@desplega.ai/agent-swarm 1.131.0 → 1.133.1

package/src/types.ts

@@ -633,6 +633,102 @@ export const AgentTaskSchema = z
   })
   .openapi("AgentTask");
 
+// ─── Create-task input contract ──────────────────────────────────────────────
+//
+// Runtime schema for `createTaskExtended` options (src/be/db.ts). Every task
+// write — REST POST /api/tasks, MCP send-task, the scripts bridge, webhooks,
+// the scheduler, and internal callers — funnels through that function, so
+// this schema is the single enforcement point for task-input shapes. It
+// rejects, never coerces: a type mismatch or out-of-range value throws, and
+// only an ABSENT field falls back to the `??` defaults at the INSERT bind
+// site. Deliberately NOT an `.openapi()` component: it is an internal write
+// contract, not a response shape.
+export const CreateTaskOptionsSchema = z.object({
+  key: z.string().min(1).optional(),
+  agentId: z.string().nullable().optional(),
+  creatorAgentId: z.string().optional(),
+  source: AgentTaskSourceSchema.optional(),
+  taskType: z.string().max(50).optional(),
+  tags: z.array(z.string()).optional(),
+  priority: z.number().int().min(0).max(100).optional(),
+  dependsOn: z.array(z.string()).optional(),
+  offeredTo: z.string().optional(),
+  /** Explicitly set initial status. */
+  status: z.enum(["backlog", "unassigned"]).optional(),
+  slackChannelId: z.string().optional(),
+  slackThreadTs: z.string().optional(),
+  /** Exact Slack message that directly triggered this task; never inherited. */
+  slackTriggerMessageTs: z.string().optional(),
+  slackUserId: z.string().optional(),
+  /**
+   * Opt out of the residual Slack/contextKey normalization (see the
+   * "Residual-mismatch guard" comment near the INSERT in src/be/db.ts): a
+   * deliberate cross-channel/thread dispatch (e.g. `send-task`'s
+   * `overrideSlackContext: true`) sets this so its explicit slackChannelId/
+   * slackThreadTs survive even when they disagree with a slack-family
+   * `contextKey`/parent. Trusted callers that don't set this get normalized —
+   * this boundary must not let a caller silently persist a mismatch.
+   */
+  overrideSlackContext: z.boolean().optional(),
+  vcsProvider: z.enum(["github", "gitlab"]).optional(),
+  vcsRepo: z.string().optional(),
+  vcsEventType: z.string().optional(),
+  vcsNumber: z.number().int().optional(),
+  vcsCommentId: z.number().int().optional(),
+  vcsAuthor: z.string().optional(),
+  vcsUrl: z.string().optional(),
+  vcsInstallationId: z.number().int().optional(),
+  vcsNodeId: z.string().optional(),
+  agentmailInboxId: z.string().optional(),
+  agentmailMessageId: z.string().optional(),
+  agentmailThreadId: z.string().optional(),
+  mentionMessageId: z.string().optional(),
+  mentionChannelId: z.string().optional(),
+  dir: z.string().optional(),
+  parentTaskId: z.string().optional(),
+  model: z.string().optional(),
+  modelTier: ModelTierSchema.optional(),
+  effort: ReasoningEffortSchema.optional(),
+  scheduleId: z.string().optional(),
+  workflowRunId: z.string().optional(),
+  workflowRunStepId: z.string().optional(),
+  sourceTaskId: z.string().optional(),
+  /**
+   * Optional JSON Schema the agent's final output must conform to.
+   *
+   * Enforced via the MCP `store-progress` tool (validated in
+   * `src/tools/store-progress.ts`). NOT enforced when the task runs on
+   * default-mode Devin (no MCP) — see runbooks/harness-providers.md
+   * ("Per-task outputSchema support"). Callers reading `task.output` for
+   * a schema'd task should be defensive about JSON parsing.
+   */
+  outputSchema: z.record(z.string(), z.unknown()).optional(),
+  /**
+   * When a `parentTaskId` is set, the child inherits the parent's `outputSchema`
+   * by default. Set this to `false` to opt out — used by control-plane children
+   * (e.g. the Lead `reroute-decision` task) that must inherit Slack/VCS context
+   * from the parent but must NOT be forced to satisfy the original work's output
+   * contract on completion (which would block the control task — DES-523).
+   */
+  inheritParentOutputSchema: z.boolean().optional(),
+  followUpConfig: FollowUpConfigSchema.optional(),
+  requestedByUserId: z.string().optional(),
+  contextKey: z.string().optional(),
+  /**
+   * Internal control-plane escape hatch for continuations that MUST coexist
+   * with their active Linear parent (for example promoted steering). General
+   * task creation keeps tracker-context dedup enabled.
+   */
+  bypassTrackerContextDedup: z.boolean().optional(),
+  /**
+   * Routing-affinity snapshot gating pool eligibility (see
+   * `isAgentEligibleForTask`). Inherited from the parent (via `parentTaskId`)
+   * when not explicitly set — same treatment as `vcsRepo`/`contextKey`.
+   */
+  routingAffinity: RoutingAffinitySchema.optional(),
+});
+export type CreateTaskOptions = z.infer<typeof CreateTaskOptionsSchema>;
+
 // ============================================================================
 // Task Attachments (Phase 1 — pointer-based artifacts)
 // ============================================================================
@@ -645,11 +741,19 @@ export const AgentTaskSchema = z
 export const TaskAttachmentKindSchema = z.enum(["agent-fs", "url", "shared-fs", "page"]);
 export type TaskAttachmentKind = z.infer<typeof TaskAttachmentKindSchema>;
 
