@desplega.ai/agent-swarm 2.5.1 → 2.5.3

package/dist/{cli-pyy4c9ch.js → cli-jjznk3f7.js}

@@ -4,9 +4,22 @@ import {
   scrubJsonValue,
   init_scrub_json,
   getDbClient2,
+  getAgentById2,
+  updateAgentStatus2,
+  updateAgentMaxTasks2,
+  getActiveTaskCount2,
   getTaskById2,
+  getChildWorkflowRunId,
+  isParentStepAttemptCurrent,
   createForeachChildSteps,
   init_workflow_runs,
+  isApiOnlyConfigKey,
+  isInternalConfigKey,
+  internalConfigKeyError,
+  isReservedConfigKey,
+  reservedKeyError,
+  validateConfigEntry,
+  init_swarm_config_guard,
   getOAuthApp,
   getOAuthTokens,
   init_oauth,
@@ -14,6 +27,7 @@ import {
   init_workflow_replay,
   createTaskExtended2,
   getSwarmConfigs2,
+  upsertSwarmConfig2,
   getWorkflow2,
   createWorkflowRun2,
   getWorkflowRun2,
@@ -31,22 +45,36 @@ import {
   getStepCountForNode2,
   getLatestStepForNode2,
   getCurrentStepForNode2,
+  getApprovalRequestById2,
   claimApprovalCancellationNotification2,
   completeApprovalCancellationNotificationClaim2,
   releaseApprovalCancellationNotificationClaim2,
+  updateApprovalRequestNotifications2,
   init_db3
-} from "./cli-q9pzwxvk.js";
+} from "./cli-kxawjrxg.js";
+import {
+  isMultiRuntimeEnabled
+} from "./cli-e8xyjvfc.js";
 import {
   getSlackApp2
-} from "./cli-e9btqw4y.js";
+} from "./cli-ce0ak9ms.js";
+import {
+  externalChannelToolError2,
+  isBlockExternalEnabled2,
+  getChannelBlockReason2
+} from "./cli-s53vp709.js";
 import {
   DEFAULT_MODEL,
   resolveCredential
 } from "./cli-qqzmjxkf.js";
+import {
+  revokeRuntimeTokensForRuntime,
+  init_users
+} from "./cli-e8jyq7d8.js";
 import {
   TERMINAL_TASK_STATUSES,
   init_types
-} from "./cli-rh5smt8t.js";
+} from "./cli-mz9afxxf.js";
 import {
   getSlackConfiguration,
   isSlackConfigured,
@@ -117,7 +145,7 @@ async function notifyAutomationPreflightFailure(preflight) {
     return;
   }
   try {
-    const { getSlackApp } = await import("./app-nndcvftq.js");
+    const { getSlackApp } = await import("./app-ag29n14f.js");
     const app = getSlackApp();
     if (!app) {
       console.warn("[Automation Preflight] Slack not available, cannot send notification");
@@ -355,6 +383,15 @@ function utcDayBounds(now) {
   const start = new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), now.getUTCDate()));
   return { start: start.toISOString(), end: new Date(start.getTime() + 86400000).toISOString() };
 }
+async function isFirstWorkflowPreflightFailureToday(workflowId, runId, now = new Date) {
+  const bounds = utcDayBounds(now);
+  const row = await getDbClient2().get(`SELECT 1 AS found FROM workflow_runs
+     WHERE workflowId = ? AND id != ? AND status = 'failed'
+       AND error LIKE 'needs_setup:%'
+       AND startedAt >= ? AND startedAt < ?
+     LIMIT 1`, [workflowId, runId, bounds.start, bounds.end]);
+  return row == null;
+}
 async function recordSchedulePreflightFailure(scheduleId, failureReason, now = new Date) {
   const message = scrubSecrets(failureReason);
   return await getDbClient2().transaction(async (tx) => {
@@ -375,7 +412,7 @@ async function recordWorkflowPreflightFailure(input) {
   const bounds = utcDayBounds(now);
   return await getDbClient2().transaction(async (tx) => {
     const existing = await tx.get(`SELECT id FROM workflow_runs
-       WHERE workflowId = ? AND status = 'failed'
+       WHERE workflowId = ? AND status = 'failed' AND parentStepId IS NULL
          AND error LIKE 'needs_setup:%'
          AND startedAt >= ? AND startedAt < ?
        ORDER BY startedAt ASC LIMIT 1`, [input.workflowId, bounds.start, bounds.end]);
@@ -397,7 +434,10 @@ async function recordWorkflowPreflightFailure(input) {
       timestamp,
       timestamp
     ]);
-    return { runId, recorded: true };
+    return {
+      runId,
+      recorded: await isFirstWorkflowPreflightFailureToday(input.workflowId, runId, now)
+    };
   });
 }
 
@@ -450,14 +490,628 @@ class BaseExecutor {
 
 // src/workflows/executors/human-in-the-loop.ts
 init_zod();
-init_constants2();
+
+// src/be/approval-config-question.ts
+init_zod();
+init_db3();
+
+// src/be/multi-runtime.ts
+init_secret_scrubber();
+init_db3();
+init_users();
+var AGENT_MAX_TASKS_CONFIG_KEY = "AGENT_MAX_TASKS";
+function parseAgentMaxTasksValue(raw) {
+  const str = raw.trim();
+  if (!/^\d+$/.test(str))
+    return null;
+  const value = Number(str);
+  return value >= 1 && value <= 100 ? value : null;
+}
+function defaultMaxTasksForAgent(agent) {
+  return agent.isLead ? 2 : 1;
+}
+async function getAgentMaxTasksConfig(agentId) {
+  return (await getSwarmConfigs2({ scope: "agent", scopeId: agentId, key: AGENT_MAX_TASKS_CONFIG_KEY }))[0] ?? null;
+}
+async function reconcileAgentMaxTasksPolicy(agentId) {
+  const agent = await getAgentById2(agentId);
+  if (!agent)
+    return;
+  const existing = await getAgentMaxTasksConfig(agentId);
+  if (existing) {
+    const authoritative = parseAgentMaxTasksValue(existing.value);
+    if (authoritative !== null && authoritative !== (agent.maxTasks ?? 1)) {
+      await updateAgentMaxTasks2(agentId, authoritative);
+    }
+    return;
+  }
+  await upsertSwarmConfig2({
+    scope: "agent",
+    scopeId: agentId,
+    key: AGENT_MAX_TASKS_CONFIG_KEY,
+    value: String(agent.maxTasks ?? defaultMaxTasksForAgent(agent)),
+    description: "Logical agent max-tasks policy (seeded from agents.maxTasks)"
+  });
+}
+async function resetAgentMaxTasksMirror(agentId) {
+  const agent = await getAgentById2(agentId);
+  if (!agent)
+    return;
+  await updateAgentMaxTasks2(agentId, defaultMaxTasksForAgent(agent));
+}
+async function upsertSwarmConfigWithPolicyMirror(data) {
+  const scopeId = data.scope === "agent" ? data.scopeId : null;
+  if (!scopeId || data.key !== AGENT_MAX_TASKS_CONFIG_KEY) {
+    return upsertSwarmConfig2(data);
+  }
+  return await getDbClient2().transaction(async () => {
+    const row = await upsertSwarmConfig2(data);
+    const value = parseAgentMaxTasksValue(data.value);
+    if (value !== null)
+      await updateAgentMaxTasks2(scopeId, value);
+    return row;
+  });
+}
+function rowToRuntimeInstance(row) {
+  let metadata = null;
+  if (row.metadata) {
+    try {
+      metadata = JSON.parse(row.metadata);
+    } catch {
+      metadata = null;
+    }
+  }
+  return {
+    id: row.id,
+    agentId: row.agent_id,
+    poolId: row.pool_id ?? null,
+    controllerId: row.controller_id ?? null,
+    externalHandle: row.external_handle ? JSON.parse(row.external_handle) : null,
+    provisionAttempts: row.provision_attempts ?? 0,
+    provisionError: row.provision_error ?? null,
+    provisionRequestedAt: row.provision_requested_at ?? null,
+    draining: row.draining === 1,
+    idleSince: row.idle_since ?? null,
+    leaseExpiresAt: row.lease_expires_at ?? null,
+    taskId: row.task_id ?? null,
+    status: row.status,
+    reportedSlots: row.reported_slots,
+    credentialReady: row.credential_ready === null ? null : row.credential_ready === 1,
+    metadata,
+    lastSeenAt: row.last_seen_at,
+    createdAt: row.created_at,
+    updatedAt: row.updated_at
+  };
+}
+function runtimeStaleThresholdMinutes() {
+  return Number(process.env.RUNTIME_STALE_THRESHOLD_MIN) || 5;
+}
+function runtimeLivenessCutoff() {
+  return new Date(Date.now() - runtimeStaleThresholdMinutes() * 60 * 1000).toISOString();
+}
+async function upsertRuntimeInstance(instance) {
+  const metadataJson = instance.metadata ? JSON.stringify(instance.metadata) : null;
+  const row = await getDbClient2().transaction(async (tx) => {
+    const provisioning = await tx.get("SELECT id FROM runtime_instances WHERE id = ? AND status = 'provisioning' AND agent_id = ?", [instance.id, instance.agentId]);
+    const row = await tx.get(`INSERT INTO runtime_instances (id, agent_id, status, reported_slots, metadata)
+     VALUES (?, ?, 'active', ?, ?)
