@bastani/atomic 0.9.42 → 0.9.43-alpha.1

package/CHANGELOG.md

@@ -2,6 +2,25 @@
 
 ## [Unreleased]
 
+## [0.9.43-alpha.1] - 2026-10-24
+
+Local workflow worker pools now survive slow, busy, and crashed workers, and large workflow journals open without running out of memory.
+
+- **Pools that recover instead of failing:** a worker that dies mid-run is replaced and its child replays from the last checkpoint instead of crashing the root with `EPIPE`, a resumed root releases children leased to workers that died with the host, and unconfirmed worker exits are retried rather than failing every waiting child ([#3891](https://github.com/bastani-inc/atomic/pull/3891), [#3893](https://github.com/bastani-inc/atomic/pull/3893), [#3895](https://github.com/bastani-inc/atomic/pull/3895))
+- **Leases that follow worker liveness:** a busy root no longer fences healthy workers with `Stale work lease`, and the new `workflows.localWorkers.leaseMs` setting controls how long an unresponsive worker keeps its child (30000 ms by default) ([#3894](https://github.com/bastani-inc/atomic/pull/3894))
+- **Retry decisions you can make in code:** `WorkflowInfrastructureError` and `isRetryableWorkflowError` tell retryable pool and runtime faults apart from failures of a child's own logic ([#3895](https://github.com/bastani-inc/atomic/pull/3895))
+- **Faster startup on long journals:** workers become ready without reading the whole journal, the readiness timeout is configurable with `workflows.localWorkers.startupTimeoutMs`, and sessions, `/workflow status`, and the `/workflow resume` picker read each run's latest state instead of every event, so large journals no longer exhaust the heap ([#3891](https://github.com/bastani-inc/atomic/pull/3891), [#3896](https://github.com/bastani-inc/atomic/pull/3896))
+- **Easier worker diagnosis:** each worker's standard error is kept under `worker-logs/` next to the journal, and startup and retry-limit errors name the log file and show the end of its output ([#3891](https://github.com/bastani-inc/atomic/pull/3891))
+
+### Added
+
+- Added `WorkflowInfrastructureError` and `isRetryableWorkflowError` to `@bastani/atomic/workflows`, so workflows can tell local worker pool and runtime faults (which are safe to retry) from failures of a child workflow's own logic ([#3889](https://github.com/bastani-inc/atomic/issues/3889))
+- Added the `workflows.localWorkers.leaseMs` setting: how long, in milliseconds, a local workflow worker that is still running but has stopped responding keeps its child before the child is replayed on another worker (30000 by default, at least 2000) ([#3888](https://github.com/bastani-inc/atomic/issues/3888))
+
+### Fixed
+
+- Local workflow worker pools no longer fail with `Local worker startup timed out` when workers are slow to become ready, for example on a workflow journal with a long history. The readiness timeout is now configurable with the `workflows.localWorkers.startupTimeoutMs` setting (30000 ms by default) ([#3887](https://github.com/bastani-inc/atomic/issues/3887))
+
 ## [0.9.42] - 2026-10-23
 
 Sessions, workflow runs, and Intercom can now share one libSQL / Turso database across machines, and provider rate limits are respected across every request in a process.

package/dist/builtin/intercom/CHANGELOG.md

@@ -4,6 +4,12 @@ All notable changes to the `pi-intercom` extension will be documented in this fi
 
 ## [Unreleased]
 
+## [0.9.43-alpha.1] - 2026-10-24
+
+### Fixed
+
+- Fixed `Intercom event relay failed (atomic:workflow-pending-stage-route): Intercom runtime no longer active` appearing in the session after a local workflow worker died and its child was replayed. Route updates that arrive while a run's previous route connection is still closing or opening, as they do when the run's route is replaced, no longer race each other: the newest route is registered over one connection and an update the replacement made obsolete ends quietly. A route connection abandoned because the session itself shut down is still reported ([#3887](https://github.com/bastani-inc/atomic/issues/3887))
+
 ## [0.9.42] - 2026-10-23
 
