@desplega.ai/agent-swarm 2.5.2 → 2.5.4

package/src/be/migrations/239_skills_fts.sql

@@ -0,0 +1,40 @@
+-- Full-text index for ranked skill search (searchSkills / skill-search tool).
+-- Same shape as memory_fts: an id column FTS5 does not index, the searchable
+-- text columns, and the porter tokenizer. Column order matters: searchSkills
+-- passes bm25() weights positionally (skill_id, name, description, content).
+CREATE VIRTUAL TABLE IF NOT EXISTS skills_fts USING fts5(
+  skill_id UNINDEXED,
+  name,
+  description,
+  content,
+  tokenize='porter unicode61'
+);
+
+INSERT INTO skills_fts(skill_id, name, description, content)
+  SELECT id, name, description, content FROM skills
+  WHERE id NOT IN (SELECT skill_id FROM skills_fts WHERE skill_id IS NOT NULL);
+
+-- Triggers keep the index in sync on every write path, including FK cascade
+-- deletes. A later migration that rebuilds `skills` (CREATE new + DROP +
+-- RENAME) drops these triggers with the old table and must recreate them;
+-- src/tests/skill-search.test.ts asserts they exist on the migrated schema.
+CREATE TRIGGER IF NOT EXISTS skills_fts_insert
+AFTER INSERT ON skills
+BEGIN
+  INSERT INTO skills_fts(skill_id, name, description, content)
+    VALUES (NEW.id, NEW.name, NEW.description, NEW.content);
+END;
+
+CREATE TRIGGER IF NOT EXISTS skills_fts_update
+AFTER UPDATE OF id, name, description, content ON skills
+BEGIN
+  DELETE FROM skills_fts WHERE skill_id = OLD.id;
+  INSERT INTO skills_fts(skill_id, name, description, content)
+    VALUES (NEW.id, NEW.name, NEW.description, NEW.content);
+END;
+
+CREATE TRIGGER IF NOT EXISTS skills_fts_delete
+AFTER DELETE ON skills
+BEGIN
+  DELETE FROM skills_fts WHERE skill_id = OLD.id;
+END;

package/src/be/migrations/240_workflow_run_parent_step_attempt.sql

@@ -0,0 +1,37 @@
+-- Key a child workflow run by its parent step AND that step's attempt.
+--
+-- The retry poller re-executes a failed step under the same step id, with
+-- `retryCount` bumped. Keyed by step id alone, the retried `sub-workflow`
+-- step reconnected to the failed child of the previous attempt and failed
+-- again without starting a new one.
+
+ALTER TABLE workflow_runs ADD COLUMN parentStepAttempt INTEGER NOT NULL DEFAULT 0;
+
+-- Before this migration a step had at most one child, created on whichever
+-- attempt first got that far (a retry after a synchronous failure, such as a
+-- disabled child workflow, creates it on attempt 1 or later), and every later
+-- attempt reconnected to it. Hand that child to the attempt that settles or
+-- re-executes it now, or recovery would look up the step's current attempt,
+-- find no child and fail the parent as "deleted":
+-- - a step queued for a retry (`failed` with `nextRetryAt`) starts its next
+--   attempt at `retryCount`, which must start a new child, so the existing
+--   child belongs to the previous attempt;
+-- - any other step (running, waiting, terminal) owns it at `retryCount`.
+-- A child whose step is gone keeps attempt 0.
+UPDATE workflow_runs
+   SET parentStepAttempt = (
+     SELECT CASE
+              WHEN s.status = 'failed' AND s.nextRetryAt IS NOT NULL
+                THEN MAX(s.retryCount - 1, 0)
+              ELSE s.retryCount
+            END
+       FROM workflow_run_steps s
+      WHERE s.id = workflow_runs.parentStepId
+   )
+ WHERE parentStepId IS NOT NULL
+   AND EXISTS (SELECT 1 FROM workflow_run_steps s WHERE s.id = workflow_runs.parentStepId);
+
+DROP INDEX IF EXISTS idx_workflow_runs_parentStepId;
+
+CREATE UNIQUE INDEX IF NOT EXISTS idx_workflow_runs_parentStep_attempt
+  ON workflow_runs(parentStepId, parentStepAttempt) WHERE parentStepId IS NOT NULL;

