@desplega.ai/agent-swarm 2.4.5 → 2.5.0

package/src/be/db/tasks/read.ts

@@ -297,7 +297,8 @@ export function rowToAgentTask(row: AgentTaskRow): AgentTask {
     slackReplySent: !!row.slackReplySent,
     slackProgressMessageTs: row.slackProgressMessageTs ?? undefined,
     slackTreeRootMessageTs: row.slackTreeRootMessageTs ?? undefined,
-    vcsProvider: (row.vcsProvider as "github" | "gitlab" | "azure-devops" | null) ?? undefined,
+    vcsProvider:
+      (row.vcsProvider as "github" | "gitlab" | "azure-devops" | "bitbucket" | null) ?? undefined,
     vcsRepo: row.vcsRepo ?? undefined,
     vcsEventType: row.vcsEventType ?? undefined,
     vcsNumber: row.vcsNumber ?? undefined,
@@ -713,18 +714,53 @@ export async function getTasksByStatus(status: AgentTaskStatus): Promise<AgentTa
  * in `src/types.ts`. SQL strings can't import a TS const — if you add a
  * new terminal status, grep for `NOT IN ('completed'` across this file.
  */
-export async function findTaskByVcs(vcsRepo: string, vcsNumber: number): Promise<AgentTask | null> {
+/**
+ * Most recent active task for a provider + repo + PR/issue number. The
+ * provider is required: `owner/repo` exists on GitHub, GitLab and Bitbucket
+ * alike, so an unscoped lookup lets one host's webhook act on another host's
+ * task. A NULL `vcsProvider` is a legacy GitHub row (pre-provider writers), so
+ * the GitHub lookup still matches it.
+ */
+export async function findTaskByVcs(
+  vcsRepo: string,
+  vcsNumber: number,
+  vcsProvider: NonNullable<AgentTask["vcsProvider"]>,
+): Promise<AgentTask | null> {
+  const providerClause =
+    vcsProvider === "github" ? "(vcsProvider = ? OR vcsProvider IS NULL)" : "vcsProvider = ?";
   const row = await getDbClient().get<AgentTaskRow>(
     `SELECT * FROM agent_tasks
-       WHERE vcsRepo = ? AND vcsNumber = ?
+       WHERE vcsRepo = ? AND vcsNumber = ? AND ${providerClause}
        AND status NOT IN ('completed', 'failed', 'cancelled', 'superseded')
        ORDER BY createdAt DESC
        LIMIT 1`,
-    [vcsRepo, vcsNumber],
+    [vcsRepo, vcsNumber, vcsProvider],
   );
   return row ? rowToAgentTask(row) : null;
 }
 
+/**
+ * Every active task for a provider + repo + PR/issue number, newest first.
+ * Same scoping as `findTaskByVcs`; for callers that must settle all of them
+ * (a PR close leaves no task worth running).
+ */
+export async function findActiveTasksByVcs(
+  vcsRepo: string,
+  vcsNumber: number,
+  vcsProvider: NonNullable<AgentTask["vcsProvider"]>,
+): Promise<AgentTask[]> {
+  const providerClause =
+    vcsProvider === "github" ? "(vcsProvider = ? OR vcsProvider IS NULL)" : "vcsProvider = ?";
+  const rows = await getDbClient().query<AgentTaskRow>(
+    `SELECT * FROM agent_tasks
+       WHERE vcsRepo = ? AND vcsNumber = ? AND ${providerClause}
+       AND status NOT IN ('completed', 'failed', 'cancelled', 'superseded')
+       ORDER BY createdAt DESC`,
+    [vcsRepo, vcsNumber, vcsProvider],
+  );
+  return rows.map(rowToAgentTask);
+}
+
 /** @deprecated Use findTaskByVcs instead */
 export const findTaskByGitHub = findTaskByVcs;
 

package/src/be/db/workflow-runs.ts

@@ -1,5 +1,6 @@
 import type { WorkflowRunStatus } from "../../types";
 import { scrubSecrets } from "../../utils/secret-scrubber";
+import { scrubJsonValue } from "../scrub-json";
 import { getDbClient } from "./runtime";
 