 ### Added

package/dist/builtin/intercom/index.bundle.mjs

@@ -8151,23 +8151,30 @@ function piIntercomExtension(pi, testOverrides = {}) {
       pi.events.emit(PENDING_STAGE_ROUTE_REVOKED_EVENT, { runId, capability: state.route.capability });
     });
   }
+  async function retirePendingStageRouteClient(state) {
+    try {
+      await state.promise;
+    } catch {}
+    if (state.client) {
+      try {
+        await state.client.disconnect();
+      } catch {}
+    }
+  }
+  function supersededPendingStageRouteError(context, generation) {
+    return getLiveContext(context, generation) ? new IntercomClientDisconnectedError : new Error("Intercom runtime no longer active");
+  }
   async function ensurePendingStageRouteClient(runId, route, options = {}) {
     const contextAtStart = getLiveContext();
     const generationAtStart = runtimeGeneration;
     if (!contextAtStart)
       throw new Error("Intercom runtime not initialized");
     let existing = pendingStageRouteClients.get(runId);
+    let retired;
     if (existing && !samePendingStageRoute(existing.route, route)) {
       pendingStageRouteClients.delete(runId);
       endPendingStageRouteBackoff(existing, new IntercomClientDisconnectedError);
-      try {
-        await existing.promise;
-      } catch {}
-      if (existing.client) {
-        try {
-          await existing.client.disconnect();
-        } catch {}
-      }
+      retired = retirePendingStageRouteClient(existing);
       existing = undefined;
     }
     const state = existing ?? {
@@ -8191,9 +8198,9 @@ function piIntercomExtension(pi, testOverrides = {}) {
     }
     if (state.reconnectTimer !== null && options.bypassBackoff !== true)
       return state.retryWaiters.join();
-    const promise = routeClientConnectGate.run(async () => {
+    const connect = () => routeClientConnectGate.run(async () => {
       if (!pendingStageRouteClientIsCurrent(runId, state, contextAtStart, generationAtStart)) {
-        throw new Error("Intercom runtime no longer active");
+        throw supersededPendingStageRouteError(contextAtStart, generationAtStart);
       }
       await spawnBrokerIfNeeded(config.brokerCommand, config.brokerArgs);
       const routeReturnAddress = `${currentSessionId}:pending-stage-route:${runId}`;
@@ -8205,16 +8212,17 @@ function piIntercomExtension(pi, testOverrides = {}) {
       await nextClient.connect({ ...buildRegistration(), recipientPurpose: "control", name: undefined, groups: [normalizeGroup(route.group)], group: normalizeGroup(route.group) }, undefined, undefined, readSubagentMessageSource(runtimeContext?.subagentPolicy));
       if (!pendingStageRouteClientIsCurrent(runId, state, contextAtStart, generationAtStart)) {
         await nextClient.disconnect();
-        throw new Error("Intercom runtime no longer active");
+        throw supersededPendingStageRouteError(contextAtStart, generationAtStart);
       }
       await nextClient.registerPendingStageRouteAcknowledged(runId, normalizeGroup(route.group), route.capability, route.stages, route.possibleStages, route.parent, route.dormant === true);
       if (!pendingStageRouteClientIsCurrent(runId, state, contextAtStart, generationAtStart)) {
         await nextClient.disconnect();
-        throw new Error("Intercom runtime no longer active");
+        throw supersededPendingStageRouteError(contextAtStart, generationAtStart);
       }
       state.reconnectAttempt = 0;
       endPendingStageRouteBackoff(state);
     });
+    const promise = retired === undefined ? connect() : retired.then(connect);
     state.promise = promise;
     try {
       await promise;

package/dist/builtin/intercom/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bastani/intercom",
-  "version": "0.9.42",
+  "version": "0.9.43-alpha.1",
   "private": true,
   "description": "Atomic extension providing a private coordination channel between parent and child agent sessions. Fork of: https://github.com/nicobailon/pi-intercom",
   "contributors": [

package/dist/builtin/mcp/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bastani/mcp",
-  "version": "0.9.42",
+  "version": "0.9.43-alpha.1",
   "private": true,
   "description": "Atomic's pi-compatible MCP integration for server connections, OAuth, tools, resources, and terminal management.",
   "contributors": [

