@tt-a1i/hive 1.4.4 → 1.5.0

package/dist/src/server/workflow-cli-policy.js

@@ -0,0 +1,110 @@
+/**
+ * Workflow CLI policy — controls which CLI a workflow's `agent()` spawns.
+ *
+ * Before this, the runner hard-coded `opts.cli ?? 'claude'`: a user who only
+ * had Codex set up would have every workflow agent that omitted `cli` spawn a
+ * `claude` it can't run. The policy makes the default configurable and lets
+ * the user constrain which CLIs workflow agents may use.
+ *
+ * Stored GLOBALLY in `app_state` (CLI availability is a machine-level fact, not
+ * per-workspace) under WORKFLOW_CLI_POLICY_KEY as a JSON `{default, allowed}`.
+ * An absent/malformed value reads back as DEFAULT_WORKFLOW_CLI_POLICY, which is
+ * unrestricted and defaults to `claude` — i.e. exactly the old behavior, so
+ * upgrading without configuring anything changes nothing.
+ */
+/** Canonical CLI set — mirrors the built-in command preset ids
+ *  (see command-preset-defaults.ts). The allowlist is a subset of these. */
+export const CANONICAL_WORKFLOW_CLIS = ['claude', 'codex', 'opencode', 'gemini'];
+export const WORKFLOW_CLI_POLICY_KEY = 'workflow.cli-policy';
+export const DEFAULT_WORKFLOW_CLI_POLICY = {
+    default: 'claude',
+    allowed: [...CANONICAL_WORKFLOW_CLIS],
+};
+const isCanonical = (value) => typeof value === 'string' && CANONICAL_WORKFLOW_CLIS.includes(value);
+/** Canonical entries from `input`, deduped and in canonical order. */
+const sanitizeAllowed = (input) => {
+    if (!Array.isArray(input))
+        return [];
+    const set = new Set(input.filter(isCanonical));
+    return CANONICAL_WORKFLOW_CLIS.filter((cli) => set.has(cli));
+};
+/**
+ * Lenient coercion used by the runtime reader: turn arbitrary stored data into
+ * a usable policy, never throwing. Junk in `allowed` is dropped; an empty
+ * result falls back to the full canonical default; a `default` outside the
+ * sanitized `allowed` is pulled back to the first allowed entry.
+ */
+export const normalizeWorkflowCliPolicy = (input) => {
+    if (typeof input !== 'object' || input === null)
+        return DEFAULT_WORKFLOW_CLI_POLICY;
+    const record = input;
+    const allowed = sanitizeAllowed(record.allowed);
+    if (allowed.length === 0)
+        return DEFAULT_WORKFLOW_CLI_POLICY;
+    const requestedDefault = record.default;
+    const fallback = allowed[0];
+    const resolvedDefault = typeof requestedDefault === 'string' && allowed.includes(requestedDefault)
+        ? requestedDefault
+        : fallback;
+    return { default: resolvedDefault, allowed };
+};
+/** Parse the raw `app_state` string. Absent / malformed → canonical default. */
+export const readWorkflowCliPolicy = (raw) => {
+    if (raw === null || raw === undefined)
+        return DEFAULT_WORKFLOW_CLI_POLICY;
+    try {
+        return normalizeWorkflowCliPolicy(JSON.parse(raw));
+    }
+    catch {
+        return DEFAULT_WORKFLOW_CLI_POLICY;
+    }
+};
+/**
+ * Strict validation for the settings API: reject bad input so a malformed
+ * policy can never be persisted (the reader tolerates junk, but we'd rather
+ * fail the write than silently store something the user didn't intend).
+ */
+export const assertValidWorkflowCliPolicy = (input) => {
+    if (typeof input !== 'object' || input === null) {
+        throw new Error('workflow cli policy must be an object { default, allowed }');
+    }
+    const record = input;
+    if (!Array.isArray(record.allowed)) {
+        throw new Error('workflow cli policy `allowed` must be an array');
+    }
+    if (record.allowed.length === 0) {
+        throw new Error('workflow cli policy `allowed` must list at least one CLI');
+    }
+    const bad = record.allowed.find((entry) => !isCanonical(entry));
+    if (bad !== undefined) {
+        throw new Error(`workflow cli policy "allowed" has an unsupported CLI: ${JSON.stringify(bad)}. Supported: ${CANONICAL_WORKFLOW_CLIS.join(', ')}`);
+    }
+    if (typeof record.default !== 'string' || !record.allowed.includes(record.default)) {
+        throw new Error(`workflow cli policy "default" (${JSON.stringify(record.default)}) must be one of allowed: ${record.allowed.join(', ')}`);
+    }
+    // Dedupe + canonical order while preserving the (now-validated) selection.
+    return { default: record.default, allowed: sanitizeAllowed(record.allowed) };
+};
+/**
+ * Resolve the CLI command a workflow agent should launch with.
+ *
+ * - An explicit `requestedCli` is ALWAYS validated against `allowed` (throws
+ *   if disallowed, so the orchestrator gets a clear, fixable error).
+ * - When omitted: a custom template keeps its own `defaultCommand` (the user
+ *   curated that role deliberately — exempt from the allowlist); a built-in
+ *   role falls back to `policy.default`.
+ */
+export const resolveWorkflowCli = ({ requestedCli, isCustomTemplate, templateDefaultCommand, policy, }) => {
+    const explicit = requestedCli?.trim();
+    if (explicit) {
+        if (!policy.allowed.includes(explicit)) {
+            throw new Error(`Workflow agent cli '${explicit}' is not allowed in this workspace. ` +
+                `Allowed: ${policy.allowed.join(', ')}. ` +
+                `Pick an allowed cli, or change the workflow CLI policy in Settings.`);
+        }
+        return explicit;
+    }
+    if (isCustomTemplate && templateDefaultCommand)
+        return templateDefaultCommand;
+    return policy.default;
+};

