@bastani/atomic 0.9.45 → 0.9.46

package/dist/builtin/intercom/index.bundle.mjs

@@ -190,13 +190,14 @@ var init_recoverable_disconnect = __esm(() => {
 });
 
 // dist/builtin/intercom/retry-policy.ts
-var ASK_REPLY_TIMEOUT_MS, RETRY_IDENTITY_RETRY_OPPORTUNITY_MS, RETRY_IDENTITY_TTL_MS, DELIVERED_MESSAGE_TTL_MS, RECONNECT_DELAYS_MS, SEND_RESPONSE_TIMEOUT_MS = 1e4;
+var ASK_REPLY_TIMEOUT_MS, RETRY_IDENTITY_RETRY_OPPORTUNITY_MS, RETRY_IDENTITY_TTL_MS, DELIVERED_MESSAGE_TTL_MS, RECONNECT_DELAYS_MS, SEND_RESPONSE_TIMEOUT_MS = 1e4, RECIPIENT_RECEIPT_TIMEOUT_MS = 8000, RECIPIENT_SAVING_REPORT_INTERVAL_MS;
 var init_retry_policy = __esm(() => {
   ASK_REPLY_TIMEOUT_MS = 10 * 60 * 1000;
   RETRY_IDENTITY_RETRY_OPPORTUNITY_MS = 60 * 1000;
   RETRY_IDENTITY_TTL_MS = ASK_REPLY_TIMEOUT_MS + RETRY_IDENTITY_RETRY_OPPORTUNITY_MS;
   DELIVERED_MESSAGE_TTL_MS = RETRY_IDENTITY_TTL_MS + RETRY_IDENTITY_RETRY_OPPORTUNITY_MS;
   RECONNECT_DELAYS_MS = [1000, 2000, 5000];
+  RECIPIENT_SAVING_REPORT_INTERVAL_MS = RECIPIENT_RECEIPT_TIMEOUT_MS / 4;
 });
 
