@bastani/atomic 0.9.16-alpha.3 → 0.9.16-alpha.5

package/dist/builtin/web-access/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bastani/web-access",
-  "version": "0.9.16-alpha.3",
+  "version": "0.9.16-alpha.5",
   "private": true,
   "description": "Atomic extension for web search, URL fetching, GitHub repo cloning, PDF/video extraction. Fork of: https://github.com/nicobailon/pi-web-access",
   "contributors": [
@@ -31,7 +31,7 @@
   },
   "peerDependencies": {
     "@bastani/atomic": "*",
-    "@earendil-works/pi-tui": "^0.84.2"
+    "@earendil-works/pi-tui": "^0.84.3"
   },
   "peerDependenciesMeta": {
     "@bastani/atomic": {

package/dist/builtin/workflows/CHANGELOG.md

@@ -6,6 +6,26 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 
 ## [Unreleased]
 
+## [0.9.16-alpha.5] - 2026-08-26
+
+### Changed
+
+- Raised the public `workflow` tool request deadline from 30 seconds to two minutes. Timed-out requests still return `WORKFLOW_TIMEOUT` with `timeoutMs: 120000`, abort cancellable work, discard late settlement, and never retry. Mutating actions keep the unknown-outcome warning that tells callers to inspect workflow status before retrying ([#2654](https://github.com/bastani-inc/atomic/issues/2654)).
+- Agent guidance now treats "no budget" as the default for workflow runs. A `budget` is passed on `run`/`resume` only when the operator asked for a limit, and only the fields they named; otherwise the field is omitted so the workflow declaration and config resolve normally.
+- Agent guidance now assumes the existing 15-minute heartbeat cadence and does not shorten, lengthen, or disable it unless the operator asks. Heartbeats are documented as periodic alignment checks rather than failure signals, so a progressing run is not interrupted, re-capped, or polled in response to one.
+
+### Fixed
+
+- Fixed running durable `ctx.tool` message blocks showing a trailing `●` after the tool call header; running and completed calls now use the same marker-free `$ <tool-name>` presentation while other tool-state markers remain unchanged.
+- Fixed a completed `ctx.task` leaving the root raw `running` with no active stage or tool and no path to the next budget boundary. The durable task-result checkpoint now fails closed, duration is rechecked after that checkpoint, quit/interrupt can abort a never-settling persist, a checkpoint created after its signal is already aborted settles without an unobserved rejection, an active task-checkpoint control — including one owned by an expanded child run — is not diagnosed as a stranded root, bulk interrupt forwards an injected tool-control registry, cancellation settles the DBOS write queue, and a terminal-only stage checkpoint replays the complete `WorkflowTaskResult` — the exact persisted text including schema-backed `maxOutput` truncation, structured output including `null`, generated worktree artifacts, warnings, session, and model metadata — without rerunning the task. A workflow that catches a task-tail quit rejection and returns outputs still stays paused. Exact-id quit or interrupt of a nested task tail now quits the aggregate root so the parent snapshot and durable handle do not stay raw `running`. Exact `/workflow status <id>` uses the live tool-control registry so a task tail is not reported as stranded. Same-process DBOS hydration rejects unknown checkpoint history instead of replaying around it ([#2650](https://github.com/bastani-inc/atomic/issues/2650)).
+- Fixed raised-budget resume of a blocked workflow when parallel stages shared a completed `ctx.tool` parent. Fresh-ID continuations translate tool parent identities during fail-closed topology validation, preserve cached root-level tool siblings without a false mismatch, reject a replayed tool whose restored parents disagree with the continuation graph or cannot be translated, and keep a blocked source retryable after that rejection without dropping recorded prompt answers, pending-prompt descriptors, or its BLOCKED notice. The local source kill remains process-only until settlement: a mismatch leaves no terminal session entry so the durable blocked row stays reload-recoverable, while a successful continuation durably retires the superseded source so reload cannot resurrect it ([#2639](https://github.com/bastani-inc/atomic/issues/2639)).
