@bastani/atomic 0.9.40 → 0.9.41-alpha.1

package/dist/builtin/intercom/recoverable-disconnect.ts

@@ -18,6 +18,10 @@
  * reconnect, or the previous attempt's session is still being torn down), the
  * same bounded retry that recovers a lost socket clears it (#3163). A refusal
  * whose code repeats identically on retry is not recoverable.
+ *
+ * A broker that accepts the socket but does not answer a registration in time is
+ * saturated, not gone. Its timeout is recoverable for the same reason, and a
+ * background relay that sees it keeps quiet unless the outage persists.
  */
 
 import { IntercomLiveRouteRefusedError } from "./live-route-refusal.js";
@@ -47,8 +51,18 @@ export class IntercomClientDisconnectedError extends Error implements Recoverabl
 	}
 }
 
+/** Raised when the broker accepted the socket but did not answer a registration within its bound. */
+export class IntercomBrokerTimeoutError extends Error implements RecoverableDisconnectMarker {
+	readonly intercomRecoverableDisconnect = true;
+
+	constructor(message: string, options?: ErrorOptions) {
+		super(message, options);
+		this.name = "IntercomBrokerTimeoutError";
+	}
+}
+
 /**
- * True for an `IntercomClientDisconnectedError` or a transient
+ * True for an `IntercomClientDisconnectedError`, an `IntercomBrokerTimeoutError`, or a transient
  * `IntercomLiveRouteRefusedError`, directly or as a bounded `cause` ancestor.
  */
 export function isRecoverableIntercomDisconnect(error: unknown): boolean {
@@ -56,8 +70,20 @@ export function isRecoverableIntercomDisconnect(error: unknown): boolean {
 	for (let depth = 0; depth <= MAX_CAUSE_DEPTH; depth += 1) {
 		if (!(current instanceof Error)) return false;
 		if (current instanceof IntercomClientDisconnectedError) return true;
+		if (current instanceof IntercomBrokerTimeoutError) return true;
 		if (current instanceof IntercomLiveRouteRefusedError) return current.transient;
 		current = current.cause;
 	}
 	return false;
 }
+
+/** True for an `IntercomBrokerTimeoutError`, directly or as a bounded `cause` ancestor. */
+export function isIntercomBrokerTimeout(error: unknown): boolean {
+	let current: unknown = error;
+	for (let depth = 0; depth <= MAX_CAUSE_DEPTH; depth += 1) {
+		if (!(current instanceof Error)) return false;
+		if (current instanceof IntercomBrokerTimeoutError) return true;
+		current = current.cause;
+	}
+	return false;
+}

package/dist/builtin/intercom/types.ts

@@ -70,6 +70,8 @@ export interface SessionDirectory {
 	readonly sessions: SessionInfo[];
  	readonly workflowStages: WorkflowStageRosterEntry[];
 	readonly workflowFutureStages: WorkflowFutureStageRosterEntry[];
+	/** The peeked workflow invocation group exists but is visible only to its members. */
+	readonly restricted?: true;
  }
 
 export interface WorkflowStageRosterAnnouncement {
@@ -186,6 +188,8 @@ export type ClientMessage =
 	| { type: "pending_stage_notification_result"; requestId: string; delivered: boolean }
  | {
 		type: "register_pending_stage_route";
+		/** When present, the broker answers with `pending_stage_route_registered` once the route is applied. */
+		requestId?: string;
 		runId: string;
 		group: string;
 		capability: string;
@@ -230,10 +234,12 @@ export type BrokerMessage =
 			supervisorSessionId?: string;
 			/** #3761: echoed only to a client that advertised it; that client may now send `received`. */
 			acknowledgesReceipt?: true;
+			/** This broker acknowledges a `register_pending_stage_route` that carries a `requestId`; absent on older brokers. */
+			acknowledgesPendingStageRoutes?: true;
 	  }
   | { type: "registration_failed"; reason: string; code?: LiveWorkflowStageRouteRefusalCode }
   | { type: "question_target"; messageId: string; attemptId: string; sessionId: string }
- | { type: "sessions"; requestId: string; sessions: SessionInfo[]; workflowStages?: WorkflowStageRosterEntry[]; workflowFutureStages?: WorkflowFutureStageRosterEntry[] }
+ | { type: "sessions"; requestId: string; sessions: SessionInfo[]; workflowStages?: WorkflowStageRosterEntry[]; workflowFutureStages?: WorkflowFutureStageRosterEntry[]; restricted?: true }
 	| { type: "groups"; requestId: string; groups: GroupSummary[] }
 	| { type: "membership_ack"; requestId: string; groups: string[] }
   | { type: "supervisor_authorized"; requestId: string; capability: string; supervisorSessionId: string; childName: string }
@@ -251,6 +257,7 @@ export type BrokerMessage =
 			live?: boolean;
 	  }
   | { type: "live_workflow_stage_route_registered"; requestId: string }
+	| { type: "pending_stage_route_registered"; requestId: string }
 	/** A dormant route's run was resumed by another process, which now owns the run's routes (#3760). */
 	| { type: "pending_stage_route_revoked"; runId: string }
   | { type: "presence_update"; session: SessionInfo }

package/dist/builtin/mcp/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bastani/mcp",
-  "version": "0.9.40",
+  "version": "0.9.41-alpha.1",
   "private": true,
   "description": "Atomic's pi-compatible MCP integration for server connections, OAuth, tools, resources, and terminal management.",
   "contributors": [

