@relaycast/engine 4.2.0 → 5.0.1

package/dist/engine/node.js

@@ -1,6 +1,6 @@
 import { and, eq, inArray, ne, or, sql } from 'drizzle-orm';
 import { parseFleetBrokerToRelaycastMessage } from '@relaycast/types';
-import { actionInvocations, actions, agents, channelMembers, channels, nodes } from '../db/schema.js';
+import { actionInvocations, actions, agents, agentNodeBindings, channelMembers, channels, nodes } from '../db/schema.js';
 import { randomHex, sha256Hex } from '../lib/crypto.js';
 import { codedError } from '../lib/httpError.js';
 import { runAtomic } from '../ports/database.js';
@@ -9,6 +9,15 @@ import { isNodeLive, nodeHasCapability } from './placement.js';
 import { completeNodeInvocation, rescheduleInvocationsForLostNode, rescheduleNodeInvocation } from './action.js';
 import { emitInvocationCompletionEffects } from './invocationCompletion.js';
 import { ackDeliveriesUpToSeq, deliverPendingToNode } from './delivery.js';
+export function directNodeIdForAgent(agentId) {
+    return `node_direct_${agentId}`;
+}
+function directNodeNameForAgent(agentId) {
+    return `direct-${agentId}`;
+}
+function isImplicitDirectLocation(agent) {
+    return agent.locationNodeId === directNodeIdForAgent(agent.id);
+}
 function capabilityName(capability) {
     if (typeof capability === 'string')
         return capability;
@@ -25,6 +34,10 @@ function publicNode(row) {
     return {
         id: row.id,
         name: row.name,
+        kind: row.kind,
+        role: row.role,
+        delivery_adapter: row.deliveryAdapter,
+        delivery: redactDeliveryConfig(row.deliveryConfig),
         capabilities: row.capabilities,
         tags: row.tags,
         version: row.version,
@@ -38,6 +51,65 @@ function publicNode(row) {
         created_at: row.createdAt.toISOString(),
     };
 }
+const SENSITIVE_DELIVERY_KEY = /api[_-]?key|authorization|cookie|credential|headers|password|private[_-]?key|secret|token/i;
+function redactDeliveryValue(key, value) {
+    if (key && /^headers$/i.test(key) && value && typeof value === 'object' && !Array.isArray(value)) {
+        return Object.fromEntries(Object.keys(value).map((name) => [name, '[redacted]']));
+    }
+    if (key && SENSITIVE_DELIVERY_KEY.test(key)) {
+        return '[redacted]';
+    }
+    if (Array.isArray(value)) {
+        return value.map((item) => redactDeliveryValue(null, item));
+    }
+    if (value && typeof value === 'object') {
+        return Object.fromEntries(Object.entries(value).map(([childKey, childValue]) => [
+            childKey,
+            redactDeliveryValue(childKey, childValue),
+        ]));
+    }
+    return value;
+}
+function redactDeliveryConfig(config) {
+    if (!config)
+        return null;
+    return redactDeliveryValue(null, config);
+}
+function normalizeLegacyNodeShape(kind, role) {
+    if (kind === 'fleet_ws')
+        return { kind: 'ws', role: 'broker' };
+    if (kind === 'direct_ws')
+        return { kind: 'ws', role: 'direct' };
+    if (kind === 'http_push')
+        return { kind: 'http_push', role: role === 'broker' ? 'broker' : 'direct' };
+    if (kind === 'poll')
+        return { kind: 'poll', role: role === 'broker' ? 'broker' : 'direct' };
+    return { kind: 'ws', role: role === 'direct' ? 'direct' : 'broker' };
+}
+function defaultAdapter(kind, deliveryConfig) {
+    if (kind === 'ws')
+        return 'ws.node.v1';
+    if (kind === 'poll')
+        return 'poll.v1';
+    const auth = deliveryConfig?.auth;
+    const authType = auth && typeof auth === 'object' && !Array.isArray(auth)
+        ? auth.type
+        : undefined;
+    if (authType === 'hmac_sha256')
+        return 'http.hmac.v1';
+    if (authType === 'bearer')
+        return 'http.bearer.v1';
+    if (authType === 'static_headers')
+        return 'http.static_headers.v1';
+    return 'http.basic.v1';
+}
+function normalizeLegacyAdapter(adapter) {
+    if (!adapter)
+        return undefined;
+    if (adapter === 'fleet.ws.v1' || adapter === 'direct.ws.v1')
+        return 'ws.node.v1';
+    return adapter;
