@desplega.ai/agent-swarm 1.167.0 → 1.169.0

package/src/tests/ui-e2e-ingest-payload.test.ts

@@ -101,7 +101,11 @@ function propertyKeys(path: string[]): string[] {
   return Object.keys((current as { properties: Record<string, unknown> }).properties).sort();
 }
 
-function expectSchemaKeys(actual: object, path: string[], required: string[]): void {
+function expectSchemaKeys<Actual extends object>(
+  actual: Actual,
+  path: string[],
+  required: string[],
+): void {
   const actualKeys = Object.keys(actual).sort();
   expect(actualKeys).toEqual(required.slice().sort());
   expect(actualKeys.every((key) => propertyKeys(path).includes(key))).toBe(true);

package/src/tests/user-token-routes.test.ts

@@ -228,7 +228,7 @@ describe("ChatGPT connector codes", () => {
 
   type CodeBody = { code: string; expiresAt: string; connectUrl: string };
 
-  async function createCode(userId: string, body: object = {}): Promise<CodeBody> {
+  async function createCode(userId: string, body: Record<string, unknown> = {}): Promise<CodeBody> {
     const response = await authedFetch(`/api/users/${userId}/connector-codes`, {
       method: "POST",
       body: JSON.stringify(body),

package/src/tests/workflow-executors.test.ts

@@ -984,7 +984,7 @@ describe("ValidateExecutor", () => {
 // ─── Registry Wiring ─────────────────────────────────────────
 
 describe("createExecutorRegistry", () => {
-  test("registers all 13 executors (9 instant + 4 async)", () => {
+  test("registers all 14 executors (9 instant + 5 async)", () => {
     const registry = createExecutorRegistry(mockDeps);
     const types = registry.types();
 
@@ -1001,7 +1001,8 @@ describe("createExecutorRegistry", () => {
     expect(types).toContain("foreach");
     expect(types).toContain("human-in-the-loop");
     expect(types).toContain("wait");
-    expect(types).toHaveLength(13);
+    expect(types).toContain("sub-workflow");
+    expect(types).toHaveLength(14);
   });
 
   test("instant executors have mode instant, async executors have mode async", () => {

