@desplega.ai/agent-swarm 2.4.5 → 2.5.0

package/src/tests/workflow-tla-races.test.ts

@@ -213,7 +213,7 @@ describe("TLA+ workflow counterexamples", () => {
     const stepB = await untilStatus(runId, "B", "waiting");
 
     // EF: B's task fails -> run failed.
-    await failStepAndRunIfWaiting(stepB!.id, runId, "task failed");
+    await failStepAndRunIfWaiting(def, stepB!.id, runId, "task failed");
     expect((await getWorkflowRun(runId))?.status).toBe("failed");
 
     // U1/U2: the user retries; findReadyNodes returns A because it is not completed.
@@ -240,7 +240,7 @@ describe("TLA+ workflow counterexamples", () => {
 
     // EF: B's task fails -> run failed. XCkWait(A): the checkpoint CAS sees a
     // failed run, so A's row stays `running` with its task out.
-    await failStepAndRunIfWaiting(stepB!.id, runId, "task failed");
+    await failStepAndRunIfWaiting(def, stepB!.id, runId, "task failed");
     holdA.release();
     await initial;
     expect((await stepsOf(runId, "A"))[0]?.status).toBe("running");

package/src/tools/script-delete.ts

@@ -9,7 +9,7 @@ import {
 } from "./script-common";
 
 export const SCRIPT_DELETE_DESCRIPTION =
-  "Remove a swarm-shared script from the catalog. Versions table preserves history.";
+  "Permanently remove a swarm-shared script and all its versions from the catalog. This cannot be undone.";
 
 export const registerScriptDeleteTool = (server: McpServer) => {
   createToolRegistrar(server)(

package/src/tools/workflows/create-workflow.ts

@@ -40,11 +40,13 @@ export const registerCreateWorkflowTool = (server: McpServer) => {
         "- STRUCTURED OUTPUT: For agent-task nodes, put outputSchema inside 'config' to validate the agent's raw JSON output. " +
         "Node-level outputSchema validates the executor's return ({taskId, taskOutput}), which is different.\n" +
         "- Agent-task config: { template, outputSchema?, agentId?, tags?, priority?, dir?, vcsRepo?, model? }.\n" +
-        "- FOREACH NODE: type 'foreach' fans out one agent-task per item. Config: " +
-        "{ over: <array or exact {{input}} token>, itemKey: <property name>, body: { type: 'agent-task', config: {...} } }. " +
+        "- FOREACH NODE: type 'foreach' runs its body once per item. Config: " +
+        "{ over: <array or exact {{input}} token>, itemKey: <property name>, body: { type: <any executor except foreach>, config: {...} }, " +
+        "concurrency?: <integer >= 1, items in flight; unbounded when absent>, failurePolicy?: 'fail-fast' | 'collect-outcomes' }. " +
         "The body config is interpolated once per item with {{item.*}} and {{index}}. Child steps use synthetic IDs " +
         "'<foreachNodeId>#<itemKey>'; the parent waits for every child and exposes one aggregate result to successors. " +
-        "concurrency is not supported in v1; use definition-level onNodeFailure: 'continue' to aggregate failed children.\n" +
+        "failurePolicy defaults from onNodeFailure ('continue' = collect-outcomes, else fail-fast); fail-fast cancels queued items. " +
+        "retry-workflow-run on a failed fan-out reruns only failed and cancelled items.\n" +
         "- TRIGGER SCHEMA: Optional 'triggerSchema' is a JSON-Schema object that validates incoming trigger payloads. " +
         "Supported keywords: type, required, properties, enum, const, items (recursive into arrays). " +
         "Other JSON-Schema keywords (oneOf/anyOf/$ref/pattern/format/additionalProperties) are silently ignored.\n" +

package/src/types.ts

@@ -384,6 +384,7 @@ export const AgentTaskSourceSchema = z.enum([
   "github",
   "gitlab",
   "azure-devops",
+  "bitbucket",
   "agentmail",
   "system",
   "schedule",
@@ -697,7 +698,7 @@ export const AgentTaskSchema = z
     slackTreeRootMessageTs: z.string().optional(),
 
