@osolmaz/pi-workflows 0.14.0 → 0.15.1

package/dist/workflows/tool-input.js

@@ -6,10 +6,10 @@ const workflowSchema = Type.String({
     description: "Discovered workflow name or workflow file path; required when action is start",
 });
 const inputSchema = Type.Unknown({
-    description: "Checkpoint answer for answer; optional structured workflow input for start",
+    description: "Ordinary checkpoint answer for answer; protected human decisions require a human channel; optional structured workflow input for start",
 });
 const runIdSchema = Type.String({
-    description: "Run id; required for restart and optional for status, cancel, and answer",
+    description: "Run id; optional for status, cancel, and answer",
 });
 const stepSchema = Type.String({
     description: "Workflow step id; required when action is update or submit",
@@ -25,29 +25,6 @@ const updateSchema = Type.Object({
 const outputSchema = Type.Unknown({
     description: "Step output matching the expected shape; required when action is submit",
 });
-const scopeIdSchema = Type.String({
-    description: "Settings scope id; defaults to the active node scope",
-});
-const expectedChangeNumberSchema = Type.Integer({
-    minimum: 0,
-    description: "Optional settings change number for an atomic compare-and-change",
-});
-const patchOperationSchema = Type.Object({
-    op: Type.String({ enum: ["add", "remove", "replace", "move", "copy", "test"] }),
-    path: Type.String(),
-    from: Type.Optional(Type.String()),
-    value: Type.Optional(Type.Unknown()),
-}, noExtraProperties);
-const patchSchema = Type.Array(patchOperationSchema, {
-    maxItems: 256,
-    description: "RFC 6902 JSON Patch operations",
-});
-const followUpPromptSchema = Type.String({
-    minLength: 1,
-    maxLength: 65536,
-    description: "Normal user prompt to send after successful workflow completion",
-});
-const followUpIdSchema = Type.String({ description: "Queued follow-up id" });
 export const WorkflowActionSchemas = {
     list: Type.Object({ action: Type.Literal("list"), offset: Type.Optional(offsetSchema) }, noExtraProperties),
     start: Type.Object({
@@ -55,10 +32,6 @@ export const WorkflowActionSchemas = {
         workflow: workflowSchema,
         input: Type.Optional(inputSchema),
     }, noExtraProperties),
-    restart: Type.Object({
-        action: Type.Literal("restart"),
-        runId: runIdSchema,
-    }, noExtraProperties),
     status: Type.Object({ action: Type.Literal("status"), runId: Type.Optional(runIdSchema) }, noExtraProperties),
     pause: Type.Object({ action: Type.Literal("pause") }, noExtraProperties),
     resume: Type.Object({ action: Type.Literal("resume") }, noExtraProperties),
@@ -68,23 +41,6 @@ export const WorkflowActionSchemas = {
         input: inputSchema,
         runId: Type.Optional(runIdSchema),
     }, noExtraProperties),
-    "change-settings": Type.Object({
-        action: Type.Literal("change-settings"),
-        runId: Type.Optional(runIdSchema),
-        scopeId: Type.Optional(scopeIdSchema),
-        expectedChangeNumber: Type.Optional(expectedChangeNumberSchema),
-        patch: patchSchema,
-    }, noExtraProperties),
-    "queue-follow-up": Type.Object({
-        action: Type.Literal("queue-follow-up"),
-        runId: Type.Optional(runIdSchema),
-        prompt: followUpPromptSchema,
-    }, noExtraProperties),
-    "remove-follow-up": Type.Object({
-        action: Type.Literal("remove-follow-up"),
-        runId: Type.Optional(runIdSchema),
-        followUpId: followUpIdSchema,
-    }, noExtraProperties),
     update: Type.Object({
         action: Type.Literal("update"),
         step: stepSchema,
@@ -107,15 +63,11 @@ export const WorkflowSubmissionToolParameters = providerObjectSchema(Object.valu
 const workflowInputParsers = {
     list: (value) => parseToolInput(WorkflowActionSchemas.list, value, "workflow"),
     start: (value) => parseToolInput(WorkflowActionSchemas.start, value, "workflow"),
-    restart: (value) => parseToolInput(WorkflowActionSchemas.restart, value, "workflow"),
     status: (value) => parseToolInput(WorkflowActionSchemas.status, value, "workflow"),
     pause: (value) => parseToolInput(WorkflowActionSchemas.pause, value, "workflow"),
     resume: (value) => parseToolInput(WorkflowActionSchemas.resume, value, "workflow"),
     cancel: (value) => parseToolInput(WorkflowActionSchemas.cancel, value, "workflow"),
     answer: (value) => parseToolInput(WorkflowActionSchemas.answer, value, "workflow"),
-    "change-settings": (value) => parseToolInput(WorkflowActionSchemas["change-settings"], value, "workflow"),
-    "queue-follow-up": (value) => parseToolInput(WorkflowActionSchemas["queue-follow-up"], value, "workflow"),
-    "remove-follow-up": (value) => parseToolInput(WorkflowActionSchemas["remove-follow-up"], value, "workflow"),
     update: (value) => parseToolInput(WorkflowActionSchemas.update, value, "workflow"),
     submit: (value) => parseToolInput(WorkflowActionSchemas.submit, value, "workflow"),
