agent-dealer 1.2.11 → 1.2.13

package/bundle/server/dist/routes/issues.js

@@ -9,7 +9,8 @@ import { listUsageEventsForIssue, summarizeIssueUsage } from "../repository/usag
 import { listWorkflowEventsForIssue, appendWorkflowEvent, listWorkflowInstancesForIssue, getActiveWorkflowInstance, } from "../repository/workflow-events.js";
 import { listHumanActionsForIssue, listOpenHumanActions } from "../repository/human-actions.js";
 import { listFindingsForIssue } from "../repository/findings.js";
-import { abortIssueAsync, canEditParkedIssue, checkIssueReadiness, closeReadyIssue } from "../coordinator/commands.js";
+import { abortIssueAsync, applyParkedEdit, canEditParkedIssue, capWaitForIssue, checkIssueReadiness, closeReadyIssue, parkCapWait, PARKED_EDITABLE_FIELDS } from "../coordinator/commands.js";
+import { getAgent } from "../repository/agents.js";
 import { executeIssueNow, isStartable, queueStatusForIssue, refreshQueueWaitReasonForIssue, startIssueViaQueue, } from "../coordinator/admission.js";
 import { computeHumanWaitMs } from "../coordinator/metrics.js";
 import { enqueueIssue, enqueueIssueWithOutcome, getQueuedEntryForIssue } from "../repository/queue-entries.js";
@@ -19,8 +20,6 @@ import { deriveLiveProgressFromLog } from "../coordinator/session-progress.js";
 import { branchTipStatusForIssue } from "../coordinator/branch-tip-status.js";
 const TRACE_DEFAULT_MAX_CHARS = 50_000;
 const TRACE_HARD_MAX_CHARS = 200_000;
-/** NOT-185: the only fields PATCH accepts at an open attempts_exhausted park. */
-const PARKED_EDITABLE_FIELDS = new Set(["title", "description", "acceptanceCriteria"]);
 /** Non-numeric, non-finite, zero, or negative all fall back to the default rather than
  * disabling the cap — `Number("not-a-number")` is NaN, and `Math.min(NaN, N)` is NaN,
  * which made the original `.slice(-NaN)` behave as `.slice(0)` (the whole file). */
@@ -142,6 +141,9 @@ export async function registerIssueRoutes(app) {
             queued: getQueuedEntryForIssue(id) != null,
             // NOT-118: position + current wait reason so a queued `ready` issue never reads as idle.
             queueEntry: queueStatusForIssue(id),
+            // NOT-358: usage-cap / deck-outage wait behind an availability window, if any —
+            // the dashboard offers "Park for human" next to the wait notice.
+            capWait: capWaitForIssue(id),
         };
     });
     /** NOT-173: stable issue-level execution read model. The existing
@@ -272,17 +274,23 @@ export async function registerIssueRoutes(app) {
             if (fresh.status !== "ready" && fresh.status !== "needs_human") {
                 return `Cannot edit an issue that is ${fresh.status}`;
             }
+            // NOT-358: an agent swap must never race a live worker — a running session
+            // owns the frozen profile snapshot the next spawn would read.
+            if (getActiveWorkerSessionForIssue(id)) {
+                return "Cannot edit an issue with an actively running session";
+            }
             // NOT-185: the one active-workflow exception — parked at an open attempts_exhausted
-            // action with nothing pending/leased. Retry re-freezes the snapshot from these fields.
+            // or policy_escalation action with nothing pending/leased. A resume re-freezes the
+            // snapshot (task fields) and the next round's profile snapshot (agent fields).
             if (getActiveWorkflowInstance(id)) {
                 if (!canEditParkedIssue(fresh)) {
                     return "Cannot edit an issue with an active workflow";
                 }
-                // Only the fields the snapshot is frozen from may change at the park: the review budget,
-                // repo/base branch, agents and autoMerge stay as the running workflow saw them.