+     ON CONFLICT(id) DO UPDATE SET
+       status = 'active',
+       reported_slots = excluded.reported_slots,
+       metadata = COALESCE(excluded.metadata, runtime_instances.metadata),
+       last_seen_at = strftime('%Y-%m-%dT%H:%M:%fZ', 'now'),
+       updated_at = strftime('%Y-%m-%dT%H:%M:%fZ', 'now')
+     WHERE runtime_instances.agent_id = excluded.agent_id
+     RETURNING *`, [instance.id, instance.agentId, instance.reportedSlots, metadataJson]);
+    if (row?.pool_id && provisioning) {
+      await tx.run("UPDATE agents SET runtime_provision_attempts = 0, runtime_provision_retry_at = NULL WHERE id = ?", [row.agent_id]);
+      await tx.run("UPDATE runtime_pools SET consecutive_failures = 0, circuit_open_until = NULL WHERE id = ?", [row.pool_id]);
+    }
+    return row;
+  });
+  return row ? rowToRuntimeInstance(row) : null;
+}
+async function getRuntimeInstanceById(id) {
+  const row = await getDbClient2().get("SELECT * FROM runtime_instances WHERE id = ?", [id]);
+  return row ? rowToRuntimeInstance(row) : null;
+}
+async function insertProvisioningRuntime(instance) {
+  const row = await getDbClient2().get(`INSERT INTO runtime_instances (id, agent_id, pool_id, controller_id, status,
+       reported_slots, provision_requested_at)
+     VALUES (?, ?, ?, ?, 'provisioning', ?, ?) RETURNING *`, [
+    instance.id,
+    instance.agentId,
+    instance.poolId,
+    instance.controllerId,
+    instance.reportedSlots ?? 1,
+    new Date().toISOString()
+  ]);
+  return rowToRuntimeInstance(row);
+}
+async function markRuntimeTerminated(id, reason) {
+  await getDbClient2().transaction(async () => {
+    const runtime = await getRuntimeInstanceById(id);
+    if (!runtime)
+      return;
+    await markRuntimeInstanceOffline(id, runtime.agentId);
+    if (runtime.status === "provisioning") {
+      await getDbClient2().run("UPDATE runtime_instances SET provision_error = ? WHERE id = ?", [
+        scrubSecrets(reason),
+        id
+      ]);
+    }
+    await reconcileAgentStatusFromRuntimes(runtime.agentId);
+    await revokeRuntimeTokensForRuntime(id);
+  });
+}
+async function touchRuntimeInstance(id, agentId) {
+  const result = await getDbClient2().run(`UPDATE runtime_instances
+     SET last_seen_at = strftime('%Y-%m-%dT%H:%M:%fZ', 'now'),
+         updated_at = strftime('%Y-%m-%dT%H:%M:%fZ', 'now')
+     WHERE id = ? AND agent_id = ? AND status = 'active' AND last_seen_at >= ?`, [id, agentId, runtimeLivenessCutoff()]);
+  return result.changes > 0;
+}
+async function markRuntimeInstanceOffline(id, agentId) {
+  const row = await getDbClient2().get(`UPDATE runtime_instances
+     SET status = 'offline', updated_at = strftime('%Y-%m-%dT%H:%M:%fZ', 'now')
+     WHERE id = ? AND agent_id = ? RETURNING *`, [id, agentId]);
+  return row ? rowToRuntimeInstance(row) : null;
+}
+async function countActiveRuntimeInstancesForAgent(agentId) {
+  const result = await getDbClient2().get(`SELECT COUNT(*) as count FROM runtime_instances
+     WHERE agent_id = ? AND status = 'active' AND last_seen_at >= ?`, [agentId, runtimeLivenessCutoff()]);
+  return result?.count ?? 0;
+}
+async function listRuntimeInstancesForAgent(agentId) {
+  const rows = await getDbClient2().query(`SELECT *, (status = 'active' AND last_seen_at >= ?) AS is_live
+     FROM runtime_instances
+     WHERE agent_id = ?
+     ORDER BY created_at ASC, id ASC`, [runtimeLivenessCutoff(), agentId]);
+  return rows.map((row) => ({ ...rowToRuntimeInstance(row), isLive: row.is_live === 1 }));
+}
+async function setRuntimeCredentialReady(id, agentId, ready) {
+  const result = await getDbClient2().run(`UPDATE runtime_instances
+     SET credential_ready = ?, updated_at = strftime('%Y-%m-%dT%H:%M:%fZ', 'now')
+     WHERE id = ? AND agent_id = ? AND status = 'active' AND last_seen_at >= ?`, [ready ? 1 : 0, id, agentId, runtimeLivenessCutoff()]);
+  return result.changes > 0;
+}
+async function hasReadyLiveRuntime(agentId) {
+  const row = await getDbClient2().get(`SELECT COUNT(*) c FROM runtime_instances
+     WHERE agent_id = ? AND status = 'active' AND last_seen_at >= ?