 // Parent/child links between workflow runs (migration 203): a `sub-workflow`
@@ -115,3 +116,98 @@ function emitAfterCommit(childRunId: string, parentStepId: string): void {
       );
   });
 }
+
+/**
+ * Insert a foreach parent's missing child step rows as `pending` (queued), all
+ * in one transaction, so a crash never leaves a partial child set and the join
+ * always sees every item. Children that already exist (any row for the child
+ * node id) are skipped inside the transaction, which makes a concurrent
+ * re-execution of the same parent insert nothing twice. Returns how many rows
+ * this call inserted.
+ */
+export async function createForeachChildSteps(
+  runId: string,
+  parentNodeId: string,
+  rows: Array<{
+    id: string;
+    nodeId: string;
+    nodeType: string;
+    input: unknown;
+    idempotencyKey: string;
+  }>,
+): Promise<number> {
+  if (rows.length === 0) return 0;
+  const prefix = `${parentNodeId}#`;
+  return getDbClient().transaction(async (tx) => {
+    const existing = await tx.query<{ nodeId: string }>(
+      "SELECT DISTINCT nodeId FROM workflow_run_steps WHERE runId = ? AND substr(nodeId, 1, ?) = ?",
+      [runId, prefix.length, prefix],
+    );
+    const existingNodeIds = new Set(existing.map((row) => row.nodeId));
+    const now = new Date().toISOString();
+    let created = 0;
+    for (const row of rows) {
+      if (existingNodeIds.has(row.nodeId)) continue;
+      await tx.run(
+        `INSERT INTO workflow_run_steps (id, runId, nodeId, nodeType, status, startedAt, input, idempotencyKey)
+           VALUES (?, ?, ?, ?, 'pending', ?, ?, ?)`,
+        [
+          row.id,
+          runId,
+          row.nodeId,
+          row.nodeType,
+          now,
+          scrubJsonValue(row.input),
+          row.idempotencyKey,
+        ],
+      );
+      existingNodeIds.add(row.nodeId);
+      created++;
+    }
+    return created;
+  });
+}
+
+/**
+ * Insert a new `pending` attempt row for each foreach item being retried. Each
+ * row reuses its item's child node id and gets a fresh step id, so the body
+ * starts a new invocation (a new task, child run, approval or wait) while the
+ * earlier attempt rows stay as history. `attempt` is the number of rows the
+ * item already has, and the idempotency key `<runId>:<childNodeId>:<attempt>`
+ * is UNIQUE, so a duplicated retry of the same attempt inserts nothing.
+ * Call it inside the retry's transaction. Returns how many rows it inserted.
+ */
+export async function createForeachAttemptSteps(
+  runId: string,
+  rows: Array<{ nodeId: string; nodeType: string; itemKey: string; index: number }>,
+): Promise<number> {
+  if (rows.length === 0) return 0;
+  return getDbClient().transaction(async (tx) => {
+    const now = new Date().toISOString();
+    let created = 0;
+    for (const row of rows) {
+      const count = await tx.get<{ n: number }>(
+        "SELECT COUNT(*) AS n FROM workflow_run_steps WHERE runId = ? AND nodeId = ?",
+        [runId, row.nodeId],
+      );
+      const attempt = count?.n ?? 0;
+      const inserted = await tx.get<{ id: string }>(
+        `INSERT INTO workflow_run_steps (id, runId, nodeId, nodeType, status, startedAt, input, idempotencyKey)
+           VALUES (?, ?, ?, ?, 'pending', ?, ?, ?)
+           ON CONFLICT(idempotencyKey) DO NOTHING
+           RETURNING id`,
+        [
+          crypto.randomUUID(),
+          runId,
+          row.nodeId,
+          row.nodeType,
+          now,
+          scrubJsonValue({ itemKey: row.itemKey, index: row.index, attempt }),
+          `${runId}:${row.nodeId}:${attempt}`,
+        ],
+      );
+      if (inserted) created++;
+    }
+    return created;
+  });
+}

