agent-relay-server 0.10.20 → 0.10.22

package/scripts/orchestrator-spawn-smoke.ts

@@ -1,4 +1,6 @@
 #!/usr/bin/env bun
+import { hostname } from "node:os";
+
 type Orchestrator = {
   id: string;
   status: string;
@@ -20,7 +22,11 @@ type Agent = {
 const args = process.argv.slice(2);
 let relayUrl = process.env.AGENT_RELAY_URL || "http://127.0.0.1:4850";
 let orchestratorId = process.env.AGENT_RELAY_SMOKE_ORCHESTRATOR || "";
-let cwd = process.env.AGENT_RELAY_SMOKE_CWD || process.cwd();
+// Default cwd is resolved from the selected orchestrator's baseDir below, not
+// the local process.cwd() — the chosen orchestrator may be on a different host
+// (e.g. macOS macmini with /Users/admin/projects) where a local Linux path
+// fails cwd containment.
+let cwd = process.env.AGENT_RELAY_SMOKE_CWD || "";
 let timeoutMs = Number(process.env.AGENT_RELAY_SMOKE_TIMEOUT_MS || 90_000);
 let providers = (process.env.AGENT_RELAY_SMOKE_PROVIDERS || "codex,claude").split(",").filter(Boolean);
 
@@ -86,12 +92,30 @@ function findSpawnedAgent(agents: Agent[], provider: string, label: string, star
 }
 
 const orchestrators = await api<Orchestrator[]>("GET", "/orchestrators");
+// Default selection prefers the orchestrator on the same host as the relay (the
+// gate runs there): a local spawn is faster and avoids cross-host teardown
+// flakiness. Fall back to any online orchestrator. An explicit --orchestrator
+// always wins — pair it with --cwd (or rely on the baseDir default below) to
+// target a remote host such as a macOS macmini.
+const onlineOrchestrators = orchestrators.filter((orch) => orch.status === "online");
+const localOrchestrator = onlineOrchestrators.find((orch) => orch.id === hostname());
 const orchestrator = orchestratorId
   ? orchestrators.find((orch) => orch.id === orchestratorId)
-  : orchestrators.find((orch) => orch.status === "online");
+  : localOrchestrator ?? onlineOrchestrators[0];
 if (!orchestrator) throw new Error(orchestratorId ? `orchestrator not found: ${orchestratorId}` : "no online orchestrator found");
 if (orchestrator.status !== "online") throw new Error(`orchestrator ${orchestrator.id} is ${orchestrator.status}`);
 
+// Resolve the spawn cwd against the chosen orchestrator's own base directory so
+// the smoke works regardless of which host runs it. An explicit --cwd / env
+// override still wins (and is subject to the orchestrator's containment check).
+if (!cwd) {
+  if (!orchestrator.baseDir) {
+    throw new Error(`orchestrator ${orchestrator.id} did not report a baseDir; pass --cwd or set AGENT_RELAY_SMOKE_CWD`);
+  }
+  cwd = orchestrator.baseDir;
+}
+console.log(`using cwd ${cwd} on ${orchestrator.id} (base ${orchestrator.baseDir})`);
+
 for (const provider of providers) {
   if (!orchestrator.providers.includes(provider)) {
     console.log(`skip ${provider}: orchestrator ${orchestrator.id} does not support it`);

package/src/db.ts

@@ -41,6 +41,7 @@ import type {
   OrchestratorHealth,
   OrchestratorRuntimeInput,
   OrchestratorStatus,
+  OrchestratorUpgradeState,
   PairActionInput,
   PairMessageInput,
   PairSession,
@@ -4084,7 +4085,7 @@ export function pollMessages(query: PollQuery): Message[] {
 }
 
 function messageRequiresReply(message: Message): boolean {
-  if (message.kind === "system" || message.kind === "control") return false;
+  if (message.kind === "system" || message.kind === "control" || message.kind === "session") return false;
   if (message.from === "user") return true;
   if (message.kind === "task" || message.kind === "channel.event") return true;
   return Boolean(message.payload?.source);
@@ -4132,7 +4133,7 @@ function replyObligationFromMessage(message: Message, agentId: string): ReplyObl
     ...(message.channel ? { channel: message.channel } : {}),
     bodyPreview: message.body.length > 240 ? `${message.body.slice(0, 240)}\n[truncated]` : message.body,
     createdAt: message.createdAt,
-    replyCommand: `agent-relay /reply ${message.id} --stdin < response.md`,
+    replyCommand: `agent-relay /reply ${message.id} --stdin < .agent-relay/sessions/${agentId}/tmp/reply.md`,
   };
 }
 