+       AND (credential_ready IS NULL OR credential_ready = 1)`, [agentId, runtimeLivenessCutoff()]);
+  return (row?.c ?? 0) > 0;
+}
+async function reconcileAgentStatusFromRuntimes(agentId) {
+  await getDbClient2().transaction(async () => {
+    const agent = await getAgentById2(agentId);
+    if (!agent)
+      return;
+    if (await countActiveRuntimeInstancesForAgent(agentId) === 0) {
+      if (agent.status !== "offline")
+        await updateAgentStatus2(agentId, "offline");
+      return;
+    }
+    if (!await hasReadyLiveRuntime(agentId)) {
+      if (agent.status !== "waiting_for_credentials") {
+        await updateAgentStatus2(agentId, "waiting_for_credentials");
+      }
+      return;
+    }
+    const next = await getActiveTaskCount2(agentId) > 0 ? "busy" : "idle";
+    if (agent.status !== next)
+      await updateAgentStatus2(agentId, next);
+  });
+}
+async function agentsWithLiveRuntime() {
+  const rows = await getDbClient2().query(`SELECT DISTINCT agent_id FROM runtime_instances
+     WHERE status = 'active' AND last_seen_at >= ?`, [runtimeLivenessCutoff()]);
+  return new Set(rows.map((r) => r.agent_id));
+}
+async function expireStaleRuntimeInstances() {
+  if (!isMultiRuntimeEnabled()) {
+    return { expired: 0, agentsOffline: 0, pruned: 0 };
+  }
+  return await getDbClient2().transaction(async (tx) => {
+    const cutoff = runtimeLivenessCutoff();
+    const stale = await tx.query(`SELECT id, agent_id FROM runtime_instances
+       WHERE status = 'active' AND last_seen_at < ? AND pool_id IS NULL`, [cutoff]);
+    const pruned = (await tx.run("DELETE FROM runtime_instances WHERE last_seen_at < ? AND status != 'provisioning' AND (pool_id IS NULL OR status = 'offline')", [cutoff])).changes;
+    let agentsOffline = 0;
+    for (const agentId of new Set(stale.map((r) => r.agent_id))) {
+      await reconcileAgentStatusFromRuntimes(agentId);
+      if ((await getAgentById2(agentId))?.status === "offline")
+        agentsOffline++;
+    }
+    return { expired: stale.length, agentsOffline, pruned };
+  });
+}
+async function listRuntimeInstancesForPool(poolId) {
+  return (await getDbClient2().query("SELECT * FROM runtime_instances WHERE pool_id = ? ORDER BY created_at", [poolId])).map(rowToRuntimeInstance);
+}
+
+// src/be/approval-config-question.ts
+init_swarm_config_guard();
+var ConfigQuestionSettingsSchema = object2({
+  key: string2().min(1).max(255).regex(/^\S+$/, "must not contain whitespace").describe("The swarm config key to set, e.g. BITBUCKET_TOKEN"),
+  scope: _enum2(["global", "agent", "repo"]).describe("Config scope the value is written to"),
+  scopeId: string2().min(1).optional().describe("Agent or repo id for agent/repo scope. From request-human-input, agent scope defaults to the calling agent; pass it explicitly when asking on behalf of another agent."),
+  isSecret: boolean().optional().describe("Store encrypted and never show the value (default true). An existing secret row always stays secret."),
+  helpUrl: string2().url().refine((url) => /^https?:\/\//i.test(url), "must be an http(s) URL").optional().describe("Link shown next to the field, e.g. where to create the token"),
+  options: array2(object2({
+    value: string2(),
+    label: string2(),
+    description: string2().optional()
+  })).optional().describe("Allowed values for a non-secret key, rendered as a choice"),
+  defaultValue: string2().optional().describe("Prefilled value for a non-secret key")
+});
+var ConfigAnswerSchema = discriminatedUnion("action", [
+  object2({ action: literal2("set"), value: string2() }),
+  object2({ action: literal2("keep") }),
+  object2({ action: literal2("skip") })
+]);
+var ConfigResultSchema = object2({
+  key: string2(),
+  scope: _enum2(["global", "agent", "repo"]),
+  scopeId: string2().nullable(),
+  isSecret: boolean(),
+  status: _enum2(["set", "kept", "skipped"]),
+  updatedAt: string2().nullable(),
+  value: string2().optional()
+});
+var ConfigStateSchema = object2({
+  exists: boolean(),
+  isSecret: boolean(),
+  updatedAt: string2().nullable(),
+  value: string2().optional().describe("Current value; present only for non-secret rows")
+});
+async function readConfigRow(settings) {
+  const scopeId = settings.scope === "global" ? null : settings.scopeId ?? null;
+  const row = await getDbClient2().get(`SELECT isSecret, lastUpdatedAt, envPath, description,
+            CASE WHEN isSecret = 1 THEN NULL ELSE value END AS plainValue
+       FROM swarm_config
+      WHERE scope = ? AND ${scopeId === null ? "scopeId IS NULL" : "scopeId = ?"} AND key = ?`, scopeId === null ? [settings.scope, settings.key] : [settings.scope, scopeId, settings.key]);
+  if (!row)
+    return null;
+  const isSecret = row.isSecret === 1 || isApiOnlyConfigKey(settings.key);
+  return {
+    isSecret,
+    updatedAt: row.lastUpdatedAt,
+    envPath: row.envPath,
+    description: row.description,
+    ...isSecret || row.plainValue === null ? {} : { value: row.plainValue }
+  };
+}
+async function readConfigState(settings) {
+  const row = await readConfigRow(settings);
+  if (!row)
+    return { exists: false, isSecret: settings.isSecret !== false, updatedAt: null };
+  const isSecret = row.isSecret || settings.isSecret !== false;
+  return {
+    exists: true,
+    isSecret,
+    updatedAt: row.updatedAt,
+    ...!isSecret && row.value !== undefined ? { value: row.value } : {}
+  };
+}
+async function normalizeConfigQuestion(question, ctx) {
+  const fail = (reason) => ({
+    ok: false,
+    error: `config question "${question.id}": ${reason}`
+  });
+  const parsed = ConfigQuestionSettingsSchema.safeParse(question.config);
+  if (!parsed.success) {
+    const issue = parsed.error.issues[0];
+    const path = issue?.path.length ? `config.${issue.path.map(String).join(".")}` : "config";
+    return fail(`${path}: ${issue?.message ?? "invalid"}`);
+  }
+  if (ctx.approvers.policy !== "any") {
+    return fail('a config question needs approvers.policy "any" (a config value has one author)');
+  }
+  const settings = { ...parsed.data };
+  if (settings.scope === "agent" && !settings.scopeId && ctx.callerAgentId) {
+    settings.scopeId = ctx.callerAgentId;
+  }
+  if (settings.scope === "global" && settings.scopeId) {
+    return fail("global scope must not have scopeId");
+  }
+  if (settings.scope !== "global" && !settings.scopeId) {
+    return fail(`${settings.scope} scope requires scopeId`);
+  }
+  if (isReservedConfigKey(settings.key))
+    return fail(reservedKeyError(settings.key).message);
+  if (isInternalConfigKey(settings.key))
+    return fail(internalConfigKeyError(settings.key).message);
+  const row = await readConfigRow(settings);
+  const isSecret = settings.isSecret !== false || row?.isSecret === true || isApiOnlyConfigKey(settings.key);
+  if (isSecret && (settings.options || settings.defaultValue !== undefined)) {
+    return fail("options and defaultValue are only allowed when isSecret is false (and the key is not already stored as a secret)");
+  }
+  if (settings.options?.length === 0)
+    return fail("options must not be empty");
+  if (settings.options && settings.defaultValue !== undefined && !settings.options.some((option) => option.value === settings.defaultValue)) {
+    return fail("defaultValue must be one of options");
+  }
+  const label = question.label?.trim() ? question.label : settings.key;
+  return {
+    ok: true,
+    question: {
+      ...question,
+      label,
+      required: question.required ?? true,
+      config: { ...settings, isSecret }
+    }
+  };
+}
+async function normalizeApprovalQuestions(questions, ctx) {
+  const out = [];
+  for (const question of questions) {
+    if (question.type !== "config") {
+      if (question.config !== undefined) {
+        return {
+          ok: false,
+          error: `question "${question.id}": the config block is only valid on type "config"`
+        };
+      }
+      if (typeof question.label !== "string") {
+        return { ok: false, error: `question "${question.id}": label is required` };
+      }
+      out.push({ ...question, label: question.label });
+      continue;
+    }
+    const normalized = await normalizeConfigQuestion(question, ctx);
+    if (!normalized.ok)
+      return normalized;
+    out.push(normalized.question);
+  }
+  return { ok: true, questions: out };
+}
+function isConfigQuestion(question) {
+  return question.type === "config" && typeof question.config === "object" && !!question.config;
+}
+function parseConfigAnswer(question, raw, state) {
+  const fail = (reason) => ({
+    ok: false,