package/src/be/db.ts

@@ -1,6 +1,6 @@
 import type { Database } from "bun:sqlite";
 import pkg from "../../package.json";
-import { defaultAssetKey, normalizeAssetKey } from "../assets/key";
+import { defaultAssetKey, normalizeAssetKey, sessionGroupKey } from "../assets/key";
 import {
   generateDefaultClaudeMd,
   generateDefaultIdentityMd,
@@ -195,7 +195,19 @@ import {
 } from "./db/context-versions";
 import { clearAgentModelProfileOnOverrideChange } from "./db/model-profiles";
 import { getDb, getDbClient } from "./db/runtime";
-import { type SessionViewer, sessionViewerCondition } from "./db/session-visibility";
+import {
+  assertAssetKeyMovesAllowed,
+  configureSessionMoveDependencies,
+  moveTaskChainKeyInTx,
+} from "./db/session-moves";
+import {
+  type SessionFilters,
+  type SessionReadState,
+  type SessionRowFields,
+  sessionCountQuery,
+  sessionPageFields,
+  sessionSummaryQuery,
+} from "./db/session-tree";
 import { classifyTaskHumanFree, reclassifyTaskHumanFree } from "./db/tasks/human-free";
 import {
   type AgentTaskRow,
@@ -269,6 +281,7 @@ export { recordKeySeatMismatch } from "./db/api-keys";
 export {
   type ApprovalRequestSummary,
   type ApprovalVote,
+  getPendingApprovalsForTasks,
   getPendingApprovalVoteState,
   listApprovalRequestSummaries,
   recordApprovalVotes,
@@ -281,6 +294,11 @@ export {
   getLatestContextVersion,
 } from "./db/context-versions";
 export { getScriptRunExecutionArgs } from "./db/script-runs";
+export {
+  AssetKeyMovesBlockedError,
+  assertAssetKeyMovesAllowed,
+  moveTaskChainKeyInTx,
+} from "./db/session-moves";
 
 configureAgentDependencies({
   createLogEntry: (entry) => createLogEntry(entry),
@@ -300,6 +318,7 @@ export {
 export {
   type ExistingTrackerContextWork,
   type ExistingTrackerContextWorkReason,
+  findActiveTasksByVcs,
   findCompletedTaskInThread,
   findExistingLinearTrackerContextWork,
   findRecentCancelledTaskInThread,
@@ -387,6 +406,11 @@ configureTaskWriteDependencies({
   cascadeFailDependents: (...args) => cascadeFailDependents(...args),
 });
 
+configureSessionMoveDependencies({
+  auditAssetKeys: () => auditAssetKeys(getDb()),
+  insertAssetKeyHistory: (...args) => insertAssetKeyHistory(...args),
+});
+
 configureTaskReadDependencies({
   checkDependencies: (taskId) => checkDependencies(taskId),
   assetKeyPrefixPattern: (input) => assetKeyPrefixPattern(input),
@@ -400,7 +424,7 @@ type TaskTelemetryContext = {
 };
 
 /** LIKE pattern matching strings that start with `prefix` literally (use with `ESCAPE '\\'`). */
-function literalPrefixPattern(prefix: string): string {
+export function literalPrefixPattern(prefix: string): string {
   return `${prefix.replace(/[\\%_]/g, "\\$&")}%`;
 }
 
