@humwick/server 0.130.1 → 0.130.2

package/src/provider-config-store.ts

@@ -4,7 +4,8 @@ import { hostname } from "node:os";
 import { join } from "node:path";
 import { ValidationError, listOrchestrators } from "./db";
 import { isSecretEnvKey } from "./db/provider-config-secrets";
-import { getConfig, listConfig, setConfig } from "./config-store";
+import { getConfig, listConfig } from "./config-store";
+import { setConfigAsync } from "./config-store-write";
 import { localOrchestratorIdFromEnv, providerConfigHomeFromEnv } from "./config";
 import { cleanString, cleanStringArray, optionalEnum } from "./validation";
 import { emitConfigChanged } from "./sse";
@@ -90,11 +91,11 @@ export function listProviderConfigEntries(host = defaultProviderConfigHost()): R
   ) as Record<SpawnProvider, ProviderConfigEntry>;
 }
 
-export function setProviderConfig(
+export async function setProviderConfigAsync(
   provider: string,
   value: unknown,
   opts: { host?: string; updatedBy?: string } = {},
-): ProviderConfigEntry {
+): Promise<ProviderConfigEntry> {
   const cleanProvider = normalizeProviderConfigProvider(provider);
   const host = normalizeProviderConfigHost(opts.host ?? defaultProviderConfigHost());
   const normalized = cleanProviderConfig(cleanProvider, resolveMaskedEnvSentinels(value, host, cleanProvider));
@@ -102,7 +103,7 @@ export function setProviderConfig(
   ensureProviderConfigDescriptors([key]);
   const validation = validateSettingValue(PROVIDER_CONFIG_NAMESPACE, key, normalized);
   if (!validation.valid) throw new ValidationError(validation.errors.join("; "));
-  return setConfig(PROVIDER_CONFIG_NAMESPACE, key, normalized, opts.updatedBy) as ProviderConfigEntry;
+  return await setConfigAsync(PROVIDER_CONFIG_NAMESPACE, key, normalized, opts.updatedBy) as ProviderConfigEntry;
 }
 
 export function providerConfigPublic(entry: ProviderConfigEntry, opts: { maskEnv?: boolean } = {}): Record<string, unknown> {
@@ -138,11 +139,11 @@ export function providerConfigPublic(entry: ProviderConfigEntry, opts: { maskEnv
  * This is the server-authority write path: callers are in-process (local migration
  * or the orchestrator command-bus result handler), so no HTTP scope is required.
  */
-export function seedProviderConfigs(
+export async function seedProviderConfigsAsync(
   host: string,
   rawByProvider: Record<string, unknown>,
   opts: { legacyHost?: string } = {},
-): ProviderConfigEntry[] {
+): Promise<ProviderConfigEntry[]> {
   const seeded: ProviderConfigEntry[] = [];
   const cleanHost = normalizeProviderConfigHost(host);
   const legacyHost = opts.legacyHost ? normalizeProviderConfigHost(opts.legacyHost) : undefined;
@@ -159,7 +160,7 @@ export function seedProviderConfigs(
     // still validates; the relay owns the schema, the reporter stays dumb.
     const value = legacy?.value ?? { ...providerConfigDefaults(provider), ...(isRecord(raw) ? raw : {}) };
     try {
-      const entry = setProviderConfig(provider, value, { host: cleanHost, updatedBy: `migration:${cleanHost}` });
+      const entry = await setProviderConfigAsync(provider, value, { host: cleanHost, updatedBy: `migration:${cleanHost}` });
       emitConfigChanged(entry.namespace, entry.key, entry.version);
       seeded.push(entry);
     } catch {
@@ -174,16 +175,16 @@ export function seedProviderConfigs(
  * owns the stable-id/legacy-hostname resolution together so command routes do
  * not re-parse or accidentally bypass the migration authority rules.
  */
-export function seedMigratedProviderConfigs(result: unknown): { host: string; seeded: ProviderConfigEntry[] } | null {
+export async function seedMigratedProviderConfigsAsync(result: unknown): Promise<{ host: string; seeded: ProviderConfigEntry[] } | null> {
   if (!isRecord(result)) return null;
   const host = cleanString(result.host, "result.host", { max: 120 });
   const hostname = cleanString(result.hostname, "result.hostname", { max: 120 });
   const configs = isRecord(result.configs) ? result.configs : undefined;
   if (!host || !configs) return null;
-  return { host, seeded: seedProviderConfigs(host, configs, { legacyHost: hostname }) };
+  return { host, seeded: await seedProviderConfigsAsync(host, configs, { legacyHost: hostname }) };
 }
 
-export function migrateLocalProviderConfigs(home = humwickHome(), host = defaultProviderConfigHost()): ProviderConfigEntry[] {
+export async function migrateLocalProviderConfigsAsync(home = humwickHome(), host = defaultProviderConfigHost()): Promise<ProviderConfigEntry[]> {
   const dir = join(home, "providers");
   if (!existsSync(dir)) return [];
   const raw: Record<string, unknown> = {};
@@ -192,7 +193,7 @@ export function migrateLocalProviderConfigs(home = humwickHome(), host = default
     if (!VALID_PROVIDER_CONFIGS.includes(provider as SpawnProvider)) continue;
     raw[provider] = loadLocalProviderConfig(provider, home);
   }
-  return seedProviderConfigs(host, raw);
+  return seedProviderConfigsAsync(host, raw);
 }
 
