@humwick/server 0.130.1 → 0.130.3

package/src/auth/password.ts

@@ -1,9 +1,10 @@
+import { createAuthIdentityAsync } from "../db/runtime-tail-async";
 // Password authentication provider (#389). The only built-in provider in Phase 1. Secrets are
 // hashed with scrypt (node:crypto — no dependency) and compared with `timingSafeEqual`, the same
 // constant-time primitive the token layer uses. The hash is stored in `auth_identities.secret_hash`
 // keyed by (provider="password", provider_subject=<username>).
 import { randomBytes, scrypt, timingSafeEqual } from "node:crypto";
-import { createAuthIdentity, getAuthIdentity, type AuthIdentity } from "../db/auth-identities.ts";
+import { getAuthIdentity, type AuthIdentity } from "../db/auth-identities.ts";
 import { isRecord } from "@humwick/sdk";
 import type { AuthProvider, AuthVerifyResult } from "./provider.ts";
 
@@ -98,13 +99,13 @@ export async function createPasswordIdentity(input: {
   password: string;
   metadata?: Record<string, unknown>;
 }): Promise<AuthIdentity> {
-  return createAuthIdentity({
+  return (await createAuthIdentityAsync({
     userId: input.userId,
     provider: PASSWORD_PROVIDER_ID,
     providerSubject: input.username,
     secretHash: await hashPassword(input.password),
     metadata: input.metadata,
-  });
+  }));
 }
 
 /** Parse `{ username, password }` from a login request body. */

package/src/auth/session-refresh.ts

@@ -31,7 +31,7 @@ export async function refreshUserSession(refreshToken: string, nowMs = Date.now(
       expiresAt: Math.min(nowMs + REFRESH_GRACE_MS, (resolved.payload.exp ?? Infinity) * 1000),
       result: (async () => {
         if (!(await revokeTokenAsync(jti, "rotation"))) return null;
-        const session = mintUserSession(resolved.user, resolved.payload.constraints?.sessionId);
+        const session = (await mintUserSession(resolved.user, resolved.payload.constraints?.sessionId));
         return { accessJti: session.accessJti, refreshJti: session.refreshJti };
       })(),
     };

package/src/auth/session.test-fixture.ts

@@ -4,7 +4,7 @@ import { mintUserSession } from "./session.ts";
 
 /** An `authorization` header carrying a fresh access token for `userId`. An unknown id models a
  *  session whose user no longer exists (it carries operator scopes). */
-export function sessionAuthHeader(userId: string): Record<string, string> {
+export async function sessionAuthHeader(userId: string): Promise<Record<string, string>> {
   const user = getUser(userId) ?? { id: userId, handle: userId, displayName: userId, role: "operator" as const, status: "active" as const, tenantId: "default", avatarArtifactId: null, avatarUrl: null, createdAt: 0, updatedAt: 0 };
-  return { authorization: `Bearer ${mintUserSession(user).accessToken}` };
+  return { authorization: `Bearer ${(await mintUserSession(user)).accessToken}` };
 }

package/src/auth/session.ts

@@ -5,8 +5,8 @@
 // `role` ("user"), so no machine-token path branches on it.
 import { userSinkId, userIdFromAddress, isHumanAgentId, type User, type UserRole } from "@humwick/sdk";
 import { randomUUID } from "node:crypto";
-import { revokeTokenAsync } from "../token-db-write.ts";
-import { createToken, liveTokenJtisForSession } from "../token-db.ts";
+import { createTokenAsync, revokeTokenAsync } from "../token-db-write.ts";
+import { liveTokenJtisForSession } from "../token-db.ts";
 import { verifyComponentToken } from "../security.ts";
 import { getUser } from "../db/users.ts";
 import { scopesForRole } from "./role-scopes";
@@ -50,25 +50,25 @@ export interface MintedSession {
  * SaaS seam (identity-only — enforces nothing). Both tokens share the `user:<id>` sub so a single
  * "sign out everywhere" revoke (by sub) kills the whole session family.
  */
-export function mintUserSession(user: User, sessionId: string = randomUUID()): MintedSession {
+export async function mintUserSession(user: User, sessionId: string = randomUUID()): Promise<MintedSession> {
   const sub = userSinkId(user.id);
   const constraints = { sessionId, ...(user.tenantId ? { tenantId: user.tenantId } : {}) };
-  const access = createToken({
+  const access = (await createTokenAsync({
     sub,
     role: USER_TOKEN_ROLE,
     scope: scopesForUserRole(user.role),
     constraints,
     ttlSeconds: ACCESS_TTL_SECONDS,
     createdBy: `auth:login:${user.id}`,
-  });
-  const refresh = createToken({
+  }));
+  const refresh = (await createTokenAsync({
     sub,
     role: USER_TOKEN_ROLE,
     scope: [REFRESH_SCOPE],
     constraints,
     ttlSeconds: REFRESH_TTL_SECONDS,
     createdBy: `auth:refresh:${user.id}`,
-  });
+  }));
   return {
     accessToken: access.token,
     refreshToken: refresh.token,