@@ -1060,7 +1084,7 @@ export async function setSlackMessageTracking(
 export async function updateTaskVcs(
   taskId: string,
   vcs: {
-    vcsProvider: "github" | "gitlab" | "azure-devops";
+    vcsProvider: "github" | "gitlab" | "azure-devops" | "bitbucket";
     vcsRepo: string;
     vcsNumber: number;
     vcsUrl: string;
@@ -1742,17 +1766,7 @@ export async function moveAssetKey(input: {
   descendantTaskIds?: readonly string[];
 }): Promise<false | { movedTaskIds?: string[] }> {
   const key = normalizeAssetKey(input.key);
-  // auditAssetKeys stays sync (shared with the boot audit); run it inside a
-  // client transaction so this request-path read cannot observe another
-  // request's uncommitted writes on the shared connection.
-  const audit = await getDbClient().transaction(async () => auditAssetKeys(getDb()), {
-    readOnly: true,
-  });
-  if (!audit.ok) {
-    throw new Error(
-      "Asset namespace moves are blocked until structural errors, unknown personal users, or provider mapping drift are repaired.",
-    );
-  }
+  await assertAssetKeyMovesAllowed();
   const previousKey = await currentAssetKey(input.entityType, input.id);
   if (!previousKey) return false;
   if (previousKey === key && input.entityType !== "task") return {};
@@ -1769,60 +1783,13 @@ export async function moveAssetKey(input: {
   return getDbClient().transaction(async (tx) => {
     switch (input.entityType) {
       case "task": {
-        const root = await getTaskById(input.id);
-        if (!root) return false;
-        const tasks = [root];
-        for (const id of input.descendantTaskIds ?? []) {
-          const task = id === root.id ? null : await getTaskById(id);
-          if (task) tasks.push(task);
-        }
-        const movedTaskIds: string[] = [];
-        for (const task of tasks) {
-          if (task.key === key) continue;
-          // A file shared with another task keeps the namespace of the task whose attachment
-          // sources its mapping. Mappings with no attachment source follow any attaching task.
-          const mappedFiles = await tx.query<{ id: string; key: string }>(
-            `SELECT DISTINCT m.id, m."key" AS key
-             FROM asset_key_mappings m
-             JOIN task_attachments a
-               ON m.provider_id = COALESCE(NULLIF(a.provider_id, ''), 'agent-fs')
-              AND m.provider_org_id = COALESCE(a.agent_fs_org_id, '')
-              AND m.provider_drive_id = COALESCE(a.agent_fs_drive_id, '')
-              AND m.provider_key = COALESCE(NULLIF(a.provider_key, ''), a.path)
-             WHERE a.task_id = ?
-               AND (m.source_entity_type IS NOT 'task-attachment'
-                 OR m.source_entity_id IN (SELECT id FROM task_attachments WHERE task_id = ?))`,
-            [task.id, task.id],
-          );
-          // The namespace is metadata, and lastUpdatedAt tracks task activity, as in updateTaskTitle.
-          await tx.run('UPDATE agent_tasks SET "key" = ?, updated_by = ? WHERE id = ?', [
-            key,
-            input.changedBy ?? null,
-            task.id,
-          ]);
-          for (const mapping of mappedFiles) {
-            if (mapping.key === key) continue;
-            await tx.run(
-              'UPDATE asset_key_mappings SET "key" = ?, updated_at = ?, updated_by = ? WHERE id = ?',
-              [key, now, input.changedBy ?? null, mapping.id],
-            );
-            await insertAssetKeyHistory({
-              entityType: "file",
-              entityId: mapping.id,
-              previousKey: mapping.key,
-              newKey: key,
-              changedBy: input.changedBy,
-            });
-          }
-          await insertAssetKeyHistory({
-            entityType: "task",
-            entityId: task.id,
-            previousKey: task.key,
-            newKey: key,
-            changedBy: input.changedBy,
-          });
-          movedTaskIds.push(task.id);
-        }
+        const movedTaskIds = await moveTaskChainKeyInTx(
+          input.id,
+          input.descendantTaskIds ?? [],
+          key,
+          input.changedBy,
+        );
+        if (movedTaskIds === false) return false;
         return { movedTaskIds };
       }
       case "workflow":
@@ -2605,7 +2572,7 @@ export async function createTaskExtended(
       }
 
       // VCS identity (GitHub / GitLab issue / PR / MR + webhook routing)
-      // Webhook handlers locate active work via `findTaskByVcs(repo, number)`,
+      // Webhook handlers locate active work via `findTaskByVcs(repo, number, provider)`,
       // so a resume / follow-up child MUST carry the full VCS identity or
       // subsequent review/update events get dropped.
       if (parent.vcsProvider && !options.vcsProvider) {
@@ -12921,7 +12888,7 @@ export async function getRootTaskChain(rootTaskId: string): Promise<AgentTask[]>
   return rows.map(rowToAgentTask);
 }
 
-export interface SessionListItem {
+export interface SessionListItem extends SessionRowFields {
   root: AgentTask;
   chainTaskCount: number;
   lastActivityAt: string;
@@ -12934,42 +12901,18 @@ export interface SessionListItem {
  * The session list only renders a brief of the root; the full root + chain are
  * on `GET /api/sessions/{rootTaskId}`.
  */
-export interface SessionListItemSummary {
+export interface SessionListItemSummary extends SessionRowFields {
   root: AgentTaskSummary;
   chainTaskCount: number;
   lastActivityAt: string;
   latestStatus: AgentTaskStatus;
 }
 