 // dist/builtin/intercom/reconnect-backoff.ts
@@ -923,6 +924,29 @@ var init_group = __esm(() => {
 import { EventEmitter } from "events";
 import net from "net";
 import { randomUUID as randomUUID2 } from "crypto";
+function connectAborted() {
+  return new IntercomClientDisconnectedError({ cause: new Error("Disconnected before the broker connection registered") });
+}
+function abortableDelay(ms, signal) {
+  return new Promise((resolveDelay, rejectDelay) => {
+    const timer = setTimeout(() => {
+      signal.removeEventListener("abort", onAbort);
+      resolveDelay();
+    }, ms);
+    const onAbort = () => {
+      clearTimeout(timer);
+      rejectDelay(connectAborted());
+    };
+    if (signal.aborted)
+      onAbort();
+    else
+      signal.addEventListener("abort", onAbort, { once: true });
+  });
+}
+function isBacklogRefusal(error) {
+  const code = error.code;
+  return code === "ECONNREFUSED" || code === "EAGAIN";
+}
 function toError(error) {
   return error instanceof Error ? error : new Error(String(error));
 }
@@ -932,7 +956,7 @@ function isWorkflowFutureStageRosterEntries(value) {
 function isWorkflowStageRosterEntries(value) {
   return Array.isArray(value) && value.every((entry) => typeof entry === "object" && entry !== null && entry.kind === "workflow-stage" && typeof entry.runId === "string" && typeof entry.stageId === "string" && typeof entry.stageName === "string" && typeof entry.target === "string" && (entry.lifecycle === "pending" || entry.lifecycle === "running") && typeof entry.group === "string" && (entry.sessionId === undefined || typeof entry.sessionId === "string"));
 }
-var BROKER_SOCKET, BROKER_CONNECT_TIMEOUT_MS = 1e4, PENDING_STAGE_ROUTE_ACK_TIMEOUT_MS = 1e4, GROUP_REQUEST_TIMEOUT_MS = 5000, PRESENCE_ACK_TIMEOUT_MS = 5000, RESTORING_RECIPIENT_REQUEST_TIMEOUT_MS = 5000, HELD_SEND_GRACE_MS = 5000, IntercomPendingStageRouteRefusedError, PENDING_STAGE_ROUTE_REFUSAL_CODES, IntercomClient;
+var BROKER_SOCKET, BROKER_CONNECT_TIMEOUT_MS = 1e4, PENDING_STAGE_ROUTE_ACK_TIMEOUT_MS = 1e4, GROUP_REQUEST_TIMEOUT_MS = 5000, PRESENCE_ACK_TIMEOUT_MS = 5000, RESTORING_RECIPIENT_REQUEST_TIMEOUT_MS = 5000, BROKER_BACKLOG_RETRIES = 6, BROKER_BACKLOG_RETRY_BASE_MS = 25, HELD_SEND_GRACE_MS = 5000, IntercomPendingStageRouteRefusedError, PENDING_STAGE_ROUTE_REFUSAL_CODES, IntercomClient;
 var init_client = __esm(() => {
   init_paths();
   init_pending_send_registry();
@@ -966,6 +990,9 @@ var init_client = __esm(() => {
     multiplexesPendingStageRoutes;
     brokerRefusesPendingStageRoutesInPlace = false;
     brokerAnswersStatus = false;
+    brokerClaimsWorkflowInvocations = false;
+    connectAttempt;
+    brokerExtendsSaves = false;
     socket = null;
     _sessionId = null;
     _supervisorSessionId = null;
@@ -980,6 +1007,7 @@ var init_client = __esm(() => {
     pendingBrokerStatus = new Map;
     _groups = normalizeGroups();
     pendingLiveWorkflowStageRoutes = new Map;
+    pendingWorkflowInvocationClaims = new Map;
     pendingStageRouteRegistrations = new Map;
     pendingSupervisorAuthorizations = new Map;
     pendingRestoringRecipientRequests = new Map;
@@ -1048,6 +1076,8 @@ var init_client = __esm(() => {
         pending.reject(error);
       for (const pending of this.pendingLiveWorkflowStageRoutes.values())
         pending.reject(error);
+      for (const pending of this.pendingWorkflowInvocationClaims.values())
+        pending.reject(error);
       for (const pending of this.pendingStageRouteRegistrations.values())
         pending.reject(error);
       for (const pending of this.pendingBrokerStatus.values())
@@ -1059,6 +1089,7 @@ var init_client = __esm(() => {
       this.pendingPresence.clear();
       this.pendingMemberships.clear();
       this.pendingLiveWorkflowStageRoutes.clear();
+      this.pendingWorkflowInvocationClaims.clear();
       this.pendingStageRouteRegistrations.clear();
       this.pendingBrokerStatus.clear();
     }
@@ -1088,7 +1119,31 @@ var init_client = __esm(() => {
       }
       return socket;
     }
-    connect(session, supervisor, supervisorOwnerToken, messageSource, registrationGroup) {
+    async connect(session, supervisor, supervisorOwnerToken, messageSource, registrationGroup) {
+      const attempt = new AbortController;
+      this.connectAttempt = attempt;
+      try {
+        for (let retry = 0;; retry++) {
+          if (attempt.signal.aborted)
+            throw connectAborted();
+          try {
+            await this.connectOnce(attempt.signal, session, supervisor, supervisorOwnerToken, messageSource, registrationGroup);
+            return;
+          } catch (error) {
+            if (attempt.signal.aborted)
+              throw connectAborted();
+            if (!(error instanceof Error) || !isBacklogRefusal(error) || retry >= BROKER_BACKLOG_RETRIES)
+              throw error;
+            const backoff = BROKER_BACKLOG_RETRY_BASE_MS * 2 ** retry;
+            await abortableDelay(backoff * (0.5 + Math.random() / 2), attempt.signal);
+          }
+        }
+      } finally {
+        if (this.connectAttempt === attempt)
+          this.connectAttempt = undefined;
+      }
+    }
+    connectOnce(signal, session, supervisor, supervisorOwnerToken, messageSource, registrationGroup) {
       if (this.socket) {
         return Promise.reject(new Error("Already connected"));
       }
@@ -1145,6 +1200,8 @@ var init_client = __esm(() => {
           this.brokerAcknowledgesPendingStageRoutes = false;
           this.brokerRefusesPendingStageRoutesInPlace = false;
           this.brokerAnswersStatus = false;
+          this.brokerClaimsWorkflowInvocations = false;