+- Fresh-ID continuations reuse the source `ctx.tool` checkpoint, including `failureMode: "return"` success and `return_failure` outcomes. A later hop reuses that result when the intermediate run republishes it; that write is best-effort. To re-run a completed return-mode callback, start a new run or change the tool name or args ([#2639](https://github.com/bastani-inc/atomic/issues/2639)).
+- Fixed ordinary in-process subagents stealing the parent session's workflow store binding. Subagent children retain bundled workflow definitions as resources without loading the workflows extension or exposing its tool, and the extension factory rejects admitted child sessions as a second boundary. Full `/reload` also recovers a live store displaced by an older generation, including stage, job, cancellation, tool-control, and prompt owners, merges retained parent history, and remounts the `BACKGROUND` panel. New session scopes remain isolated.
+- Fixed simultaneous post-task budget exhaustion in `ctx.parallel(..., { failFast: false })` being replaced by a generic aggregate failure after every task had already persisted a complete result. Budget-only parallel failures now retain the engine-owned resumable `budget_exceeded` classification, select the earliest authored exhausted task as the deterministic completed resume frontier, and replay all completed task results under a raised budget without rerunning their models; mixed ordinary failures retain the existing aggregate-failure behavior.
+- Fixed workflow name resolution racing past an in-flight `/workflow reload`: a run dispatched immediately after a reload could resolve against the pre-reload registry and execute the old module (observed live as reload generation N applying only after the run had started). Resolution now awaits any in-flight discovery before resolving names; a reload that fails while a registry already exists still surfaces through the reload's own caller, and resolution proceeds on the retained registry instead of throwing. ([#2667](https://github.com/bastani-inc/atomic/pull/2667) by [@uppifyagency](https://github.com/uppifyagency))
+- Fixed Goal losing its ledger, orchestrator receipt, and review artifacts when a durable resume continued under a fresh run ID. Goal now checkpoints the complete artifact directory, reloads exact turn-bearing ledger state from a durable sidecar without truncating records or fabricating reducer turns, keeps the model-visible ledger free of internal turn numbers, avoids duplicating replayed receipts and reviews, and scopes artifact ownership to the run's own identity plus its continuation chain. Fresh-ID continuation chains retain and report the original referenced owner correctly, and retention pruning protects that owner while any continuation remains live without allowing incidental quoted paths to pin failed runs forever.
+- Fixed a missing Goal reviewer `reads` artifact being reported as malformed structured reviewer output. Missing referenced files now remain explicit reviewer execution failures attributed to the `reads` contract, while completed unstructured reviewer responses continue to use the existing parse-failure path.
+
 ## [0.9.16-alpha.2] - 2026-08-23
 
 ### Added

package/dist/builtin/workflows/README.md

@@ -677,7 +677,7 @@ Raw stage-chat prompt answer replay is live-memory only. `StageSnapshot.promptAn
 ```json
 {
   "name": "workflow",
-  "description": "Run named builtin, project, user, or package workflows; custom definitions may import reusable project/package workflows or builtin definitions from @bastani/workflows/builtin and nest them with ctx.workflow(...), including deeper composition within the configured maxDepth; when workflow execution fits but another shape would better achieve the task, author a custom TypeScript workflow({...}) inline with normal coding tools, reload it, and run it; after successfully creating and reloading a newly authored custom workflow, report the folder containing its generated code as 'Custom workflow created. You can inspect its code at: <workflow-folder-path>'; do this only for newly created custom workflows, never builtin or pre-existing workflows; discover with list/get/inputs/models, list session runs with status (no runId; statusFilter narrows the list), inspect status/stages/stage details, send prompt answers or steering only while the root workflow is nonterminal, pause/resume/interrupt/quit runs, and reload workflow resources. For action 'run' and 'resume', budget accepts per-field duration, token, cost, and warning overrides; fields resolve over the workflow declaration and config, and 0 disables a field. For primitive prompt answers, use booleans or the documented confirm labels, exact case-insensitive select labels or 1-based indexes, and text strings for input/editor; an invalid answer remains pending and returns guidance instead of choosing a default. For large stage handoffs, write context to files/artifacts, pass paths via reads, and prompt downstream agents to 'Read the file at <path>...' instead of injecting large previous text. Wrap critical parts of run inputs and steering messages in <keepContext>...