package/src/tests/workflow-sub-workflow.test.ts

@@ -0,0 +1,363 @@
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { unlink } from "node:fs/promises";
+import { z } from "zod";
+import * as db from "../be/db";
+import {
+  closeDb,
+  createWorkflow,
+  getDbClient,
+  getWaitStateByStepId,
+  getWorkflowRun,
+  getWorkflowRunStepsByRunId,
+  initDb,
+} from "../be/db";
+import type { Workflow, WorkflowDefinition, WorkflowRun } from "../types";
+import { startWorkflowExecution } from "../workflows/engine";
+import { workflowEventBus } from "../workflows/event-bus";
+import {
+  BaseExecutor,
+  type ExecutorDependencies,
+  type ExecutorInput,
+  type ExecutorResult,
+} from "../workflows/executors/base";
+import { createExecutorRegistry } from "../workflows/executors/registry";
+import { MAX_SUB_WORKFLOW_DEPTH, SubWorkflowExecutor } from "../workflows/executors/sub-workflow";
+import { recoverIncompleteRuns } from "../workflows/recovery";
+import {
+  cancelWorkflowRun,
+  resumeWaitState,
+  setupWorkflowResumeListener,
+} from "../workflows/resume";
+
+const TEST_DB_PATH = "./test-workflow-sub-workflow.sqlite";
+
+const deps: ExecutorDependencies = {
+  db,
+  eventBus: workflowEventBus,
+  interpolate: (t: string) => t,
+};
+const registry = createExecutorRegistry(deps);
+let teardown: (() => void) | undefined;
+
+/** Holds every `test-gate` node open until the test resolves it. */
+let gate = Promise.withResolvers<void>();
+
+/** An instant node that runs until the test opens the gate. */
+class GateExecutor extends BaseExecutor<z.ZodObject, z.ZodObject> {
+  readonly type = "test-gate";
+  readonly mode = "instant" as const;
+  readonly configSchema = z.object({});
+  readonly outputSchema = z.object({});
+
+  protected async execute(): Promise<ExecutorResult<Record<string, never>>> {
+    await gate.promise;
+    return { status: "success", output: {} };
+  }
+}
+registry.register(new GateExecutor(deps));
+
+/** Runs `fn` with the live resume listener off, then turns it back on. */
+async function withoutListener(fn: () => Promise<void>): Promise<void> {
+  teardown?.();
+  try {
+    await fn();
+  } finally {
+    teardown = setupWorkflowResumeListener(workflowEventBus, registry);
+  }
+}
+
+async function makeWorkflow(def: WorkflowDefinition): Promise<Workflow> {
+  return createWorkflow({ name: `wf-${crypto.randomUUID()}`, definition: def });
+}
+
+/** A one-node child that checks `trigger.n === 1`. */
+const instantChild: WorkflowDefinition = {
+  nodes: [
+    {
+      id: "check",
+      type: "property-match",
+      config: { conditions: [{ field: "trigger.n", op: "eq", value: 1 }] },
+    },
+  ],
+};
+
+/** A child whose only instant node runs until the gate opens. */
+const gatedChild: WorkflowDefinition = {
+  nodes: [{ id: "gate", type: "test-gate", config: {} }],
+};
+
+/** A child that parks on a long time wait, so it stays `waiting`. */
+const waitingChild: WorkflowDefinition = {
+  nodes: [{ id: "pause", type: "wait", config: { mode: "time", durationMs: 3_600_000 } }],
+};
+
+function parentOf(childId: string): WorkflowDefinition {
+  return {
+    nodes: [
+      {
+        id: "child",
+        type: "sub-workflow",
+        config: { workflowId: childId, inputs: { n: 1 } },
+      },
+    ],
+  };
+}
+
+async function childRunsOf(workflowId: string): Promise<{ id: string; parentStepId: string }[]> {
+  return getDbClient().query<{ id: string; parentStepId: string }>(
+    "SELECT id, parentStepId FROM workflow_runs WHERE workflowId = ?",
+    [workflowId],
+  );
+}
+
+async function waitForRun(
+  runId: string,
+  done: (run: WorkflowRun) => boolean,
+): Promise<WorkflowRun> {
+  for (let i = 0; i < 250; i++) {
+    const run = await getWorkflowRun(runId);
+    if (run && done(run)) return run;
+    await Bun.sleep(20);
+  }
+  throw new Error(`run ${runId} did not settle`);
+}
+
+const isDone = (run: WorkflowRun) => run.status !== "running" && run.status !== "waiting";
+
+async function childRunOf(workflowId: string, status: string): Promise<WorkflowRun> {
+  for (let i = 0; i < 250; i++) {
+    const [row] = await childRunsOf(workflowId);
+    if (row) return waitForRun(row.id, (r) => r.status === status);
+    await Bun.sleep(20);
+  }
+  throw new Error(`no child run of ${workflowId}`);
+}
+
+beforeAll(() => {
+  initDb(TEST_DB_PATH);
+  teardown = setupWorkflowResumeListener(workflowEventBus, registry);
+});
+
+afterAll(async () => {
+  teardown?.();
+  closeDb();
+  for (const suffix of ["", "-wal", "-shm"]) {
+    await unlink(`${TEST_DB_PATH}${suffix}`).catch(() => {});
+  }
+});
+
+describe("sub-workflow node", () => {
+  test("runs an instant child and exposes its node outputs", async () => {