-/**
- * List the most recent sessions ordered by chain-wide latest activity.
- * A "session" here is any task with `parentTaskId IS NULL` — its descendants
- * (children, grand-children, …) are summarized via the recursive CTE.
- *
- * Single-pass CTE: seeds with root tasks matching the filter, walks the full
- * descendant tree once, then aggregates chainCount / lastActivityAt /
- * latestStatus in two lightweight non-recursive CTEs — replacing the original
- * pattern of 3 correlated subqueries each re-running the recursion per row.
- */
-interface ListRecentSessionsOpts {
+interface ListRecentSessionsOpts extends SessionFilters {
   limit?: number;
   offset?: number;
-  /** Filter to root tasks whose `source` is in this list. Empty/undefined → no source filter. */
-  source?: string[];
-  /** Case-insensitive substring match against `r.task`. */
-  q?: string;
-  /** When set, restrict to root tasks where `requestedByUserId` equals this value. NULL rows are excluded. */
-  requestedByUserId?: string;
-  /**
-   * When set, restrict to root tasks whose `contextKey` starts with this
-   * literal prefix (`%`, `_` and `\` are escaped). Powers the UI contextual
-   * session panel's per-page dropdown.
-   */
-  contextKeyPrefix?: string;
-  /** When true, return slim `SessionListItemSummary` rows (default: full). */
+  /** Return a slim root task summary instead of the full task. */
   slim?: boolean;
-  /** Restrict to sessions this viewer may open (session sharing). */
-  viewer?: SessionViewer;
 }
 
 export async function listRecentSessions(
@@ -12979,149 +12922,50 @@ export async function listRecentSessions(
   opts: ListRecentSessionsOpts & { slim: true },
 ): Promise<SessionListItemSummary[]>;
 export async function listRecentSessions(
-  opts?: ListRecentSessionsOpts,
+  opts: ListRecentSessionsOpts = {},
 ): Promise<SessionListItem[] | SessionListItemSummary[]> {
-  const limit = opts?.limit ?? 25;
-  const offset = opts?.offset ?? 0;
-  const sources = opts?.source?.filter((s) => s.length > 0) ?? [];
-  const q = opts?.q?.trim();
-  const requestedByUserId = opts?.requestedByUserId?.trim() || undefined;
-
-  const conditions: string[] = ["r.parentTaskId IS NULL"];
-  const params: (string | number | null)[] = [];
-
-  if (sources.length > 0) {
-    conditions.push(`r.source IN (${sources.map(() => "?").join(", ")})`);
-    params.push(...sources);
-  }
-  if (q && q.length > 0) {
-    conditions.push("(lower(r.task) LIKE ? OR lower(COALESCE(r.title, '')) LIKE ?)");
-    const like = `%${q.toLowerCase()}%`;
-    params.push(like, like);
-  }
-  if (requestedByUserId) {
-    conditions.push("r.requestedByUserId = ?");
-    params.push(requestedByUserId);
-  }
-  if (opts?.contextKeyPrefix) {
-    conditions.push(`r.contextKey LIKE ? ESCAPE '\\'`);
-    params.push(literalPrefixPattern(opts.contextKeyPrefix));
-  }
-  if (opts?.viewer) {
-    const viewer = sessionViewerCondition(opts.viewer);
-    conditions.push(viewer.sql);
-    params.push(...viewer.params);
-  }
-  params.push(limit, offset);
-
+  const query = sessionSummaryQuery(opts);
   const rootRows = await getDbClient().query<
-    AgentTaskRow & { __chainCount: number; __lastActivityAt: string; __latestStatus: string }
+    AgentTaskRow & {
+      __chainCount: number;
+      __lastActivityAt: string;
+      __latestStatus: AgentTaskStatus;
+      __readState: SessionReadState | null;
+      __snoozeUntil: string | null;
+      __needsYou: number;
+    }
   >(
-    `WITH RECURSIVE chain(root_id, id, lastUpdatedAt, status) AS (
-         SELECT r.id, r.id, r.lastUpdatedAt, r.status
-         FROM agent_tasks r
-         WHERE ${conditions.join(" AND ")}
-         UNION ALL
-         SELECT c.root_id, t.id, t.lastUpdatedAt, t.status
-         FROM agent_tasks t
-         JOIN chain c ON t.parentTaskId = c.id
-       ),
-       agg AS (
-         SELECT
-           root_id,
-           COUNT(*) AS chainCount,
-           MAX(lastUpdatedAt) AS lastActivityAt
-         FROM chain
-         GROUP BY root_id
-       ),
-       latest_status AS (
-         SELECT c.root_id, c.status AS latestStatus
-         FROM chain c
-         JOIN agg a ON c.root_id = a.root_id AND c.lastUpdatedAt = a.lastActivityAt
-         GROUP BY c.root_id
-       )
-       SELECT
-         r.*,
-         a.chainCount AS __chainCount,
-         a.lastActivityAt AS __lastActivityAt,
-         COALESCE(ls.latestStatus, r.status) AS __latestStatus
-       FROM agent_tasks r
-       JOIN agg a ON a.root_id = r.id
-       LEFT JOIN latest_status ls ON ls.root_id = r.id
-       ORDER BY a.lastActivityAt DESC, r.createdAt DESC, r.id DESC
-       LIMIT ? OFFSET ?`,
-    params,
-  );
-
-  if (opts?.slim) {
-    return rootRows.map((row): SessionListItemSummary => {
-      const { __chainCount, __lastActivityAt, __latestStatus, ...taskRow } = row;
-      return {
-        root: rowToAgentTaskSummary(taskRow as AgentTaskRow),
-        chainTaskCount: __chainCount,
-        lastActivityAt: __lastActivityAt ?? row.lastUpdatedAt,
-        latestStatus: (__latestStatus as AgentTaskStatus) ?? row.status,
-      };
-    });
-  }
-
-  return rootRows.map((row): SessionListItem => {
-    const { __chainCount, __lastActivityAt, __latestStatus, ...taskRow } = row;
-    return {
-      root: rowToAgentTask(taskRow as AgentTaskRow),
-      chainTaskCount: __chainCount,
-      lastActivityAt: __lastActivityAt ?? row.lastUpdatedAt,
-      latestStatus: (__latestStatus as AgentTaskStatus) ?? row.status,
-    };
-  });
+    `SELECT r.*, a.chainCount AS __chainCount, a.lastActivityAt AS __lastActivityAt,
+      a.latestStatus AS __latestStatus, a.readState AS __readState,
+      a.snoozeUntil AS __snoozeUntil, a.needsYou AS __needsYou
+    FROM (${query.sql}) a CROSS JOIN agent_tasks r ON r.id = a.root_id
+    ORDER BY ${opts.triage === "later" ? "a.snoozeUntil ASC," : ""}
+      a.lastActivityAt DESC, r.createdAt DESC, r.id DESC LIMIT ? OFFSET ?`,
+    [...query.params, opts.limit ?? 25, opts.offset ?? 0],
+  );
+  const fields = await sessionPageFields(
+    rootRows.map((row) => ({
+      id: row.id,
+      requestedByUserId: row.requestedByUserId ?? undefined,
+    })),
+  );
+  return rootRows.map((row) => ({
+    root: opts.slim ? rowToAgentTaskSummary(row) : rowToAgentTask(row),
+    chainTaskCount: row.__chainCount,
+    lastActivityAt: row.__lastActivityAt,
+    latestStatus: row.__latestStatus,
+    ...(row.__readState ? { readState: row.__readState } : {}),
+    snoozeUntil: row.__snoozeUntil,
+    needsYou: !!row.__needsYou,
+    groupKey: sessionGroupKey(row.key),
+    ...fields.get(row.id),
+  }));
 }
 
