage(message, name) : undefined;
-	return {
-		kind: fallbackKind ?? "unknown",
-		message,
-		source: "string_fallback",
-		...(name !== undefined ? { name } : {}),
-	};
-}
-
-export function isRetryableModelFailure(error: unknown): boolean {
-	if (error === undefined) return false;
-	const signal = normalizeModelFailureSignal(error);
-	return FALLBACKABLE_FAILURE_KINDS.has(signal.kind);
-}
+/**
+ * Compatibility exports for the shared Atomic model-failure classifier.
+ *
+ * The implementation lives in @bastani/atomic so the main chat, workflows,
+ * and subagents cannot drift into separate fallback decisions.
+ */
+
+export type {
+	ModelFallbackFailureKind,
+	ModelFallbackFailureSignal,
+	ModelFallbackFailureSource,
+} from "@bastani/atomic";
+export {
+	errorMessage,
+	isRetryableModelFailure,
+	isRetryableSameModelFailure,
+	modelFailureMessage,
+	normalizeModelFailureSignal,
+} from "@bastani/atomic";

package/dist/builtin/workflows/src/runs/shared/retry.ts

@@ -0,0 +1,44 @@
+/**
+ * Compatibility exports for the shared Atomic retry policy, plus the workflow's
+ * abort-aware sleep.
+ *
+ * The decision/backoff policy is implemented in @bastani/atomic so main chat and
+ * workflow stages cannot drift into different budgets for the same
+ * `settings.retry` values.
+ */
+
+export type { RetryDecision, RetryPolicySettings } from "@bastani/atomic";
+export { nextRetryDecision } from "@bastani/atomic";
+
+type WorkflowAbortReason = Error | DOMException | string;
+
+function abortReason(signal: AbortSignal | undefined): WorkflowAbortReason {
+	const reason = signal?.reason;
+	if (reason instanceof Error || reason instanceof DOMException || typeof reason === "string") return reason;
+	return new Error("atomic-workflows: workflow cancelled");
+}
+
+/** Sleep for a bounded interval and reject promptly when the signal aborts. */
+export function sleepOrAbort(ms: number, signal?: AbortSignal): Promise<void> {
+	if (signal?.aborted) return Promise.reject(abortReason(signal));
+	return new Promise((resolve, reject) => {
+		let settled = false;
+		const cleanup = (): void => signal?.removeEventListener("abort", onAbort);
+		const finish = (): void => {
+			if (settled) return;
+			settled = true;
+			cleanup();
+			resolve();
+		};
+		const fail = (error: WorkflowAbortReason): void => {
+			if (settled) return;
+			settled = true;
+			clearTimeout(timer);
+			cleanup();
+			reject(error);
+		};
+		const timer = setTimeout(finish, Math.max(0, ms));
+		const onAbort = (): void => fail(abortReason(signal));
+		signal?.addEventListener("abort", onAbort, { once: true });
+	});
+}

package/dist/builtin/workflows/src/runs/shared/worktree-git-runner.ts

@@ -1,5 +1,5 @@
 import { spawnSync } from "node:child_process";
-import { createGitEnvironment } from "@bastani/atomic";
+import { createChildProcessEnvironment, createGitEnvironment } from "@bastani/atomic";
 import type { GitResult } from "./worktree-types.js";
 
 const DISABLED_GIT_HOOKS_PATH = process.platform === "win32" ? "NUL" : "/dev/null";
@@ -27,7 +27,10 @@ function spawnGit(cwd: string, args: readonly string[], plain: boolean): GitResu
 	const result = spawnSync("git", plain ? args : gitCommandArgs(args), {
 		cwd,
 		encoding: "utf-8",
-		env: createGitEnvironment({ GIT_OPTIONAL_LOCKS: "0", GIT_TERMINAL_PROMPT: "0", GCM_INTERACTIVE: "never" }),
+		env: createGitEnvironment(
+			{ GIT_OPTIONAL_LOCKS: "0", GIT_TERMINAL_PROMPT: "0", GCM_INTERACTIVE: "never" },
+			createChildProcessEnvironment(),
+		),
 		timeout: GIT_COMMAND_TIMEOUT_MS,
 	});
 	return {

package/dist/builtin/workflows/src/runs/shared/worktree-setup.ts

@@ -2,6 +2,7 @@ import { spawnSync } from "node:child_process";
 import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
+import { createChildProcessEnvironment } from "@bastani/atomic";
 import { runGit, runGitChecked } from "./worktree-git.js";
 import { performPostCreationSetup } from "./worktree-post-create.js";
 import { findCanonicalGitRoot } from "./worktree-root.js";
@@ -219,6 +220,7 @@ function runWorktreeSetupHook(hook: ResolvedWorktreeSetupHook, input: WorktreeSe
 		cwd: input.worktreePath,
 		encoding: "utf-8",
 		input: JSON.stringify(input),
+		env: createChildProcessEnvironment(),
 		timeout: hook.timeoutMs,
 		shell: false,
 	});

package/dist/builtin/workflows/src/shared/authoring-contract-stage.d.ts

@@ -22,10 +22,15 @@ export type WorkflowOutputMode = "inline" | "file-only";
 export type WorkflowContextMode = "fresh" | "fork";
 export type WorkflowThinkingLevel = "off" | "minimal" | "low" | "medium" | "high" | "xhigh" | "max";
 export type WorkflowExecutionMode = "interactive" | "non_interactive";
-export type WorkflowExitStatus = "completed" | "skipped" | "cancelled" | "blocked";
-export type RunStatus = "pending" | "running" | "paused" | WorkflowExitStatus | "failed" | "killed";
+export type WorkflowExitStatus = "completed" | "skipped" | "cancelled" | "blocked" | "failed";
+export type RunStatus = "pending" | "running" | "paused" | WorkflowExitStatus | "killed";
+/**
+ * Who performed a workflow lifecycle action. Mirrors the store-side union; the
+ * authoring contract keeps its own copy so it stays independent of store types.
+ */
+export type WorkflowActor = "user" | "agent";
 export type WorkflowDetailsMode = "named" | "inspection" | "control";
-export type WorkflowDetailsStatus = "accepted" | "running" | WorkflowExitStatus | "failed" | "killed" | "noop";
+export type WorkflowDetailsStatus = "accepted" | "running" | WorkflowExitStatus | "killed" | "noop";
 export type WorkflowAction = "list" | "get" | "inputs" | "run" | "status" | "interrupt" | "resume";
 type WorkflowExitOutputValues<TOutputs extends WorkflowOutputValues = WorkflowOutputValues> = [keyof TOutputs] extends [
     never
@@ -33,6 +38,8 @@ type WorkflowExitOutputValues<TOutputs extends WorkflowOutputValues = WorkflowOu
 export interface WorkflowExitOptions<TOutputs extends WorkflowOutputValues = WorkflowOutputValues> {
     readonly status?: WorkflowExitStatus;
     readonly reason?: string;
+    /** Failed exits are non-resumable by default; set this only when retry is intended. */
+    readonly resumable?: boolean;
     readonly outputs?: WorkflowExitOutputValues<TOutputs>;
 }
 export interface WorkflowModelFallbackFields {