@bastani/atomic 0.9.41-alpha.3 → 0.9.42-alpha.1

package/dist/builtin/intercom/index.bundle.mjs

@@ -585,6 +585,32 @@ function createMessageReader(onMessage, onError) {
   };
 }
 
+// dist/builtin/intercom/broker/broker-status.ts
+function isObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isOptionalString(value) {
+  return value === undefined || typeof value === "string";
+}
+function isBrokerStatusReport(value) {
+  if (!isObject(value) || typeof value.pid !== "number" || typeof value.sessions !== "number")
+    return false;
+  const { storage, multiNode } = value;
+  if (storage !== undefined && (!isObject(storage) || typeof storage.digest !== "string" || storage.source !== "env" && storage.source !== "settings"))
+    return false;
+  return isObject(multiNode) && (multiNode.status === "off" || multiNode.status === "starting" || multiNode.status === "on" || multiNode.status === "unavailable") && isOptionalString(multiNode.reason) && isOptionalString(multiNode.adapter) && isOptionalString(multiNode.prefix) && (multiNode.peers === undefined || Array.isArray(multiNode.peers) && multiNode.peers.every((peer) => typeof peer === "string"));
+}
+function describeMultiNodeStatus(multiNode) {
+  const storage = multiNode.adapter === undefined ? "" : ` (adapter ${multiNode.adapter}, prefix ${multiNode.prefix ?? "none"})`;
+  if (multiNode.status === "off" || multiNode.status === "unavailable") {
+    return `${multiNode.status}${storage}${multiNode.reason === undefined ? "" : `: ${multiNode.reason}`}`;
+  }
+  if (multiNode.status === "starting" || multiNode.peers === undefined)
+    return `${multiNode.status}${storage}`;
+  const count = `${multiNode.peers.length} peer broker${multiNode.peers.length === 1 ? "" : "s"} live`;
+  return `on${storage}, ${count}${multiNode.peers.length === 0 ? "" : ` (${[...new Set(multiNode.peers)].join(", ")})`}`;
+}
+
 // dist/builtin/intercom/broker/paths.ts
 import { homedir } from "os";
 import { join } from "path";
@@ -730,14 +756,14 @@ class PendingSendRegistry {
       generation
     };
     attempt.timer = setTimeout(() => {
-      this.reject(attempt, new Error("Send timeout"));
+      this.expire(attempt);
     }, timeoutMs);
     this.attempts.set(messageId, attempt);
     return { attempt, owner: true };
   }
   resolve(messageId, attemptId, result) {
     const attempt = this.attempts.get(messageId);
-    if (!attempt || attempt.attemptId !== attemptId)
+    if (!attempt || attempt.timedOut || attempt.attemptId !== attemptId)
       return false;
     this.attempts.delete(messageId);
     if (attempt.timer)
@@ -748,21 +774,36 @@ class PendingSendRegistry {
   }
   extend(messageId, attemptId, timeoutMs) {
     const attempt = this.attempts.get(messageId);
-    if (!attempt || (attemptId === undefined ? !attempt.legacyEligible : attempt.attemptId !== attemptId))
+    if (!attempt || attempt.timedOut || (attemptId === undefined ? !attempt.legacyEligible : attempt.attemptId !== attemptId))
       return false;
     if (attempt.timer)
       clearTimeout(attempt.timer);
     attempt.timer = setTimeout(() => {
-      this.reject(attempt, new Error("Send timeout"));
+      this.expire(attempt);
     }, timeoutMs);
     return true;
   }
   resolveLegacy(messageId, result) {
     const attempt = this.attempts.get(messageId);
-    if (!attempt?.legacyEligible)
+    if (!attempt?.legacyEligible || attempt.timedOut)
       return false;
     return this.resolve(messageId, attempt.attemptId, result);
   }
+  expire(attempt) {
+    if (this.attempts.get(attempt.messageId) !== attempt)
+      return;
+    attempt.timedOut = true;
+    attempt.timer = undefined;
+    attempt.reject(new PendingSendTimeoutError);
+  }
+  release(attempt) {
+    const current = this.attempts.get(attempt.messageId);
+    if (current !== attempt || !current.timedOut)
+      return false;
+    this.attempts.delete(attempt.messageId);
+    this.touchGeneration(current);
+    return true;
+  }
   reject(attempt, error) {
     const current = this.attempts.get(attempt.messageId);
     if (current !== attempt)
@@ -779,9 +820,14 @@ class PendingSendRegistry {
       this.reject(attempt, error);
   }
 }
-var DEFAULT_GENERATION_TTL_MS, DEFAULT_MAX_GENERATIONS = 1e4;
+var DEFAULT_GENERATION_TTL_MS, DEFAULT_MAX_GENERATIONS = 1e4, PendingSendTimeoutError;
 var init_pending_send_registry = __esm(() => {
   DEFAULT_GENERATION_TTL_MS = 10 * 60 * 1000;
+  PendingSendTimeoutError = class PendingSendTimeoutError extends Error {
+    constructor() {
+      super("Send timeout");
+    }
+  };
 });
 