 };

package/dist/workflows/tool-input.js.map

@@ -1 +1 @@
-{"version":3,"file":"tool-input.js","sourceRoot":"","sources":["../../src/workflows/tool-input.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAA6D,MAAM,SAAS,CAAC;AAC1F,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAElD,MAAM,iBAAiB,GAAG,EAAE,oBAAoB,EAAE,KAAK,EAAW,CAAC;AAEnE,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,WAAW,EAAE,sBAAsB,EAAE,CAAC,CAAC;AACvF,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,CAAC;IACjC,WAAW,EAAE,+EAA+E;CAC7F,CAAC,CAAC;AACH,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC;IAC/B,WAAW,EAAE,4EAA4E;CAC1F,CAAC,CAAC;AACH,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC;IAC9B,WAAW,EAAE,0EAA0E;CACxF,CAAC,CAAC;AACH,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC;IAC7B,WAAW,EAAE,4DAA4D;CAC1E,CAAC,CAAC;AACH,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC;IAChC,WAAW,EAAE,+DAA+D;CAC7E,CAAC,CAAC;AACH,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAC9B;IACE,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE;IACnB,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE;IAClB,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;CACjD,EACD,iBAAiB,CAClB,CAAC;AACF,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC;IAChC,WAAW,EAAE,yEAAyE;CACvF,CAAC,CAAC;AACH,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC;IAChC,WAAW,EAAE,sDAAsD;CACpE,CAAC,CAAC;AACH,MAAM,0BAA0B,GAAG,IAAI,CAAC,OAAO,CAAC;IAC9C,OAAO,EAAE,CAAC;IACV,WAAW,EAAE,kEAAkE;CAChF,CAAC,CAAC;AACH,MAAM,oBAAoB,GAAG,IAAI,CAAC,MAAM,CACtC;IACE,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;IAC/E,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE;IACnB,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;IAClC,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;CACrC,EACD,iBAAiB,CAClB,CAAC;AACF,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,oBAAoB,EAAE;IACnD,QAAQ,EAAE,GAAG;IACb,WAAW,EAAE,gCAAgC;CAC9C,CAAC,CAAC;AACH,MAAM,oBAAoB,GAAG,IAAI,CAAC,MAAM,CAAC;IACvC,SAAS,EAAE,CAAC;IACZ,SAAS,EAAE,KAAK;IAChB,WAAW,EAAE,iEAAiE;CAC/E,CAAC,CAAC;AACH,MAAM,gBAAgB,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,qBAAqB,EAAE,CAAC,CAAC;AAE7E,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,IAAI,EAAE,IAAI,CAAC,MAAM,CACf,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,EACrE,iBAAiB,CAClB;IACD,KAAK,EAAE,IAAI,CAAC,MAAM,CAChB;QACE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;QAC7B,QAAQ,EAAE,cAAc;QACxB,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;KAClC,EACD,iBAAiB,CAClB;IACD,OAAO,EAAE,IAAI,CAAC,MAAM,CAClB;QACE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;QAC/B,KAAK,EAAE,WAAW;KACnB,EACD,iBAAiB,CAClB;IACD,MAAM,EAAE,IAAI,CAAC,MAAM,CACjB,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,EACrE,iBAAiB,CAClB;IACD,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,iBAAiB,CAAC;IACxE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,iBAAiB,CAAC;IAC1E,MAAM,EAAE,IAAI,CAAC,MAAM,CACjB,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,EACrE,iBAAiB,CAClB;IACD,MAAM,EAAE,IAAI,CAAC,MAAM,CACjB;QACE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;QAC9B,KAAK,EAAE,WAAW;QAClB,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;KAClC,EACD,iBAAiB,CAClB;IACD,iBAAiB,EAAE,IAAI,CAAC,MAAM,CAC5B;QACE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC;QACvC,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;QACjC,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC;QACrC,oBAAoB,EAAE,IAAI,CAAC,QAAQ,CAAC,0BAA0B,CAAC;QAC/D,KAAK,EAAE,WAAW;KACnB,EACD,iBAAiB,CAClB;IACD,iBAAiB,EAAE,IAAI,CAAC,MAAM,CAC5B;QACE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC;QACvC,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;QACjC,MAAM,EAAE,oBAAoB;KAC7B,EACD,iBAAiB,CAClB;IACD,kBAAkB,EAAE,IAAI,CAAC,MAAM,CAC7B;QACE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC;QACxC,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;QACjC,UAAU,EAAE,gBAAgB;KAC7B,EACD,iBAAiB,CAClB;IACD,MAAM,EAAE,IAAI,CAAC,MAAM,CACjB;QACE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;QAC9B,IAAI,EAAE,UAAU;QAChB,OAAO,EAAE,aAAa;QACtB,MAAM,EAAE,YAAY;KACrB,EACD,iBAAiB,CAClB;IACD,MAAM,EAAE,IAAI,CAAC,MAAM,CACjB;QACE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;QAC9B,IAAI,EAAE,UAAU;QAChB,OAAO,EAAE,aAAa;QACtB,MAAM,EAAE,YAAY;KACrB,EACD,iBAAiB,CAClB;CACO,CAAC;AAEX,MAAM,+BAA+B,GAAG;IACtC,MAAM,EAAE,qBAAqB,CAAC,MAAM;IACpC,MAAM,EAAE,qBAAqB,CAAC,MAAM;CAC5B,CAAC;AAOX,MAAM,CAAC,MAAM,sBAAsB,GAAG,oBAAoB,CAAC,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC,CAAC;AACjG,MAAM,CAAC,MAAM,gCAAgC,GAAG,oBAAoB,CAClE,MAAM,CAAC,MAAM,CAAC,+BAA+B,CAAC,CAC/C,CAAC;AAIF,MAAM,oBAAoB,GAAG;IAC3B,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,IAAI,EAAE,KAAK,EAAE,UAAU,CAAC;IAC9E,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,KAAK,EAAE,KAAK,EAAE,UAAU,CAAC;IAChF,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,OAAO,EAAE,KAAK,EAAE,UAAU,CAAC;IACpF,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,MAAM,EAAE,KAAK,EAAE,UAAU,CAAC;IAClF,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,KAAK,EAAE,KAAK,EAAE,UAAU,CAAC;IAChF,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,MAAM,EAAE,KAAK,EAAE,UAAU,CAAC;IAClF,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,MAAM,EAAE,KAAK,EAAE,UAAU,CAAC;IAClF,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,MAAM,EAAE,KAAK,EAAE,UAAU,CAAC;IAClF,iBAAiB,EAAE,CAAC,KAAK,EAAE,EAAE,CAC3B,cAAc,CAAC,qBAAqB,CAAC,iBAAiB,CAAC,EAAE,KAAK,EAAE,UAAU,CAAC;IAC7E,iBAAiB,EAAE,CAAC,KAAK,EAAE,EAAE,CAC3B,cAAc,CAAC,qBAAqB,CAAC,iBAAiB,CAAC,EAAE,KAAK,EAAE,UAAU,CAAC;IAC7E,kBAAkB,EAAE,CAAC,KAAK,EAAE,EAAE,CAC5B,cAAc,CAAC,qBAAqB,CAAC,kBAAkB,CAAC,EAAE,KAAK,EAAE,UAAU,CAAC;IAC9E,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,MAAM,EAAE,KAAK,EAAE,UAAU,CAAC;IAClF,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,MAAM,EAAE,KAAK,EAAE,UAAU,CAAC;CACM,CAAC;AAE3F,MAAM,8BAA8B,GAAG;IACrC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAChB,cAAc,CAAC,+BAA+B,CAAC,MAAM,EAAE,KAAK,EAAE,qBAAqB,CAAC;IACtF,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAChB,cAAc,CAAC,+BAA+B,CAAC,MAAM,EAAE,KAAK,EAAE,qBAAqB,CAAC;CAIvF,CAAC;AAEF,MAAM,UAAU,sBAAsB,CAAC,KAAc;IACnD,OAAO,mBAAmB,CAAoB,oBAAoB,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;AACzF,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,KAAc;IACzD,OAAO,mBAAmB,CACxB,8BAA8B,EAC9B,KAAK,EACL,qBAAqB,CACtB,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,QAA4B;IACxD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,UAAU,GAAgB,EAAE,CAAC;IAEnC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC;QACzC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;QAC/E,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAE3B,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YAChE,IAAI,IAAI,KAAK,QAAQ;gBAAE,SAAS;YAChC,MAAM,cAAc,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC7C,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;YACjC,IAAI,OAAO,KAAK,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,EAAE,CAAC;gBACxF,MAAM,IAAI,KAAK,CAAC,qBAAqB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;YACzF,CAAC;YACD,UAAU,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC;QACpC,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC,MAAM,CAChB;QACE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QACtC,GAAG,UAAU;KACd,EACD,iBAAiB,CAClB,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAC1B,OAA0D,EAC1D,KAAc,EACd,KAAa;IAEb,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ;QAAE,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC;IACrF,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACrC,IAAI,MAAM,KAAK,SAAS;QAAE,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC;IACrD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,IAAI,KAAK,CAAC,WAAW,KAAK,4CAA4C,CAAC,CAAC;AACjF,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,cAAc,CACrB,MAAc,EACd,KAAc,EACd,KAAa;IAEb,IAAI,CAAC;QACH,OAAO,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC9B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,CAAC,KAAK,YAAY,UAAU,CAAC;YAAE,MAAM,KAAK,CAAC;QAChD,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM;aAC/B,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;aACX,GAAG,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,EAAE,EAAE,EAAE;YACjC,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACpE,MAAM,YAAY,GAAG,OAAO,KAAK,iBAAiB,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,OAAO,CAAC;YACpF,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,YAAY,EAAE,CAAC;QACtD,CAAC,CAAC;aACD,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,WAAW,KAAK,gBAAgB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/E,CAAC;AACH,CAAC"}
+{"version":3,"file":"tool-input.js","sourceRoot":"","sources":["../../src/workflows/tool-input.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAA6D,MAAM,SAAS,CAAC;AAC1F,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAElD,MAAM,iBAAiB,GAAG,EAAE,oBAAoB,EAAE,KAAK,EAAW,CAAC;AAEnE,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,WAAW,EAAE,sBAAsB,EAAE,CAAC,CAAC;AACvF,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,CAAC;IACjC,WAAW,EAAE,+EAA+E;CAC7F,CAAC,CAAC;AACH,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC;IAC/B,WAAW,EACT,wIAAwI;CAC3I,CAAC,CAAC;AACH,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC;IAC9B,WAAW,EAAE,iDAAiD;CAC/D,CAAC,CAAC;AACH,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC;IAC7B,WAAW,EAAE,4DAA4D;CAC1E,CAAC,CAAC;AACH,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC;IAChC,WAAW,EAAE,+DAA+D;CAC7E,CAAC,CAAC;AACH,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAC9B;IACE,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE;IACnB,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE;IAClB,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;CACjD,EACD,iBAAiB,CAClB,CAAC;AACF,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC;IAChC,WAAW,EAAE,yEAAyE;CACvF,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,IAAI,EAAE,IAAI,CAAC,MAAM,CACf,