package/src/automations/crud.ts

@@ -1,3 +1,4 @@
+import { insertAutomationAsync, updateAutomationNormalizedAsync } from "./write-async";
 import { randomUUID } from "node:crypto";
 import { getOrchestrator, ValidationError } from "../db";
 import { AUTOMATION_KIND } from "./constants";
@@ -6,63 +7,18 @@ import { db, ensureAutomationTables, getAutomation } from "./storage";
 import { normalizeCreateInput, normalizeCreateInputAsync } from "./validation";
 import type { Automation, CreateAutomationInput, UpdateAutomationInput } from "../types";
 
-export function createAutomation(input: CreateAutomationInput, now = Date.now()): Automation {
-  ensureAutomationTables();
-  const normalized = normalizeCreateInput(input);
-  return insertAutomation(normalized, now);
+export function createAutomation(input: CreateAutomationInput, now = Date.now()): Promise<Automation> {
+  return createAutomationAsync(input, now);
 }
 
 /** HTTP request path: catalog validation happens through the reader pool before this write. */
 export async function createAutomationAsync(input: CreateAutomationInput, now = Date.now()): Promise<Automation> {
   ensureAutomationTables();
-  return insertAutomation(await normalizeCreateInputAsync(input), now);
-}
-
-function insertAutomation(normalized: ReturnType<typeof normalizeCreateInput>, now: number): Automation {
-  if (!getOrchestrator(normalized.orchestratorId)) throw new ValidationError(`orchestrator ${normalized.orchestratorId} not found`);
-  const id = randomUUID();
-  const nextRunAt = normalized.enabled ? nextScheduledAt(normalized.schedule, normalized.timezone, now) : undefined;
-  db().query(`
-    INSERT INTO automations (id, kind, name, description, enabled, schedule, timezone, next_run_at, catch_up_policy, concurrency_policy, orchestrator_id, target_policy, task_template, created_at, updated_at)
-    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-  `).run(
-    id,
-    AUTOMATION_KIND,
-    normalized.name,
-    normalized.description ?? null,
-    normalized.enabled ? 1 : 0,
-    normalized.schedule,
-    normalized.timezone,
-    nextRunAt ?? null,
-    normalized.catchUpPolicy,
-    normalized.concurrencyPolicy,
-    normalized.orchestratorId,
-    JSON.stringify(normalized.targetPolicy),
-    JSON.stringify(normalized.taskTemplate),
-    now,
-    now,
-  );
-  return getAutomation(id)!;
+  return insertAutomationAsync(await normalizeCreateInputAsync(input), now);
 }
 
-export function updateAutomation(id: string, input: UpdateAutomationInput, now = Date.now()): Automation | null {
-  ensureAutomationTables();
-  const existing = getAutomation(id);
-  if (!existing) return null;
-  const next: CreateAutomationInput = {
-    kind: AUTOMATION_KIND,
-    name: input.name ?? existing.name,
-    description: input.description === null ? undefined : input.description ?? existing.description,
-    enabled: input.enabled ?? existing.enabled,
-    schedule: input.schedule ?? existing.schedule,
-    timezone: input.timezone ?? existing.timezone,
-    catchUpPolicy: input.catchUpPolicy ?? existing.catchUpPolicy,
-    concurrencyPolicy: input.concurrencyPolicy ?? existing.concurrencyPolicy,
-    orchestratorId: input.orchestratorId ?? existing.orchestratorId,
-    targetPolicy: input.targetPolicy ?? existing.targetPolicy,
-    taskTemplate: input.taskTemplate ?? existing.taskTemplate,
-  };
-  return updateAutomationNormalized(id, normalizeCreateInput(next), now);
+export function updateAutomation(id: string, input: UpdateAutomationInput, now = Date.now()): Promise<Automation | null> {
+  return updateAutomationAsync(id, input, now);
 }
 