 // dist/builtin/intercom/source-ownership.ts
@@ -878,16 +924,19 @@ var init_client = __esm(() => {
     connectTimeoutMs;
     brokerAcknowledgesReceipt = false;
     brokerAcknowledgesPendingStageRoutes = false;
+    brokerAnswersStatus = false;
     socket = null;
     _sessionId = null;
     _supervisorSessionId = null;
     _messageSource;
     pendingSends = new PendingSendRegistry;
+    sendResults = new WeakMap;
     pendingReplyTargets = new Map;
     pendingGroupLists = new Map;
     pendingLists = new Map;
     pendingPresence = new Map;
     pendingMemberships = new Map;
+    pendingBrokerStatus = new Map;
     _groups = normalizeGroups();
     pendingLiveWorkflowStageRoutes = new Map;
     pendingStageRouteRegistrations = new Map;
@@ -895,6 +944,43 @@ var init_client = __esm(() => {
     pendingRestoringRecipientRequests = new Map;
     disconnecting = false;
     disconnectError = null;
+    healthCheck;
+    async requestTimeout(socket, error) {
+      if (this.socket !== socket || socket.destroyed)
+        return this.disconnectError ?? new IntercomClientDisconnectedError;
+      if (this.healthCheck?.socket !== socket) {
+        const requestId = randomUUID2();
+        const result = new Promise((resolve) => {
+          const finish = (failure) => {
+            clearTimeout(timer);
+            this.pendingGroupLists.delete(requestId);
+            resolve(failure);
+          };
+          const timer = setTimeout(() => finish(new IntercomBrokerTimeoutError("Broker health check timed out")), GROUP_REQUEST_TIMEOUT_MS);
+          this.pendingGroupLists.set(requestId, { resolve: () => finish(), reject: finish });
+          try {
+            writeMessage(socket, { type: "list_groups", requestId });
+          } catch (cause) {
+            finish(new IntercomClientDisconnectedError({ cause }));
+          }
+        });
+        this.healthCheck = { socket, result };
+      }
+      const check = this.healthCheck;
+      const failure = await check.result;
+      if (this.healthCheck === check)
+        this.healthCheck = undefined;
+      if (failure === undefined)
+        return error;
+      const reported = failure instanceof IntercomBrokerTimeoutError ? new IntercomBrokerTimeoutError(error.message, { cause: failure }) : failure;
+      if (this.socket === socket && !this.disconnecting) {
+        this.disconnectError ??= reported;
+        this.failPending(this.disconnectError);
+        socket.destroy();
+        return this.disconnectError;
+      }
+      return reported;
+    }
     constructor(returnAddress = randomUUID2(), options = {}) {
       super();
       if (returnAddress.length === 0)
@@ -922,6 +1008,8 @@ var init_client = __esm(() => {
         pending.reject(error);
       for (const pending of this.pendingStageRouteRegistrations.values())
         pending.reject(error);
+      for (const pending of this.pendingBrokerStatus.values())
+        pending.reject(error);
       this.pendingLists.clear();
       this.pendingGroupLists.clear();
       this.pendingSupervisorAuthorizations.clear();
@@ -930,6 +1018,7 @@ var init_client = __esm(() => {
       this.pendingMemberships.clear();
       this.pendingLiveWorkflowStageRoutes.clear();
       this.pendingStageRouteRegistrations.clear();
+      this.pendingBrokerStatus.clear();
     }
     get sessionId() {
       return this._sessionId;
@@ -1012,6 +1101,7 @@ var init_client = __esm(() => {
           this._supervisorSessionId = null;
           this.brokerAcknowledgesReceipt = false;
           this.brokerAcknowledgesPendingStageRoutes = false;
+          this.brokerAnswersStatus = false;
           this._messageSource = undefined;
           this.disconnectError = null;
           if (connectionEstablished && !wasDisconnecting) {
@@ -1089,7 +1179,7 @@ var init_client = __esm(() => {
       }
       switch (brokerMessage.type) {
         case "registered": {
-          if (typeof brokerMessage.sessionId !== "string" || brokerMessage.supervisorSessionId !== undefined && typeof brokerMessage.supervisorSessionId !== "string" || brokerMessage.acknowledgesReceipt !== undefined && brokerMessage.acknowledgesReceipt !== true || brokerMessage.acknowledgesPendingStageRoutes !== undefined && brokerMessage.acknowledgesPendingStageRoutes !== true) {
+          if (typeof brokerMessage.sessionId !== "string" || brokerMessage.supervisorSessionId !== undefined && typeof brokerMessage.supervisorSessionId !== "string" || brokerMessage.acknowledgesReceipt !== undefined && brokerMessage.acknowledgesReceipt !== true || brokerMessage.acknowledgesPendingStageRoutes !== undefined && brokerMessage.acknowledgesPendingStageRoutes !== true || brokerMessage.brokerStatus !== undefined && brokerMessage.brokerStatus !== true) {
             throw new Error("Invalid registered message");
           }
           if (this._sessionId !== null) {
@@ -1099,6 +1189,7 @@ var init_client = __esm(() => {
           this._supervisorSessionId = typeof brokerMessage.supervisorSessionId === "string" ? brokerMessage.supervisorSessionId : null;
           this.brokerAcknowledgesReceipt = this.acknowledgesReceipt && brokerMessage.acknowledgesReceipt === true;
           this.brokerAcknowledgesPendingStageRoutes = brokerMessage.acknowledgesPendingStageRoutes === true;
+          this.brokerAnswersStatus = brokerMessage.brokerStatus === true;
           this.emit("_registered", { type: "registered", sessionId: brokerMessage.sessionId });
           break;
         }
@@ -1154,6 +1245,18 @@ var init_client = __esm(() => {
           pending.resolve(groups);