@@ -4652,6 +4653,11 @@ function rowToOrchestrator(row: any): Orchestrator {
   const providerStatus = Array.isArray(meta.providerStatus) ? meta.providerStatus as Orchestrator["providerStatus"] : undefined;
   const providerCatalog = Array.isArray(meta.providerCatalog) ? meta.providerCatalog as Orchestrator["providerCatalog"] : undefined;
   const compatibility = contractCompatibility(contracts, { orchestratorProtocol: CONTRACT_REQUIREMENTS.orchestratorProtocol });
+  const supervisorRaw = stringValue(meta.supervisor);
+  const supervisor = supervisorRaw === "systemd" || supervisorRaw === "process" || supervisorRaw === "unknown" ? supervisorRaw : undefined;
+  const selfUnit = stringValue(meta.selfUnit);
+  const runtimePrefix = stringValue(meta.runtimePrefix);
+  const upgrade = parseOrchestratorUpgrade(meta.upgrade);
   return {
     id: row.id,
     hostname: row.hostname,
@@ -4671,6 +4677,10 @@ function rowToOrchestrator(row: any): Orchestrator {
     ...(Number.isFinite(protocolVersion) ? { protocolVersion } : {}),
     ...(gitSha ? { gitSha } : {}),
     health: orchestratorHealth(version, compatibility),
+    ...(supervisor ? { supervisor } : {}),
+    ...(selfUnit ? { selfUnit } : {}),
+    ...(runtimePrefix ? { runtimePrefix } : {}),
+    ...(upgrade ? { upgrade } : {}),
     meta,
     managedAgents: parseJson<ManagedAgent[]>(row.managed_agents, []),
     lastSeen: row.last_seen,
@@ -4678,6 +4688,39 @@ function rowToOrchestrator(row: any): Orchestrator {
   };
 }
 
+function parseOrchestratorUpgrade(value: unknown): OrchestratorUpgradeState | undefined {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return undefined;
+  const v = value as Record<string, unknown>;
+  const desiredVersion = stringValue(v.desiredVersion);
+  const status = v.status;
+  if (!desiredVersion || (status !== "pending" && status !== "succeeded" && status !== "failed")) return undefined;
+  return {
+    desiredVersion,
+    status,
+    ...(stringValue(v.commandId) ? { commandId: stringValue(v.commandId) } : {}),
+    ...(Array.isArray(v.providers) ? { providers: v.providers.filter((p): p is string => typeof p === "string") } : {}),
+    ...(stringValue(v.fromVersion) ? { fromVersion: stringValue(v.fromVersion) } : {}),
+    ...(stringValue(v.requestedBy) ? { requestedBy: stringValue(v.requestedBy) } : {}),
+    requestedAt: typeof v.requestedAt === "number" ? v.requestedAt : 0,
+    ...(typeof v.settledAt === "number" ? { settledAt: v.settledAt } : {}),
+    ...(stringValue(v.error) ? { error: stringValue(v.error) } : {}),
+  };
+}
+
+/**
+ * Set or clear the orchestrator's in-flight/last upgrade state. Stored in the
+ * meta blob (no schema change). Pass null to clear.
+ */
+export function setOrchestratorUpgradeState(id: string, state: OrchestratorUpgradeState | null): Orchestrator | null {
+  const row = db.prepare("SELECT meta FROM orchestrators WHERE id = ?").get(id) as { meta?: string } | undefined;
+  if (!row) return null;
+  const meta = parseJson<Record<string, unknown>>(row.meta ?? "{}", {});
+  if (state) meta.upgrade = state;
+  else delete meta.upgrade;
+  db.prepare("UPDATE orchestrators SET meta = ? WHERE id = ?").run(JSON.stringify(meta), id);
+  return getOrchestrator(id);
+}
+
 function rowToWorkspace(row: any): WorkspaceRecord {
   return {
     id: row.id,
@@ -4759,6 +4802,13 @@ function mergeOrchestratorRuntimeMeta(meta: Record<string, unknown>, input: Orch
 export function upsertOrchestrator(input: RegisterOrchestratorInput): Orchestrator {
   const now = Date.now();
   const agentId = `orchestrator-${input.id}`;
+  // Carry forward server-managed meta the orchestrator never reports (upgrade
+  // state) — registration meta would otherwise drop it on the very re-register
+  // that follows a self-upgrade restart, breaking version reconciliation.
+  const existingRow = db.prepare("SELECT meta FROM orchestrators WHERE id = ?").get(input.id) as { meta?: string } | undefined;
+  const existingMeta = existingRow ? parseJson<Record<string, unknown>>(existingRow.meta ?? "{}", {}) : {};
+  const mergedMeta = mergeOrchestratorRuntimeMeta(input.meta ?? {}, input);
+  if (existingMeta.upgrade !== undefined && mergedMeta.upgrade === undefined) mergedMeta.upgrade = existingMeta.upgrade;
   const stmt = db.prepare(`
     INSERT INTO orchestrators (id, hostname, status, agent_id, providers, base_dir, api_url, env_keys, meta, last_seen, created_at)
     VALUES ($id, $hostname, 'online', $agentId, $providers, $baseDir, $apiUrl, $envKeys, $meta, $now, $now)
@@ -4780,7 +4830,7 @@ export function upsertOrchestrator(input: RegisterOrchestratorInput): Orchestrat
     $baseDir: input.baseDir,
     $apiUrl: input.apiUrl ?? null,
     $envKeys: JSON.stringify(input.envKeys ?? []),
-    $meta: JSON.stringify(mergeOrchestratorRuntimeMeta(input.meta ?? {}, input)),
+    $meta: JSON.stringify(mergedMeta),
     $now: now,
   });
 
