@desplega.ai/agent-swarm 2.5.3 → 2.5.4

package/src/be/db.ts

@@ -222,7 +222,14 @@ import {
   rowToAgentTaskSummary,
 } from "./db/tasks/read";
 import { configureTaskWriteDependencies, failTask } from "./db/tasks/write";
-import { emitChildRunFinished, wakeParentsOfDeletedRuns } from "./db/workflow-runs";
+import { tombstoneWorkflowIdempotencyKeys } from "./db/workflow-idempotency";
+import {
+  emitChildRunFinished,
+  getRunLineageBlock,
+  getStepExecutionBlock,
+  WorkflowStepNotExecutableError,
+  wakeParentsOfDeletedRuns,
+} from "./db/workflow-runs";
 import { scrubJsonValue } from "./scrub-json";
 import { openSealedJson, sealedJsonForDisplay, sealJson } from "./sealed-json";
 import { configSecretName, registerStoredSecret } from "./secret-registry";
@@ -2855,6 +2862,14 @@ export async function createTaskExtended(
   const claim = await getDbClient().transaction<
     { existing: ExistingTrackerContextWork } | { row: AgentTaskRow }
   >(async () => {
+    // A workflow step's task commits only while the step may still start
+    // work. Checked in the INSERT's transaction: a cascade cancel of the
+    // step's run tree either commits first and is seen here, or sees and
+    // cancels this task.
+    if (options?.workflowRunStepId) {
+      const blocked = await getStepExecutionBlock(options.workflowRunStepId);
+      if (blocked) throw new WorkflowStepNotExecutableError(options.workflowRunStepId, blocked);
+    }
     const existingTrackerWork = options?.bypassTrackerContextDedup
       ? null
       : await findExistingLinearTrackerContextWork(options?.contextKey);
@@ -4739,7 +4754,7 @@ export async function createSessionLogs(logs: {
   for (let start = 0; start < logs.lines.length; start += BATCH_SIZE) {
     // Yield to the event loop between batches.
     if (start > 0) await new Promise<void>((r) => setTimeout(r, 5));
-    const batch: { content: string; lineNumber: number }[] = [];
+    const batch: string[] = [];
     const end = Math.min(start + BATCH_SIZE, logs.lines.length);
     for (let i = start; i < end; i++) {
       const line = logs.lines[i];
@@ -4748,10 +4763,22 @@ export async function createSessionLogs(logs: {
       // content that is already scrubbed at the adapter emit site. We scrub
       // again here so any future write path that bypasses the adapter still
       // lands clean text in the persistent session_logs table.
-      batch.push({ content: scrubSecrets(line), lineNumber: i });
+      batch.push(scrubSecrets(line));
     }
     await getDbClient().transaction(async (tx) => {
-      for (const { content, lineNumber } of batch) {
+      // The worker flushes one (sessionId, iteration) in many POSTs, so the
+      // lineNumber continues from the newest stored row instead of restarting
+      // at the POST's index. Reading the newest row by rowid walks the
+      // sessionId index backwards and stops at the first hit, where MAX()
+      // would scan the whole session. Rows written here are monotonic in
+      // rowid, so this equals MAX + 1 for them.
+      const last = await tx.get<{ lineNumber: number }>(
+        `SELECT lineNumber FROM session_logs WHERE sessionId = ? AND iteration = ?
+         ORDER BY rowid DESC LIMIT 1`,
+        [logs.sessionId, logs.iteration],
+      );
+      let lineNumber = last ? last.lineNumber + 1 : 0;
+      for (const content of batch) {
         await tx.run(
           `INSERT INTO session_logs (id, taskId, sessionId, iteration, cli, content, lineNumber, createdAt)
            VALUES (?, ?, ?, ?, ?, ?, ?, strftime('%Y-%m-%dT%H:%M:%fZ', 'now'))`,
@@ -4762,7 +4789,7 @@ export async function createSessionLogs(logs: {
             logs.iteration,
             logs.cli,
             content,
-            lineNumber,
+            lineNumber++,
           ],
         );
       }
@@ -4770,6 +4797,10 @@ export async function createSessionLogs(logs: {
   }
 }
 