+}
 async function ensureCapabilityActions(db, workspaceId, nodeId, capabilities) {
     for (const capability of capabilities) {
         const name = capabilityName(capability);
@@ -73,13 +145,36 @@ export async function createNodeToken(db, workspaceId, data) {
     const tokenHash = await sha256Hex(token);
     const existing = await getNodeByName(db, workspaceId, data.name);
     const now = new Date();
+    const existingShape = existing ? normalizeLegacyNodeShape(existing.kind, existing.role) : null;
+    const normalized = normalizeLegacyNodeShape(data.kind ?? existing?.kind ?? 'ws', data.role ?? existing?.role ?? (data.max_agents !== undefined && data.max_agents > 1 ? 'broker' : undefined));
+    const kind = normalized.kind;
+    const role = normalized.role;
+    // When the node shape (transport or role) changes on update, recompute the
+    // delivery adapter and capacity instead of reusing the stale values: rotating
+    // an http_push node to ws must not keep an http.* adapter, and switching a
+    // broker to direct must not retain a capacity > 1.
+    const shapeChanged = !!existingShape && (existingShape.kind !== kind || existingShape.role !== role);
+    const deliveryConfig = data.delivery === undefined ? existing?.deliveryConfig ?? null : data.delivery;
+    const deliveryAdapter = data.delivery_adapter
+        ?? (!shapeChanged && data.delivery === undefined ? normalizeLegacyAdapter(existing?.deliveryAdapter) : undefined)
+        ?? defaultAdapter(kind, deliveryConfig);
+    const maxAgents = role === 'direct'
+        ? (data.max_agents ?? 1)
+        : (data.max_agents ?? existing?.maxAgents ?? 0);
+    if (role === 'direct' && maxAgents !== 1) {
+        throw codedError('Direct nodes can bind at most one agent', 'direct_node_capacity_exceeded', 400);
+    }
     if (existing) {
         const [updated] = await db
             .update(nodes)
             .set({
             tokenHash,
+            kind,
+            role,
+            deliveryAdapter,
+            deliveryConfig,
             capabilities: normalizeCapabilities(data.capabilities ?? existing.capabilities),
-            maxAgents: data.max_agents ?? existing.maxAgents,
+            maxAgents,
             tags: data.tags ?? existing.tags,
             version: data.version ?? existing.version,
             status: 'offline',
@@ -96,8 +191,12 @@ export async function createNodeToken(db, workspaceId, data) {
         workspaceId,
         name: data.name,
         tokenHash,
+        kind,
+        role,
+        deliveryAdapter,
+        deliveryConfig,
         capabilities: normalizeCapabilities(data.capabilities ?? []),
-        maxAgents: data.max_agents ?? 0,
+        maxAgents,
         tags: data.tags ?? [],
         version: data.version ?? 'unknown',
         status: 'offline',
@@ -126,6 +225,13 @@ export async function registerNode(db, workspaceId, authenticatedNodeId, message
         throw codedError('node_id does not match the authenticated node token', 'node_id_mismatch', 403);
     }
     const now = new Date();
+    const [existing] = await db
+        .select()
+        .from(nodes)
+        .where(and(eq(nodes.workspaceId, workspaceId), eq(nodes.id, authenticatedNodeId)));
+    if (!existing) {
+        throw codedError('Node token is not enrolled in this workspace', 'node_not_found', 404);
+    }
     const [existingByName] = await db
         .select()
         .from(nodes)
@@ -133,24 +239,31 @@ export async function registerNode(db, workspaceId, authenticatedNodeId, message
     if (existingByName && existingByName.id !== authenticatedNodeId) {
         throw codedError(`Node name "${message.name}" is already enrolled`, 'node_name_conflict', 409);
     }
+    const role = existing.role === 'direct' ? 'direct' : 'broker';
+    const capabilities = role === 'direct' ? [] : normalizeCapabilities(message.capabilities);
+    const maxAgents = role === 'direct' ? 1 : message.max_agents;
     const [updated] = await db
         .update(nodes)
         .set({
         name: message.name,