@@ -4865,26 +4915,48 @@ export function updateManagedAgents(id: string, agents: ManagedAgent[]): Orchest
 
 function upsertWorkspaceFromManagedAgent(agent: ManagedAgent): WorkspaceRecord | null {
   const workspace = agent.workspace;
-  if (!workspace?.id || workspace.mode !== "isolated" || !workspace.repoRoot || !workspace.worktreePath) return null;
-  return upsertWorkspace({
-    id: workspace.id,
-    repoRoot: workspace.repoRoot,
-    sourceCwd: workspace.sourceCwd ?? agent.cwd,
-    worktreePath: workspace.worktreePath,
-    branch: workspace.branch,
-    baseRef: workspace.baseRef,
-    baseSha: workspace.baseSha,
-    mode: workspace.mode,
-    requestedMode: workspace.requestedMode,
-    status: workspace.status ?? "active",
-    ownerAgentId: agent.agentId || undefined,
-    ownerPolicyName: agent.policyName,
-    ownerAutomationRunId: agent.automationRunId,
-    metadata: { provider: agent.provider, label: agent.label, sessionName: agent.sessionName, tmuxSession: agent.tmuxSession },
-  });
+  if (!workspace) return null;
+  if (workspace.mode === "isolated" && workspace.id && workspace.repoRoot && workspace.worktreePath) {
+    return upsertWorkspace({
+      id: workspace.id,
+      repoRoot: workspace.repoRoot,
+      sourceCwd: workspace.sourceCwd ?? agent.cwd,
+      worktreePath: workspace.worktreePath,
+      branch: workspace.branch,
+      baseRef: workspace.baseRef,
+      baseSha: workspace.baseSha,
+      mode: workspace.mode,
+      requestedMode: workspace.requestedMode,
+      status: workspace.status ?? "active",
+      ownerAgentId: agent.agentId || undefined,
+      ownerPolicyName: agent.policyName,
+      ownerAutomationRunId: agent.automationRunId,
+      metadata: { provider: agent.provider, label: agent.label, sessionName: agent.sessionName, tmuxSession: agent.tmuxSession },
+    });
+  }
+  // Shared-mode occupancy: one row per agent sharing a git repo, with no
+  // worktree. Records true repo occupancy in the Workspaces view (informational
+  // only — never a cleanup/merge target). Skip non-git launches.
+  const sharedRepoRoot = workspace.mode === "shared" ? (workspace.repoRoot ?? workspace.probe?.repoRoot) : undefined;
+  if (sharedRepoRoot && agent.agentId) {
+    return upsertWorkspace({
+      id: `shared-${agent.agentId}`,
+      repoRoot: sharedRepoRoot,
+      sourceCwd: workspace.sourceCwd ?? agent.cwd,
+      worktreePath: "",
+      mode: "shared",
+      requestedMode: workspace.requestedMode,
+      status: "active",
+      ownerAgentId: agent.agentId,
+      ownerPolicyName: agent.policyName,
+      ownerAutomationRunId: agent.automationRunId,
+      metadata: { occupancy: true, provider: agent.provider, label: agent.label, sessionName: agent.sessionName, tmuxSession: agent.tmuxSession },
+    });
+  }
+  return null;
 }
 