           break;
         }
+        case "broker_status": {
+          const { requestId } = brokerMessage;
+          const report = brokerMessage.report;
+          if (typeof requestId !== "string" || !isBrokerStatusReport(report))
+            throw new Error("Invalid broker_status message");
+          const pending = this.pendingBrokerStatus.get(requestId);
+          if (!pending)
+            return;
+          this.pendingBrokerStatus.delete(requestId);
+          pending.resolve(report);
+          break;
+        }
         case "supervisor_authorized": {
           const { requestId, capability, supervisorSessionId, childName } = brokerMessage;
           if (typeof requestId !== "string" || typeof capability !== "string" || typeof supervisorSessionId !== "string" || typeof childName !== "string") {
@@ -1455,7 +1558,7 @@ var init_client = __esm(() => {
         const timeout = setTimeout(() => {
           if (!this.pendingLists.delete(requestId))
             return;
-          reject(new Error("List sessions timeout"));
+          this.requestTimeout(socket, new Error("List sessions timeout")).then(reject);
         }, 5000);
         this.pendingLists.set(requestId, {
           resolve: (directory) => {
@@ -1488,7 +1591,7 @@ var init_client = __esm(() => {
         const timeout = setTimeout(() => {
           if (!this.pendingGroupLists.delete(requestId))
             return;
-          reject(new Error("List groups timeout"));
+          this.requestTimeout(socket, new Error("List groups timeout")).then(reject);
         }, GROUP_REQUEST_TIMEOUT_MS);
         this.pendingGroupLists.set(requestId, {
           resolve: (groups) => {
@@ -1509,6 +1612,41 @@ var init_client = __esm(() => {
         }
       });
     }
+    brokerStatus() {
+      let socket;
+      try {
+        socket = this.requireActiveSocket();
+      } catch (error) {
+        return Promise.reject(toError(error));
+      }
+      if (!this.brokerAnswersStatus)
+        return Promise.resolve(undefined);
+      const requestId = randomUUID2();
+      return new Promise((resolve, reject) => {
+        const timeout = setTimeout(() => {
+          if (!this.pendingBrokerStatus.delete(requestId))
+            return;
+          reject(new Error("Broker status timeout"));
+        }, GROUP_REQUEST_TIMEOUT_MS);
+        this.pendingBrokerStatus.set(requestId, {
+          resolve: (report) => {
+            clearTimeout(timeout);
+            resolve(report);
+          },
+          reject: (error) => {
+            clearTimeout(timeout);
+            reject(error);
+          }
+        });
+        try {
+          writeMessage(socket, { type: "broker_status", requestId });
+        } catch (error) {
+          clearTimeout(timeout);
+          this.pendingBrokerStatus.delete(requestId);
+          reject(toError(error));
+        }
+      });
+    }
     joinGroup(group) {
       return this.updateMembership("join_group", group);
     }
@@ -1527,7 +1665,7 @@ var init_client = __esm(() => {
         const timeout = setTimeout(() => {
           if (!this.pendingMemberships.delete(requestId))
             return;
-          reject(new Error("Membership update timeout"));
+          this.requestTimeout(socket, new Error("Membership update timeout")).then(reject);
         }, GROUP_REQUEST_TIMEOUT_MS);
         this.pendingMemberships.set(requestId, {
           resolve: (groups) => {
@@ -1563,7 +1701,7 @@ var init_client = __esm(() => {
         const timeout = setTimeout(() => {
           if (!this.pendingSupervisorAuthorizations.delete(requestId))
             return;
-          reject(new Error("Supervisor authorization timeout"));
+          this.requestTimeout(socket, new Error("Supervisor authorization timeout")).then(reject);
         }, 5000);
         this.pendingSupervisorAuthorizations.set(requestId, {
           resolve: (authorization) => {
@@ -1614,7 +1752,7 @@ var init_client = __esm(() => {
         const timeout = setTimeout(() => {
           if (!this.pendingRestoringRecipientRequests.delete(requestId))
             return;
-          reject(new Error("Restoring-recipient request timeout"));
+          this.requestTimeout(socket, new Error("Restoring-recipient request timeout")).then(reject);
         }, RESTORING_RECIPIENT_REQUEST_TIMEOUT_MS);
         this.pendingRestoringRecipientRequests.set(requestId, {
           resolve: () => {
@@ -1669,7 +1807,7 @@ var init_client = __esm(() => {
         const timeout = setTimeout(() => {
           if (!this.pendingStageRouteRegistrations.delete(requestId))
             return;
-          reject(new IntercomBrokerTimeoutError("Pending-stage route registration timeout"));
+          this.requestTimeout(socket, new IntercomBrokerTimeoutError("Pending-stage route registration timeout")).then(reject);
         }, PENDING_STAGE_ROUTE_ACK_TIMEOUT_MS);
         this.pendingStageRouteRegistrations.set(requestId, {
           resolve: () => {
@@ -1783,8 +1921,22 @@ var init_client = __esm(() => {
       } catch (error) {
         return Promise.reject(toError(error));
       }
+      let result = this.sendResults.get(acquired.attempt.promise);
+      if (result === undefined) {
+        result = acquired.attempt.promise.catch(async (error) => {
+          if (error instanceof PendingSendTimeoutError) {
+            try {
+              throw await this.requestTimeout(socket, error);
+            } finally {
+              this.pendingSends.release(acquired.attempt);
+            }
+          }
+          throw error;
+        });