 /** HTTP request path: catalog validation happens through the reader pool before this write. */
@@ -78,7 +34,7 @@ export async function updateAutomationAsync(id: string, input: UpdateAutomationI
   if (!current || JSON.stringify(current) !== JSON.stringify(existing)) {
     throw new ValidationError("automation changed or was deleted during catalog validation");
   }
-  return updateAutomationNormalized(id, normalized, now);
+  return updateAutomationNormalizedAsync(id, normalized, existing, now);
 }
 
 function automationUpdateInput(existing: Automation, input: UpdateAutomationInput): CreateAutomationInput {
@@ -97,33 +53,4 @@ function automationUpdateInput(existing: Automation, input: UpdateAutomationInpu
   };
 }
 
-function updateAutomationNormalized(id: string, normalized: ReturnType<typeof normalizeCreateInput>, now: number): Automation {
-  if (!getOrchestrator(normalized.orchestratorId)) throw new ValidationError(`orchestrator ${normalized.orchestratorId} not found`);
-  const nextRunAt = normalized.enabled ? nextScheduledAt(normalized.schedule, normalized.timezone, now) : undefined;
-  db().query(`
-    UPDATE automations
-    SET name = ?, description = ?, enabled = ?, schedule = ?, timezone = ?, next_run_at = ?,
-        catch_up_policy = ?, concurrency_policy = ?, orchestrator_id = ?, target_policy = ?, task_template = ?, updated_at = ?
-    WHERE id = ?
-  `).run(
-    normalized.name,
-    normalized.description ?? null,
-    normalized.enabled ? 1 : 0,
-    normalized.schedule,
-    normalized.timezone,
-    nextRunAt ?? null,
-    normalized.catchUpPolicy,
-    normalized.concurrencyPolicy,
-    normalized.orchestratorId,
-    JSON.stringify(normalized.targetPolicy),
-    JSON.stringify(normalized.taskTemplate),
-    now,
-    id,
-  );
-  return getAutomation(id)!;
-}
-
-export function deleteAutomation(id: string): boolean {
-  ensureAutomationTables();
-  return db().query("DELETE FROM automations WHERE id = ?").run(id).changes > 0;
-}
+export { deleteAutomationAsync } from "./write-async";

package/src/automations/dispatch.ts

@@ -1,11 +1,13 @@
+import { rescheduleAutomationAsync as persistNextRunAsync, updateRunAsync, insertRunAsync, enqueueAutomationRunAsync, cancelActiveRunsAsync, admitAutomationRunAsync } from "./write-async";
+import { ingestIntegrationEventAsync } from "../db/runtime-tail-async";
+import { runnerRuntimeTokenEnvAsync, SYSTEM_LAUNCH } from "../runtime-tokens";
+import { createCommandAsync, prepareCommandWriteAsync, submitPreparedCommandAsync } from "../commands-write";
 import { isHumanAgentId, errMessage } from "@humwick/sdk";
 import { emitAutomationRunCosmosEventAsync } from "../cosmos-events";
-import { createCommand } from "../commands-db";
-import { prepareCommandWriteAsync } from "../commands-write";
+
 import { getAgentProfile, getSpawnPolicy, resolveAgentProfileKey } from "../config-store";
-import { effectiveProviderCatalogListAsync, getOrchestrator, ingestIntegrationEvent, listAgents, ValidationError, withResolvedProvisioningAsync } from "../db";
+import { effectiveProviderCatalogListAsync, getOrchestrator, listAgents, ValidationError, withResolvedProvisioningAsync } from "../db";
 import { composeProfileSpawnInstructionsAsync } from "../project-instructions";
-import { SYSTEM_LAUNCH, runnerRuntimeTokenEnv } from "../runtime-tokens";
 import { generateSpawnAgentId } from "../services/spawn-identity";
 import { applyDefaultSharedMcp } from "../shared-mcp";
 import { resolveHostLaunchMode } from "../launch-mode";
@@ -14,22 +16,8 @@ import { systemTagsForSpawn } from "../agent-system-tags";
 import { hostProviderRefusal, isProviderDisabledOnHost } from "../host-provider-store";
 import { nextScheduledAt, formatRunDate } from "./cron";
 import { alertPrecheckAutomationFailure, precheckTaskSection, startAutomationPrecheck } from "./precheck";
-import {
-  cancelActiveRuns,
-  db,
-  enqueueAutomationRun,
-  ensureAutomationTables,
-  getAutomation,
-  getAutomationRun,
-  hasActiveRun,
-  insertRun,
-  listAutomations,
-  listDispatchableQueuedRuns,
-  rowToAutomation,
-  rowToAutomationRun,
-  updateRun,
-  rescheduleAutomation as persistNextRun,
-} from "./storage";
+import { ensureAutomationTables, getAutomation, getAutomationRun, hasActiveRun, listAutomations } from "./storage";
+import { listDispatchableQueuedRunsAsync, listDueAutomationsAsync } from "./read-async";
 import type { AutomationDispatchResult } from "./types";
 import type { AgentCard, Automation, AutomationTargetPolicy, ManagedAgent, Orchestrator } from "../types";
 