 function normalizeProviderConfigHost(host: string): string {

package/src/provider-model-seed.ts

@@ -1,18 +1 @@
-import { getConfig, setConfig } from "./config-store";
-import { seedProviderModelOverrides } from "./provider-catalog-store";
-import { reconcileClaudeCatalogSeeds } from "./db/claude-catalog-reconcile";
-import { VERSION } from "./config";
-import { errMessage } from "@humwick/sdk";
-
-// Stamp only after the transactional seed succeeds so a failure retries next boot.
-export function reconcileProviderModelSeed(): void {
-  try {
-    reconcileClaudeCatalogSeeds();
-    const stamp = `seed:${VERSION}`;
-    if (getConfig<string>("system", "provider-model-seed-version")?.value === stamp) return;
-    seedProviderModelOverrides(stamp);
-    setConfig("system", "provider-model-seed-version", stamp, "server-startup");
-  } catch (err) {
-    console.warn(`[provider-model-seed] skipped: ${errMessage(err)}`);
-  }
-}
+export { reconcileProviderModelSeed, seedProviderModelOverrides } from "./db/provider-model-seed";

package/src/provider-quota-config-store.ts

@@ -9,7 +9,8 @@
 // provider *spawn* config (provider-config-store.ts) by design — different scope,
 // different cardinality.
 import { ValidationError } from "./db";
-import { getConfig, listConfig, setConfig } from "./config-store";
+import { getConfig, listConfig } from "./config-store";
+import { setConfigAsync } from "./config-store-write";
 import { emitConfigChanged } from "./sse";
 import {
   DEFAULT_PROVIDER_QUOTA_CONFIG,
@@ -47,14 +48,14 @@ export function listProviderQuotaConfigs(): ProviderQuotaConfigMap {
  * clamped to 5m–15m, unset fields defaulted), so a partial body still validates.
  * Emits `config.changed` so the orchestrator + dashboard pick it up live.
  */
-export function setProviderQuotaConfig(
+export async function setProviderQuotaConfigAsync(
   provider: string,
   value: unknown,
   opts: { updatedBy?: string } = {},
-): ProviderQuotaConfig {
+): Promise<ProviderQuotaConfig> {
   const clean = assertValidProvider(provider);
   const normalized = normalizeProviderQuotaConfig(value);
-  const entry = setConfig(PROVIDER_QUOTA_CONFIG_NAMESPACE, clean, normalized, opts.updatedBy);
+  const entry = await setConfigAsync(PROVIDER_QUOTA_CONFIG_NAMESPACE, clean, normalized, opts.updatedBy);
   emitConfigChanged(entry.namespace, entry.key, entry.version);
   return normalized;
 }

package/src/provider-secrets.test-fixture.ts

@@ -1,5 +1,5 @@
 import { getDb } from "./db";
-import { setProviderConfig } from "./provider-config-store";
+import { setProviderConfigAsync } from "./provider-config-store";
 
 // #3402 — fake values under every key name the hub's central provider config holds, plus one no masking
 // list knows, so a test proves masking follows the configured values rather than key names.
@@ -25,9 +25,9 @@ export function leakedProviderSecrets(text: string): string[] {
 }
 
 /** Seeds the central provider config of `host` and returns its rows the way `sqlite3 ... select` prints them. */
-export function seedProviderSecrets(host: string): string {
+export async function seedProviderSecrets(host: string): Promise<string> {
   for (const [provider, env] of Object.entries(PROVIDER_SECRET_ENV)) {
-    setProviderConfig(provider, { command: provider, env: { ...env, OPENCODE_CONFIG: "/srv/opencode.json" } }, { host });
+    await setProviderConfigAsync(provider, { command: provider, env: { ...env, OPENCODE_CONFIG: "/srv/opencode.json" } }, { host });
   }
   return (getDb().query("SELECT namespace, key, value FROM config WHERE namespace = 'provider-config'").all() as Array<Record<string, string>>)
     .map((row) => `${row.namespace}|${row.key}|${row.value}`).join("\n");

package/src/recipe-runner.ts

@@ -15,7 +15,7 @@ import {
   validateRecipeArtifactRefsAsync,
 } from "./recipe-async";
 import type { AttachmentRef, Command, RecipeInstance } from "./types";
-import { SYSTEM_LAUNCH, runnerRuntimeTokenEnv } from "./runtime-tokens";
+import { SYSTEM_LAUNCH, runnerRuntimeTokenEnvAsync } from "./runtime-tokens";
 import { generateSpawnAgentId } from "./services/spawn-identity";
 
 interface StartRecipeInput {
@@ -114,7 +114,7 @@ export async function startRecipe(input: StartRecipeInput): Promise<StartRecipeR
           env: {
             ...(agent.env ?? {}),
             ...(attachments.length ? writeChildEnv({}, { AGENT_RELAY_RECIPE_ARTIFACTS: JSON.stringify(attachments) }) : {}),
-            ...runnerRuntimeTokenEnv({ authority: SYSTEM_LAUNCH,
+            ...await runnerRuntimeTokenEnvAsync({ authority: SYSTEM_LAUNCH,
               agentId,
               orchestratorId: orchestrator.id,
               cwd,

package/src/repo-config-source.ts

@@ -6,7 +6,8 @@
 import { dirname, resolve } from "node:path";
 import { isRecord, stringValue } from "@humwick/sdk";
 import { isTrustedOrchestratorApiUrl, relayAuthHeaders } from "./config";
-import { getConfig, setConfig } from "./config-store";
+import { getConfig } from "./config-store";
+import { setConfigAsync } from "./config-store-write";
 import { listOrchestrators, reportedRepoRootForCwd } from "./db";
 import { hostIsRelayHost } from "./relay-host-locality";
 import { normalizeHostToken, parseJson, sameHostIdentity } from "./utils";
@@ -70,11 +71,16 @@ export function hostRepoConfigSource<T>(spec: HostRepoConfigSpec<T>): HostRepoCo
     return null;
   }
 