-        capabilities: message.capabilities,
-        maxAgents: message.max_agents,
-        tags: message.tags,
+        capabilities,
+        kind: 'ws',
+        role,
+        deliveryAdapter: 'ws.node.v1',
+        deliveryConfig: role === 'direct' ? existing.deliveryConfig : null,
+        maxAgents,
+        activeAgents: role === 'direct' ? 1 : existing.activeAgents,
+        tags: role === 'direct' ? existing.tags : message.tags,
         version: message.version,
         status: 'online',
-        handlersLive: message.capabilities.length > 0,
+        handlersLive: role === 'broker' && capabilities.length > 0,
         lastHeartbeatAt: now,
     })
         .where(and(eq(nodes.workspaceId, workspaceId), eq(nodes.id, authenticatedNodeId)))
         .returning();
-    if (!updated) {
-        throw codedError('Node token is not enrolled in this workspace', 'node_not_found', 404);
+    if (role === 'broker') {
+        await ensureCapabilityActions(db, workspaceId, updated.id, capabilities);
     }
-    await ensureCapabilityActions(db, workspaceId, updated.id, message.capabilities);
     return publicNode(updated);
 }
 export async function heartbeatNode(db, workspaceId, nodeId, message) {
@@ -168,10 +281,21 @@ export async function heartbeatNode(db, workspaceId, nodeId, message) {
     if (message.name !== undefined)
         rosterUpdate.name = message.name;
     if (message.capabilities !== undefined) {
-        rosterUpdate.capabilities = normalizeCapabilities(message.capabilities);
+        const [node] = await db
+            .select({ role: nodes.role })
+            .from(nodes)
+            .where(and(eq(nodes.workspaceId, workspaceId), eq(nodes.id, nodeId)));
+        if (node?.role !== 'direct') {
+            rosterUpdate.capabilities = normalizeCapabilities(message.capabilities);
+        }
+    }
+    if (message.max_agents !== undefined) {
+        const [node] = await db
+            .select({ role: nodes.role })
+            .from(nodes)
+            .where(and(eq(nodes.workspaceId, workspaceId), eq(nodes.id, nodeId)));
+        rosterUpdate.maxAgents = node?.role === 'direct' ? 1 : message.max_agents;
     }
-    if (message.max_agents !== undefined)
-        rosterUpdate.maxAgents = message.max_agents;
     if (message.version !== undefined)
         rosterUpdate.version = message.version;
     const [updated] = await db
@@ -186,7 +310,7 @@ export async function heartbeatNode(db, workspaceId, nodeId, message) {
     })
         .where(and(eq(nodes.workspaceId, workspaceId), eq(nodes.id, nodeId)))
         .returning();
-    if (updated && message.capabilities !== undefined) {
+    if (updated && updated.role !== 'direct' && message.capabilities !== undefined) {
         await ensureCapabilityActions(db, workspaceId, updated.id, message.capabilities);
     }
     return updated ? publicNode(updated) : null;
@@ -232,8 +356,345 @@ async function autoJoinGeneral(db, workspaceId, agentId) {
         }).onConflictDoNothing();
     }
 }
+async function upsertAgentNodeBinding(db, workspaceId, agent, nodeId, opts = {}) {
+    if (opts.deactivateExisting ?? true) {
+        await db
+            .update(agentNodeBindings)
+            .set({ status: 'inactive', updatedAt: new Date() })
+            .where(and(eq(agentNodeBindings.workspaceId, workspaceId), eq(agentNodeBindings.agentId, agent.id), eq(agentNodeBindings.status, 'active'), ne(agentNodeBindings.nodeId, nodeId)));
+    }
+    await db
+        .insert(agentNodeBindings)
+        .values({
+        id: `anb_${generateId()}`,
+        workspaceId,
+        agentId: agent.id,
+        nodeId,
+        status: 'active',
+        sessionRef: opts.sessionRef ?? null,
+        priority: opts.priority ?? 0,
+        updatedAt: new Date(),
+    })
+        .onConflictDoUpdate({
+        target: [agentNodeBindings.agentId, agentNodeBindings.nodeId],
+        set: {
+            status: 'active',
+            sessionRef: opts.sessionRef ?? null,
+            priority: opts.priority ?? 0,
+            updatedAt: new Date(),