@@ -53,24 +41,13 @@ export { runDueAutomationsAsync as runDueAutomations, runAutomationNowAsync as r
 export async function runDueAutomationsAsync(now = Date.now()): Promise<AutomationDispatchResult[]> {
   ensureAutomationTables();
   const results: AutomationDispatchResult[] = [];
-  for (const run of listDispatchableQueuedRuns()) {
-    const automation = getAutomation(run.automationId);
-    if (!automation || hasActiveRun(automation.id)) continue;
-    results.push(await dispatchAutomationRunAsync(automation, run, now));
+  for (const run of await listDispatchableQueuedRunsAsync()) {
+    const admitted = await admitAutomationRunAsync({ automationId: run.automationId, queuedRunId: run.id, now });
+    if (admitted) results.push(await dispatchAutomationRunAsync(admitted.automation, admitted.run, now));
   }
-  const due = (db().query("SELECT * FROM automations WHERE enabled = 1 AND next_run_at IS NOT NULL AND next_run_at <= ? ORDER BY next_run_at ASC LIMIT 25").all(now) as any[]).map(rowToAutomation);
-  for (const automation of due) {
-    if (hasActiveRun(automation.id)) {
-      if (automation.concurrencyPolicy === "replace") cancelActiveRuns(automation.id, now, "Replaced by newer scheduled run");
-      else {
-        if (automation.concurrencyPolicy === "queue") enqueueAutomationRun(automation, automation.nextRunAt ?? now, now);
-        rescheduleAutomation(automation, now);
-        continue;
-      }
-    }
-    const run = insertRun(automation, automation.nextRunAt ?? now, now);
-    results.push(await dispatchAutomationRunAsync(automation, run, now));
-    rescheduleAutomation(automation, now);
+  for (const automation of await listDueAutomationsAsync(now)) {
+    const admitted = await admitAutomationRunAsync({ automationId: automation.id, now });
+    if (admitted) results.push(await dispatchAutomationRunAsync(admitted.automation, admitted.run, now));
   }
   return results;
 }
@@ -78,10 +55,8 @@ export async function runDueAutomationsAsync(now = Date.now()): Promise<Automati
 /** HTTP-triggered twin: on-demand spawn composition may canonicalize a caller cwd. */
 export async function runAutomationNowAsync(id: string, now = Date.now()): Promise<AutomationDispatchResult | null> {
   ensureAutomationTables();
-  const automation = getAutomation(id);
-  if (!automation) return null;
-  if (hasActiveRun(automation.id)) throw new ValidationError("automation already has an active run");
-  return dispatchAutomationRunAsync(automation, insertRun(automation, now, now), now);
+  const admitted = await admitAutomationRunAsync({ automationId: id, manual: true, now });
+  return admitted ? dispatchAutomationRunAsync(admitted.automation, admitted.run, now) : null;
 }
 