package/src/be/migrations/241_skills_meta_fts.sql

@@ -0,0 +1,39 @@
+-- Name + description index for ranked skill search. skills_fts (239) scores
+-- the whole row, and FTS5 bm25 length-normalizes over every column, so a
+-- long SKILL.md body buries a name or description hit. This index holds only
+-- the short fields; searchSkillRowsRanked adds its score to skills_fts's.
+-- Column order matters: bm25() weights are positional (skill_id, name,
+-- description).
+CREATE VIRTUAL TABLE IF NOT EXISTS skills_meta_fts USING fts5(
+  skill_id UNINDEXED,
+  name,
+  description,
+  tokenize='porter unicode61'
+);
+
+INSERT INTO skills_meta_fts(skill_id, name, description)
+  SELECT id, name, description FROM skills
+  WHERE id NOT IN (SELECT skill_id FROM skills_meta_fts WHERE skill_id IS NOT NULL);
+
+-- Same sync rules as skills_fts: a later migration that rebuilds `skills`
+-- must recreate these triggers; src/tests/skill-search.test.ts asserts them.
+CREATE TRIGGER IF NOT EXISTS skills_meta_fts_insert
+AFTER INSERT ON skills
+BEGIN
+  INSERT INTO skills_meta_fts(skill_id, name, description)
+    VALUES (NEW.id, NEW.name, NEW.description);
+END;
+
+CREATE TRIGGER IF NOT EXISTS skills_meta_fts_update
+AFTER UPDATE OF id, name, description ON skills
+BEGIN
+  DELETE FROM skills_meta_fts WHERE skill_id = OLD.id;
+  INSERT INTO skills_meta_fts(skill_id, name, description)
+    VALUES (NEW.id, NEW.name, NEW.description);
+END;
+
+CREATE TRIGGER IF NOT EXISTS skills_meta_fts_delete
+AFTER DELETE ON skills
+BEGIN
+  DELETE FROM skills_meta_fts WHERE skill_id = OLD.id;
+END;

package/src/be/migrations/242_workflow_idempotency_keys.sql

@@ -0,0 +1,40 @@
+-- Idempotency-Key records for POST /api/workflows and POST /api/workflows/{id}/trigger.
+--
+-- One row is one operation the server accepted under a client key. It commits
+-- in the same transaction as the workflow (create) or the run and its initial
+-- state (trigger), so a retry after a lost response, a restart or a concurrent
+-- duplicate finds it and gets the original result instead of a second
+-- workflow or run.
+--
+-- The scope is (principal, operation, targetId, keyHash): the caller's stable
+-- identity (never the bearer value), the operation, the triggered workflow id
+-- ('' for create) and a SHA-256 of the client key. requestFingerprint is a
+-- SHA-256 of the canonical request; a different request under the same key is
+-- a conflict. responseBody is the original response, sealed (sealJson). When
+-- the workflow is deleted, responseBody is cleared and resourceDeletedAt set:
+-- the key stays taken and is never accepted again.
+--
+-- No FK to workflows: a row outlives the workflow as that tombstone.
+
+CREATE TABLE IF NOT EXISTS workflow_idempotency_keys (
+  id TEXT PRIMARY KEY,
+  principal TEXT NOT NULL,
+  operation TEXT NOT NULL CHECK (operation IN ('workflow.create', 'workflow.trigger')),
+  targetId TEXT NOT NULL DEFAULT '',
+  keyHash TEXT NOT NULL,
+  requestFingerprint TEXT NOT NULL,
+  workflowId TEXT NOT NULL,
+  runId TEXT,
+  responseStatus INTEGER NOT NULL,
+  responseBody TEXT,
+  resourceDeletedAt TEXT,
+  createdAt TEXT NOT NULL,
+  created_by TEXT,
+  updated_by TEXT
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS idx_workflow_idempotency_keys_scope
+  ON workflow_idempotency_keys(principal, operation, targetId, keyHash);
+
+CREATE INDEX IF NOT EXISTS idx_workflow_idempotency_keys_workflowId
+  ON workflow_idempotency_keys(workflowId);

package/src/be/sealed-json.ts

@@ -30,6 +30,7 @@ export const SEALED_REPLAY_COLUMNS: readonly { table: string; column: string }[]
   { table: "workflow_run_steps", column: "output_replay" },
   { table: "workflow_runs", column: "context_replay" },
   { table: "approval_requests", column: "responses" },
+  { table: "workflow_idempotency_keys", column: "responseBody" },
 ];
 