     // VCS metadata (GitHub / GitLab / Azure DevOps — provider-agnostic)
-    vcsProvider: z.enum(["github", "gitlab", "azure-devops"]).optional(),
+    vcsProvider: z.enum(["github", "gitlab", "azure-devops", "bitbucket"]).optional(),
     vcsRepo: z.string().optional(),
     vcsEventType: z.string().optional(),
     vcsNumber: z.number().int().optional(),
@@ -863,7 +864,7 @@ export const CreateTaskOptionsSchema = z.object({
    * this boundary must not let a caller silently persist a mismatch.
    */
   overrideSlackContext: z.boolean().optional(),
-  vcsProvider: z.enum(["github", "gitlab", "azure-devops"]).optional(),
+  vcsProvider: z.enum(["github", "gitlab", "azure-devops", "bitbucket"]).optional(),
   vcsRepo: z.string().optional(),
   vcsEventType: z.string().optional(),
   vcsNumber: z.number().int().optional(),

package/src/utils/config-env-export.ts

@@ -24,6 +24,7 @@ export const ENV_EXPORT_RESTRICTED_KEYS: ReadonlySet<string> = new Set([
   "JIRA_CLIENT_SECRET",
   "JIRA_WEBHOOK_TOKEN",
   "AZURE_DEVOPS_WEBHOOK_SECRET",
+  "BITBUCKET_WEBHOOK_SECRET",
   "AGENTMAIL_WEBHOOK_SECRET",
   "API_AGENT_FS_API_KEY",
   "TRANSCRIPTION_API_KEY",

package/src/utils/secret-scrubber.ts

@@ -53,6 +53,10 @@ const SENSITIVE_KEY_EXACT = new Set<string>([
   "AZURE_DEVOPS_TOKEN",
   // Worker-side copy of AZURE_DEVOPS_TOKEN read by the az azure-devops extension
   "AZURE_DEVOPS_EXT_PAT",
+  // The `_TOKEN` / `_SECRET` suffixes already match these, so listing them
+  // does not change redaction and does not bump SCRUBBER_RULES_VERSION.
+  "BITBUCKET_TOKEN",
+  "BITBUCKET_WEBHOOK_SECRET",
   "CLAUDE_CODE_OAUTH_TOKEN",
   "ANTHROPIC_API_KEY",
   "OPENAI_API_KEY",

package/src/utils/skills-refresh.ts

@@ -77,26 +77,56 @@ export async function refreshSkillsIfChanged(
     isEnabled: boolean;
     isActive: boolean;
   };
+  type BundledFile = { path: string; content: string; isBinary: boolean };
   let skillRows: SkillRow[] = [];
+  // Present when the bundle call succeeded: every complex skill's files arrive
+  // in the same response, so Step 3 never fans out per file.
+  let bundledFiles: Map<string, BundledFile[]> | null = null;
   let newHash: string | null = null;
   let listFetchOk = false;
+
+  // Preferred path: one request for the skills and all of their bundled files.
+  // A 4xx from an older server (no bundle endpoint yet) falls through to the
+  // legacy list + per-file path below.
   try {
-    const skillsResp = await fetch(`${apiUrl}/api/agents/${agentId}/skills`, {
+    const bundleResp = await fetch(`${apiUrl}/api/agents/${agentId}/skills/bundle`, {
       headers: authHeaders,
     });
-    if (skillsResp.ok) {
-      const skillsData = (await skillsResp.json()) as {
-        skills: SkillRow[];
+    if (bundleResp.ok) {
+      const bundle = (await bundleResp.json()) as {
+        skills: (SkillRow & { files?: BundledFile[] })[];
         signature?: string;
       };
-      skillRows = skillsData.skills;
-      if (typeof skillsData.signature === "string") {
-        newHash = skillsData.signature;
+      skillRows = bundle.skills;
+      bundledFiles = new Map(bundle.skills.map((skill) => [skill.id, skill.files ?? []]));
+      if (typeof bundle.signature === "string") {
+        newHash = bundle.signature;
       }
       listFetchOk = true;
     }
   } catch {
-    // Transient network / parse error — bail out without touching the local FS
+    // Transient network / parse error — the legacy path below gets a chance.
+  }
+
+  if (!listFetchOk) {
+    try {
+      const skillsResp = await fetch(`${apiUrl}/api/agents/${agentId}/skills`, {
+        headers: authHeaders,
+      });
+      if (skillsResp.ok) {
+        const skillsData = (await skillsResp.json()) as {
+          skills: SkillRow[];
+          signature?: string;
+        };
+        skillRows = skillsData.skills;
+        if (typeof skillsData.signature === "string") {
+          newHash = skillsData.signature;
+        }
+        listFetchOk = true;
+      }
+    } catch {
+      // Transient network / parse error — bail out without touching the local FS
+    }
   }
 