+export const SERVER_GENERATED_ATTACHMENT_CAPABILITY = "_agentSwarmGeneratedBy";
+
+const attachmentCapabilitiesSchema = z
+  .record(z.string(), z.unknown())
+  .refine((capabilities) => !(SERVER_GENERATED_ATTACHMENT_CAPABILITY in capabilities), {
+    message: `${SERVER_GENERATED_ATTACHMENT_CAPABILITY} is reserved for server-generated attachments`,
+  });
+
 const attachmentCommonFields = {
   name: z.string().min(1).describe("Display name for the attachment."),
   providerId: z.string().min(1).optional(),
   providerKey: z.string().min(1).optional(),
-  capabilities: z.record(z.string(), z.unknown()).optional(),
+  capabilities: attachmentCapabilitiesSchema.optional(),
   mimeType: z.string().optional(),
   sizeBytes: z.number().int().min(0).optional(),
   sha256: z.string().optional(),
@@ -755,6 +859,22 @@ export const UserSchema = z
 
 export type User = z.infer<typeof UserSchema>;
 
+/**
+ * Structured communication preferences read from `users.metadata.comms`.
+ * All fields are free-form strings; values render verbatim into the requester
+ * profile prompt. Written merge-safely via the `comms` field on
+ * PATCH /api/users/{id} and the manage-user tool.
+ */
+export const UserCommsPrefsSchema = z
+  .object({
+    tone: z.string().optional(),
+    language: z.string().optional(),
+    verbosity: z.string().optional(),
+  })
+  .openapi("UserCommsPrefs");
+
+export type UserCommsPrefs = z.infer<typeof UserCommsPrefsSchema>;
+
 /**
  * Identity event types — mirrored in lockstep with the CHECK constraint on
  * `user_identity_events.eventType` in migration 064. Drift breaks helper
@@ -1338,6 +1458,8 @@ export const EventNameSchema = z.enum([
   "system.boot",
   "system.migration",
   "system.error",
+  "system.profile_sync_rejected",
+  "system.profile_sync_reconciled",
   // Script catalog events
   "script.global_upsert",
   // Schedule events
@@ -1563,6 +1685,8 @@ export const ActiveSessionSchema = z
     taskDescription: z.string().nullable(),
     runnerSessionId: z.string().nullable(),
     providerSessionId: z.string().nullable(),
+    /** Runtime process that owns this session; null for single-runtime rows. */
+    runtimeInstanceId: z.string().nullable().optional(),
     startedAt: z.iso.datetime(),
     lastHeartbeatAt: z.iso.datetime(),
   })
@@ -1570,6 +1694,45 @@ export const ActiveSessionSchema = z
 
 export type ActiveSession = z.infer<typeof ActiveSessionSchema>;
 