 /** SQL `EXISTS` arms matching a sealed value in each `SEALED_REPLAY_COLUMNS` entry. */

package/src/be/seed-scripts/catalog/compound-insights.inline.ts

@@ -574,14 +574,14 @@ export default async function compoundInsights(args: any, ctx: any) {
     const rows = rowsToObjects(
       await ctx.swarm.db_query({
         sql: `WITH raw AS (
-                 SELECT sessionId, iteration, lineNumber, content,
+                 SELECT rowid AS seq, sessionId, iteration, lineNumber, content,
                         json_extract(content, '$.tool_name') as jsonToolName
                  FROM session_logs
                  WHERE createdAt > ${w}
                    AND (content LIKE '%"type":"tool_use"%' OR json_extract(content, '$.tool_name') IS NOT NULL)
                )
                SELECT sessionId, iteration, lineNumber, jsonToolName, content
-               FROM raw ORDER BY sessionId, iteration, lineNumber LIMIT 100`,
+               FROM raw ORDER BY sessionId, iteration, seq LIMIT 100`,
       }),
     );
     const bySession = new Map<string, string[]>();

package/src/be/seed-scripts/catalog/compound-insights.ts

@@ -574,14 +574,14 @@ export default async function compoundInsights(args: any, ctx: any) {
     const rows = rowsToObjects(
       await ctx.swarm.db_query({
         sql: `WITH raw AS (
-                 SELECT sessionId, iteration, lineNumber, content,
+                 SELECT rowid AS seq, sessionId, iteration, lineNumber, content,
                         json_extract(content, '$.tool_name') as jsonToolName
                  FROM session_logs
                  WHERE createdAt > ${w}
                    AND (content LIKE '%"type":"tool_use"%' OR json_extract(content, '$.tool_name') IS NOT NULL)
                )
                SELECT sessionId, iteration, lineNumber, jsonToolName, content
-               FROM raw ORDER BY sessionId, iteration, lineNumber LIMIT 100`,
+               FROM raw ORDER BY sessionId, iteration, seq LIMIT 100`,
       }),
     );
     const bySession = new Map<string, string[]>();