package/dist/builtin/subagents/CHANGELOG.md

@@ -2,6 +2,20 @@
 
 ## [Unreleased]
 
+## [0.9.41-alpha.1] - 2026-10-21
+
+### Added
+
+- Added a `resumeInFlight` subagent setting (`"never"`, `"ask"`, or `"auto"`, default `"never"`) for recovery of paused and quit subagents that are awaiting resume. `ask` confirms once, listing each subagent, and `auto` resumes each from its own session, with its completion reaching the session that launched it; `never` leaves them for a manual `resume`. It applies when Atomic starts or a session is resumed, to that session's own subagents, never to workflow-stage children, and an invalid value is reported and treated as `never` ([#3827](https://github.com/bastani-inc/atomic/issues/3827)).
+
+### Changed
+
+- Quitting a subagent now behaves like quitting a workflow. The `quit` and `pause` results say the child is paused · awaiting resume and name `{ action: "resume", id: "<child-id>" }`; the parent's completion notice says the same, with the typed `quit` or `pause` stop reason instead of `parent-handoff` and without "This execution has ended". `{ action: "status", id }` reports a paused or quit child as paused · awaiting resume with its resume call, and `{ action: "status" }` lists every such child, including after Atomic restarts. Launch cards of such children show `‖ Paused · awaiting resume` (or `‖ Quit · paused · awaiting resume`) instead of `(resumable)`.
+
+### Fixed
+
+- A subagent with `model: "auto"` no longer waits indefinitely on a slow routing model. Each routing inference now stops after the `httpIdleTimeoutMs` deadline (10 minutes by default), and the subagent runs on the current chat model when it satisfies the routing constraints ([#3806](https://github.com/bastani-inc/atomic/issues/3806))
+
 ## [0.9.40] - 2026-10-20
 
 ### Breaking Changes

package/dist/builtin/subagents/README.md

@@ -620,6 +620,20 @@ Subagent configuration controls discovery, parallel limits, session storage, con
 
 Running capacity is selected when a parent's first child is created. Restart Atomic after changing this setting to apply the new capacity.
 