+        this.sendResults.set(acquired.attempt.promise, result);
+      }
       if (!acquired.owner)
-        return acquired.attempt.promise;
+        return result;
       const message = {
         id: messageId,
         timestamp: Date.now(),
@@ -1817,7 +1969,7 @@ var init_client = __esm(() => {
         this.pendingReplyTargets.delete(acquired.attempt.attemptId);
       };
       acquired.attempt.promise.then(clearReplyTarget, clearReplyTarget);
-      return acquired.attempt.promise;
+      return result;
     }
     updatePresence(updates) {
       if (this.disconnecting) {
@@ -1854,7 +2006,7 @@ var init_client = __esm(() => {
         const timeout = setTimeout(() => {
           if (!this.pendingPresence.delete(requestId))
             return;
-          reject(new Error("Presence update timeout"));
+          this.requestTimeout(socket, new Error("Presence update timeout")).then(reject);
         }, PRESENCE_ACK_TIMEOUT_MS);
         this.pendingPresence.set(requestId, {
           resolve: wrappedResolve,
@@ -2039,7 +2191,16 @@ function getBrokerSpawnOptions(extensionDir = EXTENSION_DIR, stderr = "ignore")
 function resetBrokerLog(logPath = BROKER_LOG) {
   ensurePrivateDirectory(dirname(logPath));
   try {
+    const previous = readBrokerLogTail(logPath);
     closeSync(openSync(logPath, "w"));
+    if (previous.length > 0) {
+      try {
+        const previousPath = `${logPath}.previous`;
+        writeFileSync(previousPath, Buffer.from(previous).subarray(-BROKER_LOG_TAIL_BYTES), { mode: 384 });
+        if (process.platform !== "win32")
+          chmodSync(previousPath, 384);
+      } catch {}
+    }
     return true;
   } catch (error) {
     const code = error.code;
@@ -2080,7 +2241,7 @@ ${tail}`;
 function toError2(error) {
   return error instanceof Error ? error : new Error(String(error));
 }
-async function spawnBrokerIfNeeded(brokerCommand, brokerArgs, readyTimeoutMs = BROKER_READY_TIMEOUT_MS) {
+async function spawnBrokerIfNeeded(brokerCommand, brokerArgs, readyTimeoutMs = BROKER_READY_TIMEOUT_MS, extensionDir = EXTENSION_DIR) {
   ensurePrivateDirectory(INTERCOM_DIR);
   if (await isBrokerRunning()) {
     return;
@@ -2095,8 +2256,8 @@ async function spawnBrokerIfNeeded(brokerCommand, brokerArgs, readyTimeoutMs = B
     if (await isBrokerRunning()) {
       return;
     }
-    const brokerPath = resolveBrokerEntrypoint(EXTENSION_DIR);
-    const launch = getBrokerLaunchSpec(brokerPath, brokerCommand, brokerArgs);
+    const brokerPath = resolveBrokerEntrypoint(extensionDir);
+    const launch = getBrokerLaunchSpec(brokerPath, brokerCommand, brokerArgs, extensionDir);
     if (launch.kind === "windows-launcher") {
       writeWindowsHiddenLauncher(launch.launcherCommandLine, launch.launcherPath);
     }
@@ -2107,7 +2268,7 @@ async function spawnBrokerIfNeeded(brokerCommand, brokerArgs, readyTimeoutMs = B
     const logFd = launch.kind === "direct" ? openSync(BROKER_LOG, "a") : undefined;
     let child;
     try {
-      child = spawn(launch.command, launch.args, getBrokerSpawnOptions(EXTENSION_DIR, logFd ?? "ignore"));
+      child = spawn(launch.command, launch.args, getBrokerSpawnOptions(extensionDir, logFd ?? "ignore"));
     } finally {
       if (logFd !== undefined)
         closeSync(logFd);
@@ -3753,6 +3914,19 @@ function retainInconclusiveRetry(reservations, attempt) {
     remainingRetries: reservations.remainingRetries(attempt)
   };
 }
+async function multiNodeStatus(client) {
+  if (typeof client.brokerStatus !== "function")
+    return;
+  try {
+    const report = await client.brokerStatus();
+    if (report === undefined) {
+      return { line: "unknown (the running broker predates status reporting; `atomic intercom restart` replaces it)" };
+    }
+    return { line: describeMultiNodeStatus(report.multiNode), multiNode: report.multiNode };
+  } catch (error) {
+    return { line: `unknown (${getErrorMessage(error)})` };
+  }
+}
 async function listDirectory(client, group) {
   if (typeof client.listDirectory === "function")
     return client.listDirectory(group);
@@ -4750,6 +4924,9 @@ ${lines.join(`
               const selectedGroupSessions = selectedGroup === undefined ? undefined : await connectedClient.listSessions(selectedGroup);
               const selectedSection = selectedGroupSessions === undefined ? "" : `
 Selected group [${selectedGroup}]: ${selectedGroupSessions.length} session(s)`;
+              const multiNode = await multiNodeStatus(connectedClient);
+              const multiNodeSection = multiNode === undefined ? "" : `
+Multi-node routing: ${multiNode.line}`;
               return {
                 content: [{
                   type: "text",
@@ -4757,13 +4934,14 @@ Selected group [${selectedGroup}]: ${selectedGroupSessions.length} session(s)`;
 Connected: Yes
 Session ID: ${mySessionId}
 Groups: ${ownGroups.join(", ")}
-Active visible sessions: ${sessions.length}${selectedSection}`
+Active visible sessions: ${sessions.length}${selectedSection}${multiNodeSection}`
                 }],
                 isError: false,
                 details: {
                   group: ownGroups.at(-1),
                   groups: ownGroups,
-                  ...selectedGroup === undefined ? {} : { selectedGroup, selectedGroupSessionCount: selectedGroupSessions?.length ?? 0 }
+                  ...selectedGroup === undefined ? {} : { selectedGroup, selectedGroupSessionCount: selectedGroupSessions?.length ?? 0 },
+                  ...multiNode?.multiNode === undefined ? {} : { multiNode: multiNode.multiNode }
                 }
               };
             } catch (error) {