+                // Only the re-frozen inputs may change at the park: repo/base branch, the review
+                // budget and autoMerge stay as the running workflow saw them.
                 const blocked = Object.keys(parsed.data).filter((k) => !PARKED_EDITABLE_FIELDS.has(k));
                 if (blocked.length > 0) {
-                    return `Only title, description and acceptanceCriteria can be edited while parked at attempts_exhausted (got: ${blocked.join(", ")})`;
+                    return `Only title, description, acceptanceCriteria, developerAgentId and reviewerAgentId can be edited while parked (got: ${blocked.join(", ")})`;
                 }
             }
             return null;
@@ -290,6 +298,19 @@ export async function registerIssueRoutes(app) {
         const fastPath = guardConflict(issue);
         if (fastPath)
             return reply.status(409).send({ error: fastPath });
+        // An active workflow instance here is a parked edit — the fast-path guard already
+        // established it is editable. The kernel command re-checks that guard inside its own
+        // transaction, so an edit that races a resume fails closed instead of landing on a
+        // live snapshot. Queue order is untouched — position is preserved by construction.
+        if (getActiveWorkflowInstance(id)) {
+            const result = applyParkedEdit(id, parsed.data);
+            if (!result.ok)
+                return reply.status(result.code).send({ error: result.error });
+            // NOT-217: re-derive the visible wait reason now that admission may see a
+            // different (e.g. healthy) agent.
+            await refreshQueueWaitReasonForIssue(id);
+            return result.issue;
+        }
         // Guard re-check + row write + `issue.reassigned` audit in one transaction, so an
         // edit that races admission fails closed instead of landing on a live snapshot.
         // Queue order is untouched (updateIssue never writes queue_entries) — position is
@@ -303,6 +324,14 @@ export async function registerIssueRoutes(app) {
                 const conflict = guardConflict(fresh);
                 if (conflict)
                     throw Object.assign(new Error(conflict), { code: 409 });
+                // NOT-358: an agent assignment must reference an existing profile — a dangling
+                // id would only surface later as a failed admission or a broken resume.
+                for (const role of ["developerAgentId", "reviewerAgentId"]) {
+                    const agentId = parsed.data[role];
+                    if (agentId !== undefined && !getAgent(agentId)) {
+                        throw Object.assign(new Error(`Unknown agent profile: ${agentId}`), { code: 400 });
+                    }
+                }
                 const next = updateIssue(id, parsed.data);
                 // NOT-217/NOT-240: durable configuration audit — only when an execution input
                 // actually changed, comparing against the freshly read row so a concurrent edit
@@ -339,6 +368,8 @@ export async function registerIssueRoutes(app) {
             }
             const code = err.code;
             const message = err instanceof Error ? err.message : String(err);
+            if (code === 400)
+                return reply.status(400).send({ error: message });
             if (code === 404)
                 return reply.status(404).send({ error: message });
             if (code === 409)
@@ -390,6 +421,22 @@ export async function registerIssueRoutes(app) {
             waitReason: queued?.waitReason ?? null,
         });
     });
+    /**
+     * NOT-358: park an issue that is waiting on a usage-cap or deck-outage window for a
+     * human. Cancels the wait without touching the worktree, moves the issue to
+     * `needs_human` with one open `policy_escalation` naming the cap and its `until`,
+     * and answers the updated issue plus the new action id. A `resume` of that action
+     * continues with whichever agents are then set.