 async function dispatchAutomationRunAsync(
@@ -89,24 +64,24 @@ async function dispatchAutomationRunAsync(
   run: ReturnType<typeof getAutomationRun> & NonNullable<unknown>,
   now: number,
 ): Promise<AutomationDispatchResult> {
-  updateRun(run.id, { status: "dispatching" }, now);
+  (await updateRunAsync(run.id, { status: "dispatching" }, now));
   try {
     await emitAutomationDispatchCosmosEventAsync(automation, run.id);
     await afterAsyncAutomationCosmosForTests?.();
     assertAutomationUnchangedBeforeAsyncSpawn(automation);
     const orchestrator = requireOnlineOrchestrator(automation.orchestratorId);
-    const prechecking = startAutomationPrecheck(automation, run, orchestrator, now);
+    const prechecking = (await startAutomationPrecheck(automation, run, orchestrator, now));
     if (prechecking) return prechecking;
     if (automation.targetPolicy.mode === "existing_agent") {
       const agent = resolveExistingAgent(automation.targetPolicy, orchestrator);
       if (!agent && automation.targetPolicy.ifNoMatch !== "spawn") throw new ValidationError("no matching managed agent for automation");
-      if (agent) return createRunTask(automation, run, durableExistingAgentTarget(automation.targetPolicy), now, { targetMode: "existing_agent", resolvedAgentId: agent.id });
+      if (agent) return (await createRunTask(automation, run, durableExistingAgentTarget(automation.targetPolicy), now, { targetMode: "existing_agent", resolvedAgentId: agent.id }));
       return await dispatchOnDemandAutomationAsync(automation, run, orchestrator, { mode: "on_demand_agent", provider: orchestrator.providers[0] ?? "codex", keepAlive: false }, now);
     }
     return await dispatchOnDemandAutomationAsync(automation, run, orchestrator, automation.targetPolicy, now);
   } catch (e) {
-    updateRun(run.id, { status: "failed", finishedAt: now, error: errMessage(e) }, now);
-    alertPrecheckAutomationFailure(automation, run.id, errMessage(e));
+    (await updateRunAsync(run.id, { status: "failed", finishedAt: now, error: errMessage(e) }, now));
+    (await alertPrecheckAutomationFailure(automation, run.id, errMessage(e)));
     return { automation, run: getAutomationRun(run.id)! };
   }
 }
@@ -156,13 +131,13 @@ async function dispatchOnDemandAutomationAsync(
       ...(composed.systemPromptAppend ? { systemPromptAppend: composed.systemPromptAppend } : {}),
       ...(composed.relayInjectionEvents.length ? { relayInjectionEvents: composed.relayInjectionEvents } : {}),
       ...(composed.memorySeam ? { memorySeam: composed.memorySeam } : {}),
-      env: runnerRuntimeTokenEnv({ authority: SYSTEM_LAUNCH, agentId, orchestratorId: orchestrator.id, cwd, provider: policy.provider, label, createdBy: "automation", profile: policy.profile }),
+      env: (await runnerRuntimeTokenEnvAsync({ authority: SYSTEM_LAUNCH, agentId, orchestratorId: orchestrator.id, cwd, provider: policy.provider, label, createdBy: "automation", profile: policy.profile })),
     }),
   }, {}, "system");
   assertAutomationUnchangedBeforeAsyncSpawn(automation);
-  const command = createCommand(prepared.input, prepared.options, prepared.id);
-  const result = createRunTask(automation, run, `label:${label}`, now, { targetMode: "on_demand_agent", provider: policy.provider, label, profile: policy.profile, workspaceMode: policy.workspaceMode ?? "inherit" });
-  updateRun(run.id, { status: "waiting_agent", meta: { ...result.run.meta, onDemandLabel: label, spawnCommandId: command.id, workspaceMode: policy.workspaceMode ?? "inherit" } }, now);
+  const command = (await submitPreparedCommandAsync(prepared));
+  const result = (await createRunTask(automation, run, `label:${label}`, now, { targetMode: "on_demand_agent", provider: policy.provider, label, profile: policy.profile, workspaceMode: policy.workspaceMode ?? "inherit" }));
+  (await updateRunAsync(run.id, { status: "waiting_agent", meta: { ...result.run.meta, onDemandLabel: label, spawnCommandId: command.id, workspaceMode: policy.workspaceMode ?? "inherit" } }, now));
   return { ...result, run: getAutomationRun(run.id)!, command };
 }
 
@@ -173,13 +148,13 @@ function assertAutomationUnchangedBeforeAsyncSpawn(automation: Automation): void
   }
 }
 
-function createRunTask(
+async function createRunTask(
   automation: Automation,
   run: ReturnType<typeof getAutomationRun> & NonNullable<unknown>,
   target: string,
   now: number,
   meta: Record<string, unknown>,
-): AutomationDispatchResult {
+): Promise<AutomationDispatchResult> {
   const template = automation.taskTemplate;
   // Inject the authoritative dispatch-time run date (#480). A long-lived managed agent's
   // session-start day awareness goes stale across midnight, so it can't be trusted to derive
@@ -193,7 +168,7 @@ function createRunTask(
   const usesRunDateToken = /\{\{\s*(runDate|runWeekday|runDateLine)\s*\}\}/.test(`${template.title}\n${template.body}`);
   const title = fill(template.title);
   const body = (usesRunDateToken ? fill(template.body) : `Run date: ${runDate.line}.\n\n${template.body}`) + precheckTaskSection(run);
-  const result = ingestIntegrationEvent({
+  const result = (await ingestIntegrationEventAsync({
     source: "automation",
     type: "scheduled_task",
     severity: template.severity ?? "info",
@@ -218,8 +193,8 @@ function createRunTask(
       runTimezone: automation.timezone,
       ...meta,
     },
-  }, "automation");
-  updateRun(run.id, {
+  }, "automation"));
+  (await updateRunAsync(run.id, {
     status: meta.targetMode === "on_demand_agent" ? "waiting_agent" : "running",
     startedAt: now,
     targetAgentId: typeof meta.resolvedAgentId === "string"
@@ -230,7 +205,7 @@ function createRunTask(
     taskId: result.task.id,
     messageId: result.message?.id,
     meta: { ...run.meta, ...meta },
-  }, now);
+  }, now));
   return { automation, run: getAutomationRun(run.id)!, task: result.task, message: result.message };
 }
 