-  function writeCached(host: string, keys: readonly string[], found: RepoConfigSource<T> | null): void {
+  /** #1870 S7: writes on the writer thread, and only when the answer changed. `at` is evidence, not a
+   *  TTL, so re-stamping an identical answer on every read only bumped the version and history. */
+  async function writeCached(host: string, keys: readonly string[], found: RepoConfigSource<T> | null): Promise<void> {
     const at = Date.now();
+    const answer = JSON.stringify(found);
     for (const key of keys) {
       try {
-        setConfig<CachedRepoConfigSource<T>>(spec.cacheNamespace, cacheKey(host, key), { found, at }, spec.cacheNamespace);
+        const current = getConfig<CachedRepoConfigSource<T>>(spec.cacheNamespace, cacheKey(host, key))?.value;
+        if (current?.at && JSON.stringify(current.found) === answer) continue;
+        await setConfigAsync<CachedRepoConfigSource<T>>(spec.cacheNamespace, cacheKey(host, key), { found, at }, spec.cacheNamespace);
       } catch {
         // The cache is an optimization for the sync paths; failing to record it must never fail a caller.
       }
@@ -149,7 +155,7 @@ export function hostRepoConfigSource<T>(spec: HostRepoConfigSpec<T>): HostRepoCo
       if (hostIsRelayHost(host)) return { known: true, found: await spec.findLocalAsync(cwd) };
       const read = await readFromHost(cwd, host!);
       if (read.known) {
-        writeCached(host!, cacheWriteKeys(cwd, read.found, opts.alsoCacheFor), read.found);
+        await writeCached(host!, cacheWriteKeys(cwd, read.found, opts.alsoCacheFor), read.found);
         return read;
       }
       return cachedLookup(host!, cwd);

package/src/routes/agent-profiles.ts

@@ -1,12 +1,12 @@
 import { PromptVersionConflictError } from "../prompt-version-errors";
 import { versionedPromptsEnabled } from "../versioned-prompts";
 import { promptActor } from "../services/prompt-version-writer";
-import { setConfigAsync } from "../config-store-write";
+import { deleteAgentProfileAsync, setAgentProfileAsync, setConfigAsync } from "../config-store-write";
 import { memoryRetirementMessage } from "../memory-retirement";
 // Auto-split from routes.ts (#299). Domain: agent-profiles.
 import { ValidationError, withResolvedProvisioningAsync } from "../db";
 import { cleanString, optionalEnum } from "../validation";
-import { deleteAgentProfile, getAgentProfile, listAgentProfiles, resolveAgentProfileKey, setAgentProfile, validateAgentProfile } from "../config-store";
+import { getAgentProfile, listAgentProfiles, resolveAgentProfileKey, validateAgentProfile } from "../config-store";
 import { RELAY_TOOL_GROUPS } from "../mcp";
 import { emitConfigChanged } from "../sse";
 import { error, isAdminRequest, json, normalizeConfigPathParam, parseBody, type Handler } from "./_shared";
@@ -140,8 +140,8 @@ export const putAgentProfileRoute: Handler = async (req, params) => {
       return json(saved);
     }
     const profile = existing?.value.builtIn && isAdminRequest(req)
-      ? setAgentProfile({ ...parsed.body, name } as AgentProfile, updatedBy, { overrideBuiltIn: true })
-      : setAgentProfile({ ...parsed.body, name } as AgentProfile, updatedBy);
+      ? await setAgentProfileAsync({ ...parsed.body, name } as AgentProfile, updatedBy, { overrideBuiltIn: true })
+      : await setAgentProfileAsync({ ...parsed.body, name } as AgentProfile, updatedBy);
     emitConfigChanged(profile.namespace, profile.key, profile.version);
     return json(profile, existing ? 200 : profile.version === 1 ? 201 : 200);
   } catch (e) {
@@ -151,14 +151,14 @@ export const putAgentProfileRoute: Handler = async (req, params) => {
   }
 };
 
-export const deleteAgentProfileRoute: Handler = (req, params) => {
+export const deleteAgentProfileRoute: Handler = async (req, params) => {
   try {
     const name = normalizeConfigPathParam(params.name, "name");
     const existing = getAgentProfile(name);
     if (!existing) return error(memoryRetirementMessage(name) ?? "agent profile not found", 404);
     const updatedBy = versionedPromptsEnabled() ? promptActor(req) : cleanString(new URL(req.url).searchParams.get("updatedBy") ?? undefined, "updatedBy", { max: 200 });
     if (existing.value.builtIn && !isAdminRequest(req)) return error("built-in agent profiles are managed by Relay", 400);
-    deleteAgentProfile(name, updatedBy, { resetBuiltInOverride: existing.value.builtIn });
+    await deleteAgentProfileAsync(name, updatedBy, { resetBuiltInOverride: existing.value.builtIn });
     emitConfigChanged(existing.namespace, existing.key, existing.version + 1);
     return json({ ok: true });
   } catch (e) {