+// ============================================================================
+// Runtime Instance Types (multi-runtime worker tracking)
+// ============================================================================
+
+/**
+ * Lifecycle of a runtime instance. Zod is the source of truth for the allowed
+ * values — the SQL column has no CHECK constraint (migration 132) so adding a
+ * state doesn't require a table rebuild.
+ */
+export const RuntimeInstanceStatusSchema = z.enum(["active", "offline"]);
+
+/**
+ * One worker process serving a logical agent. The `agents` row (AGENT_ID /
+ * X-Agent-ID) keeps durable identity and the logical maxTasks policy; a
+ * runtime instance carries only process-scoped state: liveness and its own
+ * reported execution capacity. A logical agent may be served by 0..N runtime
+ * instances; rows exist only for multi-runtime registrations
+ * (MULTI_RUNTIME_ENABLED).
+ */
+export const RuntimeInstanceSchema = z
+  .object({
+    id: z.string(),
+    agentId: z.string(),
+    status: RuntimeInstanceStatusSchema,
+    /** Runtime-local concurrent task capacity, self-reported at registration. */
+    reportedSlots: z.number().int(),
+    /** Process-local credential readiness; null when never reported. */
+    credentialReady: z.boolean().nullable().optional(),
+    /** Provider-neutral metadata; unused in the initial slice. */
+    metadata: z.record(z.string(), z.unknown()).nullable(),
+    lastSeenAt: z.iso.datetime(),
+    createdAt: z.iso.datetime(),
+    updatedAt: z.iso.datetime(),
+  })
+  .openapi("RuntimeInstance");
+
+export type RuntimeInstanceStatus = z.infer<typeof RuntimeInstanceStatusSchema>;
+export type RuntimeInstance = z.infer<typeof RuntimeInstanceSchema>;
+
 // ============================================================================
 // Workflow Engine Types
 // ============================================================================
@@ -2238,6 +2401,7 @@ export const WorkflowRunSchema = z
     triggerData: z.unknown().optional(),
     context: z.record(z.string(), z.unknown()).optional(),
     error: z.string().optional(),
+    createdBy: z.string().optional(),
     startedAt: z.string(),
     lastUpdatedAt: z.string(),
     finishedAt: z.string().optional(),