package/dist/src/server/workflow-dispatch-awaiter.d.ts

@@ -0,0 +1,12 @@
+export interface ReportPayload {
+    text: string;
+    artifacts: string[];
+    status?: string;
+}
+export interface WorkflowDispatchAwaiter {
+    awaitReport(dispatchId: string, timeoutMs?: number): Promise<ReportPayload>;
+    notifyReport(dispatchId: string, payload: ReportPayload): void;
+    notifyCancel(dispatchId: string, reason: string): void;
+    cancelAll(reason: string): void;
+}
+export declare const createWorkflowDispatchAwaiter: () => WorkflowDispatchAwaiter;

package/dist/src/server/workflow-dispatch-awaiter.js

@@ -0,0 +1,80 @@
+// Default 10 minutes — workflows often run long. Callers may shorten via opts.
+const DEFAULT_TIMEOUT_MS = 10 * 60 * 1000;
+export const createWorkflowDispatchAwaiter = () => {
+    const pending = new Map();
+    // TIER 2 #10 — deferred-cancel state. The runner creates a dispatch
+    // and THEN calls awaitReport, with at least one microtask gap between
+    // the two. If notifyCancel(id) fires in that gap, it currently hits
+    // an empty `pending` map and no-ops; the subsequent awaitReport(id)
+    // then waits the full DEFAULT_TIMEOUT_MS (10 min) on a dispatch that
+    // is already cancelled. Remembering the cancel intent here lets
+    // awaitReport reject synchronously the instant it gets registered.
+    // We also remember any pre-arrived report payload for the same
+    // reason — defensive against a future ordering change.
+    const cancelledIds = new Map();
+    const reportedIds = new Map();
+    const take = (dispatchId) => {
+        const entry = pending.get(dispatchId);
+        if (entry) {
+            clearTimeout(entry.timer);
+            pending.delete(dispatchId);
+        }
+        return entry;
+    };
+    return {
+        awaitReport(dispatchId, timeoutMs = DEFAULT_TIMEOUT_MS) {
+            return new Promise((resolve, reject) => {
+                // Pre-arrived events: drain immediately, no timer / no entry.
+                const earlyReport = reportedIds.get(dispatchId);
+                if (earlyReport) {
+                    reportedIds.delete(dispatchId);
+                    resolve(earlyReport);
+                    return;
+                }
+                const earlyCancel = cancelledIds.get(dispatchId);
+                if (earlyCancel) {
+                    cancelledIds.delete(dispatchId);
+                    reject(new Error(`workflow dispatch ${dispatchId} cancelled: ${earlyCancel}`));
+                    return;
+                }
+                const timer = setTimeout(() => {
+                    pending.delete(dispatchId);
+                    reject(new Error(`workflow dispatch ${dispatchId} timeout after ${timeoutMs}ms`));
+                }, timeoutMs);
+                pending.set(dispatchId, { resolve, reject, timer });
+            });
+        },
+        notifyReport(dispatchId, payload) {
+            const entry = take(dispatchId);
+            if (entry) {
+                entry.resolve(payload);
+            }
+            else {
+                // Pre-arrival: stash for the eventual awaitReport call. Cap
+                // stash size implicitly by overwriting on duplicate id.
+                reportedIds.set(dispatchId, payload);
+            }
+        },
+        notifyCancel(dispatchId, reason) {
+            const entry = take(dispatchId);
+            if (entry) {
+                entry.reject(new Error(`workflow dispatch ${dispatchId} cancelled: ${reason}`));
+            }
+            else {
+                cancelledIds.set(dispatchId, reason);
+            }
+        },
+        cancelAll(reason) {
+            for (const [id, entry] of pending) {
+                clearTimeout(entry.timer);
+                entry.reject(new Error(`workflow dispatch ${id} cancelled: ${reason}`));
+            }
+            pending.clear();
+            // cancelAll happens at runtime close — anything waiting at that
+            // moment should fail loudly, but the deferred state can be
+            // safely dropped since no future awaitReport will run.
+            cancelledIds.clear();
+            reportedIds.clear();
+        },
+    };
+};