package/src/be/seed-skills/bundled-files.generated.json

@@ -18,7 +18,7 @@
   "delegate-work": [
     {
       "path": "scripts/codex-exec.sh",
-      "content": "#!/usr/bin/env bash\n#\n# codex-exec.sh — invoke `codex exec` (non-interactive) for delegated\n# implementation work. This is the SINGLE SOURCE OF TRUTH for the invocation\n# flags. The delegate-work skill calls only this script; its routing matrix\n# decides WHICH gpt-5.6 variant (-m) and effort (-e) each task gets:\n#   luna  = mechanical/bounded     terra = everyday frozen-spec slice\n#   sol   = hard/long-horizon      effort: medium|high|xhigh|max (never ultra)\n#\n# Usage:\n#   codex-exec.sh [-m <model>] [-e <effort>] -C <workdir> -o <last-message-file> [-l <log-file>] \"PROMPT\"\n#   printf '%s' \"$PROMPT\" | codex-exec.sh -C <workdir> -o <file>     # prompt via stdin (preferred)\n#\n# Notes:\n#   * -C sets codex's working root (the git worktree, for parallel isolation).\n#   * -o writes codex's final message (its report) to a file you can read back.\n#   * Reads the prompt from stdin when no positional PROMPT is given.\n#   * In `exec` mode approvals are already \"never\", so nothing hangs waiting for\n#     a human. The sandbox mode below bounds what codex may WRITE.\n#\n# Sandbox default: `workspace-write` — codex may freely edit files inside its\n# working root (the worktree) and read elsewhere on disk (so it can read the\n# plan by absolute path), but cannot write outside the workspace. This keeps\n# parallel worktree runs from clobbering each other or the main tree.\n#\n# Env overrides (flags -m/-e take precedence):\n#   CODEX_MODEL   default: gpt-5.6-sol          gpt-5.6-sol | gpt-5.6-terra | gpt-5.6-luna\n#   CODEX_EFFORT  default: high                 reasoning effort (never \"fast\"/low)\n#   CODEX_SANDBOX default: workspace-write (passed to codex's -s option)\n#   CODEX_BYPASS  set to 1 to use --dangerously-bypass-approvals-and-sandbox\n#                 (fully unsandboxed — opt in only when a phase must write\n#                 outside its worktree; overrides CODEX_SANDBOX)\nset -euo pipefail\n\nWORKDIR=\".\"\nOUTFILE=\"\"\nLOGFILE=\"\"\nPROMPT=\"\"\nMODEL_FLAG=\"\"\nEFFORT_FLAG=\"\"\n\nwhile [[ $# -gt 0 ]]; do\n  case \"$1\" in\n    -m|--model)  MODEL_FLAG=\"$2\"; shift 2 ;;\n    -e|--effort) EFFORT_FLAG=\"$2\"; shift 2 ;;\n    -C|--cd)  WORKDIR=\"$2\"; shift 2 ;;\n    -o|--out) OUTFILE=\"$2\"; shift 2 ;;\n    -l|--log) LOGFILE=\"$2\"; shift 2 ;;\n    --)       shift; PROMPT=\"${1:-}\"; break ;;\n    -*)       echo \"codex-exec.sh: unknown flag: $1\" >&2; exit 2 ;;\n    *)        PROMPT=\"$1\"; shift ;;\n  esac\ndone\n\nMODEL=\"${MODEL_FLAG:-${CODEX_MODEL:-gpt-5.6-sol}}\"\nEFFORT=\"${EFFORT_FLAG:-${CODEX_EFFORT:-high}}\"\nSANDBOX=\"${CODEX_SANDBOX:-workspace-write}\"\n\nargs=( exec\n  -m \"$MODEL\"\n  -c \"model_reasoning_effort=\\\"$EFFORT\\\"\"\n  -C \"$WORKDIR\"\n)\nif [[ \"${CODEX_BYPASS:-0}\" == \"1\" ]]; then\n  args+=( --dangerously-bypass-approvals-and-sandbox )\nelse\n  args+=( -s \"$SANDBOX\" )\nfi\n[[ -n \"$OUTFILE\" ]] && args+=( -o \"$OUTFILE\" )\n\n# Prompt source: positional arg if present, otherwise stdin (`-`).\nif [[ -n \"$PROMPT\" ]]; then\n  set -- \"$PROMPT\"\nelse\n  set -- \"-\"\nfi\n\nif [[ -n \"$LOGFILE\" ]]; then\n  codex \"${args[@]}\" \"$@\" 2>&1 | tee \"$LOGFILE\"\nelse\n  codex \"${args[@]}\" \"$@\"\nfi\n"