+     */
+    app.post("/api/issues/:id/park", async (req, reply) => {
+        const { id } = req.params;
+        const body = (req.body ?? {});
+        const parkedBy = typeof body.parkedBy === "string" && body.parkedBy.trim() ? body.parkedBy.trim() : "human";
+        const result = parkCapWait(id, parkedBy);
+        if (!result.ok)
+            return reply.status(result.code).send({ error: result.error });
+        return { ...getIssue(id), humanActionId: result.humanActionId };
+    });
     app.post("/api/issues/:id/abort", async (req, reply) => {
         const { id } = req.params;
         const body = req.body;

package/bundle/server/dist/routes/issues.test.js

@@ -13,20 +13,21 @@ function tmpTraceFile(content) {
 }
 process.env.AGENT_DEALER_HOME = fs.mkdtempSync(path.join(os.tmpdir(), "dealer-issue-routes-"));
 const { migrate, getDb } = await import("../db/index.js");
-const { BUILTIN_AGENT_CLAUDE_ID, BUILTIN_AGENT_CURSOR_ID } = await import("@agent-dealer/shared");
+const { BUILTIN_AGENT_CLAUDE_ID, BUILTIN_AGENT_CODEX_ID, BUILTIN_AGENT_CURSOR_ID } = await import("@agent-dealer/shared");
 const { registerIssueRoutes } = await import("./issues.js");
 const { transitionIssue, listIssuesByExternalId, getIssue } = await import("../repository/issues.js");
 const { createHumanAction } = await import("../repository/human-actions.js");
 const { createIssueArtifact } = await import("../repository/artifacts.js");
-const { claimWorkItem } = await import("../repository/work-items.js");
+const { claimWorkItem, cancelWorkItem } = await import("../repository/work-items.js");
+const { randomUUID } = await import("node:crypto");
 const { listHumanActionsForIssue } = await import("../repository/human-actions.js");
-const { applyCompletion, resolveHumanActionAndAdvance, getTaskSnapshot } = await import("../coordinator/commands.js");
+const { applyCompletion, resolveHumanActionAndAdvance, getTaskSnapshot, startWorkflow } = await import("../coordinator/commands.js");
 const { ReviewerResult } = await import("../coordinator/reviewer-result.js");
 const { getQueuedEntryForIssue, listQueuedEntries } = await import("../repository/queue-entries.js");
 const { admitNext, setAdmissionHealthCheckerForTests, queueStatusForIssue } = await import("../coordinator/admission.js");
 const { listWorkflowInstancesForIssue } = await import("../repository/workflow-events.js");
 const { listWorkItemsForIssue } = await import("../repository/work-items.js");
-const { listWorkerSessionsForIssue } = await import("../repository/worker-sessions.js");
+const { createWorkerSession, listWorkerSessionsForIssue, startSession } = await import("../repository/worker-sessions.js");
 const { createAgent } = await import("../repository/agents.js");
 const { listWorkflowEventsForIssue } = await import("../repository/workflow-events.js");
 before(() => {
@@ -281,14 +282,14 @@ test("NOT-185: PATCH /api/issues/:id succeeds while parked at attempts_exhausted
             risks: []
         })
     });
-    // Non-task fields stay frozen at the park — notably the review budget (a non-goal).
+    // Non-task, non-agent fields stay frozen at the park — notably the review budget
+    // (a non-goal). Agent profiles are swappable at the park (NOT-358, covered below),
+    // so they are no longer in this blocked list.
     for (const payload of [
         { maxReviewRounds: 5 },
         { maxInfraAttempts: 3 },
         { repo: "acme/other" },
         { baseBranch: "develop" },
-        { developerAgentId: BUILTIN_AGENT_CURSOR_ID },
-        { reviewerAgentId: BUILTIN_AGENT_CLAUDE_ID },
         { autoMerge: true },
         { title: "Mixed", maxReviewRounds: 5 },
     ]) {
@@ -1158,3 +1159,321 @@ test("NOT-239: closed issues leave the default paginated list but stay findable
     assert.ok(legacy.some((i) => i.id === closedId));
     await app.close();
 });
+// NOT-358: parked agent-swap and cap-wait park shared helpers.
+async function n358ParkAtAttemptsExhausted(app, extra = {}) {
+    const created = (await app.inject({
+        method: "POST",
+        url: "/api/issues",
+        payload: {
+            title: "Swap me",
+            description: "old",
+            repo: "acme/app",
+            baseBranch: "main",
+            developerAgentId: BUILTIN_AGENT_CLAUDE_ID,
+            reviewerAgentId: BUILTIN_AGENT_CURSOR_ID,
+            maxReviewRounds: 1,
+            acceptanceCriteria: "Old criteria",
+            ...extra,
+        },
+    })).json();
+    // Force-started: an HTTP start would queue behind other in-flight issues in the
+    // same test — the PATCH surface under test is identical either way.