-function upsertWorkspace(input: Omit<WorkspaceRecord, "createdAt" | "updatedAt"> & Partial<Pick<WorkspaceRecord, "createdAt" | "updatedAt">>): WorkspaceRecord {
+export function upsertWorkspace(input: Omit<WorkspaceRecord, "createdAt" | "updatedAt"> & Partial<Pick<WorkspaceRecord, "createdAt" | "updatedAt">>): WorkspaceRecord {
   const now = Date.now();
   db.prepare(`
     INSERT INTO workspaces (id, repo_root, source_cwd, worktree_path, branch, base_ref, base_sha, mode, requested_mode, status, owner_agent_id, owner_policy_name, owner_automation_run_id, steward_agent_id, metadata, created_at, updated_at, ready_at, cleaned_at)
@@ -4947,6 +5019,10 @@ export function listWorkspaces(filter: { repoRoot?: string; ownerAgentId?: strin
   return (db.prepare(sql).all(...params) as any[]).map(rowToWorkspace);
 }
 
+export function deleteWorkspace(id: string): boolean {
+  return db.prepare("DELETE FROM workspaces WHERE id = ?").run(id).changes > 0;
+}
+
 export function updateWorkspaceStatus(id: string, status: WorkspaceStatus, metadata: Record<string, unknown> = {}): WorkspaceRecord | null {
   const existing = getWorkspace(id);
   if (!existing) return null;

package/src/lifecycle-manager.ts

@@ -1,6 +1,7 @@
+import { isAbsolute, relative, resolve } from "node:path";
 import { resolveProviderSelection } from "agent-relay-sdk/provider-catalog";
 import { createCommand } from "./commands-db";
-import { createActivityEvent, getAgent, getDb, getOrchestrator, resolveQueuedPolicyMessages } from "./db";
+import { createActivityEvent, deleteWorkspace, getAgent, getDb, getOrchestrator, listOrchestrators, listWorkspaces, resolveQueuedPolicyMessages } from "./db";
 import {
   getManagedAgentState,
   listSpawnPolicies,
@@ -162,6 +163,9 @@ export class LifecycleManager {
   }
 