+    const child = await makeWorkflow(instantChild);
+    const parent = await makeWorkflow(parentOf(child.id));
+
+    const runId = await startWorkflowExecution(parent, {}, registry);
+
+    const run = await waitForRun(runId, isDone);
+    expect(run?.status).toBe("completed");
+    const [childRun] = await childRunsOf(child.id);
+    const output = run?.context?.child as { runId: string; outputs: Record<string, unknown> };
+    expect(output.runId).toBe(childRun!.id);
+    expect(output.outputs.check).toMatchObject({ passed: true });
+    expect(output.outputs.trigger).toBeUndefined();
+  });
+
+  test("a failed child fails the node and the parent run", async () => {
+    const child = await makeWorkflow({
+      nodes: [{ id: "bad", type: "property-match", config: { conditions: [] } }],
+    });
+    const parent = await makeWorkflow(parentOf(child.id));
+
+    const runId = await startWorkflowExecution(parent, {}, registry);
+
+    const run = await waitForRun(runId, isDone);
+    expect(run?.status).toBe("failed");
+    const [step] = await getWorkflowRunStepsByRunId(runId);
+    expect(step?.status).toBe("failed");
+    expect(step?.error).toContain("failed");
+  });
+
+  test("parent waits for an async child and resumes when it completes", async () => {
+    const child = await makeWorkflow(waitingChild);
+    const parent = await makeWorkflow(parentOf(child.id));
+
+    const runId = await startWorkflowExecution(parent, {}, registry);
+    expect((await getWorkflowRun(runId))?.status).toBe("waiting");
+    const childRun = await childRunOf(child.id, "waiting");
+
+    const [childStep] = await getWorkflowRunStepsByRunId(childRun.id);
+    const wait = await getWaitStateByStepId(childStep!.id);
+    await resumeWaitState(wait!.id, "fired", undefined, registry);
+
+    const run = await waitForRun(runId, (r) => r.status !== "waiting");
+    expect(run.status).toBe("completed");
+    expect((run.context?.child as { runId: string }).runId).toBe(childRun.id);
+  });
+
+  test("a cancelled child fails the waiting parent step", async () => {
+    const child = await makeWorkflow(waitingChild);
+    const parent = await makeWorkflow(parentOf(child.id));
+
+    const runId = await startWorkflowExecution(parent, {}, registry);
+    const childRun = await childRunOf(child.id, "waiting");
+    await cancelWorkflowRun(childRun.id, "stop");
+
+    const run = await waitForRun(runId, (r) => r.status !== "waiting");
+    expect(run.status).toBe("failed");
+    expect(run.error).toContain(`Child workflow run ${childRun.id} cancelled`);
+  });
+
+  test("re-executing the step reconnects to the existing child; recovery resumes it", () =>
+    // No live listener for this test: the child finishing is only seen by recovery.
+    withoutListener(async () => {
+      const child = await makeWorkflow(waitingChild);
+      const parent = await makeWorkflow(parentOf(child.id));
+
+      const runId = await startWorkflowExecution(parent, {}, registry);
+      const [parentStep] = await getWorkflowRunStepsByRunId(runId);
+      const childRun = await childRunOf(child.id, "waiting");
+
+      // A restart re-runs the executor for the same step.
+      const again = await registry.get("sub-workflow").run({
+        config: { workflowId: child.id, inputs: { n: 1 } },
+        context: {},
+        meta: {
+          runId,
+          stepId: parentStep!.id,
+          nodeId: "child",
+          workflowId: parent.id,
+          dryRun: false,
+        },
+      });
+      expect(again).toMatchObject({ async: true, correlationId: childRun.id });
+      expect(await childRunsOf(child.id)).toHaveLength(1);
+
+      // The child finishes while nothing listens.
+      const [childStep] = await getWorkflowRunStepsByRunId(childRun.id);
+      const wait = await getWaitStateByStepId(childStep!.id);
+      await resumeWaitState(wait!.id, "fired", undefined, registry);
+      expect((await getWorkflowRun(childRun.id))?.status).toBe("completed");
+      expect((await getWorkflowRun(runId))?.status).toBe("waiting");
+
+      await recoverIncompleteRuns(registry);
+      expect((await getWorkflowRun(runId))?.status).toBe("completed");
+      expect(await childRunsOf(child.id)).toHaveLength(1);
+    }));
+
+  test("a slow instant child runs outside the parent executor's timeout", async () => {
+    // The gate holds the child's instant node open for as long as the test
+    // wants, past any watchdog. The parent's executor call returns regardless.
+    gate = Promise.withResolvers<void>();
+    const child = await makeWorkflow(gatedChild);
+    const parent = await makeWorkflow(parentOf(child.id));
+
+    const runId = await startWorkflowExecution(parent, {}, registry);