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,EACrE,iBAAiB,CAClB;IACD,KAAK,EAAE,IAAI,CAAC,MAAM,CAChB;QACE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;QAC7B,QAAQ,EAAE,cAAc;QACxB,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;KAClC,EACD,iBAAiB,CAClB;IACD,MAAM,EAAE,IAAI,CAAC,MAAM,CACjB,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,EACrE,iBAAiB,CAClB;IACD,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,iBAAiB,CAAC;IACxE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,iBAAiB,CAAC;IAC1E,MAAM,EAAE,IAAI,CAAC,MAAM,CACjB,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,EACrE,iBAAiB,CAClB;IACD,MAAM,EAAE,IAAI,CAAC,MAAM,CACjB;QACE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;QAC9B,KAAK,EAAE,WAAW;QAClB,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;KAClC,EACD,iBAAiB,CAClB;IACD,MAAM,EAAE,IAAI,CAAC,MAAM,CACjB;QACE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;QAC9B,IAAI,EAAE,UAAU;QAChB,OAAO,EAAE,aAAa;QACtB,MAAM,EAAE,YAAY;KACrB,EACD,iBAAiB,CAClB;IACD,MAAM,EAAE,IAAI,CAAC,MAAM,CACjB;QACE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;QAC9B,IAAI,EAAE,UAAU;QAChB,OAAO,EAAE,aAAa;QACtB,MAAM,EAAE,YAAY;KACrB,EACD,iBAAiB,CAClB;CACO,CAAC;AAEX,MAAM,+BAA+B,GAAG;IACtC,MAAM,EAAE,qBAAqB,CAAC,MAAM;IACpC,MAAM,EAAE,qBAAqB,CAAC,MAAM;CAC5B,CAAC;AAOX,MAAM,CAAC,MAAM,sBAAsB,GAAG,oBAAoB,CAAC,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC,CAAC;AACjG,MAAM,CAAC,MAAM,gCAAgC,GAAG,oBAAoB,CAClE,MAAM,CAAC,MAAM,CAAC,+BAA+B,CAAC,CAC/C,CAAC;AAIF,MAAM,oBAAoB,GAAG;IAC3B,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,IAAI,EAAE,KAAK,EAAE,UAAU,CAAC;IAC9E,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,KAAK,EAAE,KAAK,EAAE,UAAU,CAAC;IAChF,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,MAAM,EAAE,KAAK,EAAE,UAAU,CAAC;IAClF,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,KAAK,EAAE,KAAK,EAAE,UAAU,CAAC;IAChF,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,MAAM,EAAE,KAAK,EAAE,UAAU,CAAC;IAClF,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,MAAM,EAAE,KAAK,EAAE,UAAU,CAAC;IAClF,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,MAAM,EAAE,KAAK,EAAE,UAAU,CAAC;IAClF,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,MAAM,EAAE,KAAK,EAAE,UAAU,CAAC;IAClF,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,MAAM,EAAE,KAAK,EAAE,UAAU,CAAC;CACM,CAAC;AAE3F,MAAM,8BAA8B,GAAG;IACrC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAChB,cAAc,CAAC,+BAA+B,CAAC,MAAM,EAAE,KAAK,EAAE,qBAAqB,CAAC;IACtF,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAChB,cAAc,CAAC,+BAA+B,CAAC,MAAM,EAAE,KAAK,EAAE,qBAAqB,CAAC;CAIvF,CAAC;AAEF,MAAM,UAAU,sBAAsB,CAAC,KAAc;IACnD,OAAO,mBAAmB,CAAoB,oBAAoB,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;AACzF,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,KAAc;IACzD,OAAO,mBAAmB,CACxB,8BAA8B,EAC9B,KAAK,EACL,qBAAqB,CACtB,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,QAA4B;IACxD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,UAAU,GAAgB,EAAE,CAAC;IAEnC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC;QACzC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;QAC/E,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAE3B,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YAChE,IAAI,IAAI,KAAK,QAAQ;gBAAE,SAAS;YAChC,MAAM,cAAc,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC7C,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;YACjC,IAAI,OAAO,KAAK,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,EAAE,CAAC;gBACxF,MAAM,IAAI,KAAK,CAAC,qBAAqB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;YACzF,CAAC;YACD,UAAU,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC;QACpC,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC,MAAM,CAChB;QACE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QACtC,GAAG,UAAU;KACd,EACD,iBAAiB,CAClB,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAC1B,OAA0D,EAC1D,KAAc,EACd,KAAa;IAEb,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ;QAAE,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC;IACrF,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACrC,IAAI,MAAM,KAAK,SAAS;QAAE,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC;IACrD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,IAAI,KAAK,CAAC,WAAW,KAAK,4CAA4C,CAAC,CAAC;AACjF,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,cAAc,CACrB,MAAc,EACd,KAAc,EACd,KAAa;IAEb,IAAI,CAAC;QACH,OAAO,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC9B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,CAAC,KAAK,YAAY,UAAU,CAAC;YAAE,MAAM,KAAK,CAAC;QAChD,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM;aAC/B,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;aACX,GAAG,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,EAAE,EAAE,EAAE;YACjC,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACpE,MAAM,YAAY,GAAG,OAAO,KAAK,iBAAiB,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,OAAO,CAAC;YACpF,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,YAAY,EAAE,CAAC;QACtD,CAAC,CAAC;aACD,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,WAAW,KAAK,gBAAgB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/E,CAAC;AACH,CAAC"}