+    error: `config question "${question.id}": ${reason}`
+  });
+  const required = question.required !== false;
+  if (raw === undefined || raw === null) {
+    return required ? fail("an answer is required") : { ok: true, answer: { action: "skip" } };
+  }
+  const parsed = ConfigAnswerSchema.safeParse(raw);
+  if (!parsed.success) {
+    return fail('answer must be { action: "set", value } , { action: "keep" } or { action: "skip" }');
+  }
+  const answer = parsed.data;
+  if (answer.action === "keep") {
+    return state.exists ? { ok: true, answer } : fail("cannot keep a key that is not set");
+  }
+  if (answer.action === "skip") {
+    return required ? fail("a required question cannot be skipped") : { ok: true, answer };
+  }
+  if (answer.value.trim().length === 0)
+    return fail("value must not be empty");
+  const { config } = question;
+  const isSecret = config.isSecret || state.isSecret;
+  if (!isSecret && config.options && !config.options.some((o) => o.value === answer.value)) {
+    return fail("value must be one of options");
+  }
+  const error = validateConfigEntry({
+    scope: config.scope,
+    scopeId: config.scopeId ?? null,
+    key: config.key,
+    value: answer.value
+  });
+  if (error)
+    return fail(isSecret ? `value rejected by ${config.key} validation` : error);
+  return { ok: true, answer };
+}
+function result(question, status, isSecret, updatedAt, value) {
+  const { key, scope, scopeId } = question.config;
+  return {
+    key,
+    scope,
+    scopeId: scope === "global" ? null : scopeId ?? null,
+    isSecret,
+    status,
+    updatedAt,
+    ...!isSecret && value !== undefined ? { value } : {}
+  };
+}
+function skippedConfigResult(question) {
+  return result(question, "skipped", question.config.isSecret, null);
+}
+async function keptConfigResult(question) {
+  const row = await readConfigRow(question.config);
+  if (!row)
+    return null;
+  const isSecret = question.config.isSecret || row.isSecret;
+  return result(question, "kept", isSecret, row.updatedAt, row.value);
+}
+async function applyConfigAnswer(question, value) {
+  const { config } = question;
+  const existing = await readConfigRow(config);
+  const isSecret = config.isSecret || existing?.isSecret === true;
+  const written = await upsertSwarmConfigWithPolicyMirror({
+    scope: config.scope,
+    scopeId: config.scope === "global" ? null : config.scopeId ?? null,
+    key: config.key,
+    value,
+    isSecret,
+    envPath: existing?.envPath ?? null,
+    description: existing?.description ?? null
+  });
+  return result(question, "set", isSecret, written.lastUpdatedAt, value);
+}
+function formatConfigResult(value) {
+  const parsed = ConfigResultSchema.safeParse(value);
+  if (!parsed.success)
+    return null;
+  const r = parsed.data;
+  const where = `${r.scope}${r.scopeId ? `:${r.scopeId}` : ""}`;
+  const updated = r.updatedAt ? `, updated ${r.updatedAt}` : "";
+  const shown = !r.isSecret && r.value !== undefined ? ` = ${r.value}` : "";
+  return `${r.key} (${where}, ${r.isSecret ? "secret" : "plain"}): ${r.status}${updated}${shown}`;
+}
+
+// src/workflows/executors/human-in-the-loop.ts
 init_secret_scrubber();
 
 // src/workflows/approval-notifications.ts
 init_db3();
 init_resolver();
+
+// src/slack/dm.ts
+function isSlackUserId(id) {
+  return /^[UW][A-Z0-9]+$/.test(id);
+}
+async function resolveSlackConversationId(client, channelId) {
+  if (!isSlackUserId(channelId))
+    return channelId;
+  const result = await client.conversations.open({ users: channelId });
+  const dmId = result.channel?.id;
+  if (!dmId) {
+    throw new Error(`conversations.open returned no DM channel for user ${channelId}`);
+  }
+  return dmId;
+}
+
+// src/workflows/approval-notifications.ts
 init_types();
+init_constants2();
 init_secret_scrubber();
+var SLACK_SECTION_TEXT_LIMIT = 3000;
+function escapeSlackMrkdwn(text) {
+  return text.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;");
+}
+function buildSlackQuestionsSummary(questions, timeoutText = "") {
+  const header = `*Questions:*
+`;
+  const lines = questions.map((q) => `• ${escapeSlackMrkdwn((q.label ?? "").replace(/\s+/g, " ").trim())}${q.type === "config" ? " (set on dashboard)" : ""}`);
+  const fits = (shown, omitted) => {
+    const tail = omitted > 0 ? `
+_…and ${omitted} more. Answer all of them on the dashboard._` : "";
+    const text = `${header}${shown.join(`
+`)}${tail}${timeoutText}`;
+    return text.length <= SLACK_SECTION_TEXT_LIMIT ? text : null;
+  };
+  const full = fits(lines, 0);
+  if (full)
+    return full;
+  for (let count = lines.length - 1;count >= 0; count--) {
+    const text = fits(lines.slice(0, count), lines.length - count);
+    if (text)
+      return text;
+  }
+  return `${header}_${questions.length} questions. Answer them on the dashboard._`;
+}
+function formatTimeout(seconds) {
+  if (seconds < 60)
+    return `${seconds}s`;
+  if (seconds < 3600)
+    return `${Math.round(seconds / 60)}m`;
+  const hours = Math.floor(seconds / 3600);
+  const mins = Math.round(seconds % 3600 / 60);
+  return mins > 0 ? `${hours}h ${mins}m` : `${hours}h`;
+}
+async function dispatchApprovalNotifications(input, db = { updateApprovalRequestNotifications: updateApprovalRequestNotifications2, getApprovalRequestById: getApprovalRequestById2 }) {
+  const { requestId, title, questions, timeoutSeconds, notifications } = input;
+  if (!notifications.length)
+    return;
+  const approvalUrl = `${getAppUrl()}/approval-requests/${requestId}`;
+  const updatedChannels = [
+    ...notifications
+  ];
+  let updated = false;
+  for (let i = 0;i < notifications.length; i++) {
+    const notification = notifications[i];
+    if (notification.channel === "email") {
+      console.warn(`[HITL] Email notifications not yet supported (target: ${notification.target})`);
+      continue;
+    }
+    if (notification.channel === "slack") {
+      try {
+        const slackApp = getSlackApp2();
+        if (!slackApp) {
+          console.warn("[HITL] Slack not initialized — cannot send notification");
+          continue;
+        }
+        if (isBlockExternalEnabled2()) {
+          const conversationId = await resolveSlackConversationId(slackApp.client, notification.target);
+          const blockReason = await getChannelBlockReason2(slackApp.client, conversationId);
+          if (blockReason) {
+            console.warn(`[HITL] ${externalChannelToolError2(conversationId, blockReason)}`);
+            continue;
+          }
+        }
+        const questionsText = buildSlackQuestionsSummary(questions);
+        const timeoutCaption = timeoutSeconds !== undefined ? [
+          {
+            type: "context",
+            elements: [
+              {
+                type: "mrkdwn",
+                text: `⏱ Timeout: ${formatTimeout(timeoutSeconds)} — times out if not responded`
+              }
+            ]
+          }
+        ] : [];
+        const blocks = [
+          {
+            type: "section",
+            text: {
+              type: "mrkdwn",
+              text: `\uD83D\uDD14 *Approval Required: ${escapeSlackMrkdwn(title)}*`
+            }
+          },
+          {
+            type: "section",
+            text: {
+              type: "mrkdwn",
+              text: questionsText
+            }
+          },
+          {
+            type: "actions",
+            elements: [
+              {
+                type: "button",
+                text: { type: "plain_text", text: "Review & Respond" },
+                url: approvalUrl,
+                style: "primary"
+              }
+            ]
+          },
+          ...timeoutCaption
+        ];
+        const result = await slackApp.client.chat.postMessage({
+          channel: notification.target,
+          text: `Approval Required: ${escapeSlackMrkdwn(title)} — ${approvalUrl}`,
+          unfurl_links: false,
+          unfurl_media: false,
+          blocks
+        });
+        if (result.ts) {
+          updatedChannels[i] = { ...notification, messageTs: result.ts };
+          updated = true;
+        }
+        console.log(`[HITL] Slack notification sent to ${notification.target} for request ${requestId}`);
+      } catch (err) {
+        console.error(`[HITL] Failed to send Slack notification to ${notification.target}:`, scrubSecrets(err instanceof Error ? err.message : String(err)));
+      }
+    }
+  }
+  if (updated) {
+    try {
+      await db.updateApprovalRequestNotifications(requestId, updatedChannels);
+      const latest = await db.getApprovalRequestById(requestId);