package/src/routes/agents-spawn.ts

@@ -208,7 +208,7 @@ export const postAgentSpawn: Handler = async (req) => {
     // strip the heavy inlined provisioning file contents from the echoed-back summary.
     return json({
       ok: true, spawnRequestId: result.spawnRequestId, harnessSubagents: result.harnessSubagents, orchestratorId: result.orchestratorId, placementReason: result.placementReason, provider: result.provider, command: summarizeSpawnCommandForCaller(result.command),
-      ...(result.task ? { task: result.task } : {}), ...(result.warnings ? { warnings: result.warnings } : {}), ...(result.dispatchDecision ? { dispatchDecision: result.dispatchDecision } : {}), ...(workflow.reason ? { workflow: { started: false, reason: workflow.reason } } : {}),
+      ...(result.task ? { task: result.task } : {}), ...(result.warnings ? { warnings: result.warnings } : {}), ...(result.spawnPolicy ? { spawnPolicy: result.spawnPolicy } : {}), ...(result.dispatchDecision ? { dispatchDecision: result.dispatchDecision } : {}), ...(workflow.reason ? { workflow: { started: false, reason: workflow.reason } } : {}),
     }, 202);
   } catch (e) {
     if (e instanceof McpAuthError) return error(e.message, 403);

package/src/routes/agents.ts

@@ -2,7 +2,7 @@
 import { messageViewerForRequest, visibleMessages } from "./message-viewer";
 import { attachPrincipal, attachPrincipals } from "../agent-principal";
 import { VALID_AGENT_STATUSES, agentSessionStatus, auditEvent, canViewAgentRoute, error, json, normalizeAgentSessionGuard, parseBody, parseId, parseQueryInt, visibleAgentIdsForRequest, type Handler } from "./_shared";
-import { ValidationError, deleteAgentAsync, getAgent, getAgentAsync, getAgentIdentityAsync, getAgentQuotaSnapshotsAsync, getAgentTimelineAsync, getCrashReport, recordHeartbeat, listAgentChatHistoryAsync, listAgents, listAgentsAsync, listArtifactsForEntityAsync, listContextSnapshotsAsync, listPendingReplyObligationsAsync, markReadyAsync, searchAgentsAsync, setLabelAsync, setStatusAsync, setTagsAsync, validateAgentSession } from "../db";
+import { ValidationError, deleteAgentAsync, getAgent, getAgentAsync, getAgentIdentityAsync, getAgentQuotaSnapshotsAsync, getAgentTimelineAsync, getCrashReport, recordHeartbeatAsync, listAgentChatHistoryAsync, listAgents, listAgentsAsync, listArtifactsForEntityAsync, listContextSnapshotsAsync, listPendingReplyObligationsAsync, markReadyAsync, searchAgentsAsync, setLabelAsync, setStatusAsync, setTagsAsync, validateAgentSession } from "../db";
 import { attachBranchState, attachBranchStates } from "../agent-branch-state";
 import { redactAgentCardLaunchShape } from "../agent-launch-shape-redaction";
 import { attachChannelBinding, attachChannelBindings } from "../agent-channel-binding";
@@ -258,8 +258,8 @@ function cleanAgentStatus(value: unknown): AgentStatusValue {
 // #3606 — a reported status/readiness equal to the live card is a liveness tick, not a transition: no
 // row write, no agent.status event. Presence still advances through the coalescing heartbeat buffer,
 // except for a terminal row, which a beat would resurrect.
-function noteUnchangedLifecycle(agentId: string, current: AgentCard, guard: AgentSessionGuard | undefined): void {
-  if (current.status !== "offline" && current.status !== "stale") recordHeartbeat(agentId, { guard });
+async function noteUnchangedLifecycle(agentId: string, current: AgentCard, guard: AgentSessionGuard | undefined): Promise<void> {
+  if (current.status !== "offline" && current.status !== "stale") await recordHeartbeatAsync(agentId, { guard });
 }
 
 async function applyAgentStatus(agentId: string, status: AgentStatusValue, guard: AgentSessionGuard | undefined, before: AgentCard | null): Promise<boolean> {
@@ -309,7 +309,7 @@ export const patchAgentStatus: Handler = async (req, params) => {
     const session = validateAgentSession(params.id!, guard);
     if (!session.ok) return error(session.error!, agentSessionStatus(session.error));
     const before = getAgent(params.id!);
-    if (before?.status === status) noteUnchangedLifecycle(params.id!, before, guard);
+    if (before?.status === status) await noteUnchangedLifecycle(params.id!, before, guard);
     else if (!(await applyAgentStatus(params.id!, status, guard, before))) return error("agent not found", 404);
   } catch (e) {
     if (e instanceof ValidationError) return error(e.message, 400);
@@ -349,7 +349,7 @@ export const postHeartbeat: Handler = async (req, params) => {
     // A reported terminal status must not be undone by the beat's offline/stale resurrection.
     if (status !== "offline" && status !== "stale") {
       // #1468 — route the API heartbeat through the same coalescing buffer as the bus path.
-      if (!recordHeartbeat(params.id!, { guard })) return error("agent not found", 404);
+      if (!(await recordHeartbeatAsync(params.id!, { guard }))) return error("agent not found", 404);
     }
     if (wasUnavailable) {
       const after = getAgent(params.id!);
@@ -429,7 +429,7 @@ export const patchAgentReady: Handler = async (req, params) => {
     const session = validateAgentSession(params.id!, guard);
     if (!session.ok) return error(session.error!, agentSessionStatus(session.error));
     const before = getAgent(params.id!);
-    if (before?.ready === body.ready) noteUnchangedLifecycle(params.id!, before, guard);
+    if (before?.ready === body.ready) await noteUnchangedLifecycle(params.id!, before, guard);
     else if (!(await applyAgentReady(params.id!, body.ready, guard, before))) return error("agent not found", 404);
   } catch (e) {
     if (e instanceof ValidationError) return error(e.message, 400);