package/dist/workflows/types.d.ts

@@ -40,9 +40,31 @@ export type WorkflowUpdateRecord = {
     data: Record<string, unknown>;
 };
 export type WorkflowUpdateReceipt = Pick<WorkflowUpdateRecord, "updateId" | "seq" | "at" | "type" | "key">;
+export type WorkflowEffectRecovery = "idempotent" | "manual";
+export type WorkflowManagedEffect = {
+    /** Stable external effect category, for example `github.comment`. */
+    type: string;
+    /** Stable key. Idempotent adapters must pass this key to the external system. */
+    idempotencyKey: string | ((context: WorkflowNodeContext) => MaybePromise<string>);
+    /** Canonical request data used to reject key reuse with another operation. */
+    request: unknown | ((context: WorkflowNodeContext) => MaybePromise<unknown>);
+    /** `manual` never retries after an uncertain child exit. */
+    recovery: WorkflowEffectRecovery;
+};
 export type WorkflowActionContext<TInput = unknown> = WorkflowNodeContext<TInput> & {
+    effect: {
+        type: string;
+        idempotencyKey: string;
+        recovery: WorkflowEffectRecovery;
+    };
     publishUpdate(update: WorkflowUpdateInput): Promise<WorkflowUpdateReceipt>;
 };
+export type WorkflowEffectReservation = {
+    effectId: string;
+    attemptNumber: number;
+    disposition: "execute" | "adopted" | "ambiguous";
+    result?: unknown;
+};
 export type WorkflowProgressStatus = "pending" | "running" | "waiting" | "blocked" | "completed" | "failed" | "cancelled" | "unknown";
 export type WorkflowProgressData = {
     schema: "pi-workflows.progress.v1";
@@ -119,6 +141,7 @@ export type NotifyNodeDefinition = WorkflowNodeCommon & {
 /** A deterministic runtime-owned step implemented as a local function. */
 export type FunctionActionNodeDefinition = WorkflowNodeCommon & {
     nodeType: "action";
+    effect?: WorkflowManagedEffect;
     run: (context: WorkflowActionContext) => MaybePromise<unknown>;
 };
 export type ShellActionExecution = {
@@ -154,8 +177,9 @@ export type ShellActionUpdates = {
 };
 export type ShellActionNodeDefinition = WorkflowNodeCommon & {
     nodeType: "action";
-    exec: (context: WorkflowNodeContext) => MaybePromise<ShellActionExecution>;
-    parse?: (result: ShellActionResult, context: WorkflowNodeContext) => MaybePromise<unknown>;
+    effect?: WorkflowManagedEffect;
+    exec: (context: WorkflowActionContext) => MaybePromise<ShellActionExecution>;
+    parse?: (result: ShellActionResult, context: WorkflowActionContext) => MaybePromise<unknown>;
     updates?: ShellActionUpdates;
 };
 export type ActionNodeDefinition = FunctionActionNodeDefinition | ShellActionNodeDefinition;
@@ -565,6 +589,8 @@ export type WorkflowRunState = {
     currentNode?: string;
     currentAttemptId?: string;
     currentNodeStartedAt?: string;
+    /** Durable wall-clock deadline for the current attempt. Null disables the deadline. */
+    currentNodeDeadlineAt?: string | null;
     currentSettingsScopeId?: string;
     currentSettingsChangeNumber?: number;
     currentSettingsHash?: string;
@@ -585,6 +611,10 @@ export type WorkflowNodeSnapshot = {
     expectedOutput?: AgentExpectedOutput;
     settingsRoute?: true;
     actionExecution?: "function" | "shell";
+    effect?: {
+        type: string;
+        recovery: WorkflowEffectRecovery;
+    };
     mountPath?: string[];
     localNodeId?: string;
     includeTransition?: "entry" | "exit";
@@ -753,6 +783,8 @@ export interface AgentStepExecutor {
      * leave the run claimable for an origin session. Omission is unsupported.
      */
     readonly assistantMessageMode?: "visible" | "park" | "unsupported";
+    /** True when the executor can park outside this process and resume the same attempt. */
+    readonly preservesDeadlineWhileParked?: boolean;
     runAgentStep(request: AgentStepRequest, signal: AbortSignal): Promise<AgentStepSubmission>;
 }
 export type WorkflowNotificationRequest = {
@@ -778,8 +810,8 @@ export type WorkflowEngineOptions = {
     notificationSink?: WorkflowNotificationSink;
     /** Canonical SQLite database. Defaults to `~/.pi/agent/workflows/state.sqlite`. */
     databasePath?: string;
-    /** Shared SQLite run store. */
-    store?: import("./store.js").WorkflowRunStore;
+    /** Durable execution store. Workers use a host-backed implementation. */
+    store?: import("./store.js").WorkflowExecutionStore;
     /**
      * Awaited after `run_started` is persisted, before any node executes.
      */

package/docs/2026-08-30-out-of-process-workflow-host-plan.md

@@ -0,0 +1,353 @@
+---
+title: Run workflows outside Pi
+author: Onur Solmaz <2453968+osolmaz@users.noreply.github.com>
+date: 2026-08-30
+---
+
+# Run workflows outside Pi
+
+Status: implemented on the `feat/out-of-process-workflow-host` branch. The implementation keeps schema version 1, uses one global on-demand host, and has no embedded production fallback.