+          this.brokerExtendsSaves = false;
           this._messageSource = undefined;
           this.disconnectError = null;
           if (connectionEstablished && !wasDisconnecting) {
@@ -1173,7 +1230,36 @@ var init_client = __esm(() => {
         const reader = createMessageReader((msg) => {
           this.handleBrokerMessage(msg);
         }, onReaderError);
+        const onConnect = () => {
+          if (signal.aborted) {
+            onAbort();
+            return;
+          }
+          try {
+            writeMessage(socket, {
+              type: "register",
+              session,
+              ...registrationGroup !== undefined ? { registrationGroup } : {},
+              returnAddress: this.returnAddress,
+              ...this.preferredSessionId === undefined ? {} : { preferredSessionId: this.preferredSessionId },
+              ...this.acknowledgesReceipt ? { acknowledgesReceipt: true } : {},
+              ...supervisor ? { supervisor } : {},
+              ...supervisorOwnerToken ? { supervisorOwnerToken } : {}
+            });
+          } catch (error) {
+            cleanupConnectionAttempt();
+            cleanupSocketListeners();
+            if (this.socket === socket) {
+              this.socket = null;
+            }
+            socket.destroy();
+            reject(toError(error));
+          }
+        };
+        const onAbort = () => onError(connectAborted());
         const cleanupConnectionAttempt = () => {
+          signal.removeEventListener("abort", onAbort);
+          socket.off("connect", onConnect);
           this.off("_registered", onRegistered);
           this.off("_registration_failed", onRegistrationFailed);
           socket.off("error", onError);
@@ -1190,26 +1276,8 @@ var init_client = __esm(() => {
         socket.on("error", onSocketError);
         this.once("_registered", onRegistered);
         this.once("_registration_failed", onRegistrationFailed);
-        try {
-          writeMessage(socket, {
-            type: "register",
-            session,
-            ...registrationGroup !== undefined ? { registrationGroup } : {},
-            returnAddress: this.returnAddress,
-            ...this.preferredSessionId === undefined ? {} : { preferredSessionId: this.preferredSessionId },
-            ...this.acknowledgesReceipt ? { acknowledgesReceipt: true } : {},
-            ...supervisor ? { supervisor } : {},
-            ...supervisorOwnerToken ? { supervisorOwnerToken } : {}
-          });
-        } catch (error) {
-          cleanupConnectionAttempt();
-          cleanupSocketListeners();
-          if (this.socket === socket) {
-            this.socket = null;
-          }
-          socket.destroy();
-          reject(toError(error));
-        }
+        signal.addEventListener("abort", onAbort, { once: true });
+        socket.once("connect", onConnect);
       });
     }
     handleBrokerMessage(msg) {
@@ -1222,7 +1290,7 @@ var init_client = __esm(() => {
       }
       switch (brokerMessage.type) {
         case "registered": {
-          if (typeof brokerMessage.sessionId !== "string" || brokerMessage.supervisorSessionId !== undefined && typeof brokerMessage.supervisorSessionId !== "string" || brokerMessage.acknowledgesReceipt !== undefined && brokerMessage.acknowledgesReceipt !== true || brokerMessage.acknowledgesPendingStageRoutes !== undefined && brokerMessage.acknowledgesPendingStageRoutes !== true || brokerMessage.refusesPendingStageRoutesInPlace !== undefined && brokerMessage.refusesPendingStageRoutesInPlace !== true || brokerMessage.brokerStatus !== undefined && brokerMessage.brokerStatus !== true) {
+          if (typeof brokerMessage.sessionId !== "string" || brokerMessage.supervisorSessionId !== undefined && typeof brokerMessage.supervisorSessionId !== "string" || brokerMessage.acknowledgesReceipt !== undefined && brokerMessage.acknowledgesReceipt !== true || brokerMessage.acknowledgesPendingStageRoutes !== undefined && brokerMessage.acknowledgesPendingStageRoutes !== true || brokerMessage.refusesPendingStageRoutesInPlace !== undefined && brokerMessage.refusesPendingStageRoutesInPlace !== true || brokerMessage.brokerStatus !== undefined && brokerMessage.brokerStatus !== true || brokerMessage.claimsWorkflowInvocations !== undefined && brokerMessage.claimsWorkflowInvocations !== true || brokerMessage.extendsSaves !== undefined && brokerMessage.extendsSaves !== true) {
             throw new Error("Invalid registered message");
           }
           if (this._sessionId !== null) {
@@ -1234,6 +1302,8 @@ var init_client = __esm(() => {
           this.brokerAcknowledgesPendingStageRoutes = brokerMessage.acknowledgesPendingStageRoutes === true;
           this.brokerRefusesPendingStageRoutesInPlace = brokerMessage.refusesPendingStageRoutesInPlace === true;
           this.brokerAnswersStatus = brokerMessage.brokerStatus === true;
+          this.brokerClaimsWorkflowInvocations = brokerMessage.claimsWorkflowInvocations === true;
+          this.brokerExtendsSaves = this.brokerAcknowledgesReceipt && brokerMessage.extendsSaves === true;
           this.emit("_registered", { type: "registered", sessionId: brokerMessage.sessionId });
           break;
         }
@@ -1328,8 +1398,8 @@ var init_client = __esm(() => {
           break;
         }
         case "pending_stage_message": {
-          const { requestId, from, senderRegistrationName, senderReturnAddress, runId, target, message, live } = brokerMessage;