package/src/routes/commands-listing.ts

@@ -32,6 +32,10 @@ export const getCommands: Handler = async (req) => {
     limit: limitRaw ?? undefined,
     dispatchableOnly,
     oldestFirst: dispatchableOnly && status === "pending",
+    // #3391 — a listing omits each spawn's inline agentProfile (13.9 MB per 30 rows blocked the hub
+    // loop); `GET /api/commands/:id` returns the full row. The executor dispatch feed runs the rows it
+    // polls, so it keeps the profile.
+    slim: !dispatchableOnly,
   });
   return json(commands.map((command) => serializeCommandForRead(command, ctx)));
 };

package/src/routes/commands.ts

@@ -29,7 +29,7 @@ import { KERNEL_CORRELATION_PREFIX, isReservedKernelCorrelationId } from "../ser
 import { prepareScheduledCommandResultForStorage, settleScheduledCommandTimer } from "../services/scheduler-command";
 import { ServiceAuthError } from "../services/errors";
 import { applyIdleRefreshResult } from "../maintenance/workspaces";
-import { seedMigratedProviderConfigs } from "../provider-config-store";
+import { seedMigratedProviderConfigsAsync } from "../provider-config-store";
 import { notifyAgentSpawnFailed } from "../agent-lifecycle-events";
 import { scheduleRepoMerge } from "../workspace-auto-merge";
 import { settleMemoryInjectionAfterContextCommand } from "../memory-injection";
@@ -559,7 +559,7 @@ export const patchCommand: Handler = async (req, params) => {
     if (command.type === "orchestrator.migrate-provider-config" && command.status === "succeeded" && isRecord(result)) {
       // Seed central rows from the reported host-local files with server authority (#465); idempotent, a
       // stored row wins. Seeds from the request: the persisted result holds only fingerprints (#3403).
-      const migration = seedMigratedProviderConfigs(result);
+      const migration = await seedMigratedProviderConfigsAsync(result);
       if (migration?.seeded.length) {
         const { host, seeded } = migration;
         await auditEvent({

package/src/routes/continuation-archives.ts

@@ -1,7 +1,7 @@
 // Auto-split from routes.ts (#299). Domain: continuation archives.
 import { isRecord } from "@humwick/sdk";
 import { resolveCallerAgentId } from "../agent-ref";
-import { archiveContinuationSegmentAsync, appendContinuationArchiveRefs, getAgent, listAgents, ValidationError } from "../db";
+import { archiveContinuationSegmentAsync, appendContinuationArchiveRefsAsync, getAgent, listAgents, ValidationError } from "../db";
 import { getComponentAuth } from "../security";
 import { cleanEpoch, cleanPositiveId, cleanString } from "../validation";
 import { error, json, parseBody, type Handler } from "./_shared";
@@ -21,7 +21,7 @@ export const postContinuationArchiveRoute: Handler = async (req) => {
       generation: cleanPositiveId(parsed.body.generation, "generation"),
       now: cleanEpoch(parsed.body.occurredAt, "occurredAt"),
     });
-    const envelope = appendContinuationArchiveRefs(agentId, [archive.ref]);
+    const envelope = await appendContinuationArchiveRefsAsync(agentId, [archive.ref]);
     return json({ archive, envelope }, 201);
   } catch (e) {
     if (e instanceof ValidationError) return error(e.message, 400);