+
+A live workflow lost its lease while it was still working. The workflow engine kept the Node.js event loop busy, so its renewal timer did not run before the 30-second lease expired. The next state write used a generic error, the extension treated the error as a crash, and durable state was left with a running queue row, a running attempt, an expired lease, and a separate failed audit event.
+
+This plan fixes that failure first, then removes its root architectural cause. One user-level host will own workflow state. Each active run will execute in a supervised child process. Pi will become a client that starts work, presents interactive requests, and submits answers through documented extension APIs.
+
+[Workflow host](WORKFLOW_HOST.md) defines the complete target process, protocol, state, recovery, and Pi integration contracts. This plan gives the implementation order and acceptance checks.
+
+## Goals
+
+- Renew a valid run lease in the same transaction as every protected state write.
+- Reject every stale writer with a typed claim-loss result.
+- Keep run, queue, attempt, decision, lease, audit, and viewer state consistent.
+- Recover or cancel expired running rows without treating a live owner as stale.
+- Move workflow code out of the Pi extension and host processes.
+- Make the host the only normal writer to the workflow database.
+- Preserve interactive workflow steps in the original Pi session.
+- Supervise workflow children with bounded startup, runtime, output, and shutdown behavior.
+- Make retries safe for pure work and explicit for external effects.
+- Keep the workflow engine independent of Pi and use documented Pi extension APIs only.
+
+## Non-goals
+
+- Do not change Pi source, private Pi APIs, or Pi session schemas.
+- Do not add a remote service, distributed consensus, or network database.
+- Do not claim exactly-once execution when an external system has no idempotency support.
+- Do not keep the embedded runner as a fallback after the host path is complete.
+- Do not add a compatibility reader, dual path, `v2` schema, or automatic state migration for older alpha databases.
+- Do not install an operating-system service as part of this change.
+
+## Original failure
+
+The former extension and host renewed 30-second run claims from 10-second `setInterval` callbacks. `src/workflows/engine.ts` can execute a long sequence of synchronous graph transitions without a macrotask yield. A long synchronous node can also block the event loop by itself.
+
+`src/workflows/store.ts` checks lease expiry during a protected write. Every ownership failure currently becomes `Error("Workflow run write rejected because ownership changed")`. The extension handles `ClaimLostError` as a normal handoff, but it handles this generic error as a workflow crash.
+
+The former public cancellation path handled an in-memory run, a queued or starting row, or a waiting human decision. It could not claim and cancel an expired running row.
+
+The former standalone host executed the workflow engine in the same process that renewed claims. Workflow code could therefore block host renewal too.
+
+## Core rules
+
+1. A run has one current claim generation.
+2. A stale generation cannot write.
+3. An expired claim cannot renew itself.
+4. A valid protected write renews the claim and updates state in one SQLite transaction.
+5. A true claim loss stops the old runner without a terminal run write.
+6. One lifecycle transition updates every related projection in one transaction.
+7. Waiting and paused runs release their claim and need no live child.
+8. The host executes no workflow code.
+9. A workflow child writes no workflow state directly.
+10. Pi is the origin client, not the run owner.
+11. A durable command is acknowledged only after it is committed.
+12. A side effect is retried only when its contract makes the retry safe.
+13. The production runtime has one execution path.
+
+## Part 1: Correct lease handling now
+
+### Typed claim loss
+
+Replace the generic ownership error with `ClaimLostError`. Add a nonsecret internal reason for missing authority, expiry, owner mismatch, token mismatch, and generation mismatch. Logs may include the run ID and reason. They must not include the claim token.
+
+### One fenced write transaction
+
+Route every ownership-protected run mutation through one store operation. The operation will:
+
+1. Read the expected resource revision and current lease.
+2. Compare owner type, owner ID, token hash, and generation.
+3. Require `expires_at` to be later than the transaction time.
+4. Update `heartbeat_at` and `expires_at` for the same owner, token, and generation.
+5. Apply the domain mutation, event, viewer delta, and revision bump.
+6. Commit the complete change.
+
+The claim identity provider may return the caller's identity after local expiry so the store can classify the exact failure. The store remains the authority. It must never renew a lease whose stored expiry has passed.
+
+The timer remains as a backup for asynchronous waits. Correctness must not depend on the timer firing between normal state writes.
+
+### Engine fairness
+
+Yield with `setImmediate` after each committed graph transition. This lets timers, cancellation, and UI work run between fast synchronous nodes. The yield is a fairness measure. Process isolation remains the fix for one long synchronous node.
+
+### Crash classification
+
+A claim-loss catch path will:
+
+- stop the old engine;
+- skip terminal run writes;
+- skip failed audit events, fallback turns, and terminal callbacks;
+- report that the run is available to another runner or already continues there.
+
+Unknown database and engine errors remain failures.
+
+## Part 2: Keep lifecycle state consistent
+
+Create one lifecycle store boundary for run and queue changes. Start, park, wait, resume, complete, fail, and cancel operations will update these facts together:
+
+- run status and finish data;
+- queue status and availability;
+- active node attempt;
+- human decision state when applicable;
+- claim release or renewal;
+- immutable event;
+- viewer projection.
+
+The store will reject impossible transitions. It will not add an audit event without the matching current projection.
+
+Add a read-only diagnosis for contradictory rows. Add a focused repair operation only for states that have exact durable evidence. The repair must not invent successful work.
+
+## Part 3: Recover and cancel stale runs
+
+Add an atomic control claim for an expired run. It will require an expired or absent lease, reject terminal rows, increase the claim generation, and bind a new token before any mutation.