package/dist/builtin/intercom/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bastani/intercom",
-  "version": "0.9.41-alpha.3",
+  "version": "0.9.42-alpha.1",
   "private": true,
   "description": "Atomic extension providing a private coordination channel between parent and child agent sessions. Fork of: https://github.com/nicobailon/pi-intercom",
   "contributors": [

package/dist/builtin/intercom/types.ts

@@ -93,6 +93,28 @@ export interface GroupSummary {
 	member: boolean;
 }
 
+/** A broker's multi-node routing state, as `broker_status` reports it. */
+export interface BrokerMultiNodeStatus {
+	status: "off" | "starting" | "on" | "unavailable";
+	/** Why routing is off or unavailable. */
+	reason?: string;
+	/** The shared selection's adapter module, or `sqlite` for a `path` selection. */
+	adapter?: string;
+	prefix?: string;
+	/** Host names of the other brokers whose membership lease is live, while routing is on. */
+	peers?: string[];
+}
+
+/** What a broker reports about itself; read before registering by `atomic intercom restart` and `atomic storage status`. */
+export interface BrokerStatusReport {
+	pid: number;
+	/** Sessions connected to this broker. */
+	sessions: number;
+	/** The shared storage selection the broker read, as a digest of its JSON, and where it read it; absent without one. */
+	storage?: { digest: string; source: "env" | "settings" };
+	multiNode: BrokerMultiNodeStatus;
+}
+
 export interface Message {
   id: string;
   timestamp: number;
@@ -125,6 +147,7 @@ export interface SupervisorRegistration {
 
 
 export type ClientMessage =
+	| { type: "health"; requestId: string }
 	| {
 			type: "register";
 			session: Omit<SessionInfo, "id">;
@@ -225,9 +248,14 @@ export type ClientMessage =
       /** Legacy single-group membership; accepted alongside `groups` for compatibility. */
       group?: string;
       requestId?: string;
-    };
+    }
+	/** Allowed before `register`: the broker's own status. */
+	| { type: "broker_status"; requestId: string }
+	/** Allowed before `register`: shut the broker down; its sessions reconnect to a new broker. */
+	| { type: "shutdown"; requestId: string };
 