+    expect((await getWorkflowRun(runId))?.status).toBe("waiting");
+    const [childRun] = await childRunsOf(child.id);
+    expect((await getWorkflowRun(childRun!.id))?.status).toBe("running");
+
+    gate.resolve();
+    const run = await waitForRun(runId, isDone);
+    expect(run.status).toBe("completed");
+    expect((run.context?.child as { runId: string }).runId).toBe(childRun!.id);
+  });
+
+  test("a child that finishes before the parent step parks still resumes it", () =>
+    // No listener: the child's terminal event is lost, as in the race where it
+    // fires before the step is waiting. Only the post-park recheck can resume.
+    withoutListener(async () => {
+      gate = Promise.withResolvers<void>();
+      // Delays the executor's result, so parking happens after the child ends.
+      class LateParkExecutor extends SubWorkflowExecutor {
+        override async run(input: ExecutorInput) {
+          const result = await super.run(input);
+          const { correlationId } = result as { correlationId?: string };
+          gate.resolve();
+          if (correlationId) await waitForRun(correlationId, isDone);
+          return result;
+        }
+      }
+      const lateRegistry = createExecutorRegistry(deps);
+      lateRegistry.register(new GateExecutor(deps));
+      lateRegistry.register(new LateParkExecutor(deps, lateRegistry));
+      const child = await makeWorkflow(gatedChild);
+      const parent = await makeWorkflow(parentOf(child.id));
+
+      const runId = await startWorkflowExecution(parent, {}, lateRegistry);
+
+      expect((await getWorkflowRun(runId))?.status).toBe("completed");
+    }));
+
+  test("deleting an active child's workflow fails the waiting parent step", async () => {
+    const child = await makeWorkflow(waitingChild);
+    const parent = await makeWorkflow(parentOf(child.id));
+    const runId = await startWorkflowExecution(parent, {}, registry);
+    await childRunOf(child.id, "waiting");
+
+    await db.deleteWorkflow(child.id);
+
+    const run = await waitForRun(runId, isDone);
+    expect(run.status).toBe("failed");
+    expect(run.error).toContain("was deleted");
+  });
+
+  test("recovery fails a waiting parent step whose child row is gone", () =>
+    withoutListener(async () => {
+      const child = await makeWorkflow(waitingChild);
+      const parent = await makeWorkflow(parentOf(child.id));
+      const runId = await startWorkflowExecution(parent, {}, registry);
+      await childRunOf(child.id, "waiting");
+
+      await db.deleteWorkflow(child.id);
+      expect((await getWorkflowRun(runId))?.status).toBe("waiting");
+
+      await recoverIncompleteRuns(registry);
+      const run = await getWorkflowRun(runId);
+      expect(run?.status).toBe("failed");
+      expect(run?.error).toContain("was deleted");
+    }));
+
+  test("rejects a workflow that invokes itself", async () => {
+    const self = await makeWorkflow({ nodes: [] });
+    await db.updateWorkflow(self.id, { definition: parentOf(self.id) });
+    const wf = await db.getWorkflow(self.id);
+
+    const runId = await startWorkflowExecution(wf!, {}, registry);
+
+    const run = await getWorkflowRun(runId);
+    expect(run?.status).toBe("failed");
+    const [step] = await getWorkflowRunStepsByRunId(runId);
+    expect(step?.error).toContain("Sub-workflow recursion");
+    expect(await childRunsOf(self.id)).toHaveLength(1); // only the parent run itself
+  });
+
+  test("rejects an indirect cycle through an ancestor run", async () => {
+    const a = await makeWorkflow({ nodes: [] });
+    const b = await makeWorkflow(parentOf(a.id));
+    await db.updateWorkflow(a.id, { definition: parentOf(b.id) });
+    const wfA = await db.getWorkflow(a.id);
+
+    const runId = await startWorkflowExecution(wfA!, {}, registry);
+
+    const run = await waitForRun(runId, isDone);
+    expect(run.status).toBe("failed");
+    expect(run.error).toContain("Sub-workflow recursion");
+    expect(await childRunsOf(b.id)).toHaveLength(1);
+    expect(await childRunsOf(a.id)).toHaveLength(1);
+  });
+
+  test("fails closed past the max nesting depth", async () => {
+    // A chain of distinct workflows, one level deeper than allowed.
+    let next = await makeWorkflow(instantChild);
+    for (let i = 0; i <= MAX_SUB_WORKFLOW_DEPTH; i++) next = await makeWorkflow(parentOf(next.id));
+    const root = next;
+
+    const runId = await startWorkflowExecution(root, {}, registry);
+
+    expect((await waitForRun(runId, isDone)).status).toBe("failed");
+    const rows = await getDbClient().query<{ n: number }>(
+      "SELECT COUNT(*) AS n FROM workflow_run_steps WHERE error LIKE 'Sub-workflow nesting exceeds%'",
+    );
+    expect(rows[0]?.n).toBe(1);
+  });
+});