package/src/utils/github-pull-request.ts

@@ -0,0 +1,76 @@
+export interface GitHubPullRequestUrl {
+  url: string;
+  owner: string;
+  repo: string;
+  number: number;
+}
+
+const CANDIDATE_TOKEN_RE = /[^\s()[\]{}<>"'`]+/g;
+const TRAILING_PROSE_PUNCTUATION_RE = /[)\]},.;:!]+$/;
+const GITHUB_PATH_SEGMENT_RE = /^[\w.-]+$/;
+
+function parseGitHubPullRequestToken(token: string): GitHubPullRequestUrl | null {
+  const candidate = token.replace(TRAILING_PROSE_PUNCTUATION_RE, "");
+  const lowerCandidate = candidate.toLowerCase();
+  if (
+    !lowerCandidate.startsWith("https://github.com/") &&
+    !lowerCandidate.startsWith("http://github.com/") &&
+    !lowerCandidate.startsWith("github.com/")
+  ) {
+    return null;
+  }
+  const withScheme = /^https?:\/\//i.test(candidate) ? candidate : `https://${candidate}`;
+
+  let parsed: URL;
+  try {
+    parsed = new URL(withScheme);
+  } catch {
+    return null;
+  }
+  if (
+    parsed.host.toLowerCase() !== "github.com" ||
+    parsed.username.length > 0 ||
+    parsed.password.length > 0
+  ) {
+    return null;
+  }
+
+  const [owner, repo, pull, numberText] = parsed.pathname.split("/").filter(Boolean);
+  if (
+    !owner ||
+    !repo ||
+    pull?.toLowerCase() !== "pull" ||
+    !numberText ||
+    !GITHUB_PATH_SEGMENT_RE.test(owner) ||
+    !GITHUB_PATH_SEGMENT_RE.test(repo) ||
+    !/^\d+$/.test(numberText)
+  ) {
+    return null;
+  }
+
+  return {
+    url: `https://github.com/${owner}/${repo}/pull/${numberText}`,
+    owner,
+    repo,
+    number: Number(numberText),
+  };
+}
+
+/** Extract distinct canonical GitHub pull-request URLs from free text. */
+export function extractGitHubPullRequestUrls(
+  text: string | null | undefined,
+): GitHubPullRequestUrl[] {
+  if (!text) return [];
+
+  const results: GitHubPullRequestUrl[] = [];
+  const seen = new Set<string>();
+  for (const match of text.matchAll(CANDIDATE_TOKEN_RE)) {
+    const pullRequest = parseGitHubPullRequestToken(match[0]);
+    if (!pullRequest) continue;
+    const dedupeKey = pullRequest.url.toLowerCase();
+    if (seen.has(dedupeKey)) continue;
+    seen.add(dedupeKey);
+    results.push(pullRequest);
+  }
+  return results;
+}

package/src/utils/identity-field-budget.ts

@@ -0,0 +1,73 @@
+import { BOOTSTRAP_MAX_CHARS } from "../prompts/base-prompt";
+
+export const SOUL_MD_MAX_CHARS = 10_000;
+export const IDENTITY_MD_MAX_CHARS = 10_000;
+
+export const IDENTITY_FIELD_BUDGETS = {
+  soulMd: SOUL_MD_MAX_CHARS,
+  identityMd: IDENTITY_MD_MAX_CHARS,
+  claudeMd: BOOTSTRAP_MAX_CHARS,
+  toolsMd: BOOTSTRAP_MAX_CHARS,
+} as const;
+
+export type BudgetedIdentityField = keyof typeof IDENTITY_FIELD_BUDGETS;
+
+export interface IdentityFieldBudgetRejection {
+  field: BudgetedIdentityField;
+  dbSize: number;
+  diskSize: number;
+  budget: number;
+  delta: number;
+  reason: string;
+}
+
+export type IdentityFieldBudgetResult =
+  | { ok: true }
+  | ({ ok: false } & IdentityFieldBudgetRejection);
+
+export function checkIdentityFieldBudget({
+  field,
+  currentValue,
+  nextValue,
+}: {
+  field: BudgetedIdentityField;
+  currentValue: string;
+  nextValue: string;
+}): IdentityFieldBudgetResult {
+  const budget = IDENTITY_FIELD_BUDGETS[field];
+  if (nextValue.length <= budget || nextValue.length <= currentValue.length) {
+    return { ok: true };
+  }
+
+  const delta = nextValue.length - currentValue.length;
+  const remediation =
+    field === "toolsMd"
+      ? ` Content past the ${budget}-character cap is already silently dropped at read time, so shrinking that tail loses nothing sessions currently receive. Move durable content into memories and keep pointers to it in this field.`
+      : field === "claudeMd"
+        ? ` The tail past the ${budget}-character cap is dropped from the base prompt and only reaches harnesses with a native CLAUDE.md loader. Move durable content into memories and keep pointers to it in this field.`
+        : " Move durable content into memories and keep pointers to it in this field.";
+
+  return {
+    ok: false,
+    field,
+    dbSize: currentValue.length,
+    diskSize: nextValue.length,
+    budget,
+    delta,
+    reason:
+      `Update rejected for ${field}: current size ${currentValue.length} characters, ` +
+      `budget ${budget} characters, delta ${delta >= 0 ? "+" : ""}${delta} characters.` +
+      remediation,
+  };
+}
+
+export class IdentityFieldBudgetError extends Error {
+  constructor(
+    readonly rejection: IdentityFieldBudgetRejection,
+    readonly dbHash: string,
+    readonly diskHash: string,
+  ) {
+    super(rejection.reason);
+    this.name = "IdentityFieldBudgetError";
+  }
+}