-          if (typeof requestId !== "string" || !isSessionInfo(from) || senderRegistrationName !== undefined && typeof senderRegistrationName !== "string" || senderReturnAddress !== undefined && typeof senderReturnAddress !== "string" || typeof runId !== "string" || typeof target !== "string" || !isMessage(message) || live !== undefined && typeof live !== "boolean") {
+          const { requestId, from, senderRegistrationName, senderReturnAddress, runId, target, message, live, invocationControl } = brokerMessage;
+          if (typeof requestId !== "string" || !isSessionInfo(from) || senderRegistrationName !== undefined && typeof senderRegistrationName !== "string" || senderReturnAddress !== undefined && typeof senderReturnAddress !== "string" || typeof runId !== "string" || typeof target !== "string" || !isMessage(message) || live !== undefined && typeof live !== "boolean" || invocationControl !== undefined && invocationControl !== true) {
             throw new Error("Invalid pending-stage message event");
           }
           this.emit("pending_stage_message", {
@@ -1340,7 +1410,8 @@ var init_client = __esm(() => {
             runId,
             target,
             message,
-            ...live === true ? { live: true } : {}
+            ...live === true ? { live: true } : {},
+            ...invocationControl === true ? { invocationControl: true } : {}
           });
           break;
         }
@@ -1402,6 +1473,17 @@ var init_client = __esm(() => {
           pending.resolve();
           break;
         }
+        case "workflow_invocation_claimed": {
+          const { requestId, claimed } = brokerMessage;
+          if (typeof requestId !== "string" || typeof claimed !== "boolean")
+            throw new Error("Invalid workflow invocation claim answer");
+          const pending = this.pendingWorkflowInvocationClaims.get(requestId);
+          if (!pending)
+            return;
+          this.pendingWorkflowInvocationClaims.delete(requestId);
+          pending.resolve(claimed);
+          break;
+        }
         case "live_workflow_stage_route_registered": {
           const { requestId } = brokerMessage;
           if (typeof requestId !== "string")
@@ -1572,6 +1654,10 @@ var init_client = __esm(() => {
       }
     }
     async disconnect() {
+      if (this.connectAttempt !== undefined && this._sessionId === null) {
+        this.connectAttempt.abort();
+        return;
+      }
       const socket = this.socket;
       if (!socket) {
         return;
@@ -1838,7 +1924,7 @@ var init_client = __esm(() => {
         }
       });
     }
-    registerPendingStageRoute(runId, group, capability, stages, possibleStages, parent, dormant) {
+    registerPendingStageRoute(runId, group, capability, stages, possibleStages, parent, dormant, launcherCapability) {
       writeMessage(this.requireActiveSocket(), {
         type: "register_pending_stage_route",
         runId,
@@ -1847,10 +1933,11 @@ var init_client = __esm(() => {
         stages,
         possibleStages,
         ...parent === undefined ? {} : { parent },
-        ...dormant === true ? { dormant: true } : {}
+        ...dormant === true ? { dormant: true } : {},
+        ...launcherCapability === undefined || !this.brokerClaimsWorkflowInvocations ? {} : { launcherCapability }
       });
     }
-    registerPendingStageRouteAcknowledged(runId, group, capability, stages, possibleStages, parent, dormant) {
+    registerPendingStageRouteAcknowledged(runId, group, capability, stages, possibleStages, parent, dormant, launcherCapability) {
       let socket;
       try {
         socket = this.requireActiveSocket();
@@ -1859,7 +1946,7 @@ var init_client = __esm(() => {
       }
       if (!this.brokerAcknowledgesPendingStageRoutes) {
         try {
-          this.registerPendingStageRoute(runId, group, capability, stages, possibleStages, parent, dormant);
+          this.registerPendingStageRoute(runId, group, capability, stages, possibleStages, parent, dormant, launcherCapability);
         } catch (error) {
           return Promise.reject(toError(error));
         }
@@ -1895,6 +1982,7 @@ var init_client = __esm(() => {
             possibleStages,
             ...parent === undefined ? {} : { parent },
             ...dormant === true ? { dormant: true } : {},
+            ...launcherCapability === undefined || !this.brokerClaimsWorkflowInvocations ? {} : { launcherCapability },
             ...this.multiplexesPendingStageRoutes && this.brokerRefusesPendingStageRoutesInPlace ? { refusalKeepsConnection: true } : {}
           });
         } catch (error) {
@@ -1904,6 +1992,26 @@ var init_client = __esm(() => {
         }
       });
     }
+    claimWorkflowInvocation(runId, launcherCapability) {
+      let socket;
+      try {
+        socket = this.requireActiveSocket();
+      } catch (error) {
+        return Promise.reject(toError(error));
+      }
+      if (!this.brokerClaimsWorkflowInvocations)
+        return Promise.resolve(false);
+      const requestId = randomUUID2();
+      return new Promise((resolve, reject) => {
+        this.pendingWorkflowInvocationClaims.set(requestId, { resolve, reject });
+        try {
+          writeMessage(socket, { type: "claim_workflow_invocation", requestId, runId, capability: launcherCapability });
+        } catch (error) {
+          this.pendingWorkflowInvocationClaims.delete(requestId);
+          reject(toError(error));
+        }
+      });
+    }
     registerLiveWorkflowStageRoute(runId, stageKeys, capability) {
       let socket;
       try {
@@ -1956,6 +2064,11 @@ var init_client = __esm(() => {
         return;
       writeMessage(this.requireActiveSocket(), { type: "received", messageId });
     }
+    reportSaving(messageId) {