 export type BrokerMessage =
+	| { type: "health"; requestId: string; instanceId: string }
 	| {
 			type: "registered";
 			sessionId: string;
@@ -236,6 +264,8 @@ export type BrokerMessage =
 			acknowledgesReceipt?: true;
 			/** This broker acknowledges a `register_pending_stage_route` that carries a `requestId`; absent on older brokers. */
 			acknowledgesPendingStageRoutes?: true;
+			/** This broker answers `broker_status`; absent on older brokers, which drop a client that sends it. */
+			brokerStatus?: true;
 	  }
   | { type: "registration_failed"; reason: string; code?: LiveWorkflowStageRouteRefusalCode }
   | { type: "question_target"; messageId: string; attemptId: string; sessionId: string }
@@ -272,4 +302,6 @@ export type BrokerMessage =
 	/** #3760: the send is held for a subagent that is being restored; wait up to `timeoutMs` for its outcome. */
 	| { type: "send_held"; messageId: string; attemptId?: string; timeoutMs: number }
 	| { type: "restoring_recipient_ack"; requestId: string; error?: string }
-	| { type: "delivery_failed"; messageId: string; reason: string; reasonCode?: "message_id_conflict" | "session_not_found"; attemptId?: string };
+	| { type: "delivery_failed"; messageId: string; reason: string; reasonCode?: "message_id_conflict" | "session_not_found"; attemptId?: string }
+	| { type: "broker_status"; requestId: string; report: BrokerStatusReport }
+	| { type: "shutdown_ack"; requestId: string };

package/dist/builtin/mcp/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bastani/mcp",
-  "version": "0.9.41-alpha.3",
+  "version": "0.9.42-alpha.1",
   "private": true,
   "description": "Atomic's pi-compatible MCP integration for server connections, OAuth, tools, resources, and terminal management.",
   "contributors": [

package/dist/builtin/subagents/CHANGELOG.md

@@ -2,6 +2,20 @@
 
 ## [Unreleased]
 
+## [0.9.41] - 2026-10-22
+
+### Added
+
+- Added a `resumeInFlight` subagent setting (`"never"`, `"ask"`, or `"auto"`, default `"never"`) for recovery of paused and quit subagents that are awaiting resume. `ask` confirms once, listing each subagent, and `auto` resumes each from its own session, with its completion reaching the session that launched it; `never` leaves them for a manual `resume`. It applies when Atomic starts or a session is resumed, to that session's own subagents, never to workflow-stage children, and an invalid value is reported and treated as `never` ([#3827](https://github.com/bastani-inc/atomic/issues/3827)).
+
+### Changed
+
+- Quitting a subagent now behaves like quitting a workflow. The `quit` and `pause` results say the child is paused · awaiting resume and name `{ action: "resume", id: "<child-id>" }`; the parent's completion notice says the same, with the typed `quit` or `pause` stop reason instead of `parent-handoff` and without "This execution has ended". `{ action: "status", id }` reports a paused or quit child as paused · awaiting resume with its resume call, and `{ action: "status" }` lists every such child, including after Atomic restarts. Launch cards of such children show `‖ Paused · awaiting resume` (or `‖ Quit · paused · awaiting resume`) instead of `(resumable)`.
+
+### Fixed
+
+- A subagent with `model: "auto"` no longer waits indefinitely on a slow routing model. Each routing inference now stops after the `httpIdleTimeoutMs` deadline (10 minutes by default), and the subagent runs on the current chat model when it satisfies the routing constraints ([#3806](https://github.com/bastani-inc/atomic/issues/3806))
+
 ## [0.9.41-alpha.1] - 2026-10-21
 
 ### Added

package/dist/builtin/subagents/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bastani/subagents",
-  "version": "0.9.41-alpha.3",
+  "version": "0.9.42-alpha.1",
   "private": true,
   "description": "Atomic extension for delegating tasks to subagents with parallel execution. Fork of: https://github.com/nicobailon/pi-subagents",
   "contributors": [

package/dist/builtin/subagents/src/extension/index.bundle.mjs

@@ -13205,6 +13205,7 @@ class SubagentControlRuntime {
             ...inherited,
             customTools: admitted.policy.customTools ?? inherited.customTools,
             resourceLoader,
+            resourceAdmissionSignal: AbortSignal.any([signals.abort, signals.interrupt]),
             subagentPolicy: {
               ...admitted.policy,
               executionEnded: executionEnded.signal,

package/dist/builtin/web-access/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bastani/web-access",
-  "version": "0.9.41-alpha.3",
+  "version": "0.9.42-alpha.1",
   "private": true,
   "description": "Atomic extension for web search, URL fetching, GitHub repo cloning, PDF/video extraction. Fork of: https://github.com/nicobailon/pi-web-access",
   "contributors": [

package/dist/builtin/workflows/CHANGELOG.md

@@ -6,6 +6,46 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 
 ## [Unreleased]
 