+        },
+    });
+    await db
+        .update(agents)
+        .set({
+        locationType: 'via_node',
+        locationNodeId: nodeId,
+        sessionRef: opts.sessionRef ?? undefined,
+        status: 'active',
+        lastSeen: new Date(),
+    })
+        .where(and(eq(agents.workspaceId, workspaceId), eq(agents.id, agent.id)));
+}
+async function activeBindingNodeIdsForAgent(db, workspaceId, agentId) {
+    const rows = await db
+        .select({ nodeId: agentNodeBindings.nodeId })
+        .from(agentNodeBindings)
+        .where(and(eq(agentNodeBindings.workspaceId, workspaceId), eq(agentNodeBindings.agentId, agentId), eq(agentNodeBindings.status, 'active')));
+    return rows.map((row) => row.nodeId);
+}
+async function reserveNodeAgentSlot(db, workspaceId, node) {
+    const [reserved] = await db
+        .update(nodes)
+        .set({
+        activeAgents: sql `${nodes.activeAgents} + 1`,
+    })
+        .where(and(eq(nodes.workspaceId, workspaceId), eq(nodes.id, node.id), or(eq(nodes.maxAgents, 0), sql `${nodes.activeAgents} < ${nodes.maxAgents}`)))
+        .returning({ id: nodes.id });
+    if (!reserved) {
+        throw codedError(`Node "${node.name}" is at capacity`, 'node_capacity_exceeded', 409);
+    }
+}
+async function releaseNodeAgentSlots(db, workspaceId, nodeIds) {
+    const uniqueNodeIds = [...new Set(nodeIds)];
+    if (uniqueNodeIds.length === 0)
+        return;
+    await db
+        .update(nodes)
+        .set({
+        activeAgents: sql `CASE WHEN ${nodes.activeAgents} > 0 THEN ${nodes.activeAgents} - 1 ELSE 0 END`,
+    })
+        .where(and(eq(nodes.workspaceId, workspaceId), inArray(nodes.id, uniqueNodeIds)));
+}
+export async function ensureDirectNodeForAgent(db, workspaceId, agent, opts = {}) {
+    return runAtomic(db, (tx) => ensureDirectNodeForAgentInTx(tx, workspaceId, agent, opts));
+}
+async function ensureDirectNodeForAgentInTx(db, workspaceId, agent, opts = {}) {
+    const activeNodeIds = await activeBindingNodeIdsForAgent(db, workspaceId, agent.id);
+    const nodeId = directNodeIdForAgent(agent.id);
+    const alreadyDirect = activeNodeIds.includes(nodeId);
+    const explicitNodeIds = activeNodeIds.filter((activeNodeId) => activeNodeId !== nodeId);
+    if (!opts.force && explicitNodeIds.length > 0) {
+        return null;
+    }
+    const now = new Date();
+    const [existingDirect] = await db
+        .select()
+        .from(nodes)
+        .where(and(eq(nodes.workspaceId, workspaceId), eq(nodes.id, nodeId)));
+    if (!opts.force && alreadyDirect && existingDirect && agent.locationNodeId === nodeId) {
+        const update = {
+            name: directNodeNameForAgent(agent.id),
+            kind: 'ws',
+            role: 'direct',
+            deliveryAdapter: 'ws.node.v1',
+            deliveryConfig: {
+                implicit: true,
+                agent_id: agent.id,
+                agent_name: agent.name,
+            },
+            capabilities: [],
+            maxAgents: 1,
+            activeAgents: 1,
+            tags: ['implicit', 'direct'],
+            version: 'implicit',
+            handlersLive: false,
+            load: 0,
+        };
+        if (opts.online) {
+            update.status = 'online';
+            update.lastHeartbeatAt = now;
+        }
+        const [updatedDirect] = await db
+            .update(nodes)
+            .set(update)
+            .where(and(eq(nodes.workspaceId, workspaceId), eq(nodes.id, nodeId)))
+            .returning();
+        return publicNode(updatedDirect ?? {
+            ...existingDirect,
+            ...update,
+            activeAgents: 1,
+            status: opts.online ? 'online' : existingDirect.status,
+            lastHeartbeatAt: opts.online ? now : existingDirect.lastHeartbeatAt,
+        });
+    }
+    let directNode = existingDirect;
+    if (!directNode) {
+        const tokenHash = await sha256Hex(`implicit_direct:${workspaceId}:${agent.id}:${randomHex(16)}`);
+        [directNode] = await db
+            .insert(nodes)