</keepContext> so compaction preserves them verbatim in the stages that inherit them; tag role constraints, prohibitions, must-hold criteria, and identifiers, not background or bulk reference material. For transcripts, prefer status/stages/stage to get sessionFile/transcriptPath, quote the exact path without rewriting separators (Windows backslashes are valid), then search it with rg/grep and read small ranges; transcript is path-only by default when sessionFile/transcriptPath exists, explicit tail/limit returns bounded previews, and missing transcript paths fall back to a small preview. Use action 'models' to inspect models in the configured catalog; the result is a configured-auth snapshot showing what's present in the registry with configured authentication, not proof of credentials, entitlements, OAuth freshness, or live provider access. When authoring a workflow that should dynamically select a model, first call workflow({ action: 'models' }) to inspect the configured catalog, then select from the returned provider/id entries considering the isCurrent marker and available thinking levels.",
+  "description": "Run named builtin, project, user, or package workflows; custom definitions may import reusable project/package workflows or builtin definitions from @bastani/workflows/builtin and nest them with ctx.workflow(...), including deeper composition within the configured maxDepth; when workflow execution fits but another shape would better achieve the task, author a custom TypeScript workflow({...}) inline with normal coding tools, reload it, and run it; after successfully creating and reloading a newly authored custom workflow, report the folder containing its generated code as 'Custom workflow created. You can inspect its code at: <workflow-folder-path>'; do this only for newly created custom workflows, never builtin or pre-existing workflows; discover with list/get/inputs/models, list session runs with status (no runId; statusFilter narrows the list), inspect status/stages/stage details, send prompt answers or steering only while the root workflow is nonterminal, pause/resume/interrupt/quit runs, and reload workflow resources. For action 'run' and 'resume', budget accepts per-field duration, token, cost, and warning overrides; fields resolve over the workflow declaration and config, and 0 disables a field. Pass budget only when the user asked for a limit; otherwise omit it entirely and inherit the declaration and config rather than inventing a cap. For primitive prompt answers, use booleans or the documented confirm labels, exact case-insensitive select labels or 1-based indexes, and text strings for input/editor; an invalid answer remains pending and returns guidance instead of choosing a default. For large stage handoffs, write context to files/artifacts, pass paths via reads, and prompt downstream agents to 'Read the file at <path>...' instead of injecting large previous text. Wrap critical parts of run inputs and steering messages in <keepContext>...</keepContext> so compaction preserves them verbatim in the stages that inherit them; tag role constraints, prohibitions, must-hold criteria, and identifiers, not background or bulk reference material. For transcripts, prefer status/stages/stage to get sessionFile/transcriptPath, quote the exact path without rewriting separators (Windows backslashes are valid), then search it with rg/grep and read small ranges; transcript is path-only by default when sessionFile/transcriptPath exists, explicit tail/limit returns bounded previews, and missing transcript paths fall back to a small preview. Use action 'models' to inspect models in the configured catalog; the result is a configured-auth snapshot showing what's present in the registry with configured authentication, not proof of credentials, entitlements, OAuth freshness, or live provider access. When authoring a workflow that should dynamically select a model, first call workflow({ action: 'models' }) to inspect the configured catalog, then select from the returned provider/id entries considering the isCurrent marker and available thinking levels.",
   "parameters": {
     "workflow": "string (optional) — workflow ID or normalized name",
     "inputs": "object (optional) — key/value map of workflow inputs",

package/dist/builtin/workflows/builtin/goal-ledger.ts

@@ -1,9 +1,10 @@
 import { randomUUID } from "node:crypto";
-import { writeFile } from "node:fs/promises";
-import { join } from "node:path";
-import { createWorkflowArtifactDirectory } from "../src/shared/workflow-artifacts.js";
+import { readFile, rename, rm, writeFile } from "node:fs/promises";
+import { dirname, join } from "node:path";
 import { LEDGER_FILENAME, type GoalLedger, type GoalLifecycleEvent } from "./goal-types.js";
 
+const LEDGER_STATE_FILENAME = "goal-ledger-state.json";
+
 type ModelVisibleGoalLedger = Omit<
   GoalLedger,
   "turns" | "receipts" | "reviews" | "blockers" | "decisions" | "lifecycle"
@@ -39,6 +40,10 @@ function modelVisibleLedger(ledger: GoalLedger): ModelVisibleGoalLedger {
   };
 }
 
+function goalLedgerStatePath(ledgerPath: string): string {
+  return join(dirname(ledgerPath), LEDGER_STATE_FILENAME);
+}
+
 export function appendLifecycleEvent(
   ledger: GoalLedger,
   event: GoalLifecycleEvent["event"],
@@ -54,13 +59,40 @@ export function appendLifecycleEvent(
   });
 }
 
+/**
+ * Restore only lossless authoritative state. A model-visible legacy ledger has
+ * no turn fields, so treating it as fresh is safer than fabricating reducer state.