+      if (!this.brokerExtendsSaves || !this.socket || this.socket.destroyed)
+        return;
+      writeMessage(this.socket, { type: "saving", messageId });
+    }
     sendPendingStageNotification(runId, capability, to, senderRegistrationName, options, senderReturnAddress) {
       return this.sendFrame("send_pending_stage_notification", to, options, {
         runId,
@@ -7598,6 +7711,7 @@ __export(exports_index_heavy, {
   default: () => piIntercomExtension
 });
 import { APP_NAME, sessionScopedExtensionState } from "@bastani/atomic";
+import { randomUUID as randomUUID7 } from "node:crypto";
 import { appendFileSync as appendFileSync2 } from "node:fs";
 import { setTimeout as delay3 } from "node:timers/promises";
 function isPendingStageUndeliverableEvent(value) {
@@ -7670,6 +7784,16 @@ function piIntercomExtension(pi, testOverrides = {}) {
   });
   const inboundDeliveries = new InboundMessageAdmission;
   const pendingStageRoutes = new Map;
+  const launcherCapabilities = new Map;
+  const launcherCapabilityFor = (runId) => {
+    let capability = launcherCapabilities.get(runId);
+    if (capability === undefined) {
+      capability = randomUUID7();
+      launcherCapabilities.set(runId, capability);
+    }
+    return capability;
+  };
+  const launchedRunClaims = new Map;
   const pendingStageRouteClients = new Map;
   const pendingStageRouteConnections = new Map;
   const routeClientConnectGate = createConcurrencyGate(ROUTE_CLIENT_CONNECT_CONCURRENCY);
@@ -7869,7 +7993,14 @@ function piIntercomExtension(pi, testOverrides = {}) {
   }
   function receiveIncomingMessage(receiver, from, message, channel) {
     const generation = runtimeGeneration;
-    durableInbox.receive(from, message, channel, () => receiver.acknowledgeReceived(message.id)).then((arrival) => {
+    const saving = setInterval(() => receiver.reportSaving(message.id), RECIPIENT_SAVING_REPORT_INTERVAL_MS);
+    saving.unref?.();
+    const saved = durableInbox.receive(from, message, channel, () => {
+      clearInterval(saving);
+      receiver.acknowledgeReceived(message.id);
+    });
+    saved.finally(() => clearInterval(saving)).catch(() => {});
+    saved.then((arrival) => {
       if (arrival !== "fresh")
         return;
       const liveContext = getLiveContext(runtimeContext, generation);
@@ -8392,7 +8523,7 @@ function piIntercomExtension(pi, testOverrides = {}) {
       pendingStageRouteClients.set(runId, state);
     state.route = route;
     if (state.client?.isConnected()) {
-      await state.client.registerPendingStageRouteAcknowledged(runId, normalizeGroup(route.group), route.capability, route.stages, route.possibleStages, route.parent, route.dormant === true).catch((error) => {
+      await state.client.registerPendingStageRouteAcknowledged(runId, normalizeGroup(route.group), route.capability, route.stages, route.possibleStages, route.parent, route.dormant === true, launcherCapabilityFor(runId)).catch((error) => {
         if (error instanceof IntercomPendingStageRouteRefusedError) {
           if (!error.connectionKept)
             state.isolated = true;
@@ -8421,7 +8552,7 @@ function piIntercomExtension(pi, testOverrides = {}) {
         throw supersededPendingStageRouteError(contextAtStart, generationAtStart);
       }
       state.client = nextClient;
-      await nextClient.registerPendingStageRouteAcknowledged(runId, normalizeGroup(route.group), route.capability, route.stages, route.possibleStages, route.parent, route.dormant === true);
+      await nextClient.registerPendingStageRouteAcknowledged(runId, normalizeGroup(route.group), route.capability, route.stages, route.possibleStages, route.parent, route.dormant === true, launcherCapabilityFor(runId));
       if (!pendingStageRouteClientIsCurrent(runId, state, contextAtStart, generationAtStart)) {
         throw supersededPendingStageRouteError(contextAtStart, generationAtStart);
       }
@@ -8475,6 +8606,16 @@ function piIntercomExtension(pi, testOverrides = {}) {
       return;
     }
     await ensurePendingStageRouteClient(runId, { ...route, group: normalizeGroup(route.group) });
+    await claimLaunchedRun(activeClient, runId).catch(() => {});
+  }
+  async function claimLaunchedRun(activeClient, runId) {
+    const capability = launcherCapabilityFor(runId);
+    const claimed = launchedRunClaims.get(runId);
+    if (claimed?.client === activeClient && claimed.capability === capability)
+      return;
+    if (await activeClient.claimWorkflowInvocation(runId, capability)) {
+      launchedRunClaims.set(runId, { client: activeClient, capability });
+    }
   }
   function registersOnMainClient(route) {
     return clientRegistrationGroup === normalizeGroup(route.group) && route.dormant !== true;
@@ -8540,7 +8681,7 @@ function piIntercomExtension(pi, testOverrides = {}) {
                 await registerPendingStageRoute(nextClient, runId, route);
                 continue;
               }
-              ensurePendingStageRouteClient(runId, { ...route, group: normalizeGroup(route.group) }).catch(() => {});
+              ensurePendingStageRouteClient(runId, { ...route, group: normalizeGroup(route.group) }).then(() => claimLaunchedRun(nextClient, runId)).catch(() => {});
             }
             const orchestration = contextAtStart.orchestrationContext;
             if (orchestration?.kind === "workflow-stage" && orchestration.pendingStageDelivery !== undefined) {
@@ -8866,6 +9007,7 @@ var init_index_heavy = __esm(() => {
   init_session_recovery();
   init_client();
   init_spawn();
+  init_retry_policy();
   init_inline_message();
   init_config();
   init_reply_tracker();