+      "content": "#!/usr/bin/env bash\n#\n# codex-exec.sh — invoke `codex exec` (non-interactive) for delegated\n# implementation work. This is the SINGLE SOURCE OF TRUTH for the invocation\n# flags. The delegate-work skill calls only this script; its routing matrix\n# decides WHICH gpt-6 variant (-m) and effort (-e) each task gets:\n#   gpt-6-luna  = trivial/mechanical   gpt-6.1-sol = default (medium) to hard (high/xhigh)\n#   gpt-6-astra = escalation only      effort: medium|high|xhigh|max (never ultra)\n#\n# Usage:\n#   codex-exec.sh [-m <model>] [-e <effort>] -C <workdir> -o <last-message-file> [-l <log-file>] \"PROMPT\"\n#   printf '%s' \"$PROMPT\" | codex-exec.sh -C <workdir> -o <file>     # prompt via stdin (preferred)\n#\n# Notes:\n#   * -C sets codex's working root (the git worktree, for parallel isolation).\n#   * -o writes codex's final message (its report) to a file you can read back.\n#   * Reads the prompt from stdin when no positional PROMPT is given.\n#   * In `exec` mode approvals are already \"never\", so nothing hangs waiting for\n#     a human. The sandbox mode below bounds what codex may WRITE.\n#\n# Sandbox default: `workspace-write` — codex may freely edit files inside its\n# working root (the worktree) and read elsewhere on disk (so it can read the\n# plan by absolute path), but cannot write outside the workspace. This keeps\n# parallel worktree runs from clobbering each other or the main tree.\n#\n# Env overrides (flags -m/-e take precedence):\n#   CODEX_MODEL   default: gpt-6.1-sol          gpt-6.1-sol | gpt-6-astra | gpt-6-luna\n#   CODEX_EFFORT  default: high                 reasoning effort (never \"fast\"/low)\n#   CODEX_SANDBOX default: workspace-write (passed to codex's -s option)\n#   CODEX_BYPASS  set to 1 to use --dangerously-bypass-approvals-and-sandbox\n#                 (fully unsandboxed — opt in only when a phase must write\n#                 outside its worktree; overrides CODEX_SANDBOX)\nset -euo pipefail\n\nWORKDIR=\".\"\nOUTFILE=\"\"\nLOGFILE=\"\"\nPROMPT=\"\"\nMODEL_FLAG=\"\"\nEFFORT_FLAG=\"\"\n\nwhile [[ $# -gt 0 ]]; do\n  case \"$1\" in\n    -m|--model)  MODEL_FLAG=\"$2\"; shift 2 ;;\n    -e|--effort) EFFORT_FLAG=\"$2\"; shift 2 ;;\n    -C|--cd)  WORKDIR=\"$2\"; shift 2 ;;\n    -o|--out) OUTFILE=\"$2\"; shift 2 ;;\n    -l|--log) LOGFILE=\"$2\"; shift 2 ;;\n    --)       shift; PROMPT=\"${1:-}\"; break ;;\n    -*)       echo \"codex-exec.sh: unknown flag: $1\" >&2; exit 2 ;;\n    *)        PROMPT=\"$1\"; shift ;;\n  esac\ndone\n\nMODEL=\"${MODEL_FLAG:-${CODEX_MODEL:-gpt-6.1-sol}}\"\nEFFORT=\"${EFFORT_FLAG:-${CODEX_EFFORT:-high}}\"\nSANDBOX=\"${CODEX_SANDBOX:-workspace-write}\"\n\nargs=( exec\n  -m \"$MODEL\"\n  -c \"model_reasoning_effort=\\\"$EFFORT\\\"\"\n  -C \"$WORKDIR\"\n)\nif [[ \"${CODEX_BYPASS:-0}\" == \"1\" ]]; then\n  args+=( --dangerously-bypass-approvals-and-sandbox )\nelse\n  args+=( -s \"$SANDBOX\" )\nfi\n[[ -n \"$OUTFILE\" ]] && args+=( -o \"$OUTFILE\" )\n\n# Prompt source: positional arg if present, otherwise stdin (`-`).\nif [[ -n \"$PROMPT\" ]]; then\n  set -- \"$PROMPT\"\nelse\n  set -- \"-\"\nfi\n\nif [[ -n \"$LOGFILE\" ]]; then\n  codex \"${args[@]}\" \"$@\" 2>&1 | tee \"$LOGFILE\"\nelse\n  codex \"${args[@]}\" \"$@\"\nfi\n"
     }
   ],
   "design-docs": [