   // Guard: a failed list fetch must not proceed to writeSkillsToFilesystem.
@@ -125,45 +155,55 @@ export async function refreshSkillsIfChanged(
       const files: { path: string; content: string; isBinary: boolean }[] = [];
 
       if (skill.isComplex) {
-        // Fetch manifest to know which files exist + which are binary
-        try {
-          const manifestResp = await fetch(`${apiUrl}/api/skills/${skill.id}/files`, {
-            headers: authHeaders,
-          });
-          if (manifestResp.ok) {
-            const manifestData = (await manifestResp.json()) as {
-              files: { path: string; isBinary: boolean }[];
-            };
-
-            // Fetch content for each non-binary file (N+1 — acceptable for v1)
-            for (const manifestEntry of manifestData.files) {
-              if (manifestEntry.isBinary) {
-                files.push({ path: manifestEntry.path, content: "", isBinary: true });
-                continue;
-              }
-              try {
-                const encodedPath = manifestEntry.path.split("/").map(encodeURIComponent).join("/");
-                const fileResp = await fetch(
-                  `${apiUrl}/api/skills/${skill.id}/files/${encodedPath}`,
-                  { headers: authHeaders },
-                );
-                if (fileResp.ok) {
-                  const fileData = (await fileResp.json()) as {
-                    file: { path: string; content: string; isBinary: boolean };
-                  };
-                  files.push({
-                    path: fileData.file.path,
-                    content: fileData.file.content,
-                    isBinary: fileData.file.isBinary,
-                  });
+        const bundled = bundledFiles?.get(skill.id);
+        if (bundled) {
+          // Bundle path: every file (including binaries) arrived with the
+          // skill list, so there is nothing left to fetch.
+          files.push(...bundled);
+        } else {
+          // Legacy server: fetch manifest to know which files exist + which are binary
+          try {
+            const manifestResp = await fetch(`${apiUrl}/api/skills/${skill.id}/files`, {
+              headers: authHeaders,
+            });
+            if (manifestResp.ok) {
+              const manifestData = (await manifestResp.json()) as {
+                files: { path: string; isBinary: boolean }[];
+              };
+
+              // Fetch content for each non-binary file (N+1 — acceptable for v1)
+              for (const manifestEntry of manifestData.files) {
+                if (manifestEntry.isBinary) {
+                  files.push({ path: manifestEntry.path, content: "", isBinary: true });
+                  continue;
+                }
+                try {
+                  const encodedPath = manifestEntry.path
+                    .split("/")
+                    .map(encodeURIComponent)
+                    .join("/");
+                  const fileResp = await fetch(
+                    `${apiUrl}/api/skills/${skill.id}/files/${encodedPath}`,
+                    { headers: authHeaders },
+                  );
+                  if (fileResp.ok) {
+                    const fileData = (await fileResp.json()) as {
+                      file: { path: string; content: string; isBinary: boolean };
+                    };
+                    files.push({
+                      path: fileData.file.path,
+                      content: fileData.file.content,
+                      isBinary: fileData.file.isBinary,
+                    });
+                  }
+                } catch {
+                  // Non-fatal — skip this file
                 }
-              } catch {
-                // Non-fatal — skip this file
               }
             }
+          } catch {
+            // Non-fatal — treat as no files (will skip complex skill per writer logic)
           }
-        } catch {
-          // Non-fatal — treat as no files (will skip complex skill per writer logic)
         }
       }
 