+// Session log reads order by rowid, which is insert order. Rows written before
+// lineNumber was assigned server-side restart at 0 on every worker flush, so
+// only rowid orders them. The API never runs VACUUM (runbooks/db-retention.md);
+// a manual VACUUM may renumber rowids but copies rows in rowid order.
 export async function getSessionLogsByTaskId(
   taskId: string,
   limit?: number,
@@ -4777,16 +4808,16 @@ export async function getSessionLogsByTaskId(
   if (typeof limit === "number" && limit > 0) {
     const rows = await getDbClient().query<SessionLogRow>(
       `SELECT * FROM (
-         SELECT * FROM session_logs WHERE taskId = ?
-         ORDER BY iteration DESC, lineNumber DESC
+         SELECT rowid AS seq, * FROM session_logs WHERE taskId = ?
+         ORDER BY rowid DESC
          LIMIT ?
-       ) ORDER BY iteration ASC, lineNumber ASC`,
+       ) ORDER BY seq ASC`,
       [taskId, limit],
     );
     return rows.map(rowToSessionLog);
   }
   const rows = await getDbClient().query<SessionLogRow>(
-    "SELECT * FROM session_logs WHERE taskId = ? ORDER BY iteration ASC, lineNumber ASC",
+    "SELECT * FROM session_logs WHERE taskId = ? ORDER BY rowid ASC",
     [taskId],
   );
   return rows.map(rowToSessionLog);
@@ -4797,7 +4828,7 @@ export async function getSessionLogsBySession(
   iteration: number,
 ): Promise<SessionLog[]> {
   const rows = await getDbClient().query<SessionLogRow>(
-    "SELECT * FROM session_logs WHERE sessionId = ? AND iteration = ? ORDER BY lineNumber ASC",
+    "SELECT * FROM session_logs WHERE sessionId = ? AND iteration = ? ORDER BY rowid ASC",
     [sessionId, iteration],
   );
   return rows.map(rowToSessionLog);
@@ -7790,7 +7821,9 @@ async function deleteWorkflowRows(id: string, source?: "api" | "mcp"): Promise<b
   await reclassifyTaskHumanFree(linkedTaskIds);
   // 4. Delete every user's favorite of it (no FK to the workflow)
   await client.run("DELETE FROM user_favorites WHERE itemType = 'workflow' AND itemId = ?", [id]);
-  // 5. Delete workflow
+  // 5. Keep Idempotency-Keys that created or triggered it taken, without the stored response
+  await tombstoneWorkflowIdempotencyKeys(id);
+  // 6. Delete workflow
   const result = await client.run("DELETE FROM workflows WHERE id = ?", [id]);
   const deleted = result.changes > 0;
   if (deleted) {
@@ -9787,15 +9820,29 @@ export async function createApprovalRequest(data: {
   const row = await getDbClient().transaction(async () => {
     let status: ApprovalRequest["status"] = "pending";
     let resolutionReason: string | null = null;
-    if (data.requireActionableWorkflow && data.workflowRunId && data.workflowRunStepId) {
-      const run = await getWorkflowRun(data.workflowRunId);
-      const step = await getWorkflowRunStep(data.workflowRunStepId);
+    // A request linked to an existing run, with or without a step, is born
+    // cancelled unless the run is live and its tree is not cancelled: a
+    // pending request in a cancelled tree would be open work no cancel may
+    // leave behind. A missing run is refused only on the workflow (HITL) path.
+    const actionable = data.requireActionableWorkflow && data.workflowRunStepId;
+    const run = data.workflowRunId ? await getWorkflowRun(data.workflowRunId, "display") : null;
+    if (data.workflowRunId && (run || actionable)) {
+      const step = actionable ? await getWorkflowRunStep(data.workflowRunStepId!) : undefined;
       if (!run || (run.status !== "running" && run.status !== "waiting")) {
         status = "cancelled";
         resolutionReason = run?.error ?? `Workflow run is ${run?.status ?? "missing"}`;
-      } else if (!step || step.runId !== run.id || step.status !== "running") {
+      } else if (
+        step !== undefined &&
+        (!step || step.runId !== run.id || step.status !== "running")
+      ) {
         status = "cancelled";
         resolutionReason = `Human-in-the-loop step is ${step?.status ?? "missing"}`;
+      } else {
+        const blocked = await getRunLineageBlock(run.id);
+        if (blocked) {
+          status = "cancelled";
+          resolutionReason = blocked;
+        }
       }
     }
 