@@ -242,9 +217,9 @@ function durableExistingAgentTarget(policy: Extract<AutomationTargetPolicy, { mo
   throw new ValidationError("existing-agent automation target selector must include a label or capability");
 }
 
-function rescheduleAutomation(automation: Automation, now: number): void {
+async function rescheduleAutomation(automation: Automation, now: number): Promise<void> {
   const next = automation.enabled ? nextScheduledAt(automation.schedule, automation.timezone, now) : undefined;
-  persistNextRun(automation, next, now);
+  (await persistNextRunAsync(automation, next, now));
 }
 
 function requireOnlineOrchestrator(orchestratorId: string): Orchestrator {

package/src/automations/index.ts

@@ -1,5 +1,5 @@
 export type { AutomationDispatchResult, AutomationReconcileResult } from "./types";
-export { createAutomation, createAutomationAsync, deleteAutomation, updateAutomation, updateAutomationAsync } from "./crud";
+export { createAutomation, createAutomationAsync, deleteAutomationAsync, updateAutomation, updateAutomationAsync } from "./crud";
 export { getAutomation, listAutomationRuns, listAutomations } from "./storage";
 export { runAutomationNow, runAutomationNowAsync, runDueAutomations, runDueAutomationsAsync } from "./dispatch";
 export { reconcileAutomationRuns } from "./reconcile";

package/src/automations/persistence.ts

@@ -0,0 +1,65 @@
+import { randomUUID } from "node:crypto";
+import { getOrchestrator, ValidationError } from "../db";
+import { AUTOMATION_KIND } from "./constants";
+import { nextScheduledAt } from "./cron";
+import { db, ensureAutomationTables, getAutomation } from "./storage";
+import type { normalizeCreateInput } from "./validation";
+import type { Automation } from "../types";
+
+export function insertAutomation(normalized: ReturnType<typeof normalizeCreateInput>, now: number): Automation {
+  if (!getOrchestrator(normalized.orchestratorId)) throw new ValidationError(`orchestrator ${normalized.orchestratorId} not found`);
+  const id = randomUUID();
+  const nextRunAt = normalized.enabled ? nextScheduledAt(normalized.schedule, normalized.timezone, now) : undefined;
+  db().query(`
+    INSERT INTO automations (id, kind, name, description, enabled, schedule, timezone, next_run_at, catch_up_policy, concurrency_policy, orchestrator_id, target_policy, task_template, created_at, updated_at)
+    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+  `).run(
+    id,
+    AUTOMATION_KIND,
+    normalized.name,
+    normalized.description ?? null,
+    normalized.enabled ? 1 : 0,
+    normalized.schedule,
+    normalized.timezone,
+    nextRunAt ?? null,
+    normalized.catchUpPolicy,
+    normalized.concurrencyPolicy,
+    normalized.orchestratorId,
+    JSON.stringify(normalized.targetPolicy),
+    JSON.stringify(normalized.taskTemplate),
+    now,
+    now,
+  );
+  return getAutomation(id)!;
+}
+
+export function updateAutomationNormalized(id: string, normalized: ReturnType<typeof normalizeCreateInput>, now: number): Automation {
+  if (!getOrchestrator(normalized.orchestratorId)) throw new ValidationError(`orchestrator ${normalized.orchestratorId} not found`);
+  const nextRunAt = normalized.enabled ? nextScheduledAt(normalized.schedule, normalized.timezone, now) : undefined;
+  db().query(`
+    UPDATE automations
+    SET name = ?, description = ?, enabled = ?, schedule = ?, timezone = ?, next_run_at = ?,
+        catch_up_policy = ?, concurrency_policy = ?, orchestrator_id = ?, target_policy = ?, task_template = ?, updated_at = ?
+    WHERE id = ?
+  `).run(
+    normalized.name,
+    normalized.description ?? null,
+    normalized.enabled ? 1 : 0,
+    normalized.schedule,
+    normalized.timezone,
+    nextRunAt ?? null,
+    normalized.catchUpPolicy,
+    normalized.concurrencyPolicy,
+    normalized.orchestratorId,
+    JSON.stringify(normalized.targetPolicy),
+    JSON.stringify(normalized.taskTemplate),
+    now,
+    id,
+  );
+  return getAutomation(id)!;
+}
+
+export function deleteAutomation(id: string): boolean {
+  ensureAutomationTables();
+  return db().query("DELETE FROM automations WHERE id = ?").run(id).changes > 0;
+}