package/src/utils/multi-runtime.ts

@@ -0,0 +1,20 @@
+import { parseEnvFlag } from "./env-flag";
+
+/**
+ * Opt-in, default off: allows one logical agent to be served by several
+ * worker processes. Lives outside `src/be` so worker-side code can import it
+ * without crossing the DB boundary.
+ */
+export function isMultiRuntimeEnabled(env: NodeJS.ProcessEnv = process.env): boolean {
+  return parseEnvFlag(env.MULTI_RUNTIME_ENABLED, false);
+}
+
+/**
+ * Per-boot runtime identity the runner stamps into the process environment
+ * before any provider session exists. Adapters read it here to send the
+ * X-Runtime-Instance-ID header on the swarm MCP session — runtime identity is
+ * process/auth context, never a tool argument.
+ */
+export function swarmRuntimeInstanceId(env: NodeJS.ProcessEnv = process.env): string | undefined {
+  return env.SWARM_RUNTIME_INSTANCE_ID || undefined;
+}

package/src/utils/requester-comms.ts

@@ -0,0 +1,24 @@
+import type { User, UserCommsPrefs } from "../types";
+
+function pickString(value: unknown): string | undefined {
+  return typeof value === "string" && value.trim().length > 0 ? value.trim() : undefined;
+}
+
+/**
+ * Extract structured communication preferences from `users.metadata.comms`.
+ * `metadata` is a free-form JSON blob with no write-side validation, so only
+ * non-empty string fields survive; returns undefined when nothing usable is set.
+ */
+export function getUserCommsPrefs(
+  user: Pick<User, "metadata"> | null | undefined,
+): UserCommsPrefs | undefined {
+  const comms = user?.metadata?.comms;
+  if (!comms || typeof comms !== "object" || Array.isArray(comms)) return undefined;
+  const record = comms as Record<string, unknown>;
+  const prefs: UserCommsPrefs = {
+    tone: pickString(record.tone),
+    language: pickString(record.language),
+    verbosity: pickString(record.verbosity),
+  };
+  return prefs.tone || prefs.language || prefs.verbosity ? prefs : undefined;
+}

package/src/utils/sandboxed-process.ts

@@ -35,20 +35,36 @@ export const DEFAULT_SANDBOX_LIMITS: SandboxResourceLimits = {
 };
 
 /**
- * Bun's Linux runtime reserves several GB of virtual address space at
- * startup, so any sandboxed command whose argv[0] is `bun` needs a much
- * higher RLIMIT_AS floor than a plain shell/python process or the harness is
- * killed before user code ever runs. `buildSandboxedCommand` applies this
- * automatically — callers don't need to special-case it.
+ * Bun and Node reserve several GB of virtual address space and start runtime
+ * threads before user code runs. Give their process trees enough RLIMIT_AS
+ * and RLIMIT_NPROC headroom to boot while retaining the stricter defaults for
+ * direct non-interpreter commands.
  */
 export const BUN_SANDBOX_VIRTUAL_MEMORY_MB = 4096;
+export const JAVASCRIPT_RUNTIME_SANDBOX_MAX_PROCS = 512;
+
+const JAVASCRIPT_RUNTIMES = new Set(["bun", "bunx", "node", "nodejs", "npx"]);
+const SHELL_RUNTIMES = new Set(["bash", "dash", "sh"]);
+
+function commandBasename(command: string): string {
+  return command.slice(command.lastIndexOf("/") + 1);
+}
+
+function usesInterpreterSandboxProfile(innerCommand: readonly string[]): boolean {
+  const runtime = commandBasename(innerCommand[0] ?? "");
+  // A shell can invoke another interpreter through arbitrary valid shell
+  // grammar (substitutions, functions, variables, heredocs, and more). Treat
+  // the shell itself as the runtime boundary instead of letting untrusted
+  // source text select its own resource profile through brittle parsing.
+  return JAVASCRIPT_RUNTIMES.has(runtime) || SHELL_RUNTIMES.has(runtime);
+}
 