package/src/be/sql-connections.ts

@@ -51,7 +51,13 @@ export async function resolveSqlDsn(
 // so the parameterless case goes through the tagged-template path instead. Never use `.simple()`.
 // The statement runs as a server-side cursor fetched in batches, so the API never holds more than
 // one batch past the caps. DECLARE only accepts SELECT, VALUES, TABLE and WITH ... SELECT.
-const asTemplate = (text: string): TemplateStringsArray => Object.assign([text], { raw: [text] });
+// Bun >= 1.4.4 rejects an enumerable `raw`, so shape it like a real (frozen) template object.
+const asTemplate = (text: string): TemplateStringsArray =>
+  Object.freeze(
+    Object.defineProperty([text], "raw", { value: Object.freeze([text]) }) as string[] & {
+      raw: readonly string[];
+    },
+  );
 
 const defaultExecutor: SqlExecutor = async (dsn, query, params, take) => {
   // Bun.SQL global, not `import { SQL } from "bun"`: the node-target CLI bundle cannot import "bun".

package/src/be/swarm-config-guard.ts

@@ -610,6 +610,8 @@ const VALIDATED_KEYS: Record<string, ConfigValidator> = {
   // (~80k chars) it risks the SIGTERM-143 context-saturation failure mode
   // the cap exists to prevent (see context-preamble.ts).
   ...boundedIntegerValidators(["CONTEXT_PREAMBLE_MAX_TOKENS"], 100, 20000),
+  // 0 turns the one-time context-bound note off; no model window reaches 10M.
+  ...boundedIntegerValidators(["CONTEXT_BOUND_NOTE_TOKENS"], 0, 10_000_000),
   MEMORY_MIN_SIMILARITY: (value) =>
     validateFloatRange("MEMORY_MIN_SIMILARITY", value, 0, 1, "between 0 and 1 inclusive"),
   MEMORY_ACCESS_BOOST_MAX: (value) =>
@@ -628,6 +630,29 @@ export function validateConfigValue(key: string, value: unknown): string | null
   return validator ? validator(value) : null;
 }
 
+/**
+ * Every check `PUT /api/config` runs before a write: scope and scopeId shape,
+ * reserved and internal keys, the per-key value validator and the env-export
+ * rule. Shared with HITL `config` questions so the two writers cannot drift.
+ */
+export function validateConfigEntry(entry: {
+  scope: "global" | "agent" | "repo";
+  scopeId?: string | null;
+  key: string;
+  value: unknown;
+  exportToEnv?: boolean;
+}): string | null {
+  if (entry.scope === "global" && entry.scopeId) return "Global scope must not have scopeId";
+  if ((entry.scope === "agent" || entry.scope === "repo") && !entry.scopeId) {
+    return "Agent/repo scope requires scopeId";
+  }
+  if (isReservedConfigKey(entry.key)) return reservedKeyError(entry.key).message;
+  if (isInternalConfigKey(entry.key)) return internalConfigKeyError(entry.key).message;
+  return (
+    validateConfigValue(entry.key, entry.value) ?? validateExportToEnv(entry.key, entry.exportToEnv)
+  );
+}
+
 /**
  * Rejects `exportToEnv: true` for keys only the API server reads. Omitting the
  * flag is fine: the write path stores false for those keys.

package/src/be/users.ts

@@ -632,6 +632,15 @@ export async function mintScriptRunToken(
   return await insertSessionToken(agentId, null, null, ttlMs, null, undefined, null, null, true);
 }
 
+/** Whether a session token was minted by `mintScriptRunToken`. */
+export async function isScriptRunToken(tokenId: string): Promise<boolean> {
+  const row = await getDbClient().get<{ scriptRun: number }>(
+    "SELECT scriptRun FROM session_tokens WHERE id = ?",
+    [tokenId],
+  );
+  return row?.scriptRun === 1;
+}
+
 export async function insertSessionToken(
   agentId: string,
   taskId: string | null,

package/src/commands/controller.ts

@@ -1,6 +1,7 @@
 import { createRuntimeProvider } from "../runtime-providers";
 import { BuiltinController } from "../runtime-providers/controller";
 import {
+  CONTROLLER_PING_INTERVAL_MS,
   CONTROLLER_PROTOCOL_VERSION,
   type ControllerCommand,
   ControllerServerMessageSchema,
@@ -37,13 +38,21 @@ async function executeCommand(
   }
 }
 
+// A network cut never closes the socket on this side, so the client watches inbound
+// traffic. The API pings every CONTROLLER_PING_INTERVAL_MS and the client pings on
+// each check; Bun surfaces both as `ping` / `pong` events. Three ping intervals
+// without any frame means the link is half-open.
+export const CONTROLLER_LIVENESS_TIMEOUT_MS = 3 * CONTROLLER_PING_INTERVAL_MS;
+
 export function startControllerClient(options: {
   apiUrl: string;
   token: string;
   provider: RuntimeProvider;
   target: RuntimeTargetConfig;
   onFatal?: () => void;
+  livenessTimeoutMs?: number;
 }): { stop: () => void } {
+  const livenessTimeoutMs = options.livenessTimeoutMs ?? CONTROLLER_LIVENESS_TIMEOUT_MS;
   const url = new URL("/api/controllers/connect", options.apiUrl);
   if (url.protocol !== "http:" && url.protocol !== "https:")
     throw new Error("Controller API URL must use HTTP or HTTPS");
@@ -52,6 +61,7 @@ export function startControllerClient(options: {
   let stopped = false;
   let socket: WebSocket | undefined;
   let reconnect: ReturnType<typeof setTimeout> | undefined;
+  let liveness: ReturnType<typeof setInterval> | undefined;
   let attempts = 0;
   const log = (message: string) => console.log(scrubSecrets(`[runtime-controller] ${message}`));
 