package/src/automations/precheck.ts

@@ -1,15 +1,17 @@
+import { updateRunAsync } from "./write-async";
+import { createCommandAsync, getCommandAsync } from "../commands-write";
 // #3175 — an automation precheck is a plain script run on the automation's host before any agent is
 // involved, so a quiet scheduled run costs no model quota. It reuses the `scheduler.command` executor
 // (bounded, process-group reaped, output capped); only exit {@link AUTOMATION_PRECHECK_HITS_EXIT_CODE}
 // re-queues the run for its normal target dispatch.
 import { AUTOMATION_PRECHECK_HITS_EXIT_CODE, OUTPUT_WITHHELD, RELAY_RUN_OUTPUT_MASKED_CAPABILITY } from "@humwick/sdk";
-import { createCommand } from "../commands-db";
-import { getCommandAsync } from "../commands-write";
+
 import { isTerminalCommandStatus } from "../db/command-terminal-status";
 import { raiseOperatorAlarm } from "../operator-alarm";
 import { notifyWorkspaceHumanEscalation } from "../workspace-human-escalation";
 import { DEFAULT_PRECHECK_TIMEOUT_MS } from "./constants";
-import { getAutomation, getAutomationRun, listPendingPrecheckRuns, updateRun } from "./storage";
+import { getAutomation, getAutomationRun } from "./storage";
+import { listPendingPrecheckRunsAsync } from "./read-async";
 import type { AutomationDispatchResult, AutomationReconcileResult } from "./types";
 import type { Automation, AutomationRun, Command, Orchestrator } from "../types";
 
@@ -31,7 +33,7 @@ export function runPrecheck(run: AutomationRun): AutomationRunPrecheck | undefin
 }
 
 /** Starts the precheck when the automation has one and this run has not passed it yet. */
-export function startAutomationPrecheck(automation: Automation, run: AutomationRun, orchestrator: Orchestrator, now: number): AutomationDispatchResult | undefined {
+export async function startAutomationPrecheck(automation: Automation, run: AutomationRun, orchestrator: Orchestrator, now: number): Promise<AutomationDispatchResult | undefined> {
   const precheck = automation.targetPolicy.precheck;
   if (!precheck || runPrecheck(run)?.status === "hits") return undefined;
   // An executor that does not mask would store raw script output in the command, run and Task, so refuse it.
@@ -40,7 +42,7 @@ export function startAutomationPrecheck(automation: Automation, run: AutomationR
   }
   const timeoutMs = precheck.timeoutMs ?? DEFAULT_PRECHECK_TIMEOUT_MS;
   const policyCwd = automation.targetPolicy.mode === "on_demand_agent" ? automation.targetPolicy.cwd : undefined;
-  const command = createCommand({
+  const command = (await createCommandAsync({
     type: "scheduler.command",
     source: "automation",
     target: orchestrator.agentId,
@@ -56,16 +58,16 @@ export function startAutomationPrecheck(automation: Automation, run: AutomationR
       automationId: automation.id,
       automationRunId: run.id,
     },
-  });
+  }));
   const state: AutomationRunPrecheck = { commandId: command.id, status: "running" };
-  updateRun(run.id, { status: "running", startedAt: now, meta: { ...run.meta, precheck: state } }, now);
+  (await updateRunAsync(run.id, { status: "running", startedAt: now, meta: { ...run.meta, precheck: state } }, now));
   return { automation, run: getAutomationRun(run.id)!, command };
 }
 