package/dist/builtin/intercom/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bastani/intercom",
-  "version": "0.9.45",
+  "version": "0.9.46",
   "private": true,
   "description": "Atomic extension providing a private coordination channel between parent and child agent sessions. Fork of: https://github.com/nicobailon/pi-intercom",
   "contributors": [

package/dist/builtin/intercom/retry-policy.ts

@@ -12,3 +12,10 @@ export const RECONNECT_DELAYS_MS = [1_000, 2_000, 5_000] as const;
 export const SEND_RESPONSE_TIMEOUT_MS = 10_000;
 /** The broker answers an unconfirmed save before the sender's own wait ends, so the sender learns the outcome is uncertain. */
 export const RECIPIENT_RECEIPT_TIMEOUT_MS = 8_000;
+/**
+ * #3983: a recipient still saving a message (a pooled stage's journal commit waiting behind other writers) reports
+ * progress this often, each report extending the sender's wait by another `RECIPIENT_RECEIPT_TIMEOUT_MS`.
+ */
+export const RECIPIENT_SAVING_REPORT_INTERVAL_MS = RECIPIENT_RECEIPT_TIMEOUT_MS / 4;
+/** No save holds its sender longer than this, however long the recipient keeps reporting progress. */
+export const RECIPIENT_SAVE_MAX_WAIT_MS = 120_000;