+
+Cancellation will use that claim to commit one terminal cancellation. It will also close an active attempt, cancel pending interactions and human decisions, cancel effects that have not started, and mark applying effects ambiguous. A live claim cannot use this path.
+
+Startup recovery will make expired running rows claimable. A resumable run will continue from its last durable boundary. A run with an uncertain unmanaged side effect will stop for manual review instead of retrying.
+
+## Part 4: One global host
+
+The state database is global to one user installation. Use one host for that database, not one writing host per project.
+
+The host will:
+
+- own all run claims;
+- accept commands from Pi clients and command-line clients;
+- validate and commit state transitions;
+- supervise workflow child processes;
+- dispatch durable interactive requests;
+- recover work after restart;
+- reconcile controllers;
+- expose safe status without payloads or tokens.
+
+The host event loop will contain only bounded IPC, short SQLite transactions, timers, and process supervision. It will not load or execute workflow definitions.
+
+The existing package CLI will provide explicit host start, status, and stop behavior. The Pi extension may start the package host on demand. The package will not install systemd, launchd, or another operating-system service.
+
+## Part 5: Local protocol
+
+Use a versioned package-owned local protocol over a user-only Unix socket or the platform equivalent. Socket permissions must limit access to the current user.
+
+Every request will include:
+
+- protocol schema;
+- request ID;
+- command kind;
+- run ID when applicable;
+- node and attempt ID when applicable;
+- claim generation;
+- expected revision;
+- idempotency key;
+- bounded payload.
+
+The protocol will support start, pause, resume, cancel, ordinary checkpoint answers, protected human answers, interactive step submission, notification delivery, terminal turn delivery, node transition proposals, child progress, child exit, and managed effect operations.
+
+A command is successful only after the host commits it. Duplicate request IDs return the stored receipt. Stale revisions, generations, attempts, and idempotency conflicts return typed rejections.
+
+The host will bound message size and connection buffering. Malformed messages will close only that connection.
+
+## Part 6: One child per active run
+
+Each active workflow runs in a supervised child process. The child receives an immutable launch envelope with the run ID, generation, workflow source identity, project directory, input hash, and protocol endpoint.
+
+The child will:
+
+- verify the root and every mounted source identity before it loads workflow modules;
+- load the workflow and compare the resolved mounted-source map with the saved map;
+- execute graph and node code;
+- propose state transitions to the host;
+- request interactive work or managed effects;
+- exit when the run parks, waits, finishes, or loses its generation.
+
+The child will not receive a writable state store. This is an architectural boundary against accidental writes, not a security sandbox against malicious same-user code.
+
+The host will enforce:
+
+- startup handshake timeout;
+- node and run cancellation;
+- bounded stdout and stderr capture;
+- process-group termination;
+- `SIGTERM` followed by bounded `SIGKILL`;
+- orphan cleanup on host restart;
+- portable limits where Node and the operating system expose them.
+
+## Part 7: Preserve interactive Pi steps
+
+Interactive agent and assistant-message steps remain in the origin Pi session.
+
+When a child reaches one of these steps:
+
+1. It sends a durable interactive request to the host.
+2. The host commits the request and parks the run.
+3. The child exits and the claim is released.
+4. The Pi extension presents the exact step contract through documented Pi messaging and tool APIs.
+5. The extension sends a provisional result to the host with the request, node, attempt, and revision identifiers.
+6. The host records it as `validating` and schedules a new supervised child from that durable boundary.
+7. The child loads the workflow and runs the node's `validate` function.
+8. The host settles the request only after the child accepts it. A rejection keeps the request pending and returns the durable validation error to the model.
+
+If Pi closes, the request stays pending until its durable node deadline. Reopening the same session presents the same request once. A duplicate submission returns the original receipt. The host enforces the saved deadline while the worker is absent and after restart. An expired request atomically closes and starts a supervised child that records the same attempt as timed out. The workflow can route that result through `$result.outcome`; otherwise the run becomes terminal and releases its session reservation. A child failure during validation rejects only that provisional submission and leaves the request ready for a corrected retry. If the host stops after it records `validating` but before activation, startup recovery schedules that same submission unless its deadline expired.
+
+Keep one active interactive request per Pi session. Other requests remain ordered and durable.
+
+A protected human decision is displayed without starting a model turn. The model-facing workflow tool rejects it. A person answers it through the origin Pi session, while an ordinary checkpoint keeps its model-facing answer path.
+
+Notify nodes use the durable notification outbox. A root presentation prompt creates a durable terminal turn intent before completion and becomes eligible in the terminal transaction. The origin Pi session claims and adopts both message types through the host.
+
+Detached workflows can use host-managed `pi --mode rpc` children. Their execution mode and origin are durable provenance.
+
+## Part 8: Safe effects and retries
+
+Treat compute nodes as pure work. A child crash may rerun a compute node from its last committed boundary.
+
+Side-effecting action nodes must use a managed effect record with a stable key and request fingerprint. The host reserves the effect before execution and stores its receipt after execution. Duplicate requests return the stored receipt.
+
+An adapter may report safe retry only when the external system supports an idempotency key or a read-back check proves the result. If a child can have completed an external action but no receipt exists, mark the effect uncertain and stop for manual recovery.
+
+Migrate package-owned workflows to this rule before the host path becomes the only runtime. Do not silently treat arbitrary action code as exactly once.
+
+## Part 9: Alpha state change
+
+This repository's alpha policy requires an in-place schema change with the current schema identifiers. Do not add a migration, compatibility reader, dual path, alias, or `v2` schema.