package/dist/builtin/subagents/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bastani/subagents",
-  "version": "0.9.42",
+  "version": "0.9.43-alpha.1",
   "private": true,
   "description": "Atomic extension for delegating tasks to subagents with parallel execution. Fork of: https://github.com/nicobailon/pi-subagents",
   "contributors": [

package/dist/builtin/web-access/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bastani/web-access",
-  "version": "0.9.42",
+  "version": "0.9.43-alpha.1",
   "private": true,
   "description": "Atomic extension for web search, URL fetching, GitHub repo cloning, PDF/video extraction. Fork of: https://github.com/nicobailon/pi-web-access",
   "contributors": [

package/dist/builtin/workflows/CHANGELOG.md

@@ -6,6 +6,25 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 
 ## [Unreleased]
 
+## [0.9.43-alpha.1] - 2026-10-24
+
+### Added
+
+- `ctx.workflow(child)` now throws a `WorkflowInfrastructureError` with `retryable: true` and a fault `code` when the local worker pool cannot run a child because of a fault in the pool or its runtime (for example `Local worker retry limit`, `Local worker cleanup was not confirmed`, `Stale work lease`, `Intercom runtime no longer active` or `Storage unavailable`), and `isRetryableWorkflowError(error)` recognizes it anywhere in an error's `cause` chain. Failures of a child's own logic keep throwing a plain `Error` ([#3889](https://github.com/bastani-inc/atomic/issues/3889))
+
+### Changed
+
+- Local worker leases now follow worker liveness. A worker that is still running and responding keeps its child even when the root is too busy to process its heartbeats in time, so a slow root no longer fences healthy workers with `Stale work lease`. A worker that has stopped responding is fenced after `localWorkers.leaseMs` milliseconds, which defaults to 30000 instead of the previous fixed 5000 ([#3888](https://github.com/bastani-inc/atomic/issues/3888))
+
+### Fixed
+
+- A local workflow worker that dies while the root still owes it replies no longer crashes the root with `Error: write EPIPE`. The root fences that worker's attempt and replays the child from its last committed checkpoint on a replacement worker ([#3887](https://github.com/bastani-inc/atomic/issues/3887))
+- Each local worker's standard error is now kept in `worker-logs/<root run ID>/<worker ID>.log` in the workflow journal's directory, and the `Local worker exited before readiness`, `Local worker startup timed out` and `Local worker retry limit` errors name that file and include the end of the worker's output. Logs of workers that are still running when the pool shuts down normally are removed ([#3887](https://github.com/bastani-inc/atomic/issues/3887))
+- Local worker pools no longer fail with `Local worker startup timed out` on a workflow journal with a long history. Workers no longer read every run in the journal before reporting ready, the pool starts running children once one worker is ready and fails only when none starts, and the readiness timeout can be raised with `localWorkers.startupTimeoutMs` (30000 ms by default). Once running, workers bring their view of the root up to date by reading only the journal events added since their last read, instead of re-reading the root's whole history after every checkpoint and claim. The timeout is not saved with the root, so it can change between resumes ([#3887](https://github.com/bastani-inc/atomic/issues/3887))
+- Resuming a pooled root after its host process crashed no longer leaves children leased to workers that died with it. The resumed root releases those attempts as soon as it starts its new pool, and their children are replayed from their last committed checkpoints on the new workers ([#3890](https://github.com/bastani-inc/atomic/issues/3890))
+- Opening or resuming a session with a large workflow journal no longer shows a blank screen and then crashes with `JavaScript heap out of memory`. Sessions, `/workflow status` and the `/workflow resume` picker now read each run's latest state instead of every event in the journal, and load a run's full history only when that run is resumed, recovered, inspected or opened ([#3892](https://github.com/bastani-inc/atomic/issues/3892))
+- A local worker whose process exit cannot be confirmed during lease recovery no longer fails every child waiting on the pool with `Local worker cleanup was not confirmed`. The pool keeps the attempt fenced and retries recovery until the worker exits ([#3889](https://github.com/bastani-inc/atomic/issues/3889))
+
 ## [0.9.42] - 2026-10-23
 