package/src/tools/script-connections/tool.ts

@@ -4,6 +4,7 @@ import { getAgentById } from "@/be/db";
 import {
   ConnectionAuthInputSchema,
   connectionAuthInputFromFlat,
+  deleteScriptConnection,
   getScriptConnectionById,
   listScriptConnections,
   refreshScriptConnection,
@@ -16,13 +17,23 @@ import { resolveScopedResourceId, scopedResourceScopeIdSchema } from "@/utils/sc
 
 const scriptConnectionsInputSchema = z.object({
   action: z
-    .enum(["list", "upsert-openapi", "upsert-mcp", "upsert-graphql", "refresh", "disable"])
-    .describe("List, create/update, refresh, or disable a script connection."),
+    .enum([
+      "list",
+      "upsert-openapi",
+      "upsert-mcp",
+      "upsert-graphql",
+      "refresh",
+      "disable",
+      "delete",
+    ])
+    .describe(
+      "List, create/update, refresh, disable, or delete a script connection. delete is permanent: it removes the connection, its managed credential binding, and any inline secret it owns.",
+    ),
   id: z
     .string()
     .uuid()
     .optional()
-    .describe("Existing connection ID for update, refresh, or disable."),
+    .describe("Existing connection ID for update, refresh, disable, or delete."),
   slug: z
     .string()
     .min(1)
@@ -193,6 +204,27 @@ export const registerScriptConnectionsTool = (server: McpServer) => {
         });
       }
 
+      if (args.action === "delete") {
+        if (!args.id) {
+          return toolErr("id is required for delete.", {
+            data: {
+              yourAgentId: requestInfo.agentId,
+              connections: listScriptConnections({ includeDisabled: true, allScopes: true }),
+            },
+          });
+        }
+        const deleted = await deleteScriptConnection(args.id);
+        const connections = listScriptConnections({ includeDisabled: true, allScopes: true });
+        if (!deleted) {
+          return toolErr(`Script connection ${args.id} not found.`, {
+            data: { yourAgentId: requestInfo.agentId, connections },
+          });
+        }
+        return toolOk(`Script connection ${deleted.slug} deleted.`, {
+          data: { yourAgentId: requestInfo.agentId, connections },
+        });
+      }
+
       if (args.action === "refresh") {
         if (!args.id) {
           return toolErr("id is required for refresh.", {

package/src/tools/send-task.ts

@@ -355,7 +355,15 @@ export async function sendTaskHandler(
     });
   }
 
-  if (ctx.kind === "owner" && requestedAgentId === ctx.agentId) {
+  // The guard stops an agent session from handing work back to itself. A script runs as its
+  // owner (a scheduled script as the schedule's creator), so a Lead-owned poller that files
+  // work for the Lead is legitimate. The bridge marks script calls `script-sdk`; a caller that
+  // spoofs it can only send itself a task, which grants nothing it could not already do.
+  if (
+    ctx.kind === "owner" &&
+    requestedAgentId === ctx.agentId &&
+    ctx.requestInfo?.callOrigin !== "script-sdk"
+  ) {
     return toolErr("Cannot send a task to yourself, are you drunk?", {
       data: { yourAgentId: ctx.agentId },
     });