package/dist/src/server/workflow-feature.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Workflow experimental feature gate.
+ *
+ * Workflows (`team workflow run`, the scheduler, the UI drawer, and the chunk
+ * of orchestrator guidance that teaches them) are a power feature with sharp
+ * edges — runaway fan-outs, authoring footguns, no run-resume yet. They ship
+ * OFF by default; a user opts in from Settings. While off, the orchestrator is
+ * not even taught about workflows, which also keeps its always-on prompt lean.
+ *
+ * Stored GLOBALLY in `app_state` under WORKFLOW_ENABLED_KEY. Absent / anything
+ * other than the exact string "true" reads back as DISABLED.
+ */
+export declare const WORKFLOW_ENABLED_KEY = "workflow.enabled";
+export declare const readWorkflowEnabled: (raw: string | null | undefined) => boolean;
+export declare const serializeWorkflowEnabled: (enabled: boolean) => string;

package/dist/src/server/workflow-feature.js

@@ -0,0 +1,15 @@
+/**
+ * Workflow experimental feature gate.
+ *
+ * Workflows (`team workflow run`, the scheduler, the UI drawer, and the chunk
+ * of orchestrator guidance that teaches them) are a power feature with sharp
+ * edges — runaway fan-outs, authoring footguns, no run-resume yet. They ship
+ * OFF by default; a user opts in from Settings. While off, the orchestrator is
+ * not even taught about workflows, which also keeps its always-on prompt lean.
+ *
+ * Stored GLOBALLY in `app_state` under WORKFLOW_ENABLED_KEY. Absent / anything
+ * other than the exact string "true" reads back as DISABLED.
+ */
+export const WORKFLOW_ENABLED_KEY = 'workflow.enabled';
+export const readWorkflowEnabled = (raw) => raw === 'true';
+export const serializeWorkflowEnabled = (enabled) => (enabled ? 'true' : 'false');

package/dist/src/server/workflow-http-serializers.d.ts

@@ -0,0 +1,64 @@
+import type { LiveAgentRun } from './agent-runtime-types.js';
+import type { DispatchRecord } from './dispatch-ledger-store.js';
+import type { WorkflowRunRecord } from './workflow-run-store.js';
+import type { WorkflowScheduleRecord } from './workflow-schedule-store.js';
+export declare const serializeLiveAgentRun: (run: LiveAgentRun) => {
+    agent_id: string;
+    exit_code: number | null;
+    output: string;
+    pid: number | null;
+    run_id: string;
+    started_at: number;
+    status: import("./agent-manager.js").RunStatus;
+};
+export declare const serializeWorkflowRun: (run: WorkflowRunRecord) => {
+    agent_count: number;
+    args: unknown;
+    created_at: number;
+    error: string | null;
+    finished_at: number | null;
+    id: string;
+    name: string;
+    parent_run_id: string | null;
+    phase: string | null;
+    result: unknown;
+    script_hash: string | null;
+    script_path: string;
+    started_at: number;
+    status: import("./workflow-run-store.js").WorkflowRunStatus;
+    workspace_id: string;
+};
+export declare const serializeWorkflowDispatch: (dispatch: DispatchRecord & {
+    lastPtyLine?: string;
+}) => {
+    artifacts: string[];
+    created_at: number;
+    delivered_at: number | null;
+    from_agent_id: string | null;
+    id: string;
+    label: string | null;
+    last_pty_line: string | null;
+    phase: string | null;
+    reported_at: number | null;
+    report_text: string | null;
+    sequence: number | null;
+    status: import("./dispatch-ledger-store.js").DispatchStatus;
+    step_index: number | null;
+    submitted_at: number | null;
+    text: string;
+    to_agent_id: string;
+    workflow_run_id: string | null;
+    workspace_id: string;
+};
+export declare const serializeWorkflowSchedule: (schedule: WorkflowScheduleRecord) => {
+    args: unknown;
+    created_at: number;
+    cron: string;
+    enabled: boolean;
+    id: string;
+    last_run_at: number | null;
+    next_run_at: number;
+    script_path: string;
+    updated_at: number;
+    workspace_id: string;
+};