+ *
+ * A sidecar that cannot be parsed is treated as absent for the same reason: the
+ * authoritative file is published by atomic rename below, so unparsable content
+ * means a torn write from before that guarantee (or a foreign file). Starting
+ * fresh loses recorded turns; throwing here would instead make the whole
+ * continuation unable to start.
+ */
+async function readExistingGoalLedger(ledgerPath: string): Promise<GoalLedger | undefined> {
+  let contents: string;
+  try {
+    contents = await readFile(goalLedgerStatePath(ledgerPath), "utf8");
+  } catch (error) {
+    if (error instanceof Error && "code" in error && error.code === "ENOENT") return undefined;
+    throw error;
+  }
+  try {
+    return JSON.parse(contents) as GoalLedger;
+  } catch {
+    return undefined;
+  }
+}
 export async function createGoalLedger(
   objective: string,
-  acceptanceCriteria = objective,
-  runId?: string,
+  acceptanceCriteria: string,
+  artifactDir: string,
 ): Promise<{ ledger: GoalLedger; ledgerPath: string; artifactDir: string }> {
+  const ledgerPath = join(artifactDir, LEDGER_FILENAME);
+  const existing = await readExistingGoalLedger(ledgerPath);
+  if (existing !== undefined) return { ledger: existing, ledgerPath, artifactDir };
+
   const goalId = randomUUID();
-  const artifactDir = await createWorkflowArtifactDirectory(runId);
   const now = new Date().toISOString();
   const ledger: GoalLedger = {
     goal_id: goalId,
@@ -79,7 +111,6 @@ export async function createGoalLedger(
     convergence: [],
   };
   appendLifecycleEvent(ledger, "created", "Goal created.", 0);
-  const ledgerPath = join(artifactDir, LEDGER_FILENAME);
   await writeGoalLedger(ledgerPath, ledger);
   return { ledger, ledgerPath, artifactDir };
 }
@@ -89,7 +120,20 @@ export async function writeGoalLedger(
   ledger: GoalLedger,
 ): Promise<void> {
   ledger.updated_at = new Date().toISOString();
-  await writeFile(ledgerPath, `${JSON.stringify(modelVisibleLedger(ledger), null, 2)}\n`, {
-    encoding: "utf8",
-  });
+  const visibleContents = `${JSON.stringify(modelVisibleLedger(ledger), null, 2)}\n`;
+  const stateContents = `${JSON.stringify(ledger, null, 2)}\n`;
+  const statePath = goalLedgerStatePath(ledgerPath);
+  // The sidecar is the authoritative resume state, so it is published by a
+  // complete same-directory write followed by an atomic rename. Overwriting it
+  // in place leaves a partial file readable when a write is interrupted, and
+  // the next continuation would then start from nothing.