package/src/utils/internal-ai/complete-structured.ts

@@ -66,7 +66,7 @@ export interface CompleteStructuredOptions<TZod extends z.ZodTypeAny> {
     prompt: string,
     model: string,
     signal?: AbortSignal,
-    jsonSchema?: object,
+    jsonSchema?: Record<string, unknown>,
   ) => Promise<string>;
   /**
    * Bypass `resolveCredential` entirely — opencode auth path (and tests)
@@ -111,7 +111,7 @@ export async function defaultSpawnClaudeCli(
   prompt: string,
   model: string,
   signal?: AbortSignal,
-  jsonSchema?: object,
+  jsonSchema?: Record<string, unknown>,
 ): Promise<string> {
   // SWARM_USE_CLAUDE_BRIDGE mirrors the main claude adapter's subscription-pool
   // routing. Otherwise CLAUDE_BINARY may be a single binary, an absolute path,
@@ -260,7 +260,10 @@ export async function completeStructuredWithModel<TZod extends z.ZodTypeAny>(
     // The CLI flag alone is unreliable — claude sometimes asks "where's
     // the schema?" if the prompt doesn't reference one.
     // The pinned Claude executable validates schemas with Draft 7.
-    const jsonSchema = z.toJSONSchema(opts.zodSchema, { target: "draft-7" }) as object;
+    const jsonSchema = z.toJSONSchema(opts.zodSchema, { target: "draft-7" }) as Record<
+      string,
+      unknown
+    >;
     const schemaStr = JSON.stringify(jsonSchema);
     const claudeUserPrompt = `${opts.userPrompt}\n\nRespond with ONLY a JSON object (no prose, no code fences) matching this schema:\n${schemaStr}`;
     let lastErr: unknown = null;

package/src/utils/runtime-model-catalog.ts

@@ -38,7 +38,7 @@ export interface RuntimeCatalogProvider {
 
 export type RuntimeCatalog = Record<string, RuntimeCatalogProvider | undefined>;
 
-const SNAPSHOT = modelsDevSnapshot as unknown as RuntimeCatalog;
+const SNAPSHOT = modelsDevSnapshot as RuntimeCatalog;
 
 /** Default freshness window for the worker-side HTTP pull. */
 export const RUNTIME_CATALOG_TTL_MS = 10 * 60_000;

package/src/workflows/engine.ts

@@ -54,6 +54,8 @@ function maxIterations(): number {
 export interface WorkflowExecutionOptions {
   requestedByUserId?: string;
   triggerType?: "schedule" | "manual" | "event" | "api";
+  /** Set when a `sub-workflow` step starts this run as its child. */
+  parentStepId?: string;
 }
 
 /**
@@ -133,6 +135,7 @@ export async function startWorkflowExecution(
       triggerType: options.triggerType ?? "manual",
       triggerData,
       createdBy: options.requestedByUserId,
+      parentStepId: options.parentStepId,
     });
     await updateWorkflowRun(runId, {
       status: "skipped",
@@ -149,6 +152,7 @@ export async function startWorkflowExecution(
     triggerType: options.triggerType ?? "manual",
     triggerData,
     createdBy: options.requestedByUserId,
+    parentStepId: options.parentStepId,
   });
   telemetry.workflow("started", {
     workflowId: workflow.id,
@@ -195,7 +199,7 @@ export async function startWorkflowExecution(
 
   const entryNodes = findEntryNodes(workflow.definition);
   const secretKeys = getSecretInputKeys(workflow.input);
-  await walkGraph(
+  const walk = walkGraph(
     workflow.definition,
     runId,
     ctx,
@@ -205,6 +209,13 @@ export async function startWorkflowExecution(
     secretKeys,
     options,
   );
+  // A child run walks on its own, outside the parent executor's timeout. Its
+  // terminal status wakes the parent step (`resumeFromChildRun`).
+  if (options.parentStepId) {
+    walk.catch((err) => console.error(`[workflows] Child workflow run ${runId} failed:`, err));
+    return runId;
+  }
+  await walk;
   return runId;
 }
 