+      if (latest?.status === "cancelled") {
+        await postApprovalCancellationUpdates([latest], latest.resolutionReason ?? "Workflow run cancelled");
+      }
+    } catch (err) {
+      console.error("[HITL] Failed to update notification channels in DB:", scrubSecrets(err instanceof Error ? err.message : String(err)));
+    }
+  }
+}
 async function postApprovalCancellationUpdates(approvals, reason, client = getSlackApp2()?.client) {
   if (!client)
     return;
@@ -530,6 +1184,8 @@ function formatResponses(questions, responses) {
     let answerText;
     if (answer == null) {
       answerText = "(no answer)";
+    } else if (q.type === "config") {
+      answerText = formatConfigResult(answer) ?? "(unreadable config result)";
     } else if (q.type === "approval") {
       const a = answer;
       answerText = a.approved ? "Approved" : "Rejected";
@@ -593,6 +1249,14 @@ var QuestionSchema = discriminatedUnion("type", [
     required: boolean().default(true),
     description: string2().optional(),
     defaultValue: boolean().optional()
+  }),
+  object2({
+    id: string2(),
+    type: literal2("config"),
+    label: string2().optional(),
+    required: boolean().default(true),
+    description: string2().optional(),
+    config: ConfigQuestionSettingsSchema
   })
 ]);
 var ApproverConfigSchema = object2({
@@ -610,7 +1274,6 @@ var HITLTimeoutSchema = object2({
 });
 var DYNAMIC_QUESTIONS_TOKEN_RE = /^\{\{[^}]+\}\}$/;
 var MAX_HITL_QUESTIONS = 100;
-var SLACK_SECTION_TEXT_LIMIT = 3000;
 var MAX_REPORTED_ISSUES = 5;
 var HITLConfigSchema = object2({
   title: string2(),
@@ -675,30 +1338,6 @@ function resolveHitlQuestions(value) {
   }
   return { ok: true, questions };
 }
-function escapeSlackMrkdwn(text) {
-  return text.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;");
-}
-function buildSlackQuestionsSummary(questions, timeoutText = "") {
-  const header = `*Questions:*
-`;
-  const lines = questions.map((q) => `• ${escapeSlackMrkdwn(q.label.replace(/\s+/g, " ").trim())}`);
-  const fits = (shown, omitted) => {
-    const tail = omitted > 0 ? `
-_…and ${omitted} more. Answer all of them on the dashboard._` : "";
-    const text = `${header}${shown.join(`
-`)}${tail}${timeoutText}`;
-    return text.length <= SLACK_SECTION_TEXT_LIMIT ? text : null;
-  };
-  const full = fits(lines, 0);
-  if (full)
-    return full;
-  for (let count = lines.length - 1;count >= 0; count--) {
-    const text = fits(lines.slice(0, count), lines.length - count);
-    if (text)
-      return text;
-  }
-  return `${header}_${questions.length} questions. Answer them on the dashboard._`;
-}
 
 class HumanInTheLoopExecutor extends BaseExecutor {
   type = "human-in-the-loop";
@@ -709,7 +1348,17 @@ class HumanInTheLoopExecutor extends BaseExecutor {
     const resolved = resolveHitlQuestions(input.config?.questions);
     if (!resolved.ok)
       return { status: "failed", error: resolved.error };
-    return super.run({ ...input, config: { ...input.config, questions: resolved.questions } });
+    const approvers = input.config?.approvers;
+    const normalized = await normalizeApprovalQuestions(resolved.questions, {
+      approvers: { policy: approvers?.policy }
+    });
+    if (!normalized.ok) {
+      return {
+        status: "failed",
+        error: `human-in-the-loop questions are invalid: ${normalized.error}`
+      };
+    }
+    return super.run({ ...input, config: { ...input.config, questions: normalized.questions } });
   }
   async execute(config, _context, meta) {
     const { db } = this.deps;
@@ -765,7 +1414,13 @@ class HumanInTheLoopExecutor extends BaseExecutor {
       };
     }
     if (config.notifications?.length) {
-      this.dispatchNotifications(requestId, config, db).catch((err) => {
+      dispatchApprovalNotifications({
+        requestId,
+        title: config.title,
+        questions: config.questions,
+        timeoutSeconds: config.timeout?.seconds,
+        notifications: config.notifications
+      }, db).catch((err) => {
         console.error("[HITL] Unexpected error dispatching notifications:", scrubSecrets(err instanceof Error ? err.message : String(err)));
       });
     }
@@ -776,105 +1431,6 @@ class HumanInTheLoopExecutor extends BaseExecutor {
       correlationId: requestId
     };
   }
-  async dispatchNotifications(requestId, config, db) {
-    if (!config.notifications?.length)
-      return;
-    const approvalUrl = `${getAppUrl()}/approval-requests/${requestId}`;
-    const updatedChannels = [...config.notifications];
-    let updated = false;
-    for (let i = 0;i < config.notifications.length; i++) {
-      const notification = config.notifications[i];
-      if (notification.channel === "email") {
-        console.warn(`[HITL] Email notifications not yet supported (target: ${notification.target})`);
-        continue;
-      }
-      if (notification.channel === "slack") {
-        try {
-          const { getSlackApp } = await import("./app-nndcvftq.js");
-          const slackApp = getSlackApp();
-          if (!slackApp) {
-            console.warn("[HITL] Slack not initialized — cannot send notification");
-            continue;
-          }
-          const questions = Array.isArray(config.questions) ? config.questions : [];
-          const questionsText = buildSlackQuestionsSummary(questions);
-          const timeoutCaption = config.timeout ? [
-            {
-              type: "context",
-              elements: [
-                {
-                  type: "mrkdwn",
-                  text: `⏱ Timeout: ${formatTimeout(config.timeout.seconds)} — times out if not responded`
-                }
-              ]
-            }
-          ] : [];
-          const blocks = [
-            {
-              type: "section",
-              text: {
-                type: "mrkdwn",
-                text: `\uD83D\uDD14 *Approval Required: ${config.title}*`
-              }
-            },
-            {
-              type: "section",
-              text: {
-                type: "mrkdwn",
-                text: questionsText
-              }
-            },
-            {
-              type: "actions",
-              elements: [
-                {
-                  type: "button",
-                  text: { type: "plain_text", text: "Review & Respond" },
-                  url: approvalUrl,
-                  style: "primary"
-                }
-              ]
-            },
-            ...timeoutCaption
-          ];
-          const result = await slackApp.client.chat.postMessage({
-            channel: notification.target,
-            text: `Approval Required: ${config.title} — ${approvalUrl}`,
-            unfurl_links: false,
-            unfurl_media: false,
-            blocks
-          });
-          if (result.ts) {
-            updatedChannels[i] = { ...notification, messageTs: result.ts };
-            updated = true;
-          }
-          console.log(`[HITL] Slack notification sent to ${notification.target} for request ${requestId}`);
-        } catch (err) {
-          console.error(`[HITL] Failed to send Slack notification to ${notification.target}:`, scrubSecrets(err instanceof Error ? err.message : String(err)));
-        }
-      }
-    }
-    if (updated) {
-      try {
-        await db.updateApprovalRequestNotifications(requestId, updatedChannels);
-        const latest = await db.getApprovalRequestById(requestId);
-        if (latest?.status === "cancelled") {
-          await postApprovalCancellationUpdates([latest], latest.resolutionReason ?? "Workflow run cancelled");
-        }
-      } catch (err) {
-        console.error("[HITL] Failed to update notification channels in DB:", scrubSecrets(err instanceof Error ? err.message : String(err)));
-      }
-    }
-  }
-}
-function formatTimeout(seconds) {
-  if (seconds < 60)
-    return `${seconds}s`;
-  if (seconds < 3600)
-    return `${Math.round(seconds / 60)}m`;
-  const hours = Math.floor(seconds / 3600);
-  const mins = Math.round(seconds % 3600 / 60);
-  return mins > 0 ? `${hours}h ${mins}m` : `${hours}h`;
 }
 
 // src/workflows/executors/system-one-extraction.ts
@@ -2888,8 +3444,18 @@ init_db3();
 
 // src/workflows/checkpoint.ts
 init_db3();
-async function checkpointStep(runId, stepId, nodeId, result, ctx) {
-  await getDbClient2().transaction(async () => {
+async function holdsFence(runId, stepId, fence) {
+  const row = await getDbClient2().get(`SELECT 1 AS found
+       FROM workflow_run_steps s
+       JOIN workflow_runs r ON r.id = s.runId
+      WHERE s.id = ? AND s.runId = ? AND s.status = 'running' AND s.retryCount = ?