package/dist/builtin/intercom/types.ts

@@ -183,6 +183,8 @@ export type ClientMessage =
 	| { type: "unregister" }
 	/** #3761: the recipient saved this message; it ignores a copy of it sent again. */
 	| { type: "received"; messageId: string }
+	/** #3983: the recipient is still saving this message; its sender keeps waiting. Sent only to a broker that advertised `extendsSaves`. */
+	| { type: "saving"; messageId: string }
   | { type: "list"; requestId: string; group?: string }
 	| { type: "list_groups"; requestId: string }
 	| { type: "join_group"; requestId: string; group: string }
@@ -236,6 +238,11 @@ export type ClientMessage =
 		parent?: WorkflowRunParentAnnouncement;
 		/** Interrupted run queued by its restarted owner before resume; yields to the process that resumes it (#3760). */
 		dormant?: true;
+		/**
+		 * #4006: a secret held only by the process that launched the run, never given to its stages. The launching
+		 * session presents it in `claim_workflow_invocation`.
+		 */
+		launcherCapability?: string;
 		/**
 		 * #3906: the connection carries the routes of many runs, so a refusal of this one is answered with
 		 * `pending_stage_route_refused` and leaves the connection open. Honoured only with a `requestId`, and sent only to
@@ -250,6 +257,13 @@ export type ClientMessage =
       stageKeys: string[];
       capability: string;
     }
+	/**
+	 * #4006: the session that launched a run proves it with the run's launcher capability (not the route
+	 * capability its stages hold) and gains the invocation's send authority without joining
+	 * `workflow:<rootRunId>`. Sent only to a broker that advertised `claimsWorkflowInvocations`; the broker
+	 * answers with `workflow_invocation_claimed`.
+	 */
+	| { type: "claim_workflow_invocation"; requestId: string; runId: string; capability: string }
 	| {
 		type: "pending_stage_message_result";
 		requestId: string;
@@ -292,7 +306,12 @@ export type BrokerMessage =
 			refusesPendingStageRoutesInPlace?: true;
 			/** This broker answers `broker_status`; absent on older brokers, which drop a client that sends it. */
 			brokerStatus?: true;
+			/** #4006: this broker accepts `claim_workflow_invocation`; absent on older brokers, which drop a client that sends it. */
+			claimsWorkflowInvocations?: true;
+			/** #3983: this broker accepts `saving`; absent on older brokers, which drop a client that sends it. */
+			extendsSaves?: true;
 	  }
+	| { type: "workflow_invocation_claimed"; requestId: string; claimed: boolean }
   | { type: "registration_failed"; reason: string; code?: LiveWorkflowStageRouteRefusalCode; requestId?: string }
   | { type: "question_target"; messageId: string; attemptId: string; sessionId: string }
  | { type: "sessions"; requestId: string; sessions: SessionInfo[]; workflowStages?: WorkflowStageRosterEntry[]; workflowFutureStages?: WorkflowFutureStageRosterEntry[]; restricted?: true }
@@ -311,6 +330,8 @@ export type BrokerMessage =
 			target: string;
 			message: Message;
 			live?: boolean;
+			/** #4006: the broker authorized the sender as the session that launched this run, not by membership. */
+			invocationControl?: true;
 	  }
   | { type: "live_workflow_stage_route_registered"; requestId: string }
 	| { type: "pending_stage_route_registered"; requestId: string }

package/dist/builtin/mcp/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bastani/mcp",
-  "version": "0.9.45",
+  "version": "0.9.46",
   "private": true,
   "description": "Atomic's pi-compatible MCP integration for server connections, OAuth, tools, resources, and terminal management.",
   "contributors": [