 /** Settles finished prechecks: quiet runs succeed with no agent, hits re-queue for target dispatch. */
 export async function settleAutomationPrechecks(now: number): Promise<AutomationReconcileResult[]> {
   const results: AutomationReconcileResult[] = [];
-  for (const run of listPendingPrecheckRuns()) {
+  for (const run of await listPendingPrecheckRunsAsync()) {
     const state = runPrecheck(run)!;
     const command = await getCommandAsync(state.commandId);
     if (command && !isTerminalCommandStatus(command.status)) continue;
@@ -74,15 +76,15 @@ export async function settleAutomationPrechecks(now: number): Promise<Automation
     const meta = { ...run.meta, precheck };
     const automation = getAutomation(run.automationId);
     if (!automation) {
-      updateRun(run.id, { status: "failed", finishedAt: now, error: "automation deleted while its precheck ran", meta }, now);
+      (await updateRunAsync(run.id, { status: "failed", finishedAt: now, error: "automation deleted while its precheck ran", meta }, now));
     } else if (outcome.status === "hits") {
       // `scheduled` hands the run to the queued-run dispatch, which skips the precheck on `hits`.
-      updateRun(run.id, { status: "scheduled", meta }, now);
+      (await updateRunAsync(run.id, { status: "scheduled", meta }, now));
     } else if (outcome.status === "quiet") {
-      updateRun(run.id, { status: "succeeded", finishedAt: now, result: { precheck: "quiet", exitCode: 0 }, meta }, now);
+      (await updateRunAsync(run.id, { status: "succeeded", finishedAt: now, result: { precheck: "quiet", exitCode: 0 }, meta }, now));
     } else {
-      updateRun(run.id, { status: "failed", finishedAt: now, error: outcome.error, meta }, now);
-      alertPrecheckAutomationFailure(automation, run.id, outcome.error!);
+      (await updateRunAsync(run.id, { status: "failed", finishedAt: now, error: outcome.error, meta }, now));
+      (await alertPrecheckAutomationFailure(automation, run.id, outcome.error!));
     }
     results.push({ run: getAutomationRun(run.id)! });
   }
@@ -107,12 +109,12 @@ function precheckOutcome(command: Command | null): { status: AutomationRunPreche
 }
 
 /** A precheck automation that stops running is a monitoring gap, so it pages the operator once per run. */
-export function alertPrecheckAutomationFailure(automation: Automation, runId: string, error: string): void {
+export async function alertPrecheckAutomationFailure(automation: Automation, runId: string, error: string): Promise<void> {
   if (!automation.targetPolicy.precheck) return;
   const subject = `Automation precheck failed: ${automation.name}`;
   const detail = `Run ${runId} on ${automation.orchestratorId}: ${error}`;
-  raiseOperatorAlarm({ clientId: `automation-precheck-failed:${runId}`, source: "automation", subject, detail, view: "automation", metadata: { automationId: automation.id, automationRunId: runId } });
-  const human = notifyWorkspaceHumanEscalation({ subject, body: detail, priority: "high", tags: ["agent-relay", "automation"], source: "automation", idempotencyKey: `automation-precheck-failed:${runId}`, payload: { automationId: automation.id, automationRunId: runId } });
+  (await raiseOperatorAlarm({ clientId: `automation-precheck-failed:${runId}`, source: "automation", subject, detail, view: "automation", metadata: { automationId: automation.id, automationRunId: runId } }));
+  const human = (await notifyWorkspaceHumanEscalation({ subject, body: detail, priority: "high", tags: ["agent-relay", "automation"], source: "automation", idempotencyKey: `automation-precheck-failed:${runId}`, payload: { automationId: automation.id, automationRunId: runId } }));
   if (!human.accepted) console.warn(`[automations] precheck failure for ${automation.id} paged nobody: ${human.reason ?? "unknown reason"}`);
 }
 

package/src/automations/read-async.ts

@@ -0,0 +1,11 @@
+// #3799 — async facades over the automation reader ops; the main thread never scans automation tables.
+import { getGateway } from "../db/gateway";
+import type { Automation, AutomationRun } from "../types";
+
+const read = <T>(op: string, args: unknown = {}): Promise<T> => getGateway().read(op as never, args as never) as unknown as Promise<T>;
+
+export const listAutomationRunsAsync = (filter: { automationId?: string; status?: string; limit?: number } = {}) => read<AutomationRun[]>("automations.listRuns", filter);
+export const listPendingPrecheckRunsAsync = () => read<AutomationRun[]>("automations.pendingPrecheckRuns");
+export const listReconcilableRunsAsync = () => read<AutomationRun[]>("automations.reconcilableRuns");
+export const listDispatchableQueuedRunsAsync = () => read<AutomationRun[]>("automations.dispatchableQueuedRuns");
+export const listDueAutomationsAsync = (now: number) => read<Automation[]>("automations.dueAutomations", { now });