package/dist/src/server/workflow-http-serializers.js

@@ -0,0 +1,58 @@
+export const serializeLiveAgentRun = (run) => ({
+    agent_id: run.agentId,
+    exit_code: run.exitCode,
+    output: run.output,
+    pid: run.pid,
+    run_id: run.runId,
+    started_at: run.startedAt,
+    status: run.status,
+});
+export const serializeWorkflowRun = (run) => ({
+    agent_count: run.agentCount,
+    args: run.args,
+    created_at: run.createdAt,
+    error: run.error,
+    finished_at: run.finishedAt,
+    id: run.id,
+    name: run.name,
+    parent_run_id: run.parentRunId,
+    phase: run.phase,
+    result: run.result,
+    script_hash: run.scriptHash,
+    script_path: run.scriptPath,
+    started_at: run.startedAt,
+    status: run.status,
+    workspace_id: run.workspaceId,
+});
+export const serializeWorkflowDispatch = (dispatch) => ({
+    artifacts: dispatch.artifacts,
+    created_at: dispatch.createdAt,
+    delivered_at: dispatch.deliveredAt,
+    from_agent_id: dispatch.fromAgentId,
+    id: dispatch.id,
+    label: dispatch.label,
+    last_pty_line: dispatch.lastPtyLine ?? null,
+    phase: dispatch.phase,
+    reported_at: dispatch.reportedAt,
+    report_text: dispatch.reportText,
+    sequence: dispatch.sequence,
+    status: dispatch.status,
+    step_index: dispatch.stepIndex,
+    submitted_at: dispatch.submittedAt,
+    text: dispatch.text,
+    to_agent_id: dispatch.toAgentId,
+    workflow_run_id: dispatch.workflowRunId,
+    workspace_id: dispatch.workspaceId,
+});
+export const serializeWorkflowSchedule = (schedule) => ({
+    args: schedule.args,
+    created_at: schedule.createdAt,
+    cron: schedule.cron,
+    enabled: schedule.enabled,
+    id: schedule.id,
+    last_run_at: schedule.lastRunAt,
+    next_run_at: schedule.nextRunAt,
+    script_path: schedule.scriptPath,
+    updated_at: schedule.updatedAt,
+    workspace_id: schedule.workspaceId,
+});

package/dist/src/server/workflow-run-log-store.d.ts

@@ -0,0 +1,19 @@
+import type { Database } from 'better-sqlite3';
+export interface WorkflowRunLogRecord {
+    id: number;
+    runId: string;
+    ts: number;
+    message: string;
+}
+export declare const createWorkflowRunLogStore: (db: Database) => {
+    append(runId: string, message: string, ts?: number): void;
+    listForRun(runId: string): WorkflowRunLogRecord[];
+    /** Last `n` log messages for the run, oldest-first. Used by the
+     *  onRunFinished reminder to include a short narrator tail in the
+     *  orchestrator's completion notification without overwhelming it. */
+    tailForRun(runId: string, n: number): string[];
+    deleteForRun(runId: string): void;
+    /** Cascade hook: deleted alongside workflow_runs when a workspace
+     *  is removed (TIER 1 #4 cascade). */
+    deleteForWorkspace(workspaceId: string): void;
+};