-/**
- * Filter-aware count of sessions (root tasks) matching the same `source` / `q`
- * / `requestedByUserId` filters as `listRecentSessions`. Powers a correct
- * `total` in the `/api/sessions` pager — a session is a root task, so this is
- * a plain count, no recursive chain walk needed.
- */
-export async function countSessions(
-  opts?: Pick<
-    ListRecentSessionsOpts,
-    "source" | "q" | "requestedByUserId" | "contextKeyPrefix" | "viewer"
-  >,
-): Promise<number> {
-  const sources = opts?.source?.filter((s) => s.length > 0) ?? [];
-  const q = opts?.q?.trim();
-  const requestedByUserId = opts?.requestedByUserId?.trim() || undefined;
-
-  const conditions: string[] = ["r.parentTaskId IS NULL"];
-  const params: (string | null)[] = [];
-
-  if (sources.length > 0) {
-    conditions.push(`r.source IN (${sources.map(() => "?").join(", ")})`);
-    params.push(...sources);
-  }
-  if (q && q.length > 0) {
-    conditions.push("(lower(r.task) LIKE ? OR lower(COALESCE(r.title, '')) LIKE ?)");
-    const like = `%${q.toLowerCase()}%`;
-    params.push(like, like);
-  }
-  if (requestedByUserId) {
-    conditions.push("r.requestedByUserId = ?");
-    params.push(requestedByUserId);
-  }
-  if (opts?.contextKeyPrefix) {
-    conditions.push(`r.contextKey LIKE ? ESCAPE '\\'`);
-    params.push(literalPrefixPattern(opts.contextKeyPrefix));
-  }
-  if (opts?.viewer) {
-    const viewer = sessionViewerCondition(opts.viewer);
-    conditions.push(viewer.sql);
-    params.push(...viewer.params);
-  }
-
-  const row = await getDbClient().get<{ count: number }>(
-    `SELECT COUNT(*) AS count FROM agent_tasks r WHERE ${conditions.join(" AND ")}`,
-    params,
-  );
+/** Count roots directly unless a filter needs chain activity or participants. */
+export async function countSessions(opts: SessionFilters = {}): Promise<number> {
+  const query = sessionCountQuery(opts);
+  const row = await getDbClient().get<{ count: number }>(query.sql, query.params);
   return row?.count ?? 0;
 }
 