+## [0.9.42-alpha.1] - 2026-10-23
+
+### Added
+
+- Local workflow pools can be enabled per run through SDK options or workflow settings, with root and optional user-wide admission limits. A root stays local while registered child workflow subtrees run in local worker processes; unsupported process containment and incompatible worker definitions fail closed ([#3869](https://github.com/bastani-inc/atomic/issues/3869)).
+
+### Fixed
+
+- Workflow model chains now share provider-account cooldowns after rate limits, honor `Retry-After`, and wait for the earliest eligible account instead of exhausting a cooling chain. Retries remain bounded, including retries within each session; waits can be paused or cancelled, and workflow status and task results report provider counts and cooldown deadlines. Retrying a follow-up on the same model preserves its conversation history. Follow-ups keep each model's retry allowance across account switches and can return to an earlier account when its cooldown expires ([#3864](https://github.com/bastani-inc/atomic/issues/3864)).
+- Workflow stages now reload resources up to four at a time per Atomic process instead of one at a time, so a slow reload no longer blocks every other stage at startup. Cancelling a stage waiting for a reload slot removes it from the queue immediately; an active reload retains its slot until it finishes ([#3861](https://github.com/bastani-inc/atomic/issues/3861)).
+- Standalone `run()` now owns Intercom routes for eligible workflow stages until the run settles, so stages can use Intercom without an interactive workflow host. An installed SDK reuses an Intercom owner the extension bundle already registered for the store instead of starting a second one. When a route-update acknowledgement times out, the update retries without disconnecting a healthy owner ([#3863](https://github.com/bastani-inc/atomic/issues/3863))
+
+## [0.9.41] - 2026-10-22
+
+### Added
+
+- Added `schemaTimeoutMs` to workflow stage, task, chain, and parallel options: the wall-clock limit in milliseconds for each `structured_output` decision of a schema-backed item, covering its repair attempts, retries, and model fallbacks together. It defaults to the `httpIdleTimeoutMs` setting ([#3806](https://github.com/bastani-inc/atomic/issues/3806))
+
+### Changed
+
+- Reopening `/workflow resume` is faster: the run list is kept between opens and rereads only the runs whose journal changed since the last open, including changes made by other Atomic processes. Whether another session still owns a run is checked when you select it.
+- `/workflow connect` and `/workflow status` now list runs the way `/tasks` does. Active runs come before ended ones, with runs waiting for your input or blocked first, then running, then paused; ended runs follow with failed, cancelled, then completed. Within each group the newest run comes first, where before the `/workflow connect` list showed the oldest running run first ([#3824](https://github.com/bastani-inc/atomic/issues/3824)).
+
+### Fixed
+
+- A rejection that workflow code leaves unhandled no longer ends the whole Atomic process. This covers a rejected `ctx.tool`, `ctx.task`, `ctx.chain`, `ctx.parallel`, `ctx.workflow`, `ctx.ui` prompt (`input`, `confirm`, `select`, `editor` or `custom`) or stage method call (`prompt`, `complete`, `steer`, `sendUserMessage`, `setModel`, `compact` and the other promise-returning stage methods), including one that is started and never awaited (`void ctx.task(...)` used to leave the run `completed` with no sign of the failure), a `ctx.tool` call made after its run has stopped (`ctx.tool admission is closed for this run`), a string, number or `undefined` thrown from a `ctx.tool` callback, and an error the workflow file throws or receives from `fs` itself, for example in a rolling pool that keeps `branch.finally(...)` as a separate promise. It also covers `ctx.exit()` called inside such a branch, which ends the run as exited with the status and outputs it asked for (on Bun the process used to end right after the run reported `completed`), and a child workflow's own branch that uses `ctx` after its parent exited. Stopping a run no longer ends the process either: a branch that keeps running after `/workflow quit`, a kill, or an abort signal from the code that started the run, and then calls `ctx.stage`, `ctx.task`, `ctx.workflow` or `ctx.exit()`, or that was waiting on a `ctx.ui` prompt when the run was killed, could end it with `workflow killed` (a kill), the quit error (`/workflow quit`), an `AbortError` or `atomic-workflows: HIL aborted` right after the run reported `killed` or `paused`, and the run keeps that status. `ctx.exit()` called in such a branch while the run is paused ends the run as exited once the run resumes, and a kill of the paused run still ends it as `killed` (on Node it used to end as `failed` with `Workflow exit is waiting for explicit resume`, and on Bun the process ended). The rejection fails its own run when it surfaces before that run decides its final status, so other runs, stages, and the interactive engine keep going; a `ctx.task`, `ctx.chain`, `ctx.parallel`, `ctx.workflow`, `ctx.ui` or stage method rejection that the workflow awaits or catches reaches that code unchanged and does not fail the run. Once the run has ended, an error that a `ctx` call rejected with, what `ctx.exit()` threw and the reason the run was stopped with are ignored (the reason of a kill is the string `workflow killed`, which is ignored by value for the rest of the process, so a branch that wakes up long after the run ended is covered too), and so is an error thrown by the workflow file for the next 30 seconds, so the remaining branches of a failing pool cannot end the process; a later one ends it as before. On Node the owning run is identified exactly; on Bun a `ctx` call's rejection, what `ctx.exit()` threw and the reason the run was stopped with are matched by identity (a `ctx` call's string, number or `undefined` only within the event-loop turn in which the call rejected, and the string a kill uses by value), and an error thrown by the workflow file itself is matched through its stack to the run of the file that calls `workflow()`, but only when no other run of that file is running or has run at the same time (a child workflow defined in the same file does not count), so a primitive thrown outside a `ctx` call on Bun is still fatal, and an error that either of two overlapping runs of one file could have thrown ends the process as before instead of failing a run that may be healthy. This works the same in the bundled install as in a source checkout. A rejection that belongs to no workflow run, including one raised by Atomic's own code, ends the process as before, with its original error and stack, and `--unhandled-rejections=warn|none|warn-with-error-code` are honored ([#3846](https://github.com/bastani-inc/atomic/issues/3846))