@@ -12892,7 +12939,8 @@ export async function listTaskTemplates(opts?: {
 /**
  * Walk the chain rooted at `rootTaskId`, ordered by `createdAt` (root first; `rowid` breaks
  * ties as idx_agent_tasks_created did). `CROSS JOIN` keeps the chain as the outer loop: with
- * a plain JOIN, SQLite scanned all of agent_tasks to skip the sort.
+ * a plain JOIN, SQLite scanned all of agent_tasks to skip the sort. Each task carries its
+ * `totalCostUsd`, so the session header can total the whole chain, not only the root.
  */
 export async function getRootTaskChain(rootTaskId: string): Promise<AgentTask[]> {
   const rows = await getDbClient().query<AgentTaskRow>(
@@ -12902,7 +12950,9 @@ export async function getRootTaskChain(rootTaskId: string): Promise<AgentTask[]>
          SELECT t.id FROM agent_tasks t
          JOIN chain c ON t.parentTaskId = c.id
        )
-       SELECT t.* FROM chain
+       SELECT t.*,
+         (SELECT SUM(totalCostUsd) FROM session_costs WHERE session_costs.taskId = t.id) AS totalCostUsd
+       FROM chain
        CROSS JOIN agent_tasks t ON t.id = chain.id
        ORDER BY t.createdAt, t.rowid`,
     [rootTaskId],

package/src/be/migrations/242_workflow_idempotency_keys.sql

@@ -0,0 +1,40 @@
+-- Idempotency-Key records for POST /api/workflows and POST /api/workflows/{id}/trigger.
+--
+-- One row is one operation the server accepted under a client key. It commits
+-- in the same transaction as the workflow (create) or the run and its initial
+-- state (trigger), so a retry after a lost response, a restart or a concurrent
+-- duplicate finds it and gets the original result instead of a second
+-- workflow or run.
+--
+-- The scope is (principal, operation, targetId, keyHash): the caller's stable
+-- identity (never the bearer value), the operation, the triggered workflow id
+-- ('' for create) and a SHA-256 of the client key. requestFingerprint is a
+-- SHA-256 of the canonical request; a different request under the same key is
+-- a conflict. responseBody is the original response, sealed (sealJson). When
+-- the workflow is deleted, responseBody is cleared and resourceDeletedAt set:
+-- the key stays taken and is never accepted again.
+--
+-- No FK to workflows: a row outlives the workflow as that tombstone.
+
+CREATE TABLE IF NOT EXISTS workflow_idempotency_keys (
+  id TEXT PRIMARY KEY,
+  principal TEXT NOT NULL,
+  operation TEXT NOT NULL CHECK (operation IN ('workflow.create', 'workflow.trigger')),
+  targetId TEXT NOT NULL DEFAULT '',
+  keyHash TEXT NOT NULL,
+  requestFingerprint TEXT NOT NULL,
+  workflowId TEXT NOT NULL,
+  runId TEXT,
+  responseStatus INTEGER NOT NULL,
+  responseBody TEXT,
+  resourceDeletedAt TEXT,
+  createdAt TEXT NOT NULL,
+  created_by TEXT,
+  updated_by TEXT
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS idx_workflow_idempotency_keys_scope
+  ON workflow_idempotency_keys(principal, operation, targetId, keyHash);
+
+CREATE INDEX IF NOT EXISTS idx_workflow_idempotency_keys_workflowId
+  ON workflow_idempotency_keys(workflowId);

package/src/be/sealed-json.ts

@@ -30,6 +30,7 @@ export const SEALED_REPLAY_COLUMNS: readonly { table: string; column: string }[]
   { table: "workflow_run_steps", column: "output_replay" },
   { table: "workflow_runs", column: "context_replay" },
   { table: "approval_requests", column: "responses" },
+  { table: "workflow_idempotency_keys", column: "responseBody" },
 ];
 
 /** SQL `EXISTS` arms matching a sealed value in each `SEALED_REPLAY_COLUMNS` entry. */

package/src/be/seed-scripts/catalog/compound-insights.inline.ts

@@ -574,14 +574,14 @@ export default async function compoundInsights(args: any, ctx: any) {
     const rows = rowsToObjects(
       await ctx.swarm.db_query({
         sql: `WITH raw AS (
-                 SELECT sessionId, iteration, lineNumber, content,
+                 SELECT rowid AS seq, sessionId, iteration, lineNumber, content,
                         json_extract(content, '$.tool_name') as jsonToolName
                  FROM session_logs
                  WHERE createdAt > ${w}
                    AND (content LIKE '%"type":"tool_use"%' OR json_extract(content, '$.tool_name') IS NOT NULL)
                )
                SELECT sessionId, iteration, lineNumber, jsonToolName, content
-               FROM raw ORDER BY sessionId, iteration, lineNumber LIMIT 100`,
+               FROM raw ORDER BY sessionId, iteration, seq LIMIT 100`,
       }),
     );
     const bySession = new Map<string, string[]>();