 function shellQuote(value: string): string {
   return `'${value.replaceAll("'", "'\\''")}'`;
 }
 
 /**
- * Wrap `innerCommand` in a POSIX `sh -c` prelude that applies the resource
+ * Wrap `innerCommand` in a shell prelude that applies the resource
  * ulimits above, then `exec`s into a completely clean environment (`env -i`)
  * containing ONLY the entries in `env`. This is the enforcement point for
  * two invariants every spawn-user-code path must uphold:
@@ -60,7 +76,10 @@ function shellQuote(value: string): string {
  *     token / API key in `env`; pass secrets over stdin instead so they
  *     never appear in `/proc/<pid>/environ` or a child's `process.env`.
  *
- * No-ops (returns `innerCommand` unchanged) on win32, where `ulimit`/`env -i`
+ * JavaScript-capable runtime trees use Bash intentionally: Ubuntu's `/bin/sh` is
+ * dash, whose `ulimit` does not implement `-u` (RLIMIT_NPROC). Other commands
+ * retain the existing POSIX-sh sandbox behavior and its strict profile. No-ops
+ * (returns `innerCommand` unchanged) on win32, where `ulimit`/`env -i`
  * don't exist — matches the existing native.ts behavior. Because this no-op
  * means `env` is never applied on win32, callers MUST pass `env` itself
  * (not just `{ PATH }`) to `Bun.spawn` on that platform — use
@@ -74,15 +93,18 @@ export function buildSandboxedCommand(
 ): string[] {
   if (process.platform === "win32") return [...innerCommand];
 
-  const virtualMemoryMb =
-    innerCommand[0] === "bun"
-      ? Math.max(limits.virtualMemoryMb, BUN_SANDBOX_VIRTUAL_MEMORY_MB)
-      : limits.virtualMemoryMb;
+  const usesInterpreterProfile = usesInterpreterSandboxProfile(innerCommand);
+  const virtualMemoryMb = usesInterpreterProfile
+    ? Math.max(limits.virtualMemoryMb, BUN_SANDBOX_VIRTUAL_MEMORY_MB)
+    : limits.virtualMemoryMb;
+  const maxProcs = usesInterpreterProfile
+    ? Math.max(limits.maxProcs, JAVASCRIPT_RUNTIME_SANDBOX_MAX_PROCS)
+    : limits.maxProcs;
 
   const ulimits = [
     `ulimit -v ${Math.floor(virtualMemoryMb * 1024)} 2>/dev/null || true`,
     `ulimit -t ${limits.cpuTimeSec} 2>/dev/null || true`,
-    `ulimit -u ${limits.maxProcs} 2>/dev/null || true`,
+    `ulimit -u ${maxProcs} 2>/dev/null || true`,
     `ulimit -f ${limits.maxFileKb} 2>/dev/null || true`,
     `ulimit -n ${limits.maxFdCount} 2>/dev/null || true`,
   ].join("; ");
@@ -92,7 +114,11 @@ export function buildSandboxedCommand(
     .join(" ");
   const quotedInner = innerCommand.map(shellQuote).join(" ");
 
-  return ["sh", "-c", `${ulimits}; exec env -i ${envAssignments} ${quotedInner}`];
+  return [
+    usesInterpreterProfile ? "bash" : "sh",
+    "-c",
+    `${ulimits}; exec env -i ${envAssignments} ${quotedInner}`,
+  ];
 }
 