package/src/routes/index.ts

@@ -70,6 +70,7 @@ import { postIssueLifecycleReopenRoute } from "./issue-lifecycle";
 import { deleteIssueRefRoute, getIssueRefRoute, listIssueRefsRoute, patchIssueRefRoute, postIssueRefRoute, resolveIssueRefRoute } from "./issue-refs";
 import { deleteProjectEntryRoute, getProjectEntriesRoute, getProjectEntryRoute, getProjectInjectionPreviewRoute, getProjectResolveRoute, getProjectRoute, getProjectsRoute, patchProjectEntryRoute, postProjectEntryRoute } from "./projects";
 import { getPromptHistoryRoute, postPromptRevisionRoute, getPromptTemplateRoute, getPromptTemplatesRoute, postPromptTemplateResetRoute, putPromptTemplateRoute } from "./prompt-templates";
+import { projectProfileInstructionsRoute } from "./project-profile-instructions";
 import { getRecipeByName, getRecipeInstanceArtifacts, getRecipeInstanceById, getRecipeInstances, getRecipes, postRecipeInstanceArtifacts, postRecipeStart, postRecipeStop } from "./recipes";
 import { getSettingRoute, getSettingsNamespaceRoute, getSettingsRoute, putSettingRoute, putSettingsDefaultRoute } from "./settings";
 import { postNotificationPreviewRoute } from "./notifications";
@@ -85,7 +86,7 @@ import { postMcp } from "../mcp";
 import { postOrchestratorBootstrap, postOrchestratorBootstrapExchange } from "./orchestrator-bootstrap";
 import { getDeploysRoute } from "./deploys";
 import { getGateStatsRoute, getShippingBoardRoute, getShippingStatsRoute, postRedMainAbandonRoute } from "./shipping";
-import { getWorkflowCatalogRoute, getWorkflowDefinitionsRoute, getWorkflowRunBudgetRoute, getWorkflowRunRoute, getWorkflowRunsRoute, getWorkflowStatsRoute, patchWorkflowRunBudgetRoute, postWorkflowRunCancelRoute, postWorkflowRunResumeRoute, postWorkflowRunStartRoute } from "./workflows";
+import { getWorkflowCatalogRoute, getWorkflowDefinitionsRoute, getWorkflowRunBudgetRoute, getWorkflowRunRoute, getWorkflowRunsRoute, getWorkflowStatsRoute, patchWorkflowRunBudgetRoute, postWorkflowRunCancelRoute, postWorkflowRunPauseRoute, postWorkflowRunResumeRoute, postWorkflowRunStartRoute, postWorkflowRunUnpauseRoute } from "./workflows";
 import { getRestartEpochRoute, postRestartEpochAbandonRoute } from "./restart-epochs";
 import { getFleetConvergenceRoute } from "./fleet-convergence";
 import { postTimerMessageOperator } from "./kernel-timers-operator";
@@ -318,6 +319,7 @@ const routes: Route[] = [
   route("DELETE", "/api/commands/:id", deleteCommandById),
   route("POST", "/api/system/timer-message-cutover/:verb", postTimerMessageOperator),
   route("GET", "/api/agent-profiles", getAgentProfilesRoute),
+  route("GET", "/api/agent-profiles/:name/project-instructions", projectProfileInstructionsRoute),
   route("GET", "/api/agent-profiles/tool-groups", getAgentProfileToolGroupsRoute),
   route("POST", "/api/agent-profiles/preview", postAgentProfilePreviewRoute),
   route("GET", "/api/agent-profiles/:name/resolved", getResolvedAgentProfileRoute),
@@ -546,6 +548,11 @@ const routes: Route[] = [
   route("PATCH", "/api/issue-refs/:id", patchIssueRefRoute),
   route("DELETE", "/api/issue-refs/:id", deleteIssueRefRoute),
   route("GET", "/api/projects", getProjectsRoute),
+  route("GET", "/api/projects/:id/profile-instructions", projectProfileInstructionsRoute),
+  route("GET", "/api/projects/:id/profile-instructions/:profile", projectProfileInstructionsRoute),
+  route("PUT", "/api/projects/:id/profile-instructions/:profile", projectProfileInstructionsRoute),
+  route("GET", "/api/projects/:id/profile-instructions/:profile/history", projectProfileInstructionsRoute),
+  route("POST", "/api/projects/:id/profile-instructions/:profile/restore", projectProfileInstructionsRoute),
   route("POST", "/api/projects", postProjectOnboardRoute),
   route("POST", "/api/projects/:id/checkouts/bind", postProjectBindCheckoutRoute),
   route("POST", "/api/projects/:id/checkouts/unbind", postProjectUnbindCheckoutRoute),
@@ -600,6 +607,8 @@ const routes: Route[] = [
   route("GET", "/api/workflows/runs/:runId/budget", getWorkflowRunBudgetRoute),
   route("PATCH", "/api/workflows/runs/:runId/budget", patchWorkflowRunBudgetRoute),
   route("POST", "/api/workflows/runs/:runId/cancel", postWorkflowRunCancelRoute),
+  route("POST", "/api/workflows/runs/:runId/pause", postWorkflowRunPauseRoute),
+  route("POST", "/api/workflows/runs/:runId/unpause", postWorkflowRunUnpauseRoute),
   route("POST", "/api/workflows/runs/:runId/resume", postWorkflowRunResumeRoute),
   route("GET", "/api/workflows/stats", getWorkflowStatsRoute),
   route("GET", "/api/workflows/definitions", getWorkflowDefinitionsRoute),

package/src/routes/integrations.ts

@@ -1,7 +1,8 @@
+import type { IntegrationRegistryInput } from "../db/integrations";
 // Auto-split from routes.ts (#299). Domain: integrations.
 import { INTEGRATION_RATE_LIMIT_PER_MINUTE, MAX_BODY_BYTES, getIntegrationTokens, type IntegrationTokenConfig } from "../config";
 import { VALID_ARTIFACT_KINDS, VALID_ARTIFACT_ROLES, VALID_TASK_STATUSES, agentSessionStatus, authorizeRoute, cleanAttachmentRefs, dispatchTaskCallbacksInBackground, error, json, normalizeAgentSessionGuard, parseBody, reactionEmoji, sendReactionNotificationToAuthor, validateChannelAttachmentSourceRef, withPayloadAttachments, type Handler } from "./_shared";
-import { ValidationError, evaluatePoolBindingsAsync, findMessageByTelegramSourceAsync, getAgent, getChannelAsync, getMessage, ingestIntegrationEvent, isIntegrationRegistryEnabled, listChannelBindingsAsync, listChannelsAsync, listIntegrationRegistry, listIntegrationTaskStats, resolveChannelRoutesAsync, sendMessageWithResult, setMessageReactionAsync, upsertChannelBindingAsync, upsertIntegrationRegistry, validateAgentSession } from "../db";
+import { ValidationError, evaluatePoolBindingsAsync, findMessageByTelegramSourceAsync, getAgent, getChannelAsync, getMessage, ingestIntegrationEvent, isIntegrationRegistryEnabled, listChannelBindingsAsync, listChannelsAsync, listIntegrationTaskStatsAsync, reconcileIntegrationRegistryAsync, resolveChannelRoutesAsync, sendMessageWithResult, setMessageReactionAsync, upsertChannelBindingAsync, upsertIntegrationRegistry, validateAgentSession } from "../db";
 import { cleanMeta, cleanString, cleanStringArray, optionalEnum } from "../validation";
 import { emitChannelActivity, emitMessageQueued, emitMessageReactionUpdated, emitNewMessage, emitTaskChanged } from "../sse";
 import { getComponentAuth, getIntegrationAuth, hasIntegrationScope, isRequestAuthorizedFor } from "../security";
@@ -256,24 +257,7 @@ function normalizeIntegrationEvent(body: unknown): IntegrationEventInput {
   };
 }
 