@@ -63,7 +73,28 @@ export function startControllerClient(options: {
     socket = ws;
     let controller: BuiltinController | undefined;
     let connectedAt = 0;
+    let lastTrafficAt = Date.now();
+    const markAlive = () => {
+      lastTrafficAt = Date.now();
+    };
+    ws.addEventListener("ping", markAlive);
+    ws.addEventListener("pong", markAlive);
+    clearInterval(liveness);
+    liveness = setInterval(
+      () => {
+        if (socket !== ws) return;
+        if (Date.now() - lastTrafficAt > livenessTimeoutMs) {
+          log(`No traffic for ${livenessTimeoutMs}ms. Dropping the connection`);
+          clearInterval(liveness);
+          ws.terminate();
+          return;
+        }
+        if (ws.readyState === WebSocket.OPEN) ws.ping();
+      },
+      Math.ceil(livenessTimeoutMs / 3),
+    );
     ws.onmessage = (event) => {
+      markAlive();
       void (async () => {
         const message = ControllerServerMessageSchema.parse(JSON.parse(String(event.data)));
         if (message.type === "welcome") {
@@ -106,6 +137,7 @@ export function startControllerClient(options: {
     ws.onerror = () => log("Connection failed");
     ws.onclose = (event) => {
       if (stopped || socket !== ws) return;
+      clearInterval(liveness);
       if (event.code === 1008) {
         stopped = true;
         log("Controller access rejected or token revoked. Mint a token and restart this process.");
@@ -129,6 +161,7 @@ export function startControllerClient(options: {
     stop: () => {
       stopped = true;
       if (reconnect) clearTimeout(reconnect);
+      clearInterval(liveness);
       socket?.close(1000, "Controller stopped");
     },
   };

package/src/commands/runner.ts

@@ -3352,6 +3352,8 @@ export interface PollOptions {
   pollTimeout: number;
   /** Push scheduling fetches once, then returns control to the runner. */
   singlePoll?: boolean;
+  /** Stop an open poll window before its next claim request. */
+  shouldStop?: () => boolean;
   /** Distinguishes a failed fetch from an empty successful response. */
   onPollFailure?: () => void;
   since?: string; // Optional: for filtering finished tasks
@@ -3669,6 +3671,7 @@ async function pollForTriggerOnce(opts: PollOptions): Promise<Trigger | null> {
   }
 
   while (Date.now() - startTime < opts.pollTimeout) {
+    if (opts.shouldStop?.()) return null;
     try {
       // Build URL with optional since parameter
       let url = `${opts.apiUrl}/api/poll`;
@@ -7099,7 +7102,7 @@ export async function runAgent(config: RunnerConfig, opts: RunnerOptions) {
       }
     }
 
-    // Only poll if we have capacity and the API is not draining
+    // Only poll if we have capacity and neither the API nor worker is draining
     const schedule = pushDelivery.schedule({
       mode: state.deliveryMode ?? "poll",
       push: deliveryChecks.push,
@@ -7108,7 +7111,7 @@ export async function runAgent(config: RunnerConfig, opts: RunnerOptions) {
         exitAfterTasks === null
           ? state.maxConcurrent
           : Math.min(state.maxConcurrent, Math.max(0, exitAfterTasks - state.tasksProcessed)),
-      draining: state.apiDraining,
+      draining: state.apiDraining || shuttingDown,
       lastPushPingAt,
       pollInterval: PollIntervalMs,
     });
@@ -7146,6 +7149,7 @@ export async function runAgent(config: RunnerConfig, opts: RunnerOptions) {
           runtimeInstanceId,
           pollTimeout: effectiveTimeout,
           singlePoll: schedule.singlePoll,
+          shouldStop: () => shuttingDown,
           onPollFailure,
           harnessProvider: state.harnessProvider,
           onApiDrainSignal: (draining) => applyApiDrainSignal(state, role, draining),