+            .values({
+            id: nodeId,
+            workspaceId,
+            name: directNodeNameForAgent(agent.id),
+            tokenHash,
+            kind: 'ws',
+            role: 'direct',
+            deliveryAdapter: 'ws.node.v1',
+            deliveryConfig: {
+                implicit: true,
+                agent_id: agent.id,
+                agent_name: agent.name,
+            },
+            capabilities: [],
+            maxAgents: 1,
+            activeAgents: 0,
+            tags: ['implicit', 'direct'],
+            version: 'implicit',
+            status: opts.online ? 'online' : 'offline',
+            handlersLive: false,
+            load: 0,
+            lastHeartbeatAt: opts.online ? now : null,
+            createdAt: now,
+        })
+            .returning();
+    }
+    else {
+        const update = {
+            name: directNodeNameForAgent(agent.id),
+            kind: 'ws',
+            role: 'direct',
+            deliveryAdapter: 'ws.node.v1',
+            deliveryConfig: {
+                implicit: true,
+                agent_id: agent.id,
+                agent_name: agent.name,
+            },
+            capabilities: [],
+            maxAgents: 1,
+            tags: ['implicit', 'direct'],
+            version: 'implicit',
+            handlersLive: false,
+            load: 0,
+        };
+        if (opts.online) {
+            update.status = 'online';
+            update.lastHeartbeatAt = now;
+        }
+        [directNode] = await db
+            .update(nodes)
+            .set(update)
+            .where(and(eq(nodes.workspaceId, workspaceId), eq(nodes.id, nodeId)))
+            .returning();
+    }
+    await upsertAgentNodeBinding(db, workspaceId, agent, nodeId, {
+        sessionRef: opts.sessionRef ?? null,
+        deactivateExisting: true,
+    });
+    await releaseNodeAgentSlots(db, workspaceId, explicitNodeIds);
+    await db
+        .update(nodes)
+        .set({
+        activeAgents: 1,
+        status: opts.online ? 'online' : directNode.status,
+        lastHeartbeatAt: opts.online ? now : directNode.lastHeartbeatAt,
+    })
+        .where(and(eq(nodes.workspaceId, workspaceId), eq(nodes.id, nodeId)));
+    return publicNode({
+        ...directNode,
+        activeAgents: 1,
+        status: opts.online ? 'online' : directNode.status,
+        lastHeartbeatAt: opts.online ? now : directNode.lastHeartbeatAt,
+    });
+}
+export async function markDirectNodeOfflineForAgent(db, workspaceId, agentId) {
+    const nodeId = directNodeIdForAgent(agentId);
+    await db
+        .update(nodes)
+        .set({
+        status: 'offline',
+        handlersLive: false,
+        load: 0,
+        lastHeartbeatAt: new Date(),
+    })
+        .where(and(eq(nodes.workspaceId, workspaceId), eq(nodes.id, nodeId)));
+}
+function serializeBinding(row) {
+    return {
+        id: row.id,
+        agent_id: row.agentId,
+        agent_name: row.agentName,
+        node_id: row.nodeId,
+        node_name: row.nodeName,
+        node_kind: row.nodeKind,
+        node_role: row.nodeRole,
+        status: row.status,
+        session_ref: row.sessionRef,
+        priority: row.priority,
+        created_at: row.createdAt.toISOString(),
+        updated_at: row.updatedAt?.toISOString() ?? null,
+    };
+}
+export async function bindAgentToNode(db, workspaceId, nodeName, agentName, opts = {}) {
+    return runAtomic(db, async (tx) => {
+        const node = await getNodeByName(tx, workspaceId, nodeName);
+        if (!node)
+            throw codedError(`Node "${nodeName}" not found`, 'node_not_found', 404);
+        const [agent] = await tx
+            .select()
+            .from(agents)
+            .where(and(eq(agents.workspaceId, workspaceId), eq(agents.name, agentName)));
+        if (!agent)
+            throw codedError(`Agent "${agentName}" not found`, 'agent_not_found', 404);
+        const activeNodeIds = await activeBindingNodeIdsForAgent(tx, workspaceId, agent.id);
+        const targetWasActive = activeNodeIds.includes(node.id);