+    assert.equal(startWorkflow(created.id).ok, true);
+    const complete = async (outcome) => {
+        const item = claimWorkItem("route-test", { leaseMs: 60_000 });
+        await applyCompletion(item.id, item.leaseToken, outcome);
+    };
+    await complete({ kind: "clean_handoff", branch: "swap-b", headSha: "abc", baseSha: "base", prNumber: 1, prUrl: "https://gh/pr/1" });
+    await complete({
+        kind: "verdict",
+        result: ReviewerResult.parse({
+            verdict: "changes_requested",
+            baseSha: "b",
+            headSha: "h",
+            acceptanceCriteriaAssessment: "ok",
+            evidenceAssessment: "ok",
+            findings: [],
+            risks: [],
+        }),
+    });
+    return created.id;
+}
+/** The frozen profile snapshot the resumed round carries — what the next session spawns from. */
+function n358PendingSnapshot(issueId, kind) {
+    const item = listWorkItemsForIssue(issueId).find((i) => i.status === "pending" && i.kind === kind);
+    assert.ok(item, `expected a pending ${kind} work item`);
+    const payload = JSON.parse(item.payloadJson);
+    const snapshot = JSON.parse(payload.profileSnapshot);
+    return snapshot;
+}
+test("NOT-358: PATCH swaps the developer alone at an attempts_exhausted park, and resume freezes the new profile", async () => {
+    const app = await buildApp();
+    const issueId = await n358ParkAtAttemptsExhausted(app);
+    const patch = (payload) => app.inject({ method: "PATCH", url: `/api/issues/${issueId}`, payload });
+    const res = await patch({ developerAgentId: BUILTIN_AGENT_CODEX_ID });
+    assert.equal(res.statusCode, 200);
+    const body = res.json();
+    assert.equal(body.developerAgentId, BUILTIN_AGENT_CODEX_ID);
+    assert.equal(body.reviewerAgentId, BUILTIN_AGENT_CURSOR_ID, "the other role is untouched");
+    assert.equal(body.branch, "swap-b", "the swap keeps the existing branch");
+    assert.deepEqual([body.currentRound, body.maxReviewRounds], [1, 1], "rounds are unchanged");
+    const events = listWorkflowEventsForIssue(issueId).filter((e) => e.type === "issue.reassigned");
+    assert.equal(events.length, 1);
+    assert.deepEqual(JSON.parse(events[0].payloadJson), {
+        fromRepo: "github.com/acme/app",
+        toRepo: "github.com/acme/app",
+        fromDeveloperAgentId: BUILTIN_AGENT_CLAUDE_ID,
+        toDeveloperAgentId: BUILTIN_AGENT_CODEX_ID,
+        fromReviewerAgentId: BUILTIN_AGENT_CURSOR_ID,
+        toReviewerAgentId: BUILTIN_AGENT_CURSOR_ID,
+    });
+    const action = listHumanActionsForIssue(issueId).find((a) => a.actionType === "attempts_exhausted");
+    assert.equal(resolveHumanActionAndAdvance(action.id, "op", "retry").ok, true);
+    // The resumed developer round carries the NEW profile — the worker loop builds the
+    // spawned session (agent + runtime) from exactly this snapshot.
+    const snapshot = n358PendingSnapshot(issueId, "developer");
+    assert.equal(snapshot.agentId, BUILTIN_AGENT_CODEX_ID);
+    assert.equal(snapshot.runtime, "codex_local");
+    assert.equal(snapshot.role, "developer");
+    await app.close();
+});
+test("NOT-358: PATCH swaps the reviewer alone and both roles together at a policy_escalation park", async () => {
+    const app = await buildApp();
+    const created = (await app.inject({
+        method: "POST",
+        url: "/api/issues",
+        payload: {
+            title: "Capped",
+            repo: "acme/app",
+            baseBranch: "main",
+            developerAgentId: BUILTIN_AGENT_CLAUDE_ID,
+            reviewerAgentId: BUILTIN_AGENT_CURSOR_ID,
+            acceptanceCriteria: "It works",
+        },
+    })).json();
+    assert.equal((await app.inject({ method: "POST", url: `/api/issues/${created.id}/start` })).statusCode, 200);
+    const item = claimWorkItem("route-test", { leaseMs: 60_000 });
+    const until = new Date(Date.now() + 300_000).toISOString();
+    await applyCompletion(item.id, item.leaseToken, {
+        kind: "usage_capped",
+        until,
+        reason: "claude_code usage capped — five_hour limit rejected",
+    });
+    // The detail names the wait — the dashboard parks from this notice.