+  const pendingStatePath = `${statePath}.${randomUUID()}.tmp`;
+  await writeFile(pendingStatePath, stateContents, { encoding: "utf8" });
+  try {
+    await rename(pendingStatePath, statePath);
+  } catch (error) {
+    await rm(pendingStatePath, { force: true });
+    throw error;
+  }
+  await writeFile(ledgerPath, visibleContents, { encoding: "utf8" });
 }

package/dist/builtin/workflows/builtin/goal-runner.ts

@@ -1,5 +1,15 @@
 import { join } from "node:path";
-import type { WorkflowParallelOptions, WorkflowTaskOptions, WorkflowTaskResult, WorkflowTaskStep } from "../src/shared/types.js";
+import type {
+  WorkflowParallelOptions,
+  WorkflowTaskOptions,
+  WorkflowTaskResult,
+  WorkflowTaskStep,
+  WorkflowToolPrimitive,
+} from "../src/shared/types.js";
+import {
+  ensureWorkflowArtifactDirectory,
+  workflowArtifactDirectoryPath,
+} from "../src/shared/workflow-artifacts.js";
 import { fold_usage } from "./verification-usage.js";
 import {
   convergence_escalation_evidence,
@@ -26,6 +36,7 @@ import { formatReviewReport, renderFinalReport } from "./goal-reports.js";
 import {
   parsedReviewDecisionFromResult,
   reviewDecisionToRecord,
+  reviewerErrorDecision,
 } from "./goal-review.js";
 import { reviewerFailureText } from "./review-convergence.js";
 import { consolidateFindingsBatch } from "./review-convergence.js";
@@ -73,10 +84,22 @@ function normalizeBranchInput(
 type GoalRunnerContext = {
   readonly inputs: GoalWorkflowInputs;
   readonly runId?: string;
+  readonly tool: WorkflowToolPrimitive;
   task(name: string, options: WorkflowTaskOptions): Promise<WorkflowTaskResult>;
   parallel(steps: readonly WorkflowTaskStep[], options: WorkflowParallelOptions): Promise<WorkflowTaskResult[]>;
 };
 
+type GoalArtifactContext = Pick<GoalRunnerContext, "runId" | "tool">;
+
+export async function createGoalArtifactDirectory(ctx: GoalArtifactContext): Promise<string> {
+  const artifactDir = await ctx.tool(
+    "artifact-root",
+    { workflow: "goal" },
+    async () => workflowArtifactDirectoryPath(ctx.runId),
+  );
+  return ensureWorkflowArtifactDirectory(artifactDir);
+}
+
 type GoalWorkflowOptions = {
   readonly createPr: boolean;
   readonly workflowStartCwd: string;
@@ -120,7 +143,8 @@ export async function runGoalWorkflow(ctx: GoalRunnerContext, options: GoalWorkf
     const reviewQuorum = DEFAULT_REVIEW_QUORUM;
     const blockerThreshold = Math.min(DEFAULT_BLOCKER_THRESHOLD, maxTurns);
     const comparisonBaseBranch = normalizeBranchInput(inputs.base_branch, "origin/main");
-    const { ledger, ledgerPath, artifactDir } = await createGoalLedger(objective, acceptanceCriteria, ctx.runId);
+    const artifactDir = await createGoalArtifactDirectory(ctx);
+    const { ledger, ledgerPath } = await createGoalLedger(objective, acceptanceCriteria, artifactDir);
 
     let latestReviews: ReviewRecord[] = [];
     let latestReviewArtifactPaths: string[] = [];
@@ -188,13 +212,18 @@ export async function runGoalWorkflow(ctx: GoalRunnerContext, options: GoalWorkf
 
       previousOrchestratorSessionFile = orchestrator.sessionFile;
       ledger.turns = turn;
-      ledger.receipts.push({
-        turn,
-        stage: orchestrator.name ?? orchestrator.stageName,
-        artifact_path: orchestratorReceiptPath,
-        summary: `Orchestrator receipt artifact: ${orchestratorReceiptPath}`,
-      });
-      appendLifecycleEvent(ledger, "receipt_recorded", "Orchestrator receipt recorded.", turn);
+      const receiptAlreadyRecorded = ledger.receipts.some(
+        (receipt) => receipt.turn === turn && receipt.artifact_path === orchestratorReceiptPath,
+      );
+      if (!receiptAlreadyRecorded) {