+        let reservedTargetSlot = false;
+        try {
+            if (!targetWasActive) {
+                await reserveNodeAgentSlot(tx, workspaceId, node);
+                reservedTargetSlot = true;
+            }
+            await upsertAgentNodeBinding(tx, workspaceId, agent, node.id, {
+                sessionRef: opts.session_ref ?? null,
+                priority: opts.priority ?? 0,
+            });
+            await releaseNodeAgentSlots(tx, workspaceId, activeNodeIds.filter((nodeId) => nodeId !== node.id));
+        }
+        catch (err) {
+            if (reservedTargetSlot) {
+                await releaseNodeAgentSlots(tx, workspaceId, [node.id]);
+            }
+            throw err;
+        }
+        const [binding] = await tx
+            .select({
+            id: agentNodeBindings.id,
+            agentId: agentNodeBindings.agentId,
+            agentName: agents.name,
+            nodeId: agentNodeBindings.nodeId,
+            nodeName: nodes.name,
+            nodeKind: nodes.kind,
+            nodeRole: nodes.role,
+            status: agentNodeBindings.status,
+            sessionRef: agentNodeBindings.sessionRef,
+            priority: agentNodeBindings.priority,
+            createdAt: agentNodeBindings.createdAt,
+            updatedAt: agentNodeBindings.updatedAt,
+        })
+            .from(agentNodeBindings)
+            .innerJoin(agents, eq(agentNodeBindings.agentId, agents.id))
+            .innerJoin(nodes, eq(agentNodeBindings.nodeId, nodes.id))
+            .where(and(eq(agentNodeBindings.workspaceId, workspaceId), eq(agentNodeBindings.agentId, agent.id), eq(agentNodeBindings.nodeId, node.id)));
+        return serializeBinding(binding);
+    });
+}
+export async function unbindAgentFromNode(db, workspaceId, nodeName, agentName) {
+    return runAtomic(db, async (tx) => {
+        const node = await getNodeByName(tx, workspaceId, nodeName);
+        if (!node)
+            return false;
+        const [agent] = await tx
+            .select()
+            .from(agents)
+            .where(and(eq(agents.workspaceId, workspaceId), eq(agents.name, agentName)));
+        if (!agent)
+            return false;
+        const updated = await tx
+            .update(agentNodeBindings)
+            .set({ status: 'inactive', updatedAt: new Date() })
+            .where(and(eq(agentNodeBindings.workspaceId, workspaceId), eq(agentNodeBindings.nodeId, node.id), eq(agentNodeBindings.agentId, agent.id), eq(agentNodeBindings.status, 'active')))
+            .returning({ id: agentNodeBindings.id });
+        if (updated.length === 0)
+            return false;
+        await releaseNodeAgentSlots(tx, workspaceId, [node.id]);
+        if (agent.locationNodeId === node.id) {
+            await ensureDirectNodeForAgentInTx(tx, workspaceId, agent, { force: true });
+        }
+        return true;
+    });
+}
+export async function listNodeAgents(db, workspaceId, nodeName) {
+    const node = await getNodeByName(db, workspaceId, nodeName);
+    if (!node)
+        return null;
+    const rows = await db
+        .select({
+        id: agentNodeBindings.id,
+        agentId: agentNodeBindings.agentId,
+        agentName: agents.name,
+        nodeId: agentNodeBindings.nodeId,
+        nodeName: nodes.name,
+        nodeKind: nodes.kind,
+        nodeRole: nodes.role,
+        status: agentNodeBindings.status,
+        sessionRef: agentNodeBindings.sessionRef,
+        priority: agentNodeBindings.priority,
+        createdAt: agentNodeBindings.createdAt,
+        updatedAt: agentNodeBindings.updatedAt,
+    })
+        .from(agentNodeBindings)
+        .innerJoin(agents, eq(agentNodeBindings.agentId, agents.id))
+        .innerJoin(nodes, eq(agentNodeBindings.nodeId, nodes.id))
+        .where(and(eq(agentNodeBindings.workspaceId, workspaceId), eq(agentNodeBindings.nodeId, node.id), eq(agentNodeBindings.status, 'active')));
+    return rows.map(serializeBinding);
+}
 export async function registerAgentViaNode(db, workspaceId, nodeId, message) {