+    const waiting = (await app.inject({ method: "GET", url: `/api/issues/${created.id}` })).json();
+    assert.deepEqual(waiting.capWait, {
+        kind: "usage_capped",
+        until,
+        reason: "claude_code usage capped — five_hour limit rejected",
+    });
+    const parked = await app.inject({ method: "POST", url: `/api/issues/${created.id}/park`, payload: {} });
+    assert.equal(parked.statusCode, 200);
+    const parkedBody = parked.json();
+    assert.equal(parkedBody.status, "needs_human");
+    assert.ok(parkedBody.humanActionId);
+    const patch = (payload) => app.inject({ method: "PATCH", url: `/api/issues/${created.id}`, payload });
+    const revRes = await patch({ reviewerAgentId: BUILTIN_AGENT_CLAUDE_ID });
+    assert.equal(revRes.statusCode, 200);
+    assert.equal(revRes.json().reviewerAgentId, BUILTIN_AGENT_CLAUDE_ID);
+    const bothRes = await patch({ developerAgentId: BUILTIN_AGENT_CODEX_ID, reviewerAgentId: BUILTIN_AGENT_CURSOR_ID });
+    assert.equal(bothRes.statusCode, 200);
+    const bothBody = bothRes.json();
+    assert.equal(bothBody.developerAgentId, BUILTIN_AGENT_CODEX_ID);
+    assert.equal(bothBody.reviewerAgentId, BUILTIN_AGENT_CURSOR_ID);
+    assert.equal(listWorkflowEventsForIssue(created.id).filter((e) => e.type === "issue.reassigned").length, 2, "one reassigned event per PATCH");
+    const action = listHumanActionsForIssue(created.id).find((a) => a.status === "open");
+    assert.equal(action.actionType, "policy_escalation");
+    assert.equal(resolveHumanActionAndAdvance(action.id, "op", "resume").ok, true);
+    const snapshot = n358PendingSnapshot(created.id, "developer");
+    assert.equal(snapshot.agentId, BUILTIN_AGENT_CODEX_ID);
+    assert.equal(snapshot.runtime, "codex_local");
+    await app.close();
+});
+test("NOT-358: PATCH agent IDs are rejected while running, queued behind work, completed, or with an active session (409), and unknown IDs are 400", async () => {
+    const app = await buildApp();
+    const mk = async (title) => (await app.inject({
+        method: "POST",
+        url: "/api/issues",
+        payload: {
+            title,
+            repo: "acme/app",
+            baseBranch: "main",
+            developerAgentId: BUILTIN_AGENT_CLAUDE_ID,
+            reviewerAgentId: BUILTIN_AGENT_CURSOR_ID,
+            acceptanceCriteria: "It works",
+        },
+    })).json().id;
+    const patch = (id, payload) => app.inject({ method: "PATCH", url: `/api/issues/${id}`, payload });
+    // `claimWorkItem` takes the oldest claimable item across issues — cancel each flow's
+    // leftovers so later flows claim their own items.
+    const cancelPending = (id) => {
+        for (const i of listWorkItemsForIssue(id)) {
+            if (i.status === "pending" || i.status === "leased")
+                cancelWorkItem(i.id);
+        }
+    };
+    // Running: a pending developer item owns the snapshot.
+    const runningId = await mk("Running swap");
+    assert.equal((await app.inject({ method: "POST", url: `/api/issues/${runningId}/start` })).statusCode, 200);
+    assert.equal((await patch(runningId, { developerAgentId: BUILTIN_AGENT_CODEX_ID })).statusCode, 409);
+    assert.equal(getIssue(runningId).developerAgentId, BUILTIN_AGENT_CLAUDE_ID);
+    assert.equal(listWorkflowEventsForIssue(runningId).filter((e) => e.type === "issue.reassigned").length, 0);
+    cancelPending(runningId);
+    // Queued behind work: parked at policy_escalation but a work item is still pending.
+    // Force-started directly: an HTTP start would queue behind the running issue above.