package/src/be/seed-scripts/catalog/compound-insights.ts

@@ -574,14 +574,14 @@ export default async function compoundInsights(args: any, ctx: any) {
     const rows = rowsToObjects(
       await ctx.swarm.db_query({
         sql: `WITH raw AS (
-                 SELECT sessionId, iteration, lineNumber, content,
+                 SELECT rowid AS seq, sessionId, iteration, lineNumber, content,
                         json_extract(content, '$.tool_name') as jsonToolName
                  FROM session_logs
                  WHERE createdAt > ${w}
                    AND (content LIKE '%"type":"tool_use"%' OR json_extract(content, '$.tool_name') IS NOT NULL)
                )
                SELECT sessionId, iteration, lineNumber, jsonToolName, content
-               FROM raw ORDER BY sessionId, iteration, lineNumber LIMIT 100`,
+               FROM raw ORDER BY sessionId, iteration, seq LIMIT 100`,
       }),
     );
     const bySession = new Map<string, string[]>();

package/src/be/seed-skills/bundled-files.generated.json

@@ -18,7 +18,7 @@
   "delegate-work": [
     {
       "path": "scripts/codex-exec.sh",
-      "content": "#!/usr/bin/env bash\n#\n# codex-exec.sh — invoke `codex exec` (non-interactive) for delegated\n# implementation work. This is the SINGLE SOURCE OF TRUTH for the invocation\n# flags. The delegate-work skill calls only this script; its routing matrix\n# decides WHICH gpt-5.6 variant (-m) and effort (-e) each task gets:\n#   luna  = mechanical/bounded     terra = everyday frozen-spec slice\n#   sol   = hard/long-horizon      effort: medium|high|xhigh|max (never ultra)\n#\n# Usage:\n#   codex-exec.sh [-m <model>] [-e <effort>] -C <workdir> -o <last-message-file> [-l <log-file>] \"PROMPT\"\n#   printf '%s' \"$PROMPT\" | codex-exec.sh -C <workdir> -o <file>     # prompt via stdin (preferred)\n#\n# Notes:\n#   * -C sets codex's working root (the git worktree, for parallel isolation).\n#   * -o writes codex's final message (its report) to a file you can read back.\n#   * Reads the prompt from stdin when no positional PROMPT is given.\n#   * In `exec` mode approvals are already \"never\", so nothing hangs waiting for\n#     a human. The sandbox mode below bounds what codex may WRITE.\n#\n# Sandbox default: `workspace-write` — codex may freely edit files inside its\n# working root (the worktree) and read elsewhere on disk (so it can read the\n# plan by absolute path), but cannot write outside the workspace. This keeps\n# parallel worktree runs from clobbering each other or the main tree.\n#\n# Env overrides (flags -m/-e take precedence):\n#   CODEX_MODEL   default: gpt-5.6-sol          gpt-5.6-sol | gpt-5.6-terra | gpt-5.6-luna\n#   CODEX_EFFORT  default: high                 reasoning effort (never \"fast\"/low)\n#   CODEX_SANDBOX default: workspace-write (passed to codex's -s option)\n#   CODEX_BYPASS  set to 1 to use --dangerously-bypass-approvals-and-sandbox\n#                 (fully unsandboxed — opt in only when a phase must write\n#                 outside its worktree; overrides CODEX_SANDBOX)\nset -euo pipefail\n\nWORKDIR=\".\"\nOUTFILE=\"\"\nLOGFILE=\"\"\nPROMPT=\"\"\nMODEL_FLAG=\"\"\nEFFORT_FLAG=\"\"\n\nwhile [[ $# -gt 0 ]]; do\n  case \"$1\" in\n    -m|--model)  MODEL_FLAG=\"$2\"; shift 2 ;;\n    -e|--effort) EFFORT_FLAG=\"$2\"; shift 2 ;;\n    -C|--cd)  WORKDIR=\"$2\"; shift 2 ;;\n    -o|--out) OUTFILE=\"$2\"; shift 2 ;;\n    -l|--log) LOGFILE=\"$2\"; shift 2 ;;\n    --)       shift; PROMPT=\"${1:-}\"; break ;;\n    -*)       echo \"codex-exec.sh: unknown flag: $1\" >&2; exit 2 ;;\n    *)        PROMPT=\"$1\"; shift ;;\n  esac\ndone\n\nMODEL=\"${MODEL_FLAG:-${CODEX_MODEL:-gpt-5.6-sol}}\"\nEFFORT=\"${EFFORT_FLAG:-${CODEX_EFFORT:-high}}\"\nSANDBOX=\"${CODEX_SANDBOX:-workspace-write}\"\n\nargs=( exec\n  -m \"$MODEL\"\n  -c \"model_reasoning_effort=\\\"$EFFORT\\\"\"\n  -C \"$WORKDIR\"\n)\nif [[ \"${CODEX_BYPASS:-0}\" == \"1\" ]]; then\n  args+=( --dangerously-bypass-approvals-and-sandbox )\nelse\n  args+=( -s \"$SANDBOX\" )\nfi\n[[ -n \"$OUTFILE\" ]] && args+=( -o \"$OUTFILE\" )\n\n# Prompt source: positional arg if present, otherwise stdin (`-`).\nif [[ -n \"$PROMPT\" ]]; then\n  set -- \"$PROMPT\"\nelse\n  set -- \"-\"\nfi\n\nif [[ -n \"$LOGFILE\" ]]; then\n  codex \"${args[@]}\" \"$@\" 2>&1 | tee \"$LOGFILE\"\nelse\n  codex \"${args[@]}\" \"$@\"\nfi\n"