     return runAtomic(db, async (tx) => {
+        const [node] = await tx
+            .select()
+            .from(nodes)
+            .where(and(eq(nodes.workspaceId, workspaceId), eq(nodes.id, nodeId)));
+        if (!node)
+            throw codedError(`Node "${nodeId}" not found`, 'node_not_found', 404);
         const token = `at_live_${randomHex(16)}`;
         const tokenHash = await sha256Hex(token);
         const now = new Date().toISOString();
@@ -273,13 +734,33 @@ export async function registerAgentViaNode(db, workspaceId, nodeId, message) {
                 resumable: message.resumable ?? false,
                 sessionRef: message.session_ref ?? null,
             },
-            setWhere: or(ne(agents.status, 'active'), and(eq(agents.locationType, 'via_node'), eq(agents.locationNodeId, nodeId))),
+            setWhere: or(ne(agents.status, 'active'), and(eq(agents.locationType, 'via_node'), or(eq(agents.locationNodeId, nodeId), sql `${agents.locationNodeId} = 'node_direct_' || ${agents.id}`))),
         })
             .returning();
         if (!result) {
             throw codedError(`Agent "${message.name}" already has an active location`, 'agent_location_conflict', 409);
         }
         await autoJoinGeneral(tx, workspaceId, result.id);
+        const activeNodeIds = await activeBindingNodeIdsForAgent(tx, workspaceId, result.id);
+        const targetWasActive = activeNodeIds.includes(nodeId);
+        let reservedTargetSlot = false;
+        try {
+            if (!targetWasActive) {
+                await reserveNodeAgentSlot(tx, workspaceId, node);
+                reservedTargetSlot = true;
+            }
+            await upsertAgentNodeBinding(tx, workspaceId, result, nodeId, {
+                sessionRef: message.session_ref ?? null,
+                deactivateExisting: true,
+            });
+            await releaseNodeAgentSlots(tx, workspaceId, activeNodeIds.filter((activeNodeId) => activeNodeId !== nodeId));
+        }
+        catch (err) {
+            if (reservedTargetSlot) {
+                await releaseNodeAgentSlots(tx, workspaceId, [nodeId]);
+            }
+            throw err;
+        }
         return {
             agent_id: result.id,
             name: result.name,
@@ -307,12 +788,33 @@ export async function deregisterAgentViaNode(db, workspaceId, nodeId, message) {
         .set({ status: 'offline', lastSeen: new Date() })
         .where(and(...conditions))
         .returning();
+    if (updated) {
+        const activeNodeIds = await activeBindingNodeIdsForAgent(db, workspaceId, updated.id);
+        await db
+            .update(agentNodeBindings)
+            .set({ status: 'inactive', updatedAt: new Date() })
+            .where(and(eq(agentNodeBindings.workspaceId, workspaceId), eq(agentNodeBindings.nodeId, nodeId), eq(agentNodeBindings.agentId, updated.id), eq(agentNodeBindings.status, 'active')));
+        await releaseNodeAgentSlots(db, workspaceId, [nodeId]);
+        await ensureDirectNodeForAgent(db, workspaceId, updated, { force: true });
+        await db
+            .update(agents)
+            .set({ status: 'offline', lastSeen: new Date() })
+            .where(and(eq(agents.workspaceId, workspaceId), eq(agents.id, updated.id)));
+        await markDirectNodeOfflineForAgent(db, workspaceId, updated.id);
+        await releaseNodeAgentSlots(db, workspaceId, activeNodeIds.filter((activeNodeId) => activeNodeId !== nodeId));
+    }
     return updated ?? null;
 }
 export async function reconcileInventory(db, registry, workspaceId, nodeId, inventoryAgents, completionDeps) {
     const names = new Set(inventoryAgents.map((agent) => agent.name));
     const liveInvocationIds = new Set(inventoryAgents.flatMap((agent) => (agent.invocation_id ? [agent.invocation_id] : [])));
     let completedInvocations = 0;
+    const [node] = await db
+        .select()
+        .from(nodes)
+        .where(and(eq(nodes.workspaceId, workspaceId), eq(nodes.id, nodeId)));
+    if (!node)
+        throw codedError(`Node "${nodeId}" not found`, 'node_not_found', 404);