package/dist/src/server/workflow-run-log-store.js

@@ -0,0 +1,45 @@
+/* TIER 2 #3 — narrator lane storage. `log()` calls from a workflow script
+ * append here; the Drawer polls listForRun(runId) alongside the dispatch
+ * timeline; the orchestrator's completion reminder splices in the last
+ * few lines so a run that finished with a long sequence of `log()` calls
+ * can be summarised back to the user.
+ *
+ * Append-only. No retention policy yet — TIER 3 work if log volume grows
+ * to where it matters; CC's Workflow tool keeps logs for the run's
+ * lifetime so we mirror that. */
+export const createWorkflowRunLogStore = (db) => {
+    const insert = db.prepare('INSERT INTO workflow_run_logs (run_id, ts, message) VALUES (?, ?, ?)');
+    const listStmt = db.prepare('SELECT id, run_id, ts, message FROM workflow_run_logs WHERE run_id = ? ORDER BY id');
+    const tailStmt = db.prepare('SELECT message FROM workflow_run_logs WHERE run_id = ? ORDER BY id DESC LIMIT ?');
+    const deleteForRunStmt = db.prepare('DELETE FROM workflow_run_logs WHERE run_id = ?');
+    const deleteForWorkspaceStmt = db.prepare(`DELETE FROM workflow_run_logs
+     WHERE run_id IN (SELECT id FROM workflow_runs WHERE workspace_id = ?)`);
+    return {
+        append(runId, message, ts = Date.now()) {
+            insert.run(runId, ts, message);
+        },
+        listForRun(runId) {
+            return listStmt.all(runId).map((row) => ({
+                id: row.id,
+                runId: row.run_id,
+                ts: row.ts,
+                message: row.message,
+            }));
+        },
+        /** Last `n` log messages for the run, oldest-first. Used by the
+         *  onRunFinished reminder to include a short narrator tail in the
+         *  orchestrator's completion notification without overwhelming it. */
+        tailForRun(runId, n) {
+            const rows = tailStmt.all(runId, n);
+            return rows.map((r) => r.message).reverse();
+        },
+        deleteForRun(runId) {
+            deleteForRunStmt.run(runId);
+        },
+        /** Cascade hook: deleted alongside workflow_runs when a workspace
+         *  is removed (TIER 1 #4 cascade). */
+        deleteForWorkspace(workspaceId) {
+            deleteForWorkspaceStmt.run(workspaceId);
+        },
+    };
+};

package/dist/src/server/workflow-run-store.d.ts

@@ -0,0 +1,50 @@
+import type { Database } from 'better-sqlite3';
+export type WorkflowRunStatus = 'running' | 'completed' | 'failed' | 'interrupted' | 'stopped';
+export interface WorkflowRunRecord {
+    id: string;
+    workspaceId: string;
+    scriptPath: string;
+    scriptHash: string | null;
+    name: string;
+    status: WorkflowRunStatus;
+    phase: string | null;
+    args: unknown;
+    result: unknown;
+    startedAt: number;
+    finishedAt: number | null;
+    error: string | null;
+    createdAt: number;
+    /** Count of `agent()` calls dispatched by this run. TIER 1 #14 — lets the
+     *  Drawer show "12 agents" on the row without an extra round-trip per
+     *  expand. Cheap subquery against the indexed workflow_run_id column. */
+    agentCount: number;
+    /** TIER 2 #5: parent workflow run id for nested workflow() calls.
+     *  Null on top-level runs. The Drawer uses this to render a child run
+     *  indented under its parent (and to collapse/expand together). */
+    parentRunId: string | null;
+}
+interface CreateRunInput {
+    workspaceId: string;
+    scriptPath: string;
+    name: string;
+    scriptHash?: string;
+    args?: unknown;
+    /** TIER 2 #5 — set when this run is being created from a nested
+     *  workflow() call. Null/omitted for top-level runs. */
+    parentRunId?: string | null;
+}
+interface UpdateRunInput {
+    status?: WorkflowRunStatus;
+    phase?: string;
+    finishedAt?: number;
+    error?: string;
+    result?: unknown;
+}
+export declare const createWorkflowRunStore: (db: Database) => {
+    createRun: (input: CreateRunInput) => WorkflowRunRecord;
+    updateRun: (id: string, input: UpdateRunInput) => void;
+    getRun: (id: string) => WorkflowRunRecord | undefined;
+    listWorkspaceRuns: (workspaceId: string) => WorkflowRunRecord[];
+    markUnfinishedRunsInterrupted: () => void;
+};
+export {};