+      "content": "#!/usr/bin/env bash\n#\n# codex-exec.sh — invoke `codex exec` (non-interactive) for delegated\n# implementation work. This is the SINGLE SOURCE OF TRUTH for the invocation\n# flags. The delegate-work skill calls only this script; its routing matrix\n# decides WHICH gpt-6 variant (-m) and effort (-e) each task gets:\n#   gpt-6-luna  = trivial/mechanical   gpt-6.1-sol = default (medium) to hard (high/xhigh)\n#   gpt-6-astra = escalation only      effort: medium|high|xhigh|max (never ultra)\n#\n# Usage:\n#   codex-exec.sh [-m <model>] [-e <effort>] -C <workdir> -o <last-message-file> [-l <log-file>] \"PROMPT\"\n#   printf '%s' \"$PROMPT\" | codex-exec.sh -C <workdir> -o <file>     # prompt via stdin (preferred)\n#\n# Notes:\n#   * -C sets codex's working root (the git worktree, for parallel isolation).\n#   * -o writes codex's final message (its report) to a file you can read back.\n#   * Reads the prompt from stdin when no positional PROMPT is given.\n#   * In `exec` mode approvals are already \"never\", so nothing hangs waiting for\n#     a human. The sandbox mode below bounds what codex may WRITE.\n#\n# Sandbox default: `workspace-write` — codex may freely edit files inside its\n# working root (the worktree) and read elsewhere on disk (so it can read the\n# plan by absolute path), but cannot write outside the workspace. This keeps\n# parallel worktree runs from clobbering each other or the main tree.\n#\n# Env overrides (flags -m/-e take precedence):\n#   CODEX_MODEL   default: gpt-6.1-sol          gpt-6.1-sol | gpt-6-astra | gpt-6-luna\n#   CODEX_EFFORT  default: high                 reasoning effort (never \"fast\"/low)\n#   CODEX_SANDBOX default: workspace-write (passed to codex's -s option)\n#   CODEX_BYPASS  set to 1 to use --dangerously-bypass-approvals-and-sandbox\n#                 (fully unsandboxed — opt in only when a phase must write\n#                 outside its worktree; overrides CODEX_SANDBOX)\nset -euo pipefail\n\nWORKDIR=\".\"\nOUTFILE=\"\"\nLOGFILE=\"\"\nPROMPT=\"\"\nMODEL_FLAG=\"\"\nEFFORT_FLAG=\"\"\n\nwhile [[ $# -gt 0 ]]; do\n  case \"$1\" in\n    -m|--model)  MODEL_FLAG=\"$2\"; shift 2 ;;\n    -e|--effort) EFFORT_FLAG=\"$2\"; shift 2 ;;\n    -C|--cd)  WORKDIR=\"$2\"; shift 2 ;;\n    -o|--out) OUTFILE=\"$2\"; shift 2 ;;\n    -l|--log) LOGFILE=\"$2\"; shift 2 ;;\n    --)       shift; PROMPT=\"${1:-}\"; break ;;\n    -*)       echo \"codex-exec.sh: unknown flag: $1\" >&2; exit 2 ;;\n    *)        PROMPT=\"$1\"; shift ;;\n  esac\ndone\n\nMODEL=\"${MODEL_FLAG:-${CODEX_MODEL:-gpt-6.1-sol}}\"\nEFFORT=\"${EFFORT_FLAG:-${CODEX_EFFORT:-high}}\"\nSANDBOX=\"${CODEX_SANDBOX:-workspace-write}\"\n\nargs=( exec\n  -m \"$MODEL\"\n  -c \"model_reasoning_effort=\\\"$EFFORT\\\"\"\n  -C \"$WORKDIR\"\n)\nif [[ \"${CODEX_BYPASS:-0}\" == \"1\" ]]; then\n  args+=( --dangerously-bypass-approvals-and-sandbox )\nelse\n  args+=( -s \"$SANDBOX\" )\nfi\n[[ -n \"$OUTFILE\" ]] && args+=( -o \"$OUTFILE\" )\n\n# Prompt source: positional arg if present, otherwise stdin (`-`).\nif [[ -n \"$PROMPT\" ]]; then\n  set -- \"$PROMPT\"\nelse\n  set -- \"-\"\nfi\n\nif [[ -n \"$LOGFILE\" ]]; then\n  codex \"${args[@]}\" \"$@\" 2>&1 | tee \"$LOGFILE\"\nelse\n  codex \"${args[@]}\" \"$@\"\nfi\n"
     }
   ],
   "design-docs": [