 /**
@@ -101,7 +127,7 @@ export function buildSandboxedCommand(
  *
  * On POSIX, `buildSandboxedCommand` wraps the command in an `env -i` prelude
  * that injects `env` itself into the child — Bun.spawn only needs PATH to
- * locate the `sh` binary that runs the prelude.
+ * locate the shell binary that runs the prelude.
  *
  * On win32, `buildSandboxedCommand` is a no-op (no `ulimit`/`env -i`), so
  * there is no prelude to inject `env` — it must go through Bun.spawn's own

package/src/workflows/engine.ts

@@ -76,7 +76,13 @@ export async function startWorkflowExecution(
   // Cooldown check
   if (workflow.cooldown && shouldSkipCooldown(workflow.id, workflow.cooldown)) {
     const runId = crypto.randomUUID();
-    createWorkflowRun({ id: runId, workflowId: workflow.id, triggerData });
+    createWorkflowRun({
+      id: runId,
+      workflowId: workflow.id,
+      triggerType: options.triggerType ?? "manual",
+      triggerData,
+      createdBy: options.requestedByUserId,
+    });
     updateWorkflowRun(runId, {
       status: "skipped",
       error: "cooldown",
@@ -86,7 +92,13 @@ export async function startWorkflowExecution(
   }
 
   const runId = crypto.randomUUID();
-  createWorkflowRun({ id: runId, workflowId: workflow.id, triggerData });
+  createWorkflowRun({
+    id: runId,
+    workflowId: workflow.id,
+    triggerType: options.triggerType ?? "manual",
+    triggerData,
+    createdBy: options.requestedByUserId,
+  });
   telemetry.workflow("started", {
     workflowId: workflow.id,
     nodeCount: workflow.definition.nodes.length,
@@ -160,6 +172,14 @@ export async function walkGraph(
   secretKeys: Set<string> = new Set(),
   options: WorkflowExecutionOptions = {},
 ): Promise<void> {
+  // Initial triggers carry the requester in options. Resumes, retries, and
+  // recovery start from persisted state, so rehydrate it from the run.
+  if (!options.requestedByUserId) {
+    options = {
+      ...options,
+      requestedByUserId: getWorkflowRun(runId)?.createdBy,
+    };
+  }
   let nodeExecutionCount = 0;
   // `run.id` is a context builtin (like `trigger` / `input`) so nodes can reference
   // their own run — e.g. an audit/receipt node correlating its output with the run

package/src/workflows/executors/swarm-script.ts

@@ -4,7 +4,12 @@ import {
   getScriptMcpConnectionDescriptors,
 } from "../../be/script-connections";
 import { buildScriptCredentialBindingsWithFailures } from "../../be/script-credential-broker";
-import { getScript, getScriptVersion } from "../../be/scripts/db";
+import {
+  getScript,
+  getScriptVersion,
+  restoreScratchScriptLastUsedIfUnchanged,
+  touchScratchScriptLastUsed,
+} from "../../be/scripts/db";
 import {
   DEFAULT_SCRIPT_RESOURCES,
   MAX_SCRIPT_WALL_CLOCK_MS,
@@ -104,6 +109,12 @@ export class SwarmScriptExecutor extends BaseExecutor<
       };
     }
 
+    // Touch before executing so an already-stale scratch script isn't reaped
+    // by the retention sweep while this run is still in flight.
+    const runStartTouch = resolved.script.isScratch
+      ? touchScratchScriptLastUsed(resolved.script.id)
+      : null;
+
     const credentials = await buildScriptCredentialBindingsWithFailures({
       agentId: agentId ?? undefined,
     });
@@ -118,6 +129,18 @@ export class SwarmScriptExecutor extends BaseExecutor<
       mcpConnections: getScriptMcpConnectionDescriptors({ agentId: agentId ?? undefined }),
       timeoutMs: config.timeoutMs,
     });
+    if (output.exitCode === 0 && !output.error && !output.runtimeError) {
+      touchScratchScriptLastUsed(resolved.script.id);
+    } else if (resolved.script.isScratch && runStartTouch) {
+      // Failed run — restore the pre-run timestamp so it doesn't buy the
+      // script another retention window, unless a concurrent run already
+      // touched it since.
+      restoreScratchScriptLastUsedIfUnchanged(
+        resolved.script.id,
+        resolved.script.updatedAt,
+        runStartTouch,
+      );
+    }
 