package/dist/src/server/workflow-run-store.js

@@ -0,0 +1,103 @@
+import { randomUUID } from 'node:crypto';
+const parseArgs = (value) => {
+    if (!value)
+        return null;
+    try {
+        return JSON.parse(value);
+    }
+    catch {
+        return null;
+    }
+};
+const toRecord = (row) => ({
+    id: row.id,
+    workspaceId: row.workspace_id,
+    scriptPath: row.script_path,
+    scriptHash: row.script_hash,
+    name: row.name,
+    status: row.status,
+    phase: row.phase,
+    args: parseArgs(row.args),
+    result: parseArgs(row.result),
+    startedAt: row.started_at,
+    finishedAt: row.finished_at,
+    error: row.error,
+    createdAt: row.created_at,
+    agentCount: Number(row.agent_count ?? 0),
+    parentRunId: row.parent_run_id ?? null,
+});
+// Selects every workflow_runs column plus the agent_count subquery; used by
+// both getRun and listWorkspaceRuns so the WorkflowRunRecord shape is
+// uniform regardless of which path produced it.
+const SELECT_RUN_COLUMNS = 'workflow_runs.*, ' +
+    '(SELECT COUNT(*) FROM dispatches WHERE dispatches.workflow_run_id = workflow_runs.id) AS agent_count';
+export const createWorkflowRunStore = (db) => {
+    const createRun = (input) => {
+        const now = Date.now();
+        const record = {
+            id: randomUUID(),
+            workspaceId: input.workspaceId,
+            scriptPath: input.scriptPath,
+            scriptHash: input.scriptHash ?? null,
+            name: input.name,
+            status: 'running',
+            phase: null,
+            args: input.args ?? null,
+            result: null,
+            startedAt: now,
+            finishedAt: null,
+            error: null,
+            createdAt: now,
+            agentCount: 0,
+            parentRunId: input.parentRunId ?? null,
+        };
+        db.prepare(`INSERT INTO workflow_runs (
+        id, workspace_id, script_path, script_hash, name, status, phase, args,
+        started_at, finished_at, error, created_at, parent_run_id
+      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(record.id, record.workspaceId, record.scriptPath, record.scriptHash, record.name, record.status, record.phase, record.args === null ? null : JSON.stringify(record.args), record.startedAt, record.finishedAt, record.error, record.createdAt, record.parentRunId);
+        return record;
+    };
+    const updateRun = (id, input) => {
+        const sets = [];
+        const values = [];
+        if (input.status !== undefined) {
+            sets.push('status = ?');
+            values.push(input.status);
+        }
+        if (input.phase !== undefined) {
+            sets.push('phase = ?');
+            values.push(input.phase);
+        }
+        if (input.finishedAt !== undefined) {
+            sets.push('finished_at = ?');
+            values.push(input.finishedAt);
+        }
+        if (input.error !== undefined) {
+            sets.push('error = ?');
+            values.push(input.error);
+        }
+        if (input.result !== undefined) {
+            sets.push('result = ?');
+            values.push(input.result === null ? null : JSON.stringify(input.result));
+        }
+        if (sets.length === 0)
+            return;
+        values.push(id);
+        db.prepare(`UPDATE workflow_runs SET ${sets.join(', ')} WHERE id = ?`).run(...values);
+    };
+    const getRun = (id) => {
+        const row = db
+            .prepare(`SELECT ${SELECT_RUN_COLUMNS} FROM workflow_runs WHERE id = ?`)
+            .get(id);
+        return row ? toRecord(row) : undefined;
+    };
+    const listWorkspaceRuns = (workspaceId) => db
+        .prepare(`SELECT ${SELECT_RUN_COLUMNS} FROM workflow_runs WHERE workspace_id = ? ORDER BY created_at DESC, id DESC`)
+        .all(workspaceId).map(toRecord);
+    // Boot sweep: a run still 'running' after a restart can never resume, so mark
+    // it interrupted (spec §13 — the UI offers Resume; we never auto-resume).
+    const markUnfinishedRunsInterrupted = () => {
+        db.prepare("UPDATE workflow_runs SET status = 'interrupted', finished_at = ? WHERE status = 'running'").run(Date.now());
+    };
+    return { createRun, updateRun, getRun, listWorkspaceRuns, markUnfinishedRunsInterrupted };
+};