package/src/be/sql-connections.ts

@@ -51,7 +51,13 @@ export async function resolveSqlDsn(
 // so the parameterless case goes through the tagged-template path instead. Never use `.simple()`.
 // The statement runs as a server-side cursor fetched in batches, so the API never holds more than
 // one batch past the caps. DECLARE only accepts SELECT, VALUES, TABLE and WITH ... SELECT.
-const asTemplate = (text: string): TemplateStringsArray => Object.assign([text], { raw: [text] });
+// Bun >= 1.4.4 rejects an enumerable `raw`, so shape it like a real (frozen) template object.
+const asTemplate = (text: string): TemplateStringsArray =>
+  Object.freeze(
+    Object.defineProperty([text], "raw", { value: Object.freeze([text]) }) as string[] & {
+      raw: readonly string[];
+    },
+  );
 
 const defaultExecutor: SqlExecutor = async (dsn, query, params, take) => {
   // Bun.SQL global, not `import { SQL } from "bun"`: the node-target CLI bundle cannot import "bun".

package/src/be/swarm-config-guard.ts

@@ -610,6 +610,8 @@ const VALIDATED_KEYS: Record<string, ConfigValidator> = {
   // (~80k chars) it risks the SIGTERM-143 context-saturation failure mode
   // the cap exists to prevent (see context-preamble.ts).
   ...boundedIntegerValidators(["CONTEXT_PREAMBLE_MAX_TOKENS"], 100, 20000),
+  // 0 turns the one-time context-bound note off; no model window reaches 10M.
+  ...boundedIntegerValidators(["CONTEXT_BOUND_NOTE_TOKENS"], 0, 10_000_000),
   MEMORY_MIN_SIMILARITY: (value) =>
     validateFloatRange("MEMORY_MIN_SIMILARITY", value, 0, 1, "between 0 and 1 inclusive"),
   MEMORY_ACCESS_BOOST_MAX: (value) =>

package/src/be/users.ts

@@ -632,6 +632,15 @@ export async function mintScriptRunToken(
   return await insertSessionToken(agentId, null, null, ttlMs, null, undefined, null, null, true);
 }
 
+/** Whether a session token was minted by `mintScriptRunToken`. */
+export async function isScriptRunToken(tokenId: string): Promise<boolean> {
+  const row = await getDbClient().get<{ scriptRun: number }>(
+    "SELECT scriptRun FROM session_tokens WHERE id = ?",
+    [tokenId],
+  );
+  return row?.scriptRun === 1;
+}
+
 export async function insertSessionToken(
   agentId: string,
   taskId: string | null,

package/src/commands/controller.ts

@@ -1,6 +1,7 @@
 import { createRuntimeProvider } from "../runtime-providers";
 import { BuiltinController } from "../runtime-providers/controller";
 import {
+  CONTROLLER_PING_INTERVAL_MS,
   CONTROLLER_PROTOCOL_VERSION,
   type ControllerCommand,
   ControllerServerMessageSchema,
@@ -37,13 +38,21 @@ async function executeCommand(
   }
 }
 