@@ -939,6 +950,11 @@ async function runClaimedStep(
   // Check for async result
   if ("async" in result && (result as AsyncExecutorResult).async) {
     const waiting = await checkpointStepWaiting(runId, stepId, ctx);
+    // A child run that finished before the step parked had its event dropped.
+    if (waiting && (result as AsyncExecutorResult).waitFor === "workflow.child.finished") {
+      const { resumeFromChildRun } = await import("./resume");
+      await resumeFromChildRun(stepId, registry);
+    }
     return { outcome: waiting ? "waiting" : "completed", successors: [] };
   }
 

package/src/workflows/executors/agent-task.ts

@@ -83,7 +83,7 @@ export class AgentTaskExecutor extends BaseExecutor<
         async: true,
         waitFor: "task.completed",
         correlationId: existingTask.id,
-      } as unknown as ExecutorResult<AgentTaskOutput>;
+      } as ExecutorResult<AgentTaskOutput>;
     }
 
     // 2. Inherit workflow-level dir/vcsRepo when node config doesn't specify them
@@ -154,6 +154,6 @@ export class AgentTaskExecutor extends BaseExecutor<
       async: true,
       waitFor: "task.completed",
       correlationId: task.id,
-    } as unknown as ExecutorResult<AgentTaskOutput>;
+    } as ExecutorResult<AgentTaskOutput>;
   }
 }

package/src/workflows/executors/human-in-the-loop.ts

@@ -286,7 +286,7 @@ export class HumanInTheLoopExecutor extends BaseExecutor<
         async: true,
         waitFor: "approval.resolved",
         correlationId: existing.id,
-      } as unknown as ExecutorResult<HITLOutput>;
+      } as ExecutorResult<HITLOutput>;
     }
 
     // 2. Create the approval request. `run` already replaced a dynamic token
@@ -314,7 +314,7 @@ export class HumanInTheLoopExecutor extends BaseExecutor<
         async: true,
         waitFor: "approval.resolved",
         correlationId: requestId,
-      } as unknown as ExecutorResult<HITLOutput>;
+      } as ExecutorResult<HITLOutput>;
     }
 
     // 3. Dispatch notifications (fire-and-forget — failures must not block the workflow)
@@ -333,7 +333,7 @@ export class HumanInTheLoopExecutor extends BaseExecutor<
       async: true,
       waitFor: "approval.resolved",
       correlationId: requestId,
-    } as unknown as ExecutorResult<HITLOutput>;
+    } as ExecutorResult<HITLOutput>;
   }
 
   /** Dispatch notifications for each configured channel. Updates DB with messageTs on success. */

package/src/workflows/executors/registry.ts

@@ -8,6 +8,7 @@ import { NotifyExecutor } from "./notify";
 import { PropertyMatchExecutor } from "./property-match";
 import { RawLlmExecutor } from "./raw-llm";
 import { ScriptExecutor } from "./script";
+import { SubWorkflowExecutor } from "./sub-workflow";
 import { SwarmScriptExecutor } from "./swarm-script";
 import { SystemOneDecisionExecutor } from "./system-one-decision";
 import { ValidateExecutor } from "./validate";
@@ -81,6 +82,7 @@ export function createExecutorRegistry(deps: ExecutorDependencies): ExecutorRegi
   registry.register(new ForeachExecutor(deps));
   registry.register(new HumanInTheLoopExecutor(deps));
   registry.register(new WaitExecutor(deps));
+  registry.register(new SubWorkflowExecutor(deps, registry));
 
   return registry;
 }

package/src/workflows/executors/script.ts

@@ -98,7 +98,7 @@ export class ScriptExecutor extends BaseExecutor<
         return {
           status: "failed",
           error: result.stderr || `Script exited with code ${result.exitCode}`,
-          output: result as unknown as z.infer<typeof ScriptOutputSchema>,
+          output: result as z.infer<typeof ScriptOutputSchema>,
         };
       }