package/src/vcs/bitbucket.ts

@@ -0,0 +1,58 @@
+/**
+ * Bitbucket Cloud URL helpers. Pure functions, safe on both the API server and
+ * the worker (no DB imports). Bitbucket Data Center is out of scope.
+ */
+
+/**
+ * True when the URL's host is bitbucket.org. Only the host counts, so a
+ * `bitbucket.org` path segment on another host (`gitlab.com/bitbucket.org/x`)
+ * is not Bitbucket.
+ */
+export function isBitbucketUrl(url: string): boolean {
+  const trimmed = url.trim();
+  // SCP-style SSH: user@host:path
+  const scp = trimmed.match(/^[^@/\s:]+@([^:/\s]+):/);
+  if (scp) return (scp[1] as string).toLowerCase() === "bitbucket.org";
+  try {
+    return new URL(trimmed).hostname.toLowerCase() === "bitbucket.org";
+  } catch {
+    // Scheme-less `bitbucket.org/ws/repo`
+    return /^bitbucket\.org(\/|$)/i.test(trimmed);
+  }
+}
+
+/**
+ * Split a Bitbucket Cloud remote into its workspace and repository slug.
+ * Accepts the HTTPS forms (with or without a `user@` prefix, trailing `/` or
+ * `.git`) and the SSH forms (`git@bitbucket.org:ws/repo.git`,
+ * `ssh://git@bitbucket.org/ws/repo.git`). Returns null otherwise.
+ */
+export function parseBitbucketRepoUrl(url: string): { workspace: string; repoSlug: string } | null {
+  const trimmed = url.trim();
+  if (!isBitbucketUrl(trimmed)) return null;
+
+  // SCP-style SSH: git@bitbucket.org:{workspace}/{repo}.git
+  const scp = trimmed.match(/^[^@/\s]+@bitbucket\.org:([^/]+)\/([^/]+?)(?:\.git)?\/?$/i);
+  if (scp) return { workspace: scp[1] as string, repoSlug: scp[2] as string };
+
+  let parsed: URL;
+  try {
+    parsed = new URL(trimmed);
+  } catch {
+    return null;
+  }
+  if (parsed.hostname.toLowerCase() !== "bitbucket.org") return null;
+  const parts = parsed.pathname
+    .replace(/\.git\/?$/, "")
+    .split("/")
+    .filter(Boolean);
+  const [workspace, repoSlug] = parts;
+  if (!workspace || !repoSlug) return null;
+  return { workspace: decodeURIComponent(workspace), repoSlug: decodeURIComponent(repoSlug) };
+}
+
+/** `workspace/repo_slug` for a Bitbucket Cloud remote, or null. */
+export function bitbucketFullName(url: string): string | null {
+  const parsed = parseBitbucketRepoUrl(url);
+  return parsed ? `${parsed.workspace}/${parsed.repoSlug}` : null;
+}

package/src/vcs/index.ts

@@ -3,6 +3,7 @@
  */
 
 import { isAzureDevOpsUrl } from "./azure-devops";
+import { isBitbucketUrl } from "./bitbucket";
 import type { VcsProvider } from "./types";
 
 export type { VcsProvider } from "./types";
@@ -13,6 +14,7 @@ export type { VcsProvider } from "./types";
  */
 export function detectVcsProvider(url: string): VcsProvider | null {
   if (isAzureDevOpsUrl(url)) return "azure-devops";
+  if (isBitbucketUrl(url)) return "bitbucket";
   if (url.includes("gitlab.com") || url.includes("gitlab.")) return "gitlab";
   if (url.includes("github.com") || /^[\w.-]+\/[\w.-]+$/.test(url)) return "github";
   return null;

package/src/vcs/types.ts

@@ -1,5 +1,5 @@
 /**
- * VCS Provider types — shared across GitHub/GitLab/Azure DevOps integration.
+ * VCS Provider types — shared across GitHub/GitLab/Azure DevOps/Bitbucket integration.
  */
 
-export type VcsProvider = "github" | "gitlab" | "azure-devops";
+export type VcsProvider = "github" | "gitlab" | "azure-devops" | "bitbucket";

package/src/workflows/approval-resolution.ts

@@ -1,6 +1,7 @@
 import type { WorkflowDefinition } from "../types";
 import type { ApprovalOutcome, ResolvedApproval } from "./executors/base";
 import type { ExecutorRegistry } from "./executors/registry";
+import { resolveStepNode } from "./foreach-body";
 