   onAgentDisappeared(agentId: string): void {
+    // Reconcile the agent's worktrees before policy handling — this runs for
+    // every agent (managed or not), so it must not depend on a policy match.
+    this.reconcileWorkspacesForAgent(agentId);
     const policy = this.loadPolicies().find((item) => getManagedAgentState(item.name)?.agentId === agentId);
     if (!policy) return;
     const state = getManagedAgentState(policy.name);
@@ -570,6 +574,57 @@ export class LifecycleManager {
       data: { command },
     });
   }
+
+  // When an agent disappears, its isolated worktrees would otherwise sit
+  // `active` on disk forever. Dispatch a workspace.reconcile command to the
+  // owning orchestrator, which probes the worktree and either removes it (no
+  // work) or leaves it intact (the relay then flags it for review). Only live
+  // states are touched; if no online orchestrator owns the path we leave the
+  // row as-is so nothing is lost — it can be reconciled later.
+  private reconcileWorkspacesForAgent(agentId: string): void {
+    const owned = listWorkspaces({ ownerAgentId: agentId });
+    // Shared-mode rows are pure occupancy markers with nothing on disk — drop
+    // them outright when the occupant leaves; no orchestrator round-trip.
+    for (const ws of owned) {
+      if (ws.mode === "shared" && ws.status !== "cleaned") deleteWorkspace(ws.id);
+    }
+    const candidates = owned.filter(
+      (ws) => ws.mode === "isolated" && (ws.status === "active" || ws.status === "ready") && Boolean(ws.worktreePath),
+    );
+    if (!candidates.length) return;
+    const orchestrators = listOrchestrators();
+    for (const ws of candidates) {
+      const orch = orchestrators.find(
+        (candidate) => candidate.status === "online" && pathWithinBaseDir(ws.sourceCwd, candidate.baseDir),
+      );
+      if (!orch) continue;
+      const command = createCommand({
+        type: "workspace.reconcile",
+        source: "system",
+        target: orch.agentId,
+        correlationId: ws.id,
+        params: {
+          action: "reconcile",
+          workspaceId: ws.id,
+          repoRoot: ws.repoRoot,
+          worktreePath: ws.worktreePath,
+          branch: ws.branch,
+          baseRef: ws.baseRef,
+          baseSha: ws.baseSha,
+          reason: "owner-disappeared",
+          requestedBy: "lifecycle-manager",
+          requestedAt: this.now(),
+        },
+      });
+      this.emitCommand(command);
+    }
+  }
+}
+
+function pathWithinBaseDir(path: string | undefined, baseDir: string | undefined): boolean {
+  if (!path || !baseDir) return false;
+  const rel = relative(resolve(baseDir), resolve(path));
+  return rel === "" || (!!rel && !rel.startsWith("..") && !isAbsolute(rel));
 }
 
 let singleton: LifecycleManager | null = null;

package/src/maintenance.ts

@@ -4,19 +4,25 @@ import { expireStaleBusAgents } from "./bus";
 import { pruneOutbox } from "./bus-outbox";
 import { expireCommands } from "./commands-db";
 import { DAY_MS, OFFLINE_PRUNE_MS, REAP_INTERVAL_MS, STALE_TTL_MS } from "./config";
+import { isAbsolute, relative, resolve } from "node:path";
 import {
   createActivityEvent,
   evaluatePoolBindings,
   expireQueuedMessages,
   getDb,
+  listOrchestrators,
+  listWorkspaces,
   pruneOfflineAgents,
   pruneOldMessages,
   reapStaleAgents,
   reapStaleOrchestrators,
   releaseExpiredClaims,
   releaseOrphanedTasks,
+  sendMessage,
   sweepArtifacts,
+  updateWorkspaceStatus,
 } from "./db";
+import type { WorkspaceMergePreview, WorkspaceRecord, WorkspaceStatus } from "./types";
 import { emitRelayEvent } from "./events";
 import { getLifecycleManager } from "./lifecycle-manager";
 import { applyCommandToRecipe } from "./recipe-runner";
@@ -25,6 +31,7 @@ import {
   emitAgentStatus,
   emitMessageClaimReleased,
   emitMessageExpired,
+  emitNewMessage,
   emitOrchestratorStatus,
   emitPoolBindingChanged,
   emitTaskChanged,
@@ -36,6 +43,10 @@ const DEFAULT_TIMEOUT_MS = 30_000;
 const SCHEDULER_TICK_MS = 10_000;
 const OUTBOX_RETENTION_MS = Number(process.env.AGENT_RELAY_OUTBOX_RETENTION_MS) || 60 * 60 * 1000;
 const TOKEN_RECORD_RETENTION_SECONDS = Number(process.env.AGENT_RELAY_TOKEN_RECORD_RETENTION_SECONDS) || 7 * 24 * 60 * 60;
+const CONFLICT_SCAN_INTERVAL_MS = Number(process.env.AGENT_RELAY_CONFLICT_SCAN_INTERVAL_MS) || 2 * 60 * 1000;
+// Live statuses worth scanning. Terminal (cleaned/merged/abandoned) and
+// in-flight (cleanup_requested) states are skipped.
+const CONFLICT_SCAN_STATUSES = new Set<WorkspaceStatus>(["active", "ready", "review_requested", "merge_planned", "conflict"]);
 
 interface MaintenanceJobDefinition {
   id: string;