+    const queuedId = await mk("Queued swap");
+    assert.equal(startWorkflow(queuedId).ok, true);
+    transitionIssue(queuedId, "needs_human");
+    createHumanAction({
+        issueId: queuedId,
+        actionType: "policy_escalation",
+        reason: "test park",
+        question: "Resume?",
+    });
+    assert.equal((await patch(queuedId, { reviewerAgentId: BUILTIN_AGENT_CLAUDE_ID })).statusCode, 409);
+    assert.equal(getIssue(queuedId).reviewerAgentId, BUILTIN_AGENT_CURSOR_ID);
+    cancelPending(queuedId);
+    // Completed: history is immutable.
+    const doneId = await mk("Done swap");
+    transitionIssue(doneId, "developing");
+    transitionIssue(doneId, "reviewing");
+    transitionIssue(doneId, "final_review");
+    transitionIssue(doneId, "done");
+    assert.equal((await patch(doneId, { developerAgentId: BUILTIN_AGENT_CODEX_ID })).statusCode, 409);
+    // Active session: parked with nothing pending/leased, but a worker still runs.
+    const sessionId = await mk("Session swap");
+    assert.equal(startWorkflow(sessionId).ok, true);
+    const pending = claimWorkItem("route-test", { leaseMs: 60_000 });
+    assert.equal(pending.issueId, sessionId);
+    cancelWorkItem(pending.id);
+    transitionIssue(sessionId, "needs_human");
+    createHumanAction({
+        issueId: sessionId,
+        actionType: "policy_escalation",
+        reason: "test park",
+        question: "Resume?",
+    });
+    const worker = createWorkerSession({
+        issueId: sessionId,
+        role: "developer",
+        round: 1,
+        agentId: BUILTIN_AGENT_CLAUDE_ID,
+        runtime: "claude_code",
+    });
+    startSession(worker.id);
+    const sessionRes = await patch(sessionId, { developerAgentId: BUILTIN_AGENT_CODEX_ID });
+    assert.equal(sessionRes.statusCode, 409);
+    assert.match(sessionRes.json().error, /running session/);
+    assert.equal(getIssue(sessionId).developerAgentId, BUILTIN_AGENT_CLAUDE_ID);
+    // Unknown agent profiles are 400 and change nothing — at both park flavors.
+    const parkedId = await n358ParkAtAttemptsExhausted(app);
+    const unknownId = randomUUID();
+    assert.equal((await patch(parkedId, { developerAgentId: unknownId })).statusCode, 400);
+    assert.equal((await patch(parkedId, { reviewerAgentId: unknownId })).statusCode, 400);
+    assert.equal(getIssue(parkedId).developerAgentId, BUILTIN_AGENT_CLAUDE_ID);
+    assert.equal(getIssue(parkedId).reviewerAgentId, BUILTIN_AGENT_CURSOR_ID);
+    // Locked fields stay locked at a policy_escalation park too.
+    assert.equal((await patch(queuedId, { maxReviewRounds: 5 })).statusCode, 409);
+    await app.close();
+});
+test("NOT-358: POST /api/issues/:id/park parks cap and outage waits, and rejects anything else", async () => {
+    const app = await buildApp();
+    assert.equal((await app.inject({ method: "POST", url: "/api/issues/does-not-exist/park", payload: {} })).statusCode, 404);
+    // No active workflow: nothing to park.
+    const ready = (await app.inject({
+        method: "POST",
+        url: "/api/issues",
+        payload: {
+            title: "Never started",
+            repo: "acme/app",
+            baseBranch: "main",
+            developerAgentId: BUILTIN_AGENT_CLAUDE_ID,
+            reviewerAgentId: BUILTIN_AGENT_CURSOR_ID,
+            acceptanceCriteria: "It works",
+        },
+    })).json();
+    assert.equal((await app.inject({ method: "POST", url: `/api/issues/${ready.id}/park`, payload: {} })).statusCode, 409);
+    // A plain pending item is not a cap wait.