package/dist/builtin/subagents/CHANGELOG.md

@@ -2,6 +2,27 @@
 
 ## [Unreleased]
 
+## [0.9.46] - 2026-10-27
+
+### Fixed
+
+- A subagent that waited for a free slot (`concurrency`, or a burst of launches) or was restored, and that starts after its parent workflow stage's session was replaced by model fallback, now launches instead of failing with `This extension ctx is stale after session replacement or reload`. It takes its settings from the replacement session, and starts in the directory it was launched for ([#3981](https://github.com/bastani-inc/atomic/issues/3981))
+- A detached subagent that exits after its parent workflow stage's session was replaced by model fallback still sends its completion notice. Before, the notice was lost and the workflow run failed with `This extension ctx is stale after session replacement or reload` ([#3981](https://github.com/bastani-inc/atomic/issues/3981))
+- A resumed subagent child now receives its resume message and the messages it had queued and not read exactly as written. They used to go through `prompt()` or `followUp()` depending on whether the child had held messages, so `/review …` was replaced by a prompt template's contents, a registered command such as `/workflow` either ran or failed the child with `Extension command "/workflow" cannot be queued`, and text the child had already received was expanded a second time. Only an original task the child never read is still prompted the way a fresh launch prompts it ([#4027](https://github.com/bastani-inc/atomic/pull/4027)).
+- A subagent child paused, quit or stopped by its owner while it waited for its run's running capacity, before its session existed, can be resumed and restored again: it used to report `could not be resumed: no session was recorded for it`. A child admitted behind its run's concurrency limit and stopped that way no longer receives its task twice when it is restored. Resuming or restoring a child that had not started now says it started fresh with its task instead of claiming it resumed from its own session ([#4027](https://github.com/bastani-inc/atomic/pull/4027)).
+- A subagent whose model is pinned with a thinking suffix (such as `provider/model:low`) no longer shows that suffix as part of its model on its launch and status cards once its session has started; the cards show `provider/model` and the thinking level beside it, as they do before the session starts ([#4009](https://github.com/bastani-inc/atomic/issues/4009))
+- A paused subagent child resumed without a message, and a child restored after a restart, are now told to redo or continue a command or step the pause or restart interrupted, as a resumed workflow stage is ([#3996](https://github.com/bastani-inc/atomic/issues/3996))
+
+## [0.9.46-alpha.1] - 2026-10-27
+
+### Fixed
+
+- A subagent that waited for a free slot (`concurrency`, or a burst of launches) or was restored, and that starts after its parent workflow stage's session was replaced by model fallback, now launches instead of failing with `This extension ctx is stale after session replacement or reload`. It takes its settings from the replacement session, and starts in the directory it was launched for ([#3981](https://github.com/bastani-inc/atomic/issues/3981))
+- A detached subagent that exits after its parent workflow stage's session was replaced by model fallback still sends its completion notice. Before, the notice was lost and the workflow run failed with `This extension ctx is stale after session replacement or reload` ([#3981](https://github.com/bastani-inc/atomic/issues/3981))
+- A resumed subagent child now receives its resume message and the messages it had queued and not read exactly as written. They used to go through `prompt()` or `followUp()` depending on whether the child had held messages, so `/review …` was replaced by a prompt template's contents, a registered command such as `/workflow` either ran or failed the child with `Extension command "/workflow" cannot be queued`, and text the child had already received was expanded a second time. Only an original task the child never read is still prompted the way a fresh launch prompts it ([#4027](https://github.com/bastani-inc/atomic/pull/4027)).
+- A subagent child paused, quit or stopped by its owner while it waited for its run's running capacity, before its session existed, can be resumed and restored again: it used to report `could not be resumed: no session was recorded for it`. A child admitted behind its run's concurrency limit and stopped that way no longer receives its task twice when it is restored. Resuming or restoring a child that had not started now says it started fresh with its task instead of claiming it resumed from its own session ([#4027](https://github.com/bastani-inc/atomic/pull/4027)).
+- A subagent whose model is pinned with a thinking suffix (such as `provider/model:low`) no longer shows that suffix as part of its model on its launch and status cards once its session has started; the cards show `provider/model` and the thinking level beside it, as they do before the session starts ([#4009](https://github.com/bastani-inc/atomic/issues/4009))
+
 ## [0.9.44] - 2026-10-25
 
 ### Changed

package/dist/builtin/subagents/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bastani/subagents",
-  "version": "0.9.45",
+  "version": "0.9.46",
   "private": true,
   "description": "Atomic extension for delegating tasks to subagents with parallel execution. Fork of: https://github.com/nicobailon/pi-subagents",
   "contributors": [