+        ledger.receipts.push({
+          turn,
+          stage: orchestrator.name ?? orchestrator.stageName,
+          artifact_path: orchestratorReceiptPath,
+          summary: `Orchestrator receipt artifact: ${orchestratorReceiptPath}`,
+        });
+        appendLifecycleEvent(ledger, "receipt_recorded", "Orchestrator receipt recorded.", turn);
+      }
       await writeGoalLedger(ledgerPath, ledger);
 
       const reviewerStep = (
@@ -238,6 +267,7 @@ export async function runGoalWorkflow(ctx: GoalRunnerContext, options: GoalWorkf
 
       let reviewResults: WorkflowTaskResult[];
       let reviewerBatchFailed = false;
+      let reviewerExecutionDiagnostic: string | undefined;
       try {
         reviewResults = await ctx.parallel(reviewerSteps, {
           task: objective,
@@ -246,11 +276,15 @@ export async function runGoalWorkflow(ctx: GoalRunnerContext, options: GoalWorkf
         });
       } catch (err) {
         reviewerBatchFailed = true;
+        const failure = reviewerFailureText(err);
+        reviewerExecutionDiagnostic = failure.includes("referenced artifact does not exist")
+          ? `Reviewer execution failed while resolving its reads contract: ${failure}`
+          : `Reviewer execution failed before producing a decision: ${failure}`;
         reviewResults = [
           {
             name: "reviewer-error",
             stageName: "reviewer-error",
-            text: reviewerFailureText(err),
+            text: failure,
           },
         ];
       }
@@ -258,7 +292,13 @@ export async function runGoalWorkflow(ctx: GoalRunnerContext, options: GoalWorkf
       latestReviews = await Promise.all(reviewResults.map(async (result) => {
         const reviewerName = result.name ?? result.stageName;
         const normalizedReviewerName = reviewerName.replace(/-\d+$/u, "");
-        const parsed = parsedReviewDecisionFromResult(result, reviewerName);
+        const parsed = reviewerBatchFailed
+          ? {
+              decision: reviewerErrorDecision(reviewerExecutionDiagnostic ?? "Reviewer execution failed."),
+              parsed: false,
+              diagnostics: [reviewerExecutionDiagnostic ?? "Reviewer execution failed."],
+            }
+          : parsedReviewDecisionFromResult(result, reviewerName);
         const reviewArtifactPath = join(
           artifactDir,
           `review-${artifactSafeName(normalizedReviewerName)}.json`,
@@ -332,7 +372,12 @@ export async function runGoalWorkflow(ctx: GoalRunnerContext, options: GoalWorkf
           usage: fold_usage([orchestrator, ...reviewResults, ...reverifyResults]),
         }));
       }
-      ledger.reviews.push(...latestReviews);
+      const newReviews = latestReviews.filter(
+        (review) => !ledger.reviews.some(
+          (recorded) => recorded.turn === review.turn && recorded.reviewer === review.reviewer,
+        ),
+      );
+      ledger.reviews.push(...newReviews);
       // Consolidated round artifact leads so the next orchestrator turn plans the full findings batch first.
       latestReviewArtifactPaths = [latestReviewReportPath, ...latestReviews.map((review) => review.artifact_path)];
       appendLifecycleEvent(

package/dist/builtin/workflows/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bastani/workflows",
-  "version": "0.9.16-alpha.3",
+  "version": "0.9.16-alpha.5",
   "private": true,
   "description": "Atomic extension for multi-stage workflow authoring and execution.",
   "contributors": [
@@ -83,7 +83,7 @@
   },
   "peerDependencies": {
     "@bastani/atomic": "*",
-    "@earendil-works/pi-tui": "^0.84.2"
+    "@earendil-works/pi-tui": "^0.84.3"
   },
   "peerDependenciesMeta": {
     "@bastani/atomic": {