+### `resumeInFlight`
+
+```json
+{ "resumeInFlight": "ask" }
+```
+
+Recovery of paused and quit subagents that are awaiting resume when a session starts or is resumed, using the same values as the workflow setting of that name:
+
+- `never` (default): leave them listed under "Awaiting resume" for a manual `resume`.
+- `ask`: confirm once, listing each subagent by name and id. No leaves them awaiting resume; without a UI it behaves like `never`.
+- `auto`: resume each from its own session. Its result reaches the session that launched it.
+
+Starting Atomic and resuming a session recover children; a reload, new session, or fork does not. Only children launched by the session being started or resumed are affected; workflow-stage children are never resumed this way. Any other value is reported and treated as `never`.
+
 ### `defaultSessionDir`
 
 ```json

package/dist/builtin/subagents/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bastani/subagents",
-  "version": "0.9.40",
+  "version": "0.9.41-alpha.1",
   "private": true,
   "description": "Atomic extension for delegating tasks to subagents with parallel execution. Fork of: https://github.com/nicobailon/pi-subagents",
   "contributors": [

package/dist/builtin/subagents/src/extension/index.bundle.mjs

@@ -8467,6 +8467,7 @@ var SUBAGENT_CONTROL_INTERCOM_EVENT = "subagent:control-intercom";
 var SUBAGENT_RESULT_INTERCOM_EVENT = "subagent:result-intercom";
 var SUBAGENT_TERMINAL_ORDERING_BARRIER_EVENT = "subagent:terminal-ordering-barrier";
 var SUBAGENT_RESULT_INTERCOM_DELIVERY_EVENT = "subagent:result-intercom-delivery";
+var RESUME_IN_FLIGHT_MODES = ["ask", "auto", "never"];
 // dist/builtin/subagents/src/shared/types-depth.ts
 function isWorkflowStageOrchestrationContext(ctx) {
   return ctx.orchestrationContext?.kind === "workflow-stage";
@@ -10558,7 +10559,11 @@ function retainedTaskOutput(ownerId, taskId) {
 
 // dist/builtin/subagents/src/runs/foreground/task-execution.ts
 function subagentTaskResultLabel(result) {
-  return result.kind === "cancelled" && result.cause === "user" ? "killed (non-resumable)" : result.kind;
+  if (result.kind === "cancelled" && result.cause === "user")
+    return "killed (non-resumable)";
+  if (result.kind === "cancelled" && (result.cause === "pause" || result.cause === "quit"))
+    return "paused · awaiting resume";
+  return result.kind;
 }
 function subagentTaskResponseText(response) {
   const outcomes = response.kind === "parallel" ? response.slots.map((slot) => slot.outcome) : [response];
@@ -10887,7 +10892,7 @@ ${launch.message}` : input.task,
           });
         const stopped = takeSubagentChildStop(context.ref.taskId);
         const stoppedByControl = stopped !== undefined && child.status === "interrupted";
-        const stoppedByStagePause = !stoppedByControl && child.status === "interrupted" && context.signal.aborted && context.signal.reason === "parent-handoff";
+        const stoppedByStagePause = !stoppedByControl && child.status === "interrupted" && context.signal.aborted && context.signal.reason === "pause";
         const endedForGood = ownerClosed() && input.recordChild?.ownerEndedForGood?.() === true;
         if (stopped !== undefined && !stoppedByControl)
           unparkRunWorktree(runId, index);
@@ -10921,7 +10926,7 @@ ${launch.message}` : input.task,
         if (child.interrupted)
           return {
             kind: "cancelled",
-            cause: stoppedByControl || stoppedByStagePause || input.options.interruptSignal?.aborted ? "parent-handoff" : "owner-close",
+            cause: stoppedByControl ? stopped === "quit" ? "quit" : "pause" : stoppedByStagePause ? "pause" : input.options.interruptSignal?.aborted ? "parent-handoff" : "owner-close",
             output
           };
         return child.status === "ok" ? { kind: "completed", output } : {
@@ -17474,7 +17479,7 @@ async function stopHostChild(deps, host, record, status) {
   const taskId = record.taskId;
   requestSubagentChildStop(taskId, status);
   parkRunWorktree(record.runId, record.index);
-  const cancelled = await host.cancelTask(taskId, "parent-handoff");
+  const cancelled = await host.cancelTask(taskId, status === "quit" ? "quit" : "pause");
   if (!cancelled.ok) {
     unparkRunWorktree(record.runId, record.index);
     return cancelled.error.message;
@@ -17550,7 +17555,7 @@ async function stopChildren(deps, ctx, request) {
         continue;
       }
       children.push(childDetails(record, status));
-      lines.push(action === "pause" ? `Paused ${label(record)}. Its queued messages are held until resume; resume it with { action: "resume", id: "${record.childId}", message? }.` : `Quit ${label(record)}. It stays resumable with { action: "resume", id: "${record.childId}", message? }.`);
+      lines.push(action === "pause" ? `Paused ${label(record)} · awaiting resume. Its queued messages are held until resume; resume it with { action: "resume", id: "${record.childId}", message? }.` : `Quit ${label(record)}: paused · awaiting resume, as a quit workflow run is. It stays resumable with { action: "resume", id: "${record.childId}", message? }.`);
       continue;
     }
     const stopped = stoppedAs(record);
@@ -17559,7 +17564,7 @@ async function stopChildren(deps, ctx, request) {
         releasePausedChildHold(key);
         await recordSubagentChildStatus(deps.pi, record, "quit");
         children.push(childDetails(record, "quit"));
-        lines.push(`Quit paused ${label(record)}. It stays resumable.`);
+        lines.push(`Quit paused ${label(record)}: paused · awaiting resume. It stays resumable with { action: "resume", id: "${record.childId}", message? }.`);
         continue;
       }
       children.push(childDetails(record, stopped));
@@ -17605,6 +17610,18 @@ async function resumeChild(deps, ctx, request) {
     ...message ? { message } : {}
   });
 }
+function awaitingResumeLine(record) {