 /**
  * Step output and output port for a step whose approval request resolved.
@@ -18,7 +19,9 @@ export function shapeApprovalResolution(
   parkedOutput: unknown,
   approval: ResolvedApproval,
 ): ApprovalOutcome {
-  const node = definition.nodes.find((candidate) => candidate.id === nodeId);
+  // A foreach child resolves to its body node, so a system-one-decision body
+  // keeps its own shaping.
+  const node = resolveStepNode(definition, nodeId);
   if (node && registry.has(node.type)) {
     const shaped = registry.get(node.type).resolveApproval(parkedOutput, approval);
     if (shaped) return shaped;

package/src/workflows/checkpoint.ts

@@ -83,11 +83,16 @@ export async function checkpointStepFailure(
 
 /**
  * Checkpoint a step entering waiting state (async executor).
+ *
+ * `keepRunStatus` parks the step and persists the context but leaves the run
+ * `running`: a foreach parent parks before its driver starts the children, and
+ * the run must not read as `waiting` until they are dispatched.
  */
 export async function checkpointStepWaiting(
   runId: string,
   stepId: string,
   ctx: Record<string, unknown>,
+  options: { keepRunStatus?: boolean } = {},
 ): Promise<boolean> {
   return getDbClient().transaction(async () => {
     const step = await getDbClient().get<{ id: string }>(
@@ -103,7 +108,10 @@ export async function checkpointStepWaiting(
     );
     if (!step) return false;
 
-    await updateWorkflowRun(runId, { status: "waiting", context: ctx });
+    await updateWorkflowRun(
+      runId,
+      options.keepRunStatus ? { context: ctx } : { status: "waiting", context: ctx },
+    );
     return true;
   });
 }

package/src/workflows/constants.ts

@@ -1 +1,4 @@
 export const FAILED_TASK_OUTPUT_PREFIX = "[FAILED:";
+
+/** `waitFor` of a foreach parent that materialized its children; the driver starts them. */
+export const FOREACH_ITEMS_WAIT_FOR = "foreach.items";

package/src/workflows/definition.ts

@@ -11,6 +11,12 @@ import {
   systemOneStaticShapeViolations,
 } from "./executors/system-one-decision";
 import { systemOneExtractionStaticShapeViolations } from "./executors/system-one-extraction";
+import {
+  FOREACH_FAILURE_POLICIES,
+  type ForeachFailurePolicy,
+  foreachBodyTypeError,
+  isForeachBodyType,
+} from "./foreach-body";
 
 /** Extract all target node IDs from a node's `next` field */
 export function getNextTargets(next: string | string[] | Record<string, string>): string[] {
@@ -220,7 +226,7 @@ export function validateDefinition(
       ...systemOneRetryViolations(node),
     );
     if (node.type === "foreach") {
-      validateForeachNode(node, errors);
+      validateForeachNode(node, errors, registry);
       // A legacy `#` id may stay editable as a NORMAL node, but never as a foreach
       // parent: its children would be `a#b#item`, and parseSyntheticNodeId splits on
       // the FIRST `#`, so the join would resolve them to parent "a" and never close.
@@ -312,20 +318,25 @@ export function validateDefinition(
 
       reportStaticConfigIssues(node, registry.get(node.type).configSchema, node.config, errors);
 