+
+The changed DDL digest will reject an older state database with the standard clear reset instruction. The old file remains untouched. Documentation must tell users how to back it up before resetting.
+
+The new state shape will add the minimum durable records needed for:
+
+- host command receipts;
+- interactive requests and submissions;
+- child process epochs and exits;
+- uncertain effects when existing effect rows cannot express the state.
+
+Reuse current notifications, turn intents, attempts, and effects when they already provide the required contract. Add no parallel record for the same fact.
+
+## Part 10: Hard cutover
+
+Land the work in coherent commits and keep one implementation pull request. The final production change will:
+
+1. Use the host path for every new run.
+2. Remove embedded engine execution from the extension.
+3. Remove host-side in-process workflow execution.
+4. Remove old renewal-only ownership handling.
+5. Keep read-only viewers on the same canonical database.
+6. Keep the extension as a documented Pi client.
+7. Keep no fallback or feature flag for the old path.
+
+The host protocol and worker runtime may exist under tests before the final switch. There must never be two selectable production runtimes.
+
+## Tests
+
+### Lease regression
+
+- Run more than one lease interval of synchronous transitions with a fake clock and blocked timers.
+- Prove that each valid write renews the lease atomically.
+- Prove that an expired claim cannot renew itself.
+- Prove that a new generation fences the old token.
+- Prove that claim loss adds no failed run event.
+
+### Lifecycle consistency
+
+- Crash before and after every lifecycle commit.
+- Verify run, queue, attempt, decision, lease, event, and viewer state.
+- Cancel an expired running row.
+- Commit live cancellation and its command receipt in one transaction before worker shutdown.
+- Cancel a committed run before its scheduled worker activation.
+- Reject stale cancellation against a live owner.
+- Recover a resumable expired run.
+- Stop an uncertain effect for manual review.
+
+### Host and child isolation
+
+- Block a child event loop longer than the run lease and prove the host keeps ownership.
+- Kill Pi while a run computes.
+- Kill a child before and after a proposed transition.
+- Kill the host before and after a committed transition.
+- Restart after a provisional interaction submission commits but before child activation.
+- Change an included source and prove the resumed child rejects it before module execution.
+- Start two hosts and prove that one is rejected or fenced.
+- Reject stale child messages after a generation change.
+- Kill complete process groups on cancellation.
+- Bound malformed input and output floods.
+
+### Interactive bridge
+
+- Start a workflow from real Pi with the mock provider.
+- Commit and present an interactive request.
+- Restart Pi before submission and present the same request once.
+- Restart the host after an interactive deadline expires, close the request, and resume the same attempt into its timeout route.
+- Submit once and replay the same receipt for a duplicate.
+- Run workflow-specific submission validation only in a supervised child.
+- Return an actionable validation error and accept a corrected submission for the same request.
+- Reject a stale attempt submission.
+- Continue an ordinary checkpoint through the model-facing answer action.
+- Reject a protected human decision from that model-facing action.
+- Deliver a notify node through the durable origin-session outbox.
+- Start one terminal presentation turn only after completion commits.
+- Finish the run and preserve normal visible session entries.
+
+### Effects
+
+- Deduplicate a repeated effect request.
+- Recover a stored effect receipt after child and host restart.
+- Mark a request uncertain when completion cannot be proved.
+- Never auto-retry an uncertain effect.
+
+### Repository gates
+
+Run:
+
+```bash
+npm run check
+npm run test:e2e
+npx slophammer-ts@latest dry .
+npx slophammer-ts@latest check . --only ts.dependency-boundaries-required
+npx -y @simpledoc/simpledoc check
+git diff --check
+```
+
+Run Pi Reviewer against `main` until no P0 or P1 findings remain. Check pull-request comments and CI after the final review passes.
+
+## Acceptance criteria
+
+- The observed event-loop starvation cannot reproduce false ownership loss.
+- A stale runner cannot write after expiry or generation change.
+- A child blocked longer than the lease cannot block host renewal.
+- Run lifecycle projections remain consistent after injected crashes.
+- Expired running rows can be resumed or cancelled safely.
+- Pi restart does not lose or falsely fail pending work.
+- An unanswered interactive request keeps its original node deadline, follows its timeout route, and cannot hold a stale session reservation forever.
+- Host restart recovers durable work without duplicate transitions.
+- Interactive steps still use the origin Pi session.
+- Duplicate commands and submissions return stored receipts.
+- A submission is not accepted until supervised workflow validation succeeds.
+- Effects are deduplicated or marked uncertain.
+- The extension and host execute no workflow code in production.
+- Pi source, private APIs, and session schemas remain unchanged.
+- The old in-process runtime and all compatibility paths are removed.
+- Local checks, real Pi end-to-end tests, Pi Reviewer, pull-request review, and CI pass.
+
+## Contract impact
+
+- **Session state:** Normal Pi messages and tool results continue to append through documented Pi behavior. Pi Workflows does not edit Pi session files or schemas.
+- **Other persistent data:** The canonical workflow SQLite shape changes in place. Older alpha state requires an explicit backup and reset.
+- **Pi internals:** None.
+- **Public Pi APIs:** The extension uses documented commands, tools, session lifecycle events, message sending, widgets, and status APIs.
+- **Workflow authoring API:** Graph structure stays stable. Side-effecting actions gain an explicit managed-effect or manual-recovery requirement.
+- **Runtime:** Workflow graphs execute in supervised child processes. One global host owns state and claims.