+        AND r.status IN ('running', 'waiting')`, [stepId, runId, fence.retryCount]);
+  return row != null;
+}
+async function checkpointStep(runId, stepId, nodeId, result, ctx, options = {}) {
+  return getDbClient2().transaction(async () => {
+    if (options.fence && !await holdsFence(runId, stepId, options.fence))
+      return false;
     await updateWorkflowRunStep2(stepId, {
       status: "completed",
       output: result.output,
@@ -2900,42 +3466,48 @@ async function checkpointStep(runId, stepId, nodeId, result, ctx) {
     await updateWorkflowRun2(runId, {
       context: ctx
     });
+    return true;
   });
 }
 async function checkpointStepFailure(runId, stepId, error, retryCount, retryPolicy, options) {
   const now = new Date().toISOString();
-  if (retryPolicy && retryCount < retryPolicy.maxRetries) {
-    const delay = calculateBackoff(retryPolicy, retryCount);
-    const nextRetryAt = new Date(Date.now() + delay).toISOString();
+  return getDbClient2().transaction(async () => {
+    if (options?.fence && !await holdsFence(runId, stepId, options.fence)) {
+      return { shouldRetry: false, stale: true };
+    }
+    if (retryPolicy && retryCount < retryPolicy.maxRetries) {
+      const delay = calculateBackoff(retryPolicy, retryCount);
+      const nextRetryAt = new Date(Date.now() + delay).toISOString();
+      await updateWorkflowRunStep2(stepId, {
+        status: "failed",
+        error,
+        output: options?.output,
+        retryCount: retryCount + 1,
+        maxRetries: retryPolicy.maxRetries,
+        nextRetryAt
+      });
+      return { shouldRetry: true };
+    }
     await updateWorkflowRunStep2(stepId, {
       status: "failed",
       error,
-      retryCount: retryCount + 1,
-      maxRetries: retryPolicy.maxRetries,
-      nextRetryAt
+      output: options?.output,
+      finishedAt: now,
+      nextRetryAt: null
     });
-    return { shouldRetry: true };
-  }
-  await updateWorkflowRunStep2(stepId, {
-    status: "failed",
-    error,
-    finishedAt: now,
-    nextRetryAt: null
-  });
-  const markRunFailed = options?.markRunFailed ?? true;
-  if (markRunFailed) {
-    await getDbClient2().transaction(async () => {
+    const markRunFailed = options?.markRunFailed ?? true;
+    if (markRunFailed) {
       const run = await getWorkflowRun2(runId);
-      if (run?.status !== "running" && run?.status !== "waiting")
-        return;
-      await updateWorkflowRun2(runId, {
-        status: "failed",
-        error: `Step failed: ${error}`,
-        finishedAt: now
-      });
-    });
-  }
-  return { shouldRetry: false };
+      if (run?.status === "running" || run?.status === "waiting") {
+        await updateWorkflowRun2(runId, {
+          status: "failed",
+          error: `Step failed: ${error}`,
+          finishedAt: now
+        });
+      }
+    }
+    return { shouldRetry: false };
+  });
 }
 async function checkpointStepWaiting(runId, stepId, ctx, options = {}) {
   return getDbClient2().transaction(async () => {
@@ -2982,6 +3554,7 @@ var FOREACH_ITEMS_WAIT_FOR = "foreach.items";
 
 // src/workflows/engine.ts
 init_db3();
+init_workflow_runs();
 init_workflow_replay();
 init_telemetry();
 
@@ -3369,7 +3942,7 @@ async function resolveRenderedWorkflowInputs(input) {
 }
 async function startWorkflowExecution2(workflow, triggerData, registry, options = {}) {
   const preflight = preflightAutomation(workflowPreflightInput(workflow), await getAutomationSetupStates());
-  if (preflight.state === "needs_setup") {
+  if (preflight.state === "needs_setup" && !options.parentStepId) {
     const { runId, recorded } = await recordWorkflowPreflightFailure({
       workflowId: workflow.id,
       triggerType: options.triggerType ?? "manual",
@@ -3381,52 +3954,74 @@ async function startWorkflowExecution2(workflow, triggerData, registry, options
       await notifyAutomationPreflightFailure(preflight);
     return runId;
   }
-  workflow = renderAutomationTokens(workflow, workflow.params ?? {});
-  if (workflow.triggerSchema) {
-    const validationErrors = validateJsonSchema(workflow.triggerSchema, triggerData);
-    if (validationErrors.length > 0) {
-      throw new TriggerSchemaError(validationErrors);
+  let initial;
+  if (preflight.state === "needs_setup") {
+    initial = {
+      status: "failed",
+      error: preflight.failureReason,
+      finishedAt: new Date().toISOString(),
+      preflight: true
+    };
+  } else {
+    workflow = renderAutomationTokens(workflow, workflow.params ?? {});
+    if (workflow.triggerSchema) {
+      const validationErrors = validateJsonSchema(workflow.triggerSchema, triggerData);
+      if (validationErrors.length > 0) {
+        throw new TriggerSchemaError(validationErrors);
+      }
+    }
+    if (workflow.cooldown && await shouldSkipCooldown(workflow.id, workflow.cooldown)) {
+      initial = { status: "skipped", error: "cooldown", finishedAt: new Date().toISOString() };
+    } else {
+      initial = await buildInitialRunState(workflow, triggerData, registry, options);
     }
   }
-  if (workflow.cooldown && await shouldSkipCooldown(workflow.id, workflow.cooldown)) {
-    const runId = crypto.randomUUID();
-    await createWorkflowRun2({
-      id: runId,
+  const newRunId = crypto.randomUUID();
+  const release = holdWorkflowRun(newRunId);
+  try {
+    const { runId, created, preflightAlert } = await createRunWithInitialState(workflow, triggerData, options, initial, newRunId);
+    if (!created)
+      return runId;
+    if (initial.status === "failed" && initial.preflight) {
+      if (preflightAlert)
+        await notifyAutomationPreflightFailure(preflight);
+      return runId;
+    }
+    if (initial.status === "skipped")
+      return runId;
+    telemetry.workflow("started", {
       workflowId: workflow.id,
-      triggerType: options.triggerType ?? "manual",
-      triggerData,
-      createdBy: options.requestedByUserId,
-      parentStepId: options.parentStepId
-    });
-    await updateWorkflowRun2(runId, {
-      status: "skipped",
-      error: "cooldown",
-      finishedAt: new Date().toISOString()
+      nodeCount: workflow.definition.nodes.length,
+      triggerType: options.triggerType ?? "manual"
     });
+    if (initial.status)
+      return runId;
+    const walk = walkGraph(workflow.definition, runId, initial.context, findEntryNodes(workflow.definition), registry, workflow.id, getSecretInputKeys(workflow.input), options);
+    if (options.parentStepId) {
+      walk.catch((err) => console.error(`[workflows] Child workflow run ${runId} failed:`, err));
+      return runId;
+    }
+    await walk;
     return runId;
+  } finally {
+    release();
   }
-  const runId = crypto.randomUUID();
-  await createWorkflowRun2({
-    id: runId,
-    workflowId: workflow.id,
-    triggerType: options.triggerType ?? "manual",
-    triggerData,
-    createdBy: options.requestedByUserId,
-    parentStepId: options.parentStepId
-  });
-  telemetry.workflow("started", {
-    workflowId: workflow.id,
-    nodeCount: workflow.definition.nodes.length,
-    triggerType: options.triggerType ?? "manual"
-  });
+}
+
+class ParentStepNotCurrentError extends Error {
+  constructor(parentStepId, attempt) {
+    super(`Parent step ${parentStepId} (attempt ${attempt}) is no longer running; no child run started`);
+    this.name = "ParentStepNotCurrentError";
+  }
+}
+async function buildInitialRunState(workflow, triggerData, registry, options) {
   const notReady = await findWorkflowReadinessProblems(workflow.definition, registry);
   if (notReady.length > 0) {
-    await updateWorkflowRun2(runId, {
+    return {
       status: "failed",
       error: formatReadinessRunError(notReady),
       finishedAt: new Date().toISOString()
-    });
-    return runId;
+    };
   }
   const ctx = { trigger: triggerData };
   if (options.requestedByUserId) {
@@ -3440,23 +4035,40 @@ async function startWorkflowExecution2(workflow, triggerData, registry, options
       const resolved = await resolveRenderedWorkflowInputs(workflow.input);
       Object.assign(ctx, { input: resolved });
     } catch (err) {
-      await updateWorkflowRun2(runId, {
+      return {