+// A network cut never closes the socket on this side, so the client watches inbound
+// traffic. The API pings every CONTROLLER_PING_INTERVAL_MS and the client pings on
+// each check; Bun surfaces both as `ping` / `pong` events. Three ping intervals
+// without any frame means the link is half-open.
+export const CONTROLLER_LIVENESS_TIMEOUT_MS = 3 * CONTROLLER_PING_INTERVAL_MS;
+
 export function startControllerClient(options: {
   apiUrl: string;
   token: string;
   provider: RuntimeProvider;
   target: RuntimeTargetConfig;
   onFatal?: () => void;
+  livenessTimeoutMs?: number;
 }): { stop: () => void } {
+  const livenessTimeoutMs = options.livenessTimeoutMs ?? CONTROLLER_LIVENESS_TIMEOUT_MS;
   const url = new URL("/api/controllers/connect", options.apiUrl);
   if (url.protocol !== "http:" && url.protocol !== "https:")
     throw new Error("Controller API URL must use HTTP or HTTPS");
@@ -52,6 +61,7 @@ export function startControllerClient(options: {
   let stopped = false;
   let socket: WebSocket | undefined;
   let reconnect: ReturnType<typeof setTimeout> | undefined;
+  let liveness: ReturnType<typeof setInterval> | undefined;
   let attempts = 0;
   const log = (message: string) => console.log(scrubSecrets(`[runtime-controller] ${message}`));
 
@@ -63,7 +73,28 @@ export function startControllerClient(options: {
     socket = ws;
     let controller: BuiltinController | undefined;
     let connectedAt = 0;
+    let lastTrafficAt = Date.now();
+    const markAlive = () => {
+      lastTrafficAt = Date.now();
+    };
+    ws.addEventListener("ping", markAlive);
+    ws.addEventListener("pong", markAlive);
+    clearInterval(liveness);
+    liveness = setInterval(
+      () => {
+        if (socket !== ws) return;
+        if (Date.now() - lastTrafficAt > livenessTimeoutMs) {
+          log(`No traffic for ${livenessTimeoutMs}ms. Dropping the connection`);
+          clearInterval(liveness);
+          ws.terminate();
+          return;
+        }
+        if (ws.readyState === WebSocket.OPEN) ws.ping();
+      },
+      Math.ceil(livenessTimeoutMs / 3),
+    );
     ws.onmessage = (event) => {
+      markAlive();
       void (async () => {
         const message = ControllerServerMessageSchema.parse(JSON.parse(String(event.data)));
         if (message.type === "welcome") {
@@ -106,6 +137,7 @@ export function startControllerClient(options: {
     ws.onerror = () => log("Connection failed");
     ws.onclose = (event) => {
       if (stopped || socket !== ws) return;
+      clearInterval(liveness);
       if (event.code === 1008) {
         stopped = true;
         log("Controller access rejected or token revoked. Mint a token and restart this process.");
@@ -129,6 +161,7 @@ export function startControllerClient(options: {
     stop: () => {
       stopped = true;
       if (reconnect) clearTimeout(reconnect);
+      clearInterval(liveness);
       socket?.close(1000, "Controller stopped");
     },
   };

package/src/commands/runner.ts

@@ -3352,6 +3352,8 @@ export interface PollOptions {
   pollTimeout: number;
   /** Push scheduling fetches once, then returns control to the runner. */
   singlePoll?: boolean;
+  /** Stop an open poll window before its next claim request. */
+  shouldStop?: () => boolean;
   /** Distinguishes a failed fetch from an empty successful response. */
   onPollFailure?: () => void;
   since?: string; // Optional: for filtering finished tasks
@@ -3669,6 +3671,7 @@ async function pollForTriggerOnce(opts: PollOptions): Promise<Trigger | null> {
   }
 
   while (Date.now() - startTime < opts.pollTimeout) {
+    if (opts.shouldStop?.()) return null;
     try {
       // Build URL with optional since parameter
       let url = `${opts.apiUrl}/api/poll`;
@@ -7099,7 +7102,7 @@ export async function runAgent(config: RunnerConfig, opts: RunnerOptions) {
       }
     }
 
-    // Only poll if we have capacity and the API is not draining
+    // Only poll if we have capacity and neither the API nor worker is draining
     const schedule = pushDelivery.schedule({
       mode: state.deliveryMode ?? "poll",
       push: deliveryChecks.push,
@@ -7108,7 +7111,7 @@ export async function runAgent(config: RunnerConfig, opts: RunnerOptions) {
         exitAfterTasks === null
           ? state.maxConcurrent
           : Math.min(state.maxConcurrent, Math.max(0, exitAfterTasks - state.tasksProcessed)),
-      draining: state.apiDraining,
+      draining: state.apiDraining || shuttingDown,
       lastPushPingAt,
       pollInterval: PollIntervalMs,
     });
@@ -7146,6 +7149,7 @@ export async function runAgent(config: RunnerConfig, opts: RunnerOptions) {
           runtimeInstanceId,
           pollTimeout: effectiveTimeout,
           singlePoll: schedule.singlePoll,
+          shouldStop: () => shuttingDown,
           onPollFailure,
           harnessProvider: state.harnessProvider,
           onApiDrainSignal: (draining) => applyApiDrainSignal(state, role, draining),