-function normalizeIntegrationRegistryInput(name: string, body: unknown): {
-  name: string;
-  displayName?: string;
-  description?: string;
-  enabled?: boolean;
-  scopes?: string[];
-  targets?: string[];
-  channels?: string[];
-  type?: string;
-  icon?: string;
-  accentColor?: string;
-  tags?: string[];
-  homepageUrl?: string;
-  repositoryUrl?: string;
-  docsUrl?: string;
-  manifest?: Record<string, unknown>;
-  source: "api";
-} {
+function normalizeIntegrationRegistryInput(name: string, body: unknown): IntegrationRegistryInput & { source: "api" } {
   if (!isRecord(body)) throw new ValidationError("body must be an object");
   if (body.enabled !== undefined && typeof body.enabled !== "boolean") throw new ValidationError("enabled must be a boolean");
   return {
@@ -364,40 +348,30 @@ function safeCallbackHost(url: string | undefined): string | undefined {
   }
 }
 
-function reconcileIntegrationRegistry(configured: Map<string, IntegrationTokenConfig>, observedStats: Map<string, ReturnType<typeof listIntegrationTaskStats>[number]>): Map<string, ReturnType<typeof listIntegrationRegistry>[number]> {
-  for (const config of configured.values()) {
-    upsertIntegrationRegistry({
-      name: config.name,
-      displayName: config.displayName,
-      description: config.description,
-      scopes: config.scopes,
-      targets: config.targets,
-      channels: config.channels,
-      type: config.type,
-      icon: config.icon,
-      accentColor: config.accentColor,
-      tags: config.tags,
-      homepageUrl: config.homepageUrl,
-      repositoryUrl: config.repositoryUrl,
-      docsUrl: config.docsUrl,
-      manifest: config.manifest,
-      source: "env",
-    });
-  }
-  for (const stats of observedStats.values()) {
-    upsertIntegrationRegistry({
-      name: stats.source,
-      enabled: true,
-      source: "observed",
-    });
-  }
-  return new Map(listIntegrationRegistry().map((integration) => [integration.name, integration]));
+async function reconcileRegistry(configured: Map<string, IntegrationTokenConfig>, observedSources: string[]) {
+  const registry = await reconcileIntegrationRegistryAsync([...configured.values()].map((config) => ({
+    name: config.name,
+    displayName: config.displayName,
+    description: config.description,
+    scopes: config.scopes,
+    targets: config.targets,
+    channels: config.channels,
+    type: config.type,
+    icon: config.icon,
+    accentColor: config.accentColor,
+    tags: config.tags,
+    homepageUrl: config.homepageUrl,
+    repositoryUrl: config.repositoryUrl,
+    docsUrl: config.docsUrl,
+    manifest: config.manifest,
+  })), observedSources);
+  return new Map(registry.map((integration) => [integration.name, integration]));
 }
 
-export const getIntegrations: Handler = () => {
+export const getIntegrations: Handler = async () => {
   const configured = new Map(getIntegrationTokens().map((integration) => [integration.name, integration]));
-  const observedStats = new Map(listIntegrationTaskStats().map((stats) => [stats.source, stats]));
-  const registry = reconcileIntegrationRegistry(configured, observedStats);
+  const observedStats = new Map((await listIntegrationTaskStatsAsync()).map((stats) => [stats.source, stats]));
+  const registry = await reconcileRegistry(configured, [...observedStats.keys()]);
   const names = [...new Set([...configured.keys(), ...observedStats.keys(), ...registry.keys()])].sort((a, b) => a.localeCompare(b));
   const now = Date.now();
 

package/src/routes/issue-refs.ts

@@ -1,4 +1,4 @@
-import { deleteIssueRefMapping, getIssueRef, listIssueRefs, patchIssueRefMapping, resolveIssueRefMapping, upsertIssueRefMapping, type ListIssueRefsOptions } from "../services/issue-refs";
+import { deleteIssueRefMappingAsync, getIssueRef, listIssueRefs, patchIssueRefMappingAsync, resolveIssueRefMappingAsync, upsertIssueRefMappingAsync, type ListIssueRefsOptions } from "../services/issue-refs";
 import { getIssueRefByExternalKey, issueRefClosedCompleted, issueRefForRefString } from "../db/issue-refs";
 import { advanceTerminalPlanRefsAsync } from "../services/plan-terminal-refs";
 import { cleanEnum, cleanString, optionalEnum } from "../validation";
@@ -76,7 +76,7 @@ export const postIssueRefRoute: Handler = async (req) => {
   try {
     const body = cleanUpsertBody(parsed.body);
     const before = getIssueRefByExternalKey(body.provider, body.repo, body.externalKey);
-    const issueRef = upsertIssueRefMapping(body);
+    const issueRef = await upsertIssueRefMappingAsync(body);
     // #2520 — a completed close cached here propagates to the plan nodes bound to this ref.
     if (issueRefClosedCompleted(before, issueRef)) await advanceTerminalPlanRefsAsync({ issueRefId: issueRef.id });
     return json({ issueRef });
@@ -98,7 +98,7 @@ export const resolveIssueRefRoute: Handler = async (req) => {
       ? issueRefForRefString(ref, cleanString(value.defaultRepo ?? value.repo, "defaultRepo", { max: 500 }))
       : getIssueRefByExternalKey(cleanProvider(value.provider), cleanString(value.repo, "repo", { required: true, max: 500 })!, cleanString(value.externalKey, "externalKey", { required: true, max: 240 })!);
     const issueRef = ref
-      ? resolveIssueRefMapping({
+      ? await resolveIssueRefMappingAsync({
         ref,
         defaultRepo: cleanString(value.defaultRepo ?? value.repo, "defaultRepo", { max: 500 }),
         provider: optionalEnum(value.provider, "provider", ISSUE_PROVIDERS, "github") as IssueProvider,
@@ -107,7 +107,7 @@ export const resolveIssueRefRoute: Handler = async (req) => {
         closeReason: cleanCloseReason(value.closeReason),
         statusSyncedAt: cleanTimestamp(value.statusSyncedAt),
       })
-      : resolveIssueRefMapping({
+      : await resolveIssueRefMappingAsync({
         provider: cleanProvider(value.provider),
         repo: cleanString(value.repo, "repo", { required: true, max: 500 })!,
         externalKey: cleanString(value.externalKey, "externalKey", { required: true, max: 240 })!,
@@ -142,7 +142,7 @@ export const patchIssueRefRoute: Handler = async (req, params) => {
   try {
     const id = cleanString(params.id, "id", { required: true, max: 120 })!;
     const before = getIssueRef(id);
-    const issueRef = patchIssueRefMapping(id, cleanPatchBody(parsed.body));
+    const issueRef = await patchIssueRefMappingAsync(id, cleanPatchBody(parsed.body));
     if (!issueRef) return error("issue ref not found", 404);
     // #2520 — a completed close cached here propagates to the plan nodes bound to this ref.
     if (issueRefClosedCompleted(before, issueRef)) await advanceTerminalPlanRefsAsync({ issueRefId: issueRef.id });
@@ -152,9 +152,9 @@ export const patchIssueRefRoute: Handler = async (req, params) => {
   }
 };
 