-      // A foreach body is executed by the agent-task executor per item — hold its
-      // static config to the same schema a top-level agent-task node gets, so an
-      // invalid field (priority: 101, tags: "x") fails at authoring instead of
+      // A foreach body is executed by its own executor per item — hold its
+      // static config to the same schema a top-level node of that type gets, so
+      // an invalid field (priority: 101, tags: "x") fails at authoring instead of
       // after the fan-out materialized. Interpolated fields defer as usual.
-      if (node.type === "foreach" && registry.has("agent-task")) {
-        const body = node.config.body;
-        const bodyConfig =
-          typeof body === "object" && body !== null && !Array.isArray(body)
-            ? (body as Record<string, unknown>).config
-            : undefined;
+      const body = node.type === "foreach" ? node.config.body : undefined;
+      const bodyRecord =
+        typeof body === "object" && body !== null && !Array.isArray(body)
+          ? (body as Record<string, unknown>)
+          : undefined;
+      if (
+        bodyRecord &&
+        typeof bodyRecord.type === "string" &&
+        isForeachBodyType(bodyRecord.type, registry)
+      ) {
+        const bodyConfig = bodyRecord.config;
         if (typeof bodyConfig === "object" && bodyConfig !== null && !Array.isArray(bodyConfig)) {
           reportStaticConfigIssues(
             node,
-            registry.get("agent-task").configSchema,
+            registry.get(bodyRecord.type).configSchema,
             bodyConfig,
             errors,
             "config.body.config",
@@ -401,10 +412,27 @@ function reportStaticConfigIssues(
   }
 }
 
-function validateForeachNode(node: WorkflowNode, errors: string[]): void {
+function validateForeachNode(
+  node: WorkflowNode,
+  errors: string[],
+  registry?: ExecutorRegistry,
+): void {
   const config = node.config;
-  if (Object.hasOwn(config, "concurrency")) {
-    errors.push(`Node "${node.id}" foreach concurrency is not supported in v1`);
+  if (
+    config.concurrency !== undefined &&
+    !(Number.isInteger(config.concurrency) && (config.concurrency as number) >= 1)
+  ) {
+    errors.push(
+      `Node "${node.id}" foreach config.concurrency must be an integer of 1 or more, got ${JSON.stringify(config.concurrency)}`,
+    );
+  }
+  if (
+    config.failurePolicy !== undefined &&
+    !FOREACH_FAILURE_POLICIES.includes(config.failurePolicy as ForeachFailurePolicy)
+  ) {
+    errors.push(
+      `Node "${node.id}" foreach config.failurePolicy must be one of ${FOREACH_FAILURE_POLICIES.map((p) => `"${p}"`).join(", ")}, got ${JSON.stringify(config.failurePolicy)}`,
+    );
   }
 
   // The asynchronous join (joinForeach) checkpoints the aggregate and routes
@@ -436,8 +464,11 @@ function validateForeachNode(node: WorkflowNode, errors: string[]): void {
     return;
   }
   const bodyRecord = body as Record<string, unknown>;
-  if (bodyRecord.type !== "agent-task") {
-    errors.push(`Node "${node.id}" foreach config.body.type must be "agent-task" in v1`);
+  if (typeof bodyRecord.type !== "string" || bodyRecord.type.length === 0) {
+    errors.push(`Node "${node.id}" foreach config.body.type must be a non-empty string`);
+  } else {
+    const typeError = foreachBodyTypeError(node.id, bodyRecord.type, registry);
+    if (typeError) errors.push(typeError);
   }
   if (
     typeof bodyRecord.config !== "object" ||
@@ -448,7 +479,7 @@ function validateForeachNode(node: WorkflowNode, errors: string[]): void {
     return;
   }
   const bodyConfig = bodyRecord.config as Record<string, unknown>;
-  if (typeof bodyConfig.template !== "string") {
+  if (bodyRecord.type === "agent-task" && typeof bodyConfig.template !== "string") {
     errors.push(`Node "${node.id}" foreach agent-task body.config.template must be a string`);
   }
 }

package/src/workflows/engine.ts

@@ -25,6 +25,7 @@ import { telemetry } from "../telemetry";
 import type { Workflow, WorkflowDefinition, WorkflowNode, WorkflowRunStep } from "../types";
 import { checkpointStep, checkpointStepFailure, checkpointStepWaiting } from "./checkpoint";
 import { loadCompletedStepRouting } from "./completed-step-routing";
+import { FOREACH_ITEMS_WAIT_FOR } from "./constants";
 import { shouldSkipCooldown } from "./cooldown";
 import { findEntryNodes, getNextTargets, getSuccessors, resolveValidationPort } from "./definition";
 import type { AsyncExecutorResult } from "./executors/base";
@@ -34,15 +35,16 @@ import {
   systemOneRetryViolations,
   systemOneUnresolvedError,
 } from "./executors/system-one-decision";
+import { parkAndDriveForeach } from "./foreach-driver";
 import { FOREACH_TERMINAL_STEP_STATUSES, resolveForeachParent } from "./foreach-join";
 import { getSecretInputKeys, redactSecretsForStorage, resolveInputs } from "./input";
 import { validateJsonSchema } from "./json-schema-validator";
 import { getMaxWorkflowStepsPerRun } from "./limits";
+import { resolveNodeTimeoutMs } from "./node-timeout";
 import { findWorkflowReadinessProblems, formatReadinessRunError } from "./readiness";
 import { deepInterpolate } from "./template";
 import { runStepValidation, type ValidationRunResult } from "./validation";
 