     // Pre-validate every item against the current state BEFORE mutating anything,
     // so a conflict on a later item can't leave earlier items partially
     // reconciled (the control handler turns a throw into an error reply). Existing
@@ -333,7 +835,9 @@ export async function reconcileInventory(db, registry, workspaceId, nodeId, inve
             .from(nodes)
             .where(and(eq(nodes.workspaceId, workspaceId), eq(nodes.id, existing.locationNodeId ?? '')));
         const boundNodeLive = !!boundNode && isNodeLive(boundNode);
-        const conflict = existing.locationType !== 'via_node' || !existing.locationNodeId || (existing.locationNodeId !== nodeId && boundNodeLive);
+        const conflict = existing.locationType !== 'via_node'
+            || !existing.locationNodeId
+            || (existing.locationNodeId !== nodeId && boundNodeLive && !isImplicitDirectLocation(existing));
         if (conflict) {
             console.warn('[node.inventory] rejected active-name claim', {
                 workspace_id: workspaceId,
@@ -349,17 +853,37 @@ export async function reconcileInventory(db, registry, workspaceId, nodeId, inve
     for (const item of inventoryAgents) {
         const existing = existingByName.get(item.name);
         if (existing) {
-            await db
-                .update(agents)
-                .set({
-                status: 'active',
-                lastSeen: new Date(),
-                locationType: 'via_node',
-                locationNodeId: nodeId,
-                originNodeId: existing.originNodeId ?? nodeId,
-                sessionRef: item.session_ref ?? existing.sessionRef,
-            })
-                .where(eq(agents.id, existing.id));
+            const activeNodeIds = await activeBindingNodeIdsForAgent(db, workspaceId, existing.id);
+            const targetWasActive = activeNodeIds.includes(nodeId);
+            let reservedTargetSlot = false;
+            try {
+                if (!targetWasActive) {
+                    await reserveNodeAgentSlot(db, workspaceId, node);
+                    reservedTargetSlot = true;
+                }
+                await db
+                    .update(agents)
+                    .set({
+                    status: 'active',
+                    lastSeen: new Date(),
+                    locationType: 'via_node',
+                    locationNodeId: nodeId,
+                    originNodeId: existing.originNodeId ?? nodeId,
+                    sessionRef: item.session_ref ?? existing.sessionRef,
+                })
+                    .where(eq(agents.id, existing.id));
+                await upsertAgentNodeBinding(db, workspaceId, existing, nodeId, {
+                    sessionRef: item.session_ref ?? existing.sessionRef,
+                    deactivateExisting: true,
+                });
+                await releaseNodeAgentSlots(db, workspaceId, activeNodeIds.filter((activeNodeId) => activeNodeId !== nodeId));
+            }
+            catch (err) {
+                if (reservedTargetSlot) {
+                    await releaseNodeAgentSlots(db, workspaceId, [nodeId]);
+                }
+                throw err;
+            }
         }
         if (!item.invocation_id)
             continue;
@@ -482,6 +1006,10 @@ export async function handleNodeControlMessage(args) {
                 // Node is now marked online: flush any queued action.invoke frames so
                 // spawns queued while it was offline can reserve capacity and dispatch.
                 await args.registry.drainNode(args.workspaceId, args.nodeId);
+                // The success reply was already sent above; keep the pending flush
+                // best-effort so a delivery error cannot trigger a second error reply
+                // for the same request id from the outer catch.
+                await deliverPendingToNode(args.db, args.registry, args.workspaceId, args.nodeId).catch(() => { });
                 return;
             }
             case 'node.heartbeat':