package/src/be/onboarding.ts

@@ -58,6 +58,7 @@ export const OnboardingIntegrationMethodSchema = z.enum([
   "slack",
   "github",
   "gitlab",
+  "bitbucket",
   "linear_oauth",
   "jira_oauth",
 ]);
@@ -139,6 +140,7 @@ export const OnboardingSignalsSchema = z.object({
     slack: z.boolean(),
     github: z.boolean(),
     gitlab: z.boolean(),
+    bitbucket: z.boolean(),
     linear: z.boolean(),
     jira: z.boolean(),
   }),
@@ -480,6 +482,7 @@ function inferIntegrationMethod(
   if (signals.integrations.slack) return "slack";
   if (signals.integrations.github) return "github";
   if (signals.integrations.gitlab) return "gitlab";
+  if (signals.integrations.bitbucket) return "bitbucket";
   if (signals.integrations.linear) return "linear_oauth";
   if (signals.integrations.jira) return "jira_oauth";
   return null;

package/src/be/skill-sync.ts

@@ -10,6 +10,7 @@
  */
 
 import { homedir } from "node:os";
+import type { SkillFile, SkillWithInstallInfo } from "../types";
 import {
   type SkillFsEntry,
   type SkillHarnessTarget,
@@ -71,8 +72,7 @@ export interface SkillsSignature {
  * uninstall, toggle, or skill-update mutates at least one of them. Output is
  * deterministic and contains no timestamps beyond per-row mutation fields.
  */
-export async function computeAgentSkillsSignature(agentId: string): Promise<SkillsSignature> {
-  const skills = await getAgentSkills(agentId);
+export function computeSkillsSignature(skills: readonly SkillWithInstallInfo[]): SkillsSignature {
   const sorted = [...skills].sort((a, b) => a.id.localeCompare(b.id));
   const canonical = JSON.stringify(
     sorted.map((s) => [
@@ -89,3 +89,44 @@ export async function computeAgentSkillsSignature(agentId: string): Promise<Skil
   const hash = new Bun.CryptoHasher("sha256").update(canonical).digest("hex");
   return { hash, count: sorted.length };
 }
+
+/**
+ * Fetch the agent's skills and sign them.
+ *
+ * Callers that already hold the rows (the bundle endpoint) must use
+ * `computeSkillsSignature` on those exact rows instead of calling this: a
+ * second read can observe a newer edit and pair a fresh hash with stale
+ * payload bytes, which makes later signature probes skip the refresh forever.
+ */
+export async function computeAgentSkillsSignature(agentId: string): Promise<SkillsSignature> {
+  return computeSkillsSignature(await getAgentSkills(agentId));
+}
+
+export interface SkillsBundle {
+  skills: (SkillWithInstallInfo & { files: SkillFile[] })[];
+  total: number;
+  signature: string;
+}
+
+/**
+ * Build the worker boot payload: every installed skill plus its bundled files,
+ * signed over the rows this same call returned.
+ *
+ * The readers are injected so the ordering the fix depends on is testable: the
+ * signature is taken before the first `readFiles`, so an edit that lands while
+ * the files are being read cannot pair stale bytes with a newer hash.
+ */
+export async function buildSkillsBundle(
+  readSkills: () => Promise<SkillWithInstallInfo[]>,
+  readFiles: (skillId: string) => Promise<SkillFile[]>,
+): Promise<SkillsBundle> {
+  const skills = await readSkills();
+  const signature = computeSkillsSignature(skills).hash;
+  const entries = await Promise.all(
+    skills.map(async (skill) => ({
+      ...skill,
+      files: skill.isComplex ? await readFiles(skill.id) : [],
+    })),
+  );
+  return { skills: entries, total: entries.length, signature };
+}