 ### Added

package/dist/builtin/workflows/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bastani/workflows",
-  "version": "0.9.42",
+  "version": "0.9.43-alpha.1",
   "private": true,
   "description": "Atomic extension for multi-stage workflow authoring and execution.",
   "contributors": [

package/dist/builtin/workflows/src/authoring.d.ts

@@ -36,6 +36,8 @@ export type RunOpts = Omit<AuthoringContract.RunOpts, "registry"> & {
 export declare const INTERACTIVE_WORKFLOW_POLICY: WorkflowExecutionPolicy;
 export declare const NON_INTERACTIVE_WORKFLOW_POLICY: WorkflowExecutionPolicy;
 export declare function run<TInputs extends WorkflowInputValues, TOutputs extends WorkflowOutputValues, TRunInputs extends WorkflowInputValues = TInputs>(definition: WorkflowDefinition<TInputs, TOutputs, TRunInputs>, inputs: Readonly<NoInfer<WorkflowRunInputArgument<TRunInputs>>>, opts?: RunOpts): Promise<RunResult<TOutputs>>;
+export type { WorkflowInfrastructureFault } from "./shared/workflow-infrastructure-error.js";
+export { isRetryableWorkflowError, WorkflowInfrastructureError } from "./shared/workflow-infrastructure-error.js";
 export declare function loadWorkerWorkflow(path: string, exportName?: string): Promise<AnyWorkflowDefinition>;
 export type { LocalWorkerOptions, WorkflowAdmissionOptions } from "./workers/public-options.js";
 /**

package/dist/builtin/workflows/src/durable/journal/internal.d.ts

@@ -1,17 +1,33 @@
 import type { SqliteExecutor } from "@bastani/atomic/storage";
-import type { RunJournal } from "./types.js";
+import { type JournalEntry, type RunJournal } from "./types.js";
 export declare const JOURNAL_READ_PAGE_SIZE = 256;
+/** Event types the durable backend folds without replacing the run's handle; every other event carries it. */
+export declare const NON_SNAPSHOT_EVENT_TYPES: readonly ["CheckpointRecorded", "MessageSettled", "MessageDelivered"];
 /** A run's latest event. A run whose history was deleted and recorded again ends with a different event. */
 export interface RunVersion {
     readonly seq: number;
     readonly at: number;
 }
+/**
+ * A run's latest snapshot event (one carrying the run's handle) and the checkpoints recorded after it: enough to
+ * list the run in a catalog without reading its history.
+ */
+export interface RunSnapshotTail {
+    /** The run's latest event of any type. */
+    readonly version: RunVersion;
+    readonly snapshot: JournalEntry;
+    readonly laterCheckpoints: number;
+    /** `completedAt` of the last of `laterCheckpoints`. */
+    readonly lastCheckpointAt?: number;
+}
 /** Lets a durable backend re-read only the runs that changed; kept off the public journal shape. */
 export interface RunJournalVersions {
     /** Moves whenever any connection, in this process or another, commits a change to the journal's store. */
     changeToken(): Promise<string>;
     /** Every listed run with its latest event; a run with no events has version `{ seq: 0, at: 0 }`. */
     runVersions(): Promise<ReadonlyMap<string, RunVersion>>;
+    /** Undefined for a run with no snapshot event. */
+    snapshotTail(runId: string): Promise<RunSnapshotTail | undefined>;
 }
 export declare function registerRunJournalVersions(journal: RunJournal, versions: RunJournalVersions): void;
 /** Change tracking for a journal that registered it; other journals are re-read in full. */

package/dist/builtin/workflows/src/durable/journal/sql-run-journal.d.ts

@@ -29,6 +29,11 @@ export declare class SqlRunJournal implements RunJournal {
      */
     private changeToken;
     private runVersions;
+    /**
+     * The latest snapshot event is found by walking the run's `(run_id, seq)` key back from its last event, so
+     * only the events after it are visited and only its payload is read.
+     */
+    private snapshotTail;
     private requireRun;
     /** Whether this run exists only in the legacy tables, whose events are then read in place. */
     private isUnconvertedLegacyRun;