-const DEFAULT_TIMEOUT_MS = 30_000;
 // Read dynamically, NOT captured at module load: `src/http/index.ts` imports
 // this module before `loadGlobalConfigsIntoEnv()` hydrates `swarm_config` into
 // `process.env`, so a module-level const would permanently ignore DB-saved
@@ -510,14 +512,19 @@ async function walkGraphOwned(
     const hasPendingRetries = finalSteps.some(
       (s) => s.status === "failed" && s.nextRetryAt != null,
     );
-    const failedSteps = finalSteps.filter((s) => s.status === "failed" && s.nextRetryAt == null);
+    // A foreach child's outcome is in its parent's aggregate; the parent step
+    // is authoritative for the run outcome.
+    const isForeachChild = (s: WorkflowRunStep) => resolveForeachParent(def, s.nodeId) !== null;
+    const failedSteps = finalSteps.filter(
+      (s) => s.status === "failed" && s.nextRetryAt == null && !isForeachChild(s),
+    );
     // Exclude entry/trigger nodes when checking for completed steps — a trigger
     // completing doesn't mean a meaningful branch succeeded. Without this filter,
     // a linear workflow (trigger → mustPass validator → action) would be marked
     // as partial-failure instead of failed when the validator fails.
     const entryNodeIds = new Set(findEntryNodes(def).map((n) => n.id));
     const hasCompletedSteps = finalSteps.some(
-      (s) => s.status === "completed" && !entryNodeIds.has(s.nodeId),
+      (s) => s.status === "completed" && !entryNodeIds.has(s.nodeId) && !isForeachChild(s),
     );
 
     if (hasWaitingSteps) {
@@ -880,18 +887,7 @@ async function runClaimedStep(
     inputCtx: interpolationCtx,
   };
 
-  // Inline script nodes historically expose their wall-clock budget as
-  // `config.timeout`, while the workflow watchdog reads `config.timeoutMs` for
-  // every other executor. Keep the outer watchdog aligned with the script
-  // executor so a script configured for (for example) 90s is not killed by the
-  // engine's 30s default first.
-  const configuredTimeoutMs =
-    typeof node.config?.timeoutMs === "number"
-      ? node.config.timeoutMs
-      : node.type === "script" && typeof node.config?.timeout === "number"
-        ? node.config.timeout
-        : undefined;
-  const timeoutMs = configuredTimeoutMs ?? DEFAULT_TIMEOUT_MS;
+  const timeoutMs = resolveNodeTimeoutMs(node);
 
   let result: Awaited<ReturnType<typeof executor.run>>;
   try {
@@ -949,6 +945,20 @@ async function runClaimedStep(
 
   // Check for async result
   if ("async" in result && (result as AsyncExecutorResult).async) {
+    if ((result as AsyncExecutorResult).waitFor === FOREACH_ITEMS_WAIT_FOR) {
+      // The foreach executor materialized its children; park the parent and
+      // start them. Instant bodies run here, each against its own budget, and
+      // can close the join before the drive returns.
+      const drive = await parkAndDriveForeach({
+        runId,
+        stepId,
+        parentNodeId: node.id,
+        ctx,
+        registry,
+      });
+      if (drive.joined) return { outcome: "completed", successors: drive.successors };
+      return { outcome: drive.parked ? "waiting" : "completed", successors: [] };
+    }
     const waiting = await checkpointStepWaiting(runId, stepId, ctx);
     // A child run that finished before the step parked had its event dropped.
     if (waiting && (result as AsyncExecutorResult).waitFor === "workflow.child.finished") {