         status: "failed",
         error: `Input resolution failed: ${err}`,
         finishedAt: new Date().toISOString()
-      });
-      return runId;
+      };
     }
   }
-  const entryNodes = findEntryNodes(workflow.definition);
-  const secretKeys = getSecretInputKeys(workflow.input);
-  const walk = walkGraph(workflow.definition, runId, ctx, entryNodes, registry, workflow.id, secretKeys, options);
-  if (options.parentStepId) {
-    walk.catch((err) => console.error(`[workflows] Child workflow run ${runId} failed:`, err));
-    return runId;
-  }
-  await walk;
-  return runId;
+  return { context: ctx };
+}
+async function createRunWithInitialState(workflow, triggerData, options, initial, runId) {
+  return getDbClient2().transaction(async () => {
+    const { parentStepId } = options;
+    const attempt = options.parentStepAttempt ?? 0;
+    if (parentStepId) {
+      if (!await isParentStepAttemptCurrent(parentStepId, attempt)) {
+        throw new ParentStepNotCurrentError(parentStepId, attempt);
+      }
+      const existingId = await getChildWorkflowRunId(parentStepId, attempt);
+      if (existingId)
+        return { runId: existingId, created: false };
+    }
+    await createWorkflowRun2({
+      id: runId,
+      workflowId: workflow.id,
+      triggerType: options.triggerType ?? "manual",
+      triggerData,
+      createdBy: options.requestedByUserId,
+      parentStepId,
+      parentStepAttempt: parentStepId ? attempt : undefined
+    });
+    await updateWorkflowRun2(runId, initial.status ? { status: initial.status, error: initial.error, finishedAt: initial.finishedAt } : { context: initial.context });
+    const preflightAlert = initial.status === "failed" && initial.preflight ? await isFirstWorkflowPreflightFailureToday(workflow.id, runId) : undefined;
+    return { runId, created: true, preflightAlert };
+  });
 }
 var activeWalks = new Map;
 var executingSteps = new Set;
@@ -3479,6 +4091,9 @@ async function failRunOnUnreadableReplay(runId, err, stepId) {
 function isWorkflowRunActive(runId) {
   return activeWalks.has(runId);
 }
+function isStepExecuting(stepId) {
+  return executingSteps.has(stepId);
+}
 function holdWorkflowRun(runId) {
   activeWalks.set(runId, (activeWalks.get(runId) ?? 0) + 1);
   let released = false;
@@ -3726,12 +4341,27 @@ async function executeStep(def, runId, ctx, node, registry, workflowId, secretKe
       if (current && (current.status !== "running" || executingSteps.has(current.id))) {
         return { current };
       }
+      if (current && node.type === "sub-workflow") {
+        claimedStepId = current.id;
+        executingSteps.add(current.id);
+        return {
+          existingStep: current,
+          stepId: current.id,
+          fence: { retryCount: current.retryCount },
+          deduped: false
+        };
+      }
     }
     const iteration = await getStepCountForNode2(runId, node.id);
     const idempotencyKey = `${runId}:${node.id}:${iteration}`;
     const existingStep = await getStepByIdempotencyKey2(idempotencyKey);
     if (existingStep && (existingStep.status === "completed" || existingStep.status === "waiting")) {
-      return { existingStep, stepId: existingStep.id, deduped: true };
+      return {
+        existingStep,
+        stepId: existingStep.id,
+        fence: { retryCount: existingStep.retryCount },
+        deduped: true
+      };
     }
     const latestForeachStep = node.type === "foreach" ? await getLatestStepForNode2(runId, node.id) : undefined;
     const reusableForeachStep = latestForeachStep && !FOREACH_TERMINAL_STEP_STATUSES.has(latestForeachStep.status) ? latestForeachStep : undefined;
@@ -3748,7 +4378,8 @@ async function executeStep(def, runId, ctx, node, registry, workflowId, secretKe
     }
     claimedStepId = stepId;
     executingSteps.add(stepId);
-    return { existingStep, stepId, deduped: false };
+    const fence = { retryCount: reusableForeachStep?.retryCount ?? 0 };
+    return { existingStep, stepId, fence, deduped: false };
   };
   const dedup = await getDbClient2().transaction(claimStep).catch((err) => {
     if (claimedStepId)
@@ -3772,7 +4403,7 @@ async function executeStep(def, runId, ctx, node, registry, workflowId, secretKe
     return { outcome: "waiting", successors: [] };
   }
   try {
-    return await runClaimedStep(def, runId, ctx, node, registry, dedup.existingStep, dedup.stepId, workflowId, options);
+    return await runClaimedStep(def, runId, ctx, node, registry, dedup.existingStep, dedup.stepId, dedup.fence, workflowId, options);
   } catch (err) {
     if (await failRunOnUnreadableReplay(runId, err, dedup.stepId)) {
       return { outcome: "failed", successors: [] };
@@ -3782,11 +4413,14 @@ async function executeStep(def, runId, ctx, node, registry, workflowId, secretKe
     executingSteps.delete(dedup.stepId);
   }
 }
-async function runClaimedStep(def, runId, ctx, node, registry, existingStep, stepId, workflowId, options = {}) {
+async function runClaimedStep(def, runId, ctx, node, registry, existingStep, stepId, fence, workflowId, options = {}) {
+  const stale = { outcome: "failed", successors: [] };
   const executor = registry.get(node.type);
   const systemOneRetryProblems = systemOneRetryViolations(node);
   if (systemOneRetryProblems.length > 0) {
-    await checkpointStepFailure(runId, stepId, systemOneRetryProblems.join("; "), 0);
+    await checkpointStepFailure(runId, stepId, systemOneRetryProblems.join("; "), 0, undefined, {
+      fence
+    });
     return { outcome: "failed", successors: [] };
   }
   const interpolationCtx = buildNodeInterpolationCtx(node, ctx);
@@ -3794,7 +4428,11 @@ async function runClaimedStep(def, runId, ctx, node, registry, existingStep, ste
     const inputErrors = validateJsonSchema(node.inputSchema, interpolationCtx);
     if (inputErrors.length > 0) {
       const errorMsg = `Input schema validation failed: ${inputErrors.join("; ")}`;
-      await checkpointStepFailure(runId, stepId, errorMsg, 0);
+      const { stale: lost } = await checkpointStepFailure(runId, stepId, errorMsg, 0, undefined, {
+        fence
+      });
+      if (lost)
+        return stale;
       throw new Error(errorMsg);
     }
   }
@@ -3808,11 +4446,11 @@ async function runClaimedStep(def, runId, ctx, node, registry, existingStep, ste
   const executionCtx = { ...ctx, ...interpolationCtx };
   if (scriptBodyUnresolved && scriptBodyUnresolved.length > 0) {
     const errorMsg = scriptBodyInterpolationError(node.id, scriptBodyUnresolved);
-    await checkpointStepFailure(runId, stepId, errorMsg, 0);
+    await checkpointStepFailure(runId, stepId, errorMsg, 0, undefined, { fence });
     return { outcome: "failed", successors: [] };
   }
   if (strictUnresolved && strictUnresolved.length > 0) {
-    await checkpointStepFailure(runId, stepId, systemOneUnresolvedError(node.id, strictUnresolved, node.type), 0);
+    await checkpointStepFailure(runId, stepId, systemOneUnresolvedError(node.id, strictUnresolved, node.type), 0, undefined, { fence });
     return { outcome: "failed", successors: [] };
   }
   if (unresolved.length > 0) {
@@ -3845,19 +4483,20 @@ async function runClaimedStep(def, runId, ctx, node, registry, existingStep, ste
     const errorMsg = err instanceof Error ? err.message : String(err);
     const retryPolicy = node.retry || executor.retryPolicy;
     const currentRetryCount = existingStep?.retryCount || 0;
-    const { shouldRetry } = await checkpointStepFailure(runId, stepId, errorMsg, currentRetryCount, retryPolicy);
+    const { shouldRetry, stale: lost } = await checkpointStepFailure(runId, stepId, errorMsg, currentRetryCount, retryPolicy, { fence });
+    if (lost)
+      return stale;
     if (!shouldRetry) {
       throw err;
     }
     return { outcome: "completed", successors: [] };
   }
   if (result.status === "failed") {
-    const retryPolicy = node.retry || executor.retryPolicy;
+    const retryPolicy = result.retryable === false ? undefined : node.retry || executor.retryPolicy;
     const currentRetryCount = existingStep?.retryCount || 0;
-    const { shouldRetry } = await checkpointStepFailure(runId, stepId, result.error || "Executor returned failed status", currentRetryCount, retryPolicy);