package/src/extensions/apply-task-create.ts

@@ -2,7 +2,8 @@ import { explicitModelErrorForAgent } from "../be/model-validation";
 import type { RequestInfo } from "../tools/utils";
 import { type CreateTaskOptions, CreateTaskOptionsSchema } from "../types";
 import { scrubSecrets } from "../utils/secret-scrubber";
-import type { TaskCreateModify, TaskCreateOrigin } from "./contract";
+import { workflowEventBus } from "../workflows/event-bus";
+import type { TaskBlockedEvent, TaskCreateModify, TaskCreateOrigin } from "./contract";
 import { dispatchPre, extensionIdForAgent, listRegistered } from "./dispatcher";
 
 const MODIFIABLE_OPTION_KEYS = [
@@ -69,6 +70,14 @@ function warnDroppedKey(extensionName: string, key: string): void {
   );
 }
 
+function scrubFields<T extends object>(fields: T): T {
+  return Object.fromEntries(
+    Object.entries(fields)
+      .filter(([, value]) => value !== undefined)
+      .map(([key, value]) => [key, typeof value === "string" ? scrubSecrets(value) : value]),
+  ) as T;
+}
+
 export async function applyPreTaskCreate(
   args: ApplyPreTaskCreateArgs,
 ): Promise<ApplyPreTaskCreateResult> {
@@ -80,6 +89,48 @@ export async function applyPreTaskCreate(
     ? (`extension:${creatingExtension.record.name}` as const)
     : args.origin;
 
+  const blocked = (
+    reason: string,
+    extension: TaskBlockedEvent["extension"],
+  ): ApplyPreTaskCreateResult => {
+    const { options, requestInfo } = args;
+    const event: TaskBlockedEvent = {
+      extension,
+      reason: scrubSecrets(reason),
+      origin,
+      source: options.source,
+      requester: scrubFields({
+        userId: options.requestedByUserId,
+        agentId: requestInfo?.agentId ?? options.creatorAgentId,
+        slackUserId: options.slackUserId,
+      }),
+      context: scrubFields({
+        contextKey: options.contextKey ?? requestInfo?.contextKey,
+        scheduleId: options.scheduleId,
+        workflowRunId: options.workflowRunId,
+        workflowRunStepId: options.workflowRunStepId,
+        parentTaskId: options.parentTaskId,
+        vcsRepo: options.vcsRepo,
+        vcsNumber: options.vcsNumber,
+        slackChannelId: options.slackChannelId,
+        slackThreadTs: options.slackThreadTs,
+      }),
+      description: scrubSecrets(args.description).slice(0, 500),
+    };
+    try {
+      workflowEventBus.emit("task.create_blocked", {
+        ...event,
+        skipExtensionId: creatingExtensionId,
+      });
+    } catch (error) {
+      console.error(
+        "[extensions] task.create_blocked event not emitted:",
+        scrubSecrets(error instanceof Error ? error.message : String(error)),
+      );
+    }
+    return { kind: "blocked", reason: event.reason, extension };
+  };
+
   // The last extension that rewrote `model` or `agentId`. The final pair is re-checked
   // against the assignee's harness, because the caller validated the pre-hook pair only.
   let modelEditor: { id: string; name: string } | undefined;
@@ -125,11 +176,7 @@ export async function applyPreTaskCreate(
   );
 
   if (result.action === "block") {
-    return {
-      kind: "blocked",
-      reason: result.reason,
-      extension: result.extension,
-    };
+    return blocked(result.reason, result.extension);
   }
   if (result.action === "continue") {
     return { kind: "proceed", description: args.description, options: args.options };
@@ -146,11 +193,10 @@ export async function applyPreTaskCreate(
       agentId: options.agentId,
     });
     if (modelError) {
-      return {
-        kind: "blocked",
-        reason: `pre.task.create rewrite from extension "${modelEditor.name}" is invalid: ${modelError}`,
-        extension: modelEditor,
-      };
+      return blocked(
+        `pre.task.create rewrite from extension "${modelEditor.name}" is invalid: ${modelError}`,
+        modelEditor,
+      );
     }
   }
   return {