-export const deleteIssueRefRoute: Handler = (_req, params) => {
+export const deleteIssueRefRoute: Handler = async (_req, params) => {
   try {
-    const deleted = deleteIssueRefMapping(cleanString(params.id, "id", { required: true, max: 120 })!);
+    const deleted = await deleteIssueRefMappingAsync(cleanString(params.id, "id", { required: true, max: 120 })!);
     if (!deleted) return error("issue ref not found", 404);
     return json({ deleted });
   } catch (err) {

package/src/routes/orchestrator-bootstrap.ts

@@ -50,7 +50,7 @@ export const postOrchestratorBootstrap: Handler = async (req) => {
       "--yes",
     ];
     for (const entry of pathPrefix ?? []) args.push("--path-prefix", entry);
-    const command = ["bunx", `agent-relay-server@${version}`, ...args].map(quoteInstallCommandArg).join(" ");
+    const command = ["bunx", `@humwick/server@${version}`, ...args].map(quoteInstallCommandArg).join(" ");
     return json({
       command,
       relayUrl,

package/src/routes/orchestrator-host-registration.ts

@@ -4,7 +4,7 @@
 // upsert, and fanning the operator-facing events out as activity events — lives here.
 import { isRecord } from "@humwick/sdk";
 import type { HostHardware } from "@humwick/sdk";
-import { upsertHostFromRegistrationAsync, type HostRegistrationEvent } from "../db";
+import { conflictingHardwareFields, upsertHostFromRegistrationAsync, type HostRegistrationEvent } from "../db";
 import { auditEvent, cleanSafeNumber } from "./_shared";
 import { recordOrchestratorUtilization } from "./orchestrator-host-utilization";
 import { cleanString } from "../validation";
@@ -55,7 +55,7 @@ async function emitHostRegistrationEvents(events: readonly HostRegistrationEvent
         clientId: `host-identity-conflict-${ev.hostId}-${ev.orchestratorId}-${Date.now()}`,
         kind: "state",
         title: "Host identity conflict",
-        body: `${ev.hostname}: reported hardware differs from the stored fingerprint — bound anyway, kept first-seen (conflict:pending)`,
+        body: `${ev.hostname}: reported hardware differs from the stored fingerprint (${conflictingHardwareFields(ev.stored, ev.reported).join(", ")} changed) — bound anyway, kept first-seen (conflict:pending)`,
         meta: ev.hostId,
         icon: "ti-alert-triangle",
         view: "orchestrators",

package/src/routes/orchestrator-host-utilization.ts

@@ -141,6 +141,7 @@ export function cleanHostUtilizationSample(value: unknown, now: number): HostUti
   const swapUsedMb = nonNegative(value.swapUsedMb);
   const diskTotalMb = nonNegative(value.diskTotalMb);
   const diskFreeMb = nonNegative(value.diskFreeMb);
+  const diskPath = optionalString(value.diskPath, "utilization.diskPath", 200);
 
   return {
     at,
@@ -162,7 +163,7 @@ export function cleanHostUtilizationSample(value: unknown, now: number): HostUti
     ...(swapTotalMb !== undefined && swapUsedMb !== undefined && swapUsedMb <= swapTotalMb
       ? { swapTotalMb, swapUsedMb } : {}),
     ...(diskTotalMb !== undefined && diskFreeMb !== undefined && diskFreeMb <= diskTotalMb
-      ? { diskTotalMb, diskFreeMb } : {}),
+      ? { diskTotalMb, diskFreeMb, ...(diskPath ? { diskPath } : {}) } : {}),
     memPressure,
     agentCountThisDaemon,
     queuedSpawnsThisDaemon,
@@ -207,6 +208,7 @@ export function toMachineSample(sample: HostUtilizationSample): HostMachineSampl
     ...(sample.swapTotalMb !== undefined ? { swapTotalMb: sample.swapTotalMb } : {}),
     ...(sample.diskFreeMb !== undefined ? { diskFreeMb: sample.diskFreeMb } : {}),
     ...(sample.diskTotalMb !== undefined ? { diskTotalMb: sample.diskTotalMb } : {}),
+    ...(sample.diskPath ? { diskPath: sample.diskPath } : {}),
     memPressure: sample.memPressure,
   };
 }