+  const how = record.terminalStatus === "quit" ? "quit · paused · awaiting resume" : record.terminalStatus === SUBAGENT_CHILD_STAGE_PAUSED_STATUS ? "paused with its workflow stage · awaiting resume" : "paused · awaiting resume";
+  return `${label(record)} ${how}. Resume it with { action: "resume", id: "${record.childId}", message? }.`;
+}
+function subagentChildrenAwaitingResume(ctx, id) {
+  const records = ownedRecords(ctx);
+  if (id?.trim()) {
+    const resolved = resolveRecord(records, id);
+    return typeof resolved === "object" && stoppedAs(resolved) ? [awaitingResumeLine(resolved)] : [];
+  }
+  return [...records.values()].filter((record) => stoppedAs(record)).map(awaitingResumeLine);
+}
 function controlSubagentChildren(deps, ctx, request) {
   if (request.all && request.id)
     return Promise.resolve(errorResult(request.action, "Pass either id or all: true, not both."));
@@ -17612,6 +17629,42 @@ function controlSubagentChildren(deps, ctx, request) {
     return Promise.resolve(errorResult(request.action, `${request.action} needs the id of a child, or all: true.`));
   return request.action === "resume" ? resumeChild(deps, ctx, request) : stopChildren(deps, ctx, { ...request, action: request.action });
 }
+async function resumeAwaitingSubagentChildren(deps, ctx, mode, isCurrent) {
+  if (mode === "never" || ctx.isPresentationOnly === true)
+    return;
+  if (isSubagentChildSession(ctx) || isWorkflowStageOrchestrationContext(ctx))
+    return;
+  if (mode === "ask" && (ctx.hasUI === false || typeof ctx.ui?.confirm !== "function"))
+    return;
+  const notify = (message, type) => {
+    try {
+      ctx.ui?.notify?.(message, type);
+    } catch {
+      return;
+    }
+  };
+  try {
+    const awaiting = [...ownedRecords(ctx).values()].filter((record) => record.owner.kind === "session" && stoppedAs(record));
+    if (awaiting.length === 0)
+      return;
+    if (mode === "ask" && !await ctx.ui.confirm("Resume interrupted subagents?", `${awaiting.length} interrupted subagent(s) can resume from their own sessions:
+${awaiting.map((record) => `- ${label(record)}`).join(`
+`)}
+Resume now? Choose No to leave them awaiting resume; resume one later with subagent({ action: "resume", id }).`))
+      return;
+    for (const record of awaiting) {
+      if (!isCurrent())
+        return;
+      const result = await controlSubagentChildren(deps, ctx, { action: "resume", id: record.childId });
+      notify(result.content.map((part) => part.type === "text" ? part.text : "").join(`
+`), result.isError ? "warning" : "info");
+    }
+  } catch (error) {
+    if (!isCurrent())
+      return;
+    notify(`Subagent startup resume failed: ${String(error)}. Use subagent({ action: "resume", id }) to retry.`, "warning");
+  }
+}
 
 // dist/builtin/subagents/src/runs/foreground/subagent-executor.ts
 var MUTATING_MANAGEMENT_ACTIONS = new Set(["create", "update", "delete"]);
@@ -17693,6 +17746,7 @@ async function handleManagementRequest(input) {
     });
   }
   const targetTaskId = paramsWithResolvedCwd.id ?? paramsWithResolvedCwd.runId;
+  const awaitingResume = action === "status" ? subagentChildrenAwaitingResume(ctx, targetTaskId) : [];
   if (action === "status" && ctx.getAgentTaskHost && targetTaskId) {
     const host = ctx.getAgentTaskHost();
     const taskId = targetTaskId;
@@ -17706,7 +17760,9 @@ async function handleManagementRequest(input) {
           content: [
             {
               type: "text",
-              text: `${records.some((task) => task.execution.kind === "settled" && subagentTaskResultLabel(task.execution.result) === "killed (non-resumable)") ? `Killed. This child cannot be resumed. Underlying host records:
+              text: `${awaitingResume.length > 0 ? `${awaitingResume.join(`
+`)}
+` : ""}${records.some((task) => task.execution.kind === "settled" && subagentTaskResultLabel(task.execution.result) === "killed (non-resumable)") ? `Killed. This child cannot be resumed. Underlying host records:
 ` : ""}${JSON.stringify(records)}${settledOutput}`
             }
           ],
@@ -17720,14 +17776,28 @@ async function handleManagementRequest(input) {
       };
     }
   }
+  if (targetTaskId && awaitingResume.length > 0)
+    return {
+      content: [{ type: "text", text: awaitingResume.join(`
+`) }],
+      details: { mode: "management", results: [] }
+    };
   if (action === "status") {
     const targetRunId = paramsWithResolvedCwd.id ?? paramsWithResolvedCwd.runId;
-    const inProcess = inspectInProcessChildStatus(targetRunId);
-    if (inProcess)
-      return inProcess;
     const foreground = getForegroundControl(deps.state, targetRunId);
-    if (foreground)
-      return foregroundStatusResult(foreground);
+    const live = inspectInProcessChildStatus(targetRunId) ?? (foreground ? foregroundStatusResult(foreground) : undefined);
+    if (awaitingResume.length > 0) {
+      const liveText = live?.content.map((part) => part.type === "text" ? part.text : "").join(`
+`);
+      const text = [liveText, `Awaiting resume:
+${awaitingResume.join(`
+`)}`].filter(Boolean).join(`
+
+`);
+      return { details: live?.details ?? { mode: "management", results: [] }, content: [{ type: "text", text }] };
+    }
+    if (live)
+      return live;
     return {
       content: [
         {
@@ -19371,11 +19441,19 @@ function renderSubagentResult(result, options, theme) {
 // dist/builtin/subagents/src/extension/config.ts
 import * as fs19 from "node:fs";
 import { getAgentConfigPaths as getAgentConfigPaths5 } from "@bastani/atomic";
+function withoutInvalidResumeInFlight(config, configPath) {
+  const value = config.resumeInFlight;
+  if (value === undefined || RESUME_IN_FLIGHT_MODES.some((mode) => mode === value))
+    return config;
+  console.error(`Invalid subagent config '${configPath}': "resumeInFlight" must be "ask", "auto", or "never", got ${JSON.stringify(value)}`);