+    const plain = (await app.inject({
+        method: "POST",
+        url: "/api/issues",
+        payload: {
+            title: "Plain pending",
+            repo: "acme/app",
+            baseBranch: "main",
+            developerAgentId: BUILTIN_AGENT_CLAUDE_ID,
+            reviewerAgentId: BUILTIN_AGENT_CURSOR_ID,
+            acceptanceCriteria: "It works",
+        },
+    })).json();
+    assert.equal((await app.inject({ method: "POST", url: `/api/issues/${plain.id}/start` })).statusCode, 200);
+    assert.equal((await app.inject({ method: "POST", url: `/api/issues/${plain.id}/park`, payload: {} })).statusCode, 409);
+    // Cancel the plain pending item — `claimWorkItem` takes the oldest claimable item
+    // across issues, so later flows must not see it.
+    for (const i of listWorkItemsForIssue(plain.id)) {
+        if (i.status === "pending" || i.status === "leased")
+            cancelWorkItem(i.id);
+    }
+    // A deck-outage wait parks the same way a usage-cap wait does.
+    const outage = (await app.inject({
+        method: "POST",
+        url: "/api/issues",
+        payload: {
+            title: "Outage wait",
+            repo: "acme/app",
+            baseBranch: "main",
+            developerAgentId: BUILTIN_AGENT_CLAUDE_ID,
+            reviewerAgentId: BUILTIN_AGENT_CURSOR_ID,
+            acceptanceCriteria: "It works",
+        },
+    })).json();
+    // Force-started: the plain issue above still holds the admission slot.
+    assert.equal(startWorkflow(outage.id).ok, true);
+    const outageItem = claimWorkItem("route-test", { leaseMs: 60_000 });
+    assert.equal(outageItem.issueId, outage.id);
+    await applyCompletion(outageItem.id, outageItem.leaseToken, {
+        kind: "deck_unavailable",
+        reason: "Agent Deck unreachable — connection refused",
+    });
+    const outagePark = await app.inject({ method: "POST", url: `/api/issues/${outage.id}/park`, payload: {} });
+    assert.equal(outagePark.statusCode, 200);
+    const outageBody = outagePark.json();
+    assert.equal(outageBody.status, "needs_human");
+    const outageAction = listHumanActionsForIssue(outage.id).find((a) => a.id === outageBody.humanActionId);
+    assert.equal(outageAction.actionType, "policy_escalation");
+    assert.match(outageAction.reason, /Agent Deck outage/);
+    // A running session blocks the park even when a cap wait is pending.
+    const live = (await app.inject({
+        method: "POST",
+        url: "/api/issues",
+        payload: {
+            title: "Live session",
+            repo: "acme/app",
+            baseBranch: "main",
+            developerAgentId: BUILTIN_AGENT_CLAUDE_ID,
+            reviewerAgentId: BUILTIN_AGENT_CURSOR_ID,
+            acceptanceCriteria: "It works",
+        },
+    })).json();
+    assert.equal(startWorkflow(live.id).ok, true);
+    const liveItem = claimWorkItem("route-test", { leaseMs: 60_000 });
+    assert.equal(liveItem.issueId, live.id);
+    await applyCompletion(liveItem.id, liveItem.leaseToken, {
+        kind: "usage_capped",
+        until: new Date(Date.now() + 300_000).toISOString(),
+        reason: "claude_code usage capped — test",
+    });
+    const liveSession = createWorkerSession({
+        issueId: live.id,
+        role: "developer",
+        round: 1,
+        agentId: BUILTIN_AGENT_CLAUDE_ID,
+        runtime: "claude_code",
+    });
+    startSession(liveSession.id);
+    const livePark = await app.inject({ method: "POST", url: `/api/issues/${live.id}/park`, payload: {} });
+    assert.equal(livePark.statusCode, 409);
+    assert.equal(getIssue(live.id).status, "developing");
+    assert.ok(listWorkItemsForIssue(live.id).some((i) => i.status === "pending"), "the rejected park cancels nothing");
+    await app.close();
+});

package/bundle/server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-dealer/server",
-  "version": "1.2.11",
+  "version": "1.2.13",
   "type": "module",
   "main": "dist/index.js",
   "files": [
@@ -22,7 +22,7 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@agent-dealer/shared": "1.2.11",
+    "@agent-dealer/shared": "1.2.13",
     "@fastify/cors": "^11.0.1",
     "@fastify/static": "^8.2.0",
     "@modelcontextprotocol/sdk": "^1.29.0",