     const workflowOutput = {
       result: output.result,

package/src/workflows/resume.ts

@@ -13,6 +13,7 @@ import {
   updateWorkflowRun,
   updateWorkflowRunStep,
 } from "../be/db";
+import { scrubSecrets } from "../utils/secret-scrubber";
 import { checkpointStep } from "./checkpoint";
 import { FAILED_TASK_OUTPUT_PREFIX } from "./constants";
 import { getSuccessors } from "./definition";
@@ -51,9 +52,9 @@ export function setupWorkflowResumeListener(
   registry: ExecutorRegistry,
 ): void {
   eventBus.on("task.completed", async (data: unknown) => {
-    const event = data as TaskEvent;
-    if (!event.workflowRunId || !event.workflowRunStepId) return;
     try {
+      const event = data as TaskEvent;
+      if (!event.workflowRunId || !event.workflowRunStepId) return;
       await resumeFromTaskCompletion(event, registry);
     } catch (err) {
       console.error("[workflows] Resume from task completion failed:", err);
@@ -61,9 +62,9 @@ export function setupWorkflowResumeListener(
   });
 
   eventBus.on("task.failed", async (data: unknown) => {
-    const event = data as TaskEvent;
-    if (!event.workflowRunId || !event.workflowRunStepId) return;
     try {
+      const event = data as TaskEvent;
+      if (!event.workflowRunId || !event.workflowRunStepId) return;
       await handleTaskFailure(event, event.failureReason ?? "Task failed", registry);
     } catch (err) {
       console.error("[workflows] Handle task failure error:", err);
@@ -71,9 +72,9 @@ export function setupWorkflowResumeListener(
   });
 
   eventBus.on("task.cancelled", async (data: unknown) => {
-    const event = data as TaskEvent;
-    if (!event.workflowRunId || !event.workflowRunStepId) return;
     try {
+      const event = data as TaskEvent;
+      if (!event.workflowRunId || !event.workflowRunStepId) return;
       await handleTaskFailure(event, "Task was cancelled", registry);
     } catch (err) {
       console.error("[workflows] Handle task cancellation error:", err);
@@ -81,9 +82,9 @@ export function setupWorkflowResumeListener(
   });
 
   eventBus.on("approval.resolved", async (data: unknown) => {
-    const event = data as ApprovalEvent;
-    if (!event.workflowRunId || !event.workflowRunStepId) return;
     try {
+      const event = data as ApprovalEvent;
+      if (!event.workflowRunId || !event.workflowRunStepId) return;
       await resumeFromApprovalResolution(event, registry);
     } catch (err) {
       console.error("[workflows] Resume from approval resolution failed:", err);
@@ -589,9 +590,16 @@ function registerWait(waitId: string, eventName: string): void {
 
   if (!listenersByEvent.has(eventName)) {
     const listener = (data: unknown) => {
-      // Fire-and-forget: don't block the bus thread. Errors are logged
-      // per-wait inside processBusEvent.
-      void processBusEvent(eventName, data);
+      // Fire-and-forget: don't block the bus thread. Per-wait errors are
+      // logged inside processBusEvent's loop, but the code around that loop
+      // is not covered by it — and the emitter cannot observe this promise,
+      // since EventEmitter discards whatever a listener returns.
+      processBusEvent(eventName, data).catch((err) => {
+        console.error(
+          `[workflows] Wait bus listener failed for event=${eventName}:`,
+          scrubSecrets(err instanceof Error ? err.message : String(err)),
+        );
+      });
     };
     listenersByEvent.set(eventName, listener);
     workflowEventBus.on(eventName, listener);