-    if (result.output !== undefined) {
-      await updateWorkflowRunStep2(stepId, { output: result.output });
-    }
+    const { shouldRetry, stale: lost } = await checkpointStepFailure(runId, stepId, result.error || "Executor returned failed status", currentRetryCount, retryPolicy, { fence, output: result.output });
+    if (lost)
+      return stale;
     if (!shouldRetry) {
       throw new Error(result.error || "Step execution failed");
     }
@@ -3878,7 +4517,7 @@ async function runClaimedStep(def, runId, ctx, node, registry, existingStep, ste
     }
     const waiting = await checkpointStepWaiting(runId, stepId, ctx);
     if (waiting && result.waitFor === "workflow.child.finished") {
-      const { resumeFromChildRun } = await import("./resume-phj8xhqr.js");
+      const { resumeFromChildRun } = await import("./resume-2dvq348g.js");
       await resumeFromChildRun(stepId, registry);
     }
     return { outcome: waiting ? "waiting" : "completed", successors: [] };
@@ -3887,7 +4526,11 @@ async function runClaimedStep(def, runId, ctx, node, registry, existingStep, ste
     const outputErrors = validateJsonSchema(node.outputSchema, result.output);
     if (outputErrors.length > 0) {
       const errorMsg = `Output schema validation failed: ${outputErrors.join("; ")}`;
-      await checkpointStepFailure(runId, stepId, errorMsg, 0);
+      const { stale: lost } = await checkpointStepFailure(runId, stepId, errorMsg, 0, undefined, {
+        fence
+      });
+      if (lost)
+        return stale;
       throw new Error(errorMsg);
     }
   }
@@ -3896,7 +4539,10 @@ async function runClaimedStep(def, runId, ctx, node, registry, existingStep, ste
     validationResult = await runStepValidation(registry, node, result.output, executionCtx, meta);
     if (validationResult.outcome === "halt") {
       const errorMsg = "Validation failed (mustPass)";
-      await checkpointStepFailure(runId, stepId, errorMsg, 0, undefined, { markRunFailed: false });
+      await checkpointStepFailure(runId, stepId, errorMsg, 0, undefined, {
+        markRunFailed: false,
+        fence
+      });
       return { outcome: "failed", successors: [] };
     }
     if (validationResult.outcome === "retry") {
@@ -3907,12 +4553,15 @@ async function runClaimedStep(def, runId, ctx, node, registry, existingStep, ste
       }
       const retryPolicy = node.validation.retry || node.retry;
       const currentRetryCount = existingStep?.retryCount || 0;
-      await checkpointStepFailure(runId, stepId, "Validation failed, retrying", currentRetryCount, retryPolicy);
+      const { stale: lost } = await checkpointStepFailure(runId, stepId, "Validation failed, retrying", currentRetryCount, retryPolicy, { fence });
+      if (lost)
+        return stale;
       return { outcome: "completed", successors: [] };
     }
   }
   result.nextPort = resolveValidationPort(node.next, result.nextPort, validationResult?.passed);
-  await checkpointStep(runId, stepId, node.id, result, ctx);
+  if (!await checkpointStep(runId, stepId, node.id, result, ctx, { fence }))
+    return stale;
   const successors = result.nextPort ? getSuccessors(def, node.id, result.nextPort) : getSuccessors(def, node.id);
   return { outcome: "completed", successors };
 }
@@ -4330,7 +4979,7 @@ async function runForeachDrive(runId, parentNodeId, registry) {
     if (drive.successors.length > 0) {
       await walkGraph(workflow.definition, runId, ctx, drive.successors, registry, workflow.id, getSecretInputKeys(workflow.input));
     } else {
-      const { finalizeOrWait } = await import("./resume-phj8xhqr.js");
+      const { finalizeOrWait } = await import("./resume-2dvq348g.js");
       await finalizeOrWait(runId);
     }
     return drive;
@@ -4472,7 +5121,7 @@ async function startChild(input) {
     const parked = await getDbClient2().get("UPDATE workflow_run_steps SET status = 'waiting' WHERE id = ? AND status = 'running' RETURNING id", [child.id]);
     if (parked && result.waitFor === "workflow.child.finished") {
       ownedChildren.delete(child.id);
-      const { resumeFromChildRun } = await import("./resume-phj8xhqr.js");
+      const { resumeFromChildRun } = await import("./resume-2dvq348g.js");
       await resumeFromChildRun(child.id, registry);
     }
     return null;
@@ -5083,4 +5732,4 @@ function applyDefinitionPatch(def, patch) {
   return { definition: patchedDef, errors };
 }
 
-export { notifyAutomationPreflightFailure, automationIntegrationFixUrl, isNeedsSetupFailure, preflightAutomation, renderAutomationTokens, getAutomationSetupStates, schedulePreflightInput, listEnabledAutomationPreflightInputs, recordSchedulePreflightFailure, BaseExecutor, postApprovalCancellationUpdates, createApprovalFollowUpTask, HumanInTheLoopExecutor, resolveWorkflowLlmConfig, SYSTEM_ONE_PROVIDER_IDS, SystemOneExtractionExecutor, SYSTEM_ONE_DECISION_NODE_TYPE, SystemOneDecisionConfigSchema, SystemOneDecisionExecutor, checkpointStep, checkpointStepFailure, checkpointStepWaiting, FAILED_TASK_OUTPUT_PREFIX, FOREACH_ITEMS_WAIT_FOR, loadCompletedStepRouting, resolveInputValue, getSecretInputKeys, validateJsonSchema, findJsonSchemaShapeErrors, getMaxWorkflowStepsPerRun, findWorkflowReadinessProblems, formatReadinessProblems, workflowSaveWarnings, withSaveWarnings, runStepValidation, TriggerSchemaError, startWorkflowExecution2, failRunOnUnreadableReplay, isWorkflowRunActive, holdWorkflowRun, walkGraph, hasRunningStep, findReadyNodes, scriptBodyInterpolationError, ForeachExecutor, rebuildNodeExecutionInput, isForeachChildOwned, parkAndDriveForeach, startForeachDrive, runForeachDrive, FOREACH_TERMINAL_STEP_STATUSES, parseSyntheticNodeId, resolveForeachParent, settleForeachChild, resolveStepNode, stepFailureMode, getNextTargets, generateEdges, resolveValidationPort, getSuccessors, definitionNodeIds, validateDefinition, applyDefinitionPatch };
+export { notifyAutomationPreflightFailure, automationIntegrationFixUrl, isNeedsSetupFailure, preflightAutomation, renderAutomationTokens, getAutomationSetupStates, schedulePreflightInput, listEnabledAutomationPreflightInputs, recordSchedulePreflightFailure, BaseExecutor, AGENT_MAX_TASKS_CONFIG_KEY, reconcileAgentMaxTasksPolicy, resetAgentMaxTasksMirror, upsertSwarmConfigWithPolicyMirror, runtimeStaleThresholdMinutes, upsertRuntimeInstance, getRuntimeInstanceById, insertProvisioningRuntime, markRuntimeTerminated, touchRuntimeInstance, markRuntimeInstanceOffline, countActiveRuntimeInstancesForAgent, listRuntimeInstancesForAgent, setRuntimeCredentialReady, reconcileAgentStatusFromRuntimes, agentsWithLiveRuntime, expireStaleRuntimeInstances, listRuntimeInstancesForPool, ConfigQuestionSettingsSchema, ConfigStateSchema, readConfigState, normalizeApprovalQuestions, isConfigQuestion, parseConfigAnswer, skippedConfigResult, keptConfigResult, applyConfigAnswer, resolveSlackConversationId, dispatchApprovalNotifications, postApprovalCancellationUpdates, createApprovalFollowUpTask, HumanInTheLoopExecutor, resolveWorkflowLlmConfig, SYSTEM_ONE_PROVIDER_IDS, SystemOneExtractionExecutor, SYSTEM_ONE_DECISION_NODE_TYPE, SystemOneDecisionConfigSchema, SystemOneDecisionExecutor, checkpointStep, checkpointStepFailure, checkpointStepWaiting, FAILED_TASK_OUTPUT_PREFIX, FOREACH_ITEMS_WAIT_FOR, loadCompletedStepRouting, resolveInputValue, getSecretInputKeys, validateJsonSchema, findJsonSchemaShapeErrors, getMaxWorkflowStepsPerRun, findWorkflowReadinessProblems, formatReadinessProblems, workflowSaveWarnings, withSaveWarnings, runStepValidation, TriggerSchemaError, startWorkflowExecution2, ParentStepNotCurrentError, failRunOnUnreadableReplay, isWorkflowRunActive, isStepExecuting, holdWorkflowRun, walkGraph, hasRunningStep, findReadyNodes, scriptBodyInterpolationError, ForeachExecutor, rebuildNodeExecutionInput, isForeachChildOwned, parkAndDriveForeach, startForeachDrive, runForeachDrive, FOREACH_TERMINAL_STEP_STATUSES, parseSyntheticNodeId, resolveForeachParent, settleForeachChild, resolveStepNode, stepFailureMode, getNextTargets, generateEdges, resolveValidationPort, getSuccessors, definitionNodeIds, validateDefinition, applyDefinitionPatch };