+  const { resumeInFlight: _ignored, ...rest } = config;
+  return rest;
+}
 function loadConfig() {
   for (const configPath of getAgentConfigPaths5("extensions", "subagent", "config.json")) {
     try {
       if (fs19.existsSync(configPath)) {
-        return JSON.parse(fs19.readFileSync(configPath, "utf-8"));
+        return withoutInvalidResumeInFlight(JSON.parse(fs19.readFileSync(configPath, "utf-8")), configPath);
       }
     } catch (error) {
       console.error(`Failed to load subagent config from '${configPath}':`, error);
@@ -19664,9 +19742,9 @@ MANAGEMENT (use action field, omit agent/task/tasks):
 • { action: "update", agent: "code-analysis.custom-agent", config: { package: "analysis", ... } } - merge
 • { action: "delete", agent: "code-analysis.custom-agent" }
 CONTROL:
-• { action: "status", id: "..." } - inspect an in-process run by id or prefix
+• { action: "status", id: "..." } - inspect an in-process run by id or prefix; a paused or quit child shows as paused · awaiting resume with its resume call, and { action: "status" } lists every such child
 • { action: "pause", id: "..." } / { action: "pause", all: true } - stop a running child and hold its queued messages until resume; it stays resumable
-• { action: "quit", id: "..." } / { action: "quit", all: true } - stop a child gracefully (including a paused one); it stays resumable
+• { action: "quit", id: "..." } / { action: "quit", all: true } - stop a child gracefully (including a paused one), as a workflow quit does: it is paused · awaiting resume, not ended, and stays resumable
 • { action: "resume", id: "...", message?: "..." } - continue a paused, quit, interrupted, completed or failed child from its own session under the same id and Intercom name; message is delivered once as its next prompt, otherwise it continues where it left off. Children cancelled for good (owner or batch cancellation, the removed kill action), ended with their workflow stage (quit ones included), or reported gone cannot be resumed
 • id accepts the child id (<runId>:<index>), its task id, its Intercom name, or the run id of a single-child run. kill and interrupt were removed: use quit`;
 
@@ -19686,12 +19764,12 @@ function effectiveParallelTaskCount(tasks) {
 var SETTLED_VIEWS = {
   ok: { icon: "✓", label: "Completed", color: "success" },
   error: { icon: "✗", label: "Failed", color: "error" },
-  paused: { icon: "‖", label: "Paused (resumable)", color: "warning" },
-  quit: { icon: "■", label: "Quit (resumable)", color: "warning" },
+  paused: { icon: "‖", label: "Paused · awaiting resume", color: "warning" },
+  quit: { icon: "‖", label: "Quit · paused · awaiting resume", color: "warning" },
   interrupted: { icon: "○", label: "Interrupted (resumable)", color: "warning" },
   [SUBAGENT_CHILD_STAGE_PAUSED_STATUS]: {
     icon: "‖",
-    label: "Paused with its workflow stage (resumable)",
+    label: "Paused with its workflow stage · awaiting resume",
     color: "warning"
   },
   killed: { icon: "✗", label: "Terminal · killed", color: "error" },
@@ -19797,7 +19875,7 @@ function renderSubagentToolResult(result, options, theme, context) {
    ${theme.fg("muted", `│ ${displayText2(line)}`)}`).join("") : ""
         ].join("");
       }
-      const state = observation.kind === "yielded" ? request?.action === "wait" ? "Still running in background" : "Launched in background" : observation.result.kind === "completed" ? "Completed" : observation.result.kind === "failed" ? "Failed" : subagentTaskResultLabel(observation.result) === "killed (non-resumable)" ? "Killed (non-resumable)" : "Stopped";
+      const state = observation.kind === "yielded" ? request?.action === "wait" ? "Still running in background" : "Launched in background" : observation.result.kind === "completed" ? "Completed" : observation.result.kind === "failed" ? "Failed" : subagentTaskResultLabel(observation.result) === "killed (non-resumable)" ? "Killed (non-resumable)" : subagentTaskResultLabel(observation.result) === "paused · awaiting resume" ? "Paused · awaiting resume" : "Stopped";
       const icon = observation.kind === "yielded" ? "∀" : observation.result.kind === "completed" ? "✓" : observation.result.kind === "failed" ? "✗" : "○";
       const color = observation.kind === "yielded" ? "accent" : observation.result.kind === "failed" ? "error" : observation.result.kind === "completed" ? "success" : "warning";
       const identity = labels[index];
@@ -20326,6 +20404,8 @@ function registerSubagentExtension(pi) {
           holdRunningSubagentChildren(pi.events, ctx).catch(() => {
             return;
           });
+        if (opened)
+          resumeAwaitingSubagentChildren(executorDeps, ctx, config.resumeInFlight ?? "never", lifecycle.isCurrent);
       }
     });
     pi.on("session_recovery_restore", async (_event, ctx) => {

package/dist/builtin/web-access/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bastani/web-access",
-  "version": "0.9.40",
+  "version": "0.9.41-alpha.1",
   "private": true,
   "description": "Atomic extension for web search, URL fetching, GitHub repo cloning, PDF/video extraction. Fork of: https://github.com/nicobailon/pi-web-access",
   "contributors": [

package/dist/builtin/workflows/CHANGELOG.md

@@ -6,6 +6,31 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 
 ## [Unreleased]
 
+## [0.9.41-alpha.1] - 2026-10-21
+
+### Added
+
+- Added `schemaTimeoutMs` to workflow stage, task, chain, and parallel options: the wall-clock limit in milliseconds for each `structured_output` decision of a schema-backed item, covering its repair attempts, retries, and model fallbacks together. It defaults to the `httpIdleTimeoutMs` setting ([#3806](https://github.com/bastani-inc/atomic/issues/3806))
+
+### Changed
+