package/src/extensions/apply-task-create.ts

@@ -2,7 +2,8 @@ import { explicitModelErrorForAgent } from "../be/model-validation";
 import type { RequestInfo } from "../tools/utils";
 import { type CreateTaskOptions, CreateTaskOptionsSchema } from "../types";
 import { scrubSecrets } from "../utils/secret-scrubber";
-import type { TaskCreateModify, TaskCreateOrigin } from "./contract";
+import { workflowEventBus } from "../workflows/event-bus";
+import type { TaskBlockedEvent, TaskCreateModify, TaskCreateOrigin } from "./contract";
 import { dispatchPre, extensionIdForAgent, listRegistered } from "./dispatcher";
 
 const MODIFIABLE_OPTION_KEYS = [
@@ -69,6 +70,14 @@ function warnDroppedKey(extensionName: string, key: string): void {
   );
 }
 
+function scrubFields<T extends object>(fields: T): T {
+  return Object.fromEntries(
+    Object.entries(fields)
+      .filter(([, value]) => value !== undefined)
+      .map(([key, value]) => [key, typeof value === "string" ? scrubSecrets(value) : value]),
+  ) as T;
+}
+
 export async function applyPreTaskCreate(
   args: ApplyPreTaskCreateArgs,
 ): Promise<ApplyPreTaskCreateResult> {
@@ -80,6 +89,48 @@ export async function applyPreTaskCreate(
     ? (`extension:${creatingExtension.record.name}` as const)
     : args.origin;
 
+  const blocked = (
+    reason: string,
+    extension: TaskBlockedEvent["extension"],
+  ): ApplyPreTaskCreateResult => {
+    const { options, requestInfo } = args;
+    const event: TaskBlockedEvent = {
+      extension,
+      reason: scrubSecrets(reason),
+      origin,
+      source: options.source,
+      requester: scrubFields({
+        userId: options.requestedByUserId,
+        agentId: requestInfo?.agentId ?? options.creatorAgentId,
+        slackUserId: options.slackUserId,
+      }),
+      context: scrubFields({
+        contextKey: options.contextKey ?? requestInfo?.contextKey,
+        scheduleId: options.scheduleId,
+        workflowRunId: options.workflowRunId,
+        workflowRunStepId: options.workflowRunStepId,
+        parentTaskId: options.parentTaskId,
+        vcsRepo: options.vcsRepo,
+        vcsNumber: options.vcsNumber,
+        slackChannelId: options.slackChannelId,
+        slackThreadTs: options.slackThreadTs,
+      }),
+      description: scrubSecrets(args.description).slice(0, 500),
+    };
+    try {
+      workflowEventBus.emit("task.create_blocked", {
+        ...event,
+        skipExtensionId: creatingExtensionId,
+      });
+    } catch (error) {
+      console.error(
+        "[extensions] task.create_blocked event not emitted:",
+        scrubSecrets(error instanceof Error ? error.message : String(error)),
+      );
+    }
+    return { kind: "blocked", reason: event.reason, extension };
+  };
+
   // The last extension that rewrote `model` or `agentId`. The final pair is re-checked
   // against the assignee's harness, because the caller validated the pre-hook pair only.
   let modelEditor: { id: string; name: string } | undefined;
@@ -125,11 +176,7 @@ export async function applyPreTaskCreate(
   );
 
   if (result.action === "block") {
-    return {
-      kind: "blocked",
-      reason: result.reason,
-      extension: result.extension,
-    };
+    return blocked(result.reason, result.extension);
   }
   if (result.action === "continue") {
     return { kind: "proceed", description: args.description, options: args.options };
@@ -146,11 +193,10 @@ export async function applyPreTaskCreate(
       agentId: options.agentId,
     });
     if (modelError) {
-      return {
-        kind: "blocked",
-        reason: `pre.task.create rewrite from extension "${modelEditor.name}" is invalid: ${modelError}`,
-        extension: modelEditor,
-      };
+      return blocked(
+        `pre.task.create rewrite from extension "${modelEditor.name}" is invalid: ${modelError}`,
+        modelEditor,
+      );
     }
   }
   return {