+- A workflow that omits `name` is now named after the file that defines it when Atomic runs from the bundled install, as it already was in a source checkout, instead of after the bundled extension file (`index.bundle`) ([#3846](https://github.com/bastani-inc/atomic/issues/3846))
+- `/workflow status <runId>` no longer reports `durable checkpoint topology is malformed or incomplete` for a running or crashed run whose child `ctx.workflow` calls have started but not yet recorded a stage or tool of their own, such as a pool of concurrent children when the process was killed. The children now show as running, and a crashed run can be inspected and resumed. A run that fails while such children are still starting now cancels them first, so its status can be inspected as well ([#3846](https://github.com/bastani-inc/atomic/issues/3846))
+- A workflow stage no longer stays stuck selecting its model when many workflows run at once. A stage with `model: "auto"` now waits at most five minutes for model selection, counting any wait for one of eight routing slots shared by every stage, so a burst of stages queues instead of overloading the router provider. When the wait ends, the stage runs on the current chat model if that model satisfies every routing constraint; otherwise it fails with an error that names the stage and the `model-resolution` startup phase, and its startup status reads `failed` instead of staying active. A failed selection is no longer remembered, so the next prompt on the same stage selects a model again, without launching a replacement workflow.
+- After a blocked workflow run is resumed, Intercom sends to `workflow:<rootRunId>/**`, to stage patterns, and to stages that have not started yet are accepted and delivered again instead of failing with `Workflow execution for <runId> is retired`.
+- In a long-running session, starting a workflow from a turn that an Intercom message started no longer fails with `Workflow execution for <runId> is retired; startup cleanup failed: …` after an earlier workflow run in the session has ended or been quit. The session's Intercom connection is now opened outside the workflow run that first needed it. The `is retired` error now names the run whose execution actually ended, not the run being started.
+- A workflow stage whose fallback session fails to start because an extension's `session_start` failed under load, for example Intercom's `Broker failed to start within timeout` or `connect ECONNREFUSED`, now retries that session with the same-model retry budget and then moves on to its next fallback model, instead of failing the stage and letting fail-fast skip its sibling stages. Any other extension startup error still fails the stage at once. The stage error, model attempts, and fallback warnings now name each failing extension and its error rather than only `Extension startup failed`.
+- When a workflow stage falls back to another model and that fallback session cannot start, the stage now closes the session it was replacing. Before, that session kept its session database open after the stage failed, and on Windows the file could not be deleted until the process exited.
+- Workflow stage sessions now provide `ctx.ui.theme` and the other default UI members, so extensions that read `ctx.ui.theme.fg(...)` in `session_start`, such as `examples/extensions/status-line.ts`, no longer fail stage startup with `Extension startup failed` ([#3801](https://github.com/bastani-inc/atomic/issues/3801))
+- Workflow inputs now reject integer and number values outside the `minimum`/`maximum` declared in the input schema, such as `count: 0` for `Type.Integer({ minimum: 1, maximum: 8 })`, when the run is started, instead of passing them to the workflow body. The error names the input and the violated bound ([#3812](https://github.com/bastani-inc/atomic/issues/3812)).
+- A `ctx.parallel(..., { failFast: false })` call that has a failing step no longer loses the results of the steps that succeeded. The `AggregateError` it rejects with now carries `partialResults`, one entry per step in step order, holding each completed step's result and `undefined` for a step that failed. The `WorkflowParallelFailure` type describes it ([#3809](https://github.com/bastani-inc/atomic/issues/3809))
+- A workflow stage's corrective prompt after a rejected `structured_output` result now names the failing paths and expected types, or reports that the tool arguments were not valid JSON, instead of only saying the response does not match the decision schema ([#3802](https://github.com/bastani-inc/atomic/issues/3802))
+- Disposing a session right after a workflow run reports that it ended no longer leaves the run `running` in the workflow journal, with its lease released, for readers to report as crashed. `session.dispose()` now waits up to 10 seconds for runs that have ended but are still recording their ending, before it closes the journal, and it rejects naming the run when that ending still cannot be recorded. A run whose journal rejects the write of its `completed` status now retries it once, and reports it with an error notice and a rejected `waitForSettled` when it still fails, instead of failing in silence ([#3811](https://github.com/bastani-inc/atomic/issues/3811))
+- A schema-backed workflow stage no longer stays `running` for hours inside one `structured_output` call when a slow model keeps generating without calling the tool. The decision now stops after the `httpIdleTimeoutMs` deadline (10 minutes by default) or the stage's `schemaTimeoutMs`, and the error that names the deadline and each attempt's duration reaches the model and the failed stage unchanged instead of being treated as a structured-output contract failure ([#3806](https://github.com/bastani-inc/atomic/issues/3806))
+
 ## [0.9.41-alpha.2] - 2026-10-22
 
 ### Fixed