+- Reopening `/workflow resume` is faster: the run list is kept between opens and rereads only the runs whose journal changed since the last open, including changes made by other Atomic processes. Whether another session still owns a run is checked when you select it.
+- `/workflow connect` and `/workflow status` now list runs the way `/tasks` does. Active runs come before ended ones, with runs waiting for your input or blocked first, then running, then paused; ended runs follow with failed, cancelled, then completed. Within each group the newest run comes first, where before the `/workflow connect` list showed the oldest running run first ([#3824](https://github.com/bastani-inc/atomic/issues/3824)).
+
+### Fixed
+
+- A workflow stage no longer stays stuck selecting its model when many workflows run at once. A stage with `model: "auto"` now waits at most five minutes for model selection, counting any wait for one of eight routing slots shared by every stage, so a burst of stages queues instead of overloading the router provider. When the wait ends, the stage runs on the current chat model if that model satisfies every routing constraint; otherwise it fails with an error that names the stage and the `model-resolution` startup phase, and its startup status reads `failed` instead of staying active. A failed selection is no longer remembered, so the next prompt on the same stage selects a model again, without launching a replacement workflow.
+- After a blocked workflow run is resumed, Intercom sends to `workflow:<rootRunId>/**`, to stage patterns, and to stages that have not started yet are accepted and delivered again instead of failing with `Workflow execution for <runId> is retired`.
+- In a long-running session, starting a workflow from a turn that an Intercom message started no longer fails with `Workflow execution for <runId> is retired; startup cleanup failed: …` after an earlier workflow run in the session has ended or been quit. The session's Intercom connection is now opened outside the workflow run that first needed it. The `is retired` error now names the run whose execution actually ended, not the run being started.
+- A workflow stage whose fallback session fails to start because an extension's `session_start` failed under load, for example Intercom's `Broker failed to start within timeout` or `connect ECONNREFUSED`, now retries that session with the same-model retry budget and then moves on to its next fallback model, instead of failing the stage and letting fail-fast skip its sibling stages. Any other extension startup error still fails the stage at once. The stage error, model attempts, and fallback warnings now name each failing extension and its error rather than only `Extension startup failed`.
+- When a workflow stage falls back to another model and that fallback session cannot start, the stage now closes the session it was replacing. Before, that session kept its session database open after the stage failed, and on Windows the file could not be deleted until the process exited.
+- Workflow stage sessions now provide `ctx.ui.theme` and the other default UI members, so extensions that read `ctx.ui.theme.fg(...)` in `session_start`, such as `examples/extensions/status-line.ts`, no longer fail stage startup with `Extension startup failed` ([#3801](https://github.com/bastani-inc/atomic/issues/3801))
+- Workflow inputs now reject integer and number values outside the `minimum`/`maximum` declared in the input schema, such as `count: 0` for `Type.Integer({ minimum: 1, maximum: 8 })`, when the run is started, instead of passing them to the workflow body. The error names the input and the violated bound ([#3812](https://github.com/bastani-inc/atomic/issues/3812)).
+- A `ctx.parallel(..., { failFast: false })` call that has a failing step no longer loses the results of the steps that succeeded. The `AggregateError` it rejects with now carries `partialResults`, one entry per step in step order, holding each completed step's result and `undefined` for a step that failed. The `WorkflowParallelFailure` type describes it ([#3809](https://github.com/bastani-inc/atomic/issues/3809))
+- A workflow stage's corrective prompt after a rejected `structured_output` result now names the failing paths and expected types, or reports that the tool arguments were not valid JSON, instead of only saying the response does not match the decision schema ([#3802](https://github.com/bastani-inc/atomic/issues/3802))
+- Disposing a session right after a workflow run reports that it ended no longer leaves the run `running` in the workflow journal, with its lease released, for readers to report as crashed. `session.dispose()` now waits up to 10 seconds for runs that have ended but are still recording their ending, before it closes the journal, and it rejects naming the run when that ending still cannot be recorded. A run whose journal rejects the write of its `completed` status now retries it once, and reports it with an error notice and a rejected `waitForSettled` when it still fails, instead of failing in silence ([#3811](https://github.com/bastani-inc/atomic/issues/3811))
+- A schema-backed workflow stage no longer stays `running` for hours inside one `structured_output` call when a slow model keeps generating without calling the tool. The decision now stops after the `httpIdleTimeoutMs` deadline (10 minutes by default) or the stage's `schemaTimeoutMs`, and the error that names the deadline and each attempt's duration reaches the model and the failed stage unchanged instead of being treated as a structured-output contract failure ([#3806](https://github.com/bastani-inc/atomic/issues/3806))
+
 ## [0.9.40] - 2026-10-20
 
 ### Added

package/dist/builtin/workflows/README.md

@@ -449,6 +449,8 @@ const decision = await ctx.stage("review-gate", { schema: Decision }).prompt(
 
 Atomic registers the canonical `structured_output` tool only for schema-enabled items and automatically adds it to explicit `tools` allowlists. The schema is used directly as the tool argument contract. A schema-backed `StageContext` supports one `prompt()` call because the final-answer tool is a single result contract; create another `ctx.stage(..., { schema })` for another structured prompt. If a turn completes without calling `structured_output`, or the tool call fails schema validation, Atomic sends up to three corrective follow-up prompts that include the exact contract/validation error before failing the item. `ctx.task`/`ctx.chain`/`ctx.parallel` results expose the captured value as `result.structured` and keep `result.text` as formatted JSON for handoffs.
 
+Each `structured_output` decision has a wall-clock limit that covers its repair attempts, retries, and model fallbacks together. It defaults to the session's `httpIdleTimeoutMs` setting (10 minutes unless changed); set `schemaTimeoutMs` (a positive integer in milliseconds) beside `schema` to change it for one item. An overrun stops the in-flight generation and fails the call with `Structured output decision exceeded its <n>ms deadline; no decision was accepted.` plus how long each attempt took. That is an execution failure, not a structured-output contract failure, and the error text reaches the model unchanged.
+
 When an item configures both `schema` and `output`, its successful `structured_output` turn has two separate channels: all ordinary assistant text blocks from that exact message, in order, form the human-readable artifact written to `output`, while the successful tool arguments remain the typed machine-readable workflow result. Atomic never serializes those arguments into the artifact. The runner snapshots the result together with the exact successful tool-call id, so corrective attempts, another call with the same tool name, and later admitted turns cannot replace either side of the pairing. When the successful message has no ordinary text — including after a model-fallback session recreation that leaves the live session without that message — Atomic falls back to the most recent earlier assistant text that made no `structured_output` call; only when no such text exists is the artifact written empty, with the standard empty-artifact warning in the receipt. Items with `schema` but no `output` keep their existing result-text behavior.
 
 `subagent` is available as a default workflow-stage tool on the same terms as main chat: a stage is a top-level session, so it can delegate once, and the children it launches cannot delegate further. Delegation is one level deep and nothing configures it. `tools` allowlists apply to bundled extension tools as well as built-ins; if a stage sets `tools`, list every non-mandatory tool it should see. Ordinary `intercom` remains registered and active in every workflow model stage even under `noTools: "all"`, restrictive allowlists, or exclusions. Restrictions on `subagent`, `web_search`, `fetch_content`, and every other tool are unchanged. Bundled `@bastani/subagents` agent definitions are available to the `subagent` tool in workflow stages, including workflows launched from a subagent child process.

package/dist/builtin/workflows/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bastani/workflows",
-  "version": "0.9.40",
+  "version": "0.9.41-alpha.1",
   "private": true,
   "description": "Atomic extension for multi-stage workflow authoring and execution.",
   "contributors": [

package/dist/builtin/workflows/src/authoring.d.ts

@@ -8,7 +8,7 @@ export type { RunJournalOption, RunJournalSettings } from "./durable/journal/res
 export { resolveRunJournal } from "./durable/journal/resolution.js";
 export { openSqlRunJournal, SqlRunJournal } from "./durable/journal/sqlite-run-journal.js";
 export * from "./durable/journal/types.js";
-export type { AgentSessionAdapter, CompleteAdapter, CompleteStageOpts, EffectiveBudget, GitWorktreeSetupOptions, GitWorktreeSetupResult, PromptAdapter, PromptOptions, ResolvedInputs, RunResult, RunStatus, StageAdapters, StageContext, StageExecutionMeta, StageMcpOptions, StageOptions, StageOutputOptions, StagePromptOptions, StageSendUserMessageOptions, StageSessionCreateOptions, StageSessionCreateResult, StageSessionEvent, StageSessionRuntime, StageSnapshot, StageStatus, StageUserMessageContent, StageUserMessageDelivery, ToolNodeSnapshot, WorkflowAction, WorkflowArtifact, WorkflowBudget, WorkflowChainOptions, WorkflowChildResult, WorkflowContextMode, WorkflowControlEvent, WorkflowCustomToolDefinition, WorkflowCustomUiComponent, WorkflowCustomUiFactory, WorkflowCustomUiKeybindings, WorkflowCustomUiOptions, WorkflowCustomUiOverlayHandle, WorkflowCustomUiOverlayOptions, WorkflowCustomUiTheme, WorkflowCustomUiTui, WorkflowDetails, WorkflowDetailsMode, WorkflowDetailsStatus, WorkflowExecutionMode, WorkflowExecutionPolicy, WorkflowExitOptions, WorkflowExitStatus, WorkflowInputBindings, WorkflowInputSchema, WorkflowInputSchemaMap, WorkflowInputValues, WorkflowIntercomSummary, WorkflowMaxOutput, WorkflowMcpPort, WorkflowModelAttempt, WorkflowModelCatalogPort, WorkflowModelFallbackFields, WorkflowModelInfo, WorkflowModelUsage, WorkflowModelValue, WorkflowOutputMode, WorkflowOutputSchema, WorkflowOutputSchemaMap, WorkflowOutputValues, WorkflowParallelOptions, WorkflowPersistencePort, WorkflowProgressSummary, WorkflowRunChildArgs, WorkflowRunChildOptions, WorkflowRunChildOptionsArgument, WorkflowRunOutput, WorkflowRuntimeConfig, WorkflowSerializableObject, WorkflowSerializablePrimitive, WorkflowSerializableValue, WorkflowSharedTaskDefaults, WorkflowTaskContext, WorkflowTaskContextInput, WorkflowTaskOptions, WorkflowTaskResult, WorkflowTaskSessionFields, WorkflowTaskSessionOptions, WorkflowTaskStep, WorkflowThinkingLevel, WorkflowToolContext, WorkflowToolError, WorkflowToolFailure, WorkflowToolOptions, WorkflowToolOutcome, WorkflowToolPrimitive, WorkflowToolReturnOptions, WorkflowToolSuccess, WorkflowToolThrowOptions, WorkflowUIAdapter, WorkflowUIContext, WorkflowWorktreeInputBinding, } from "./shared/authoring-contract.js";
+export type { AgentSessionAdapter, CompleteAdapter, CompleteStageOpts, EffectiveBudget, GitWorktreeSetupOptions, GitWorktreeSetupResult, PromptAdapter, PromptOptions, ResolvedInputs, RunResult, RunStatus, StageAdapters, StageContext, StageExecutionMeta, StageMcpOptions, StageOptions, StageOutputOptions, StagePromptOptions, StageSendUserMessageOptions, StageSessionCreateOptions, StageSessionCreateResult, StageSessionEvent, StageSessionRuntime, StageSnapshot, StageStatus, StageUserMessageContent, StageUserMessageDelivery, ToolNodeSnapshot, WorkflowAction, WorkflowArtifact, WorkflowBudget, WorkflowChainOptions, WorkflowChildResult, WorkflowContextMode, WorkflowControlEvent, WorkflowCustomToolDefinition, WorkflowCustomUiComponent, WorkflowCustomUiFactory, WorkflowCustomUiKeybindings, WorkflowCustomUiOptions, WorkflowCustomUiOverlayHandle, WorkflowCustomUiOverlayOptions, WorkflowCustomUiTheme, WorkflowCustomUiTui, WorkflowDetails, WorkflowDetailsMode, WorkflowDetailsStatus, WorkflowExecutionMode, WorkflowExecutionPolicy, WorkflowExitOptions, WorkflowExitStatus, WorkflowInputBindings, WorkflowInputSchema, WorkflowInputSchemaMap, WorkflowInputValues, WorkflowIntercomSummary, WorkflowMaxOutput, WorkflowMcpPort, WorkflowModelAttempt, WorkflowModelCatalogPort, WorkflowModelFallbackFields, WorkflowModelInfo, WorkflowModelUsage, WorkflowModelValue, WorkflowOutputMode, WorkflowOutputSchema, WorkflowOutputSchemaMap, WorkflowOutputValues, WorkflowParallelFailure, WorkflowParallelOptions, WorkflowPersistencePort, WorkflowProgressSummary, WorkflowRunChildArgs, WorkflowRunChildOptions, WorkflowRunChildOptionsArgument, WorkflowRunOutput, WorkflowRuntimeConfig, WorkflowSerializableObject, WorkflowSerializablePrimitive, WorkflowSerializableValue, WorkflowSharedTaskDefaults, WorkflowTaskContext, WorkflowTaskContextInput, WorkflowTaskOptions, WorkflowTaskResult, WorkflowTaskSessionFields, WorkflowTaskSessionOptions, WorkflowTaskStep, WorkflowThinkingLevel, WorkflowToolContext, WorkflowToolError, WorkflowToolFailure, WorkflowToolOptions, WorkflowToolOutcome, WorkflowToolPrimitive, WorkflowToolReturnOptions, WorkflowToolSuccess, WorkflowToolThrowOptions, WorkflowUIAdapter, WorkflowUIContext, WorkflowWorktreeInputBinding, } from "./shared/authoring-contract.js";
 import type * as AuthoringContract from "./shared/authoring-contract.js";
 import type { AuthoredWorkflowSpec as SharedAuthoredWorkflowSpec, WorkflowInputsFromSchemas, WorkflowOutputsFromSchemas, WorkflowProvidedInputsFromSchemas } from "./shared/workflow-authoring-types.js";
 export type { WorkflowInputsFromSchemas, WorkflowOutputsFromSchemas, WorkflowProvidedInputsFromSchemas, } from "./shared/workflow-authoring-types.js";

package/dist/builtin/workflows/src/durable/journal/internal.d.ts

@@ -1 +1,17 @@
+import type { RunJournal } from "./types.js";
 export declare const JOURNAL_READ_PAGE_SIZE = 256;
+/** A run's latest event. A run whose history was deleted and recorded again ends with a different event. */
+export interface RunVersion {
+    readonly seq: number;
+    readonly at: number;
+}
+/** Lets a durable backend re-read only the runs that changed; kept off the public journal shape. */
+export interface RunJournalVersions {
+    /** Moves whenever any connection, in this process or another, commits a change to the journal's store. */
+    changeToken(): Promise<string>;
+    /** Every listed run with its latest event; a run with no events has version `{ seq: 0, at: 0 }`. */
+    runVersions(): Promise<ReadonlyMap<string, RunVersion>>;
+}
+export declare function registerRunJournalVersions(journal: RunJournal, versions: RunJournalVersions): void;
+/** Change tracking for a journal that registered it; other journals are re-read in full. */
+export declare function runJournalVersions(journal: RunJournal): RunJournalVersions | undefined;

package/dist/builtin/workflows/src/durable/journal/legacy-journal-tables.d.ts

@@ -14,6 +14,13 @@ type LegacyEventRow = SqliteRow & {
     [c.payload]: string;
     [c.at]: number;
 };
+export type RunVersionRow = SqliteRow & {
+    [c.runId]: string;
+    [c.seq]: number;
+    [c.at]: number;
+};
+/** `seq` and `at` of the latest event of `${runs}.run_id`, through the `(run_id, seq)` primary key. */
+export declare function latestEventColumns(events: string, runs: string): string;
 /**
  * Runs recorded before #3682, kept in the unprefixed `meta`/`runs`/`events`/`leases` tables.
  *
@@ -32,6 +39,8 @@ export declare class LegacyJournalRuns {
         cwd?: string;
     }): Promise<LegacyRunRow[]>;
     find(executor: SqliteExecutor, runId: string): Promise<LegacyRunRow | undefined>;
+    /** Latest event of each pending legacy run; the legacy tables are never modified. */
+    versions(executor: SqliteExecutor): Promise<RunVersionRow[]>;
     /** Events of an unconverted legacy run, read in place. */
     events(executor: SqliteExecutor, runId: string, fromSeq: number, limit: number): Promise<LegacyEventRow[]>;
     eventByKey(executor: SqliteExecutor, runId: string, key: string): Promise<LegacyEventRow | undefined>;

package/dist/builtin/workflows/src/durable/journal/sql-run-journal.d.ts

@@ -22,6 +22,12 @@ export declare class SqlRunJournal implements RunJournal {
     listRuns(filter?: {
         cwd?: string;
     }): Promise<readonly RunSummary[]>;
+    /**
+     * `data_version` moves when another connection commits and `total_changes()` when this one writes; the
+     * table aggregates also catch run changes if the adapter does not serve every statement from one connection.
+     */
+    private changeToken;
+    private runVersions;
     private requireRun;
     /** Whether this run exists only in the legacy tables, whose events are then read in place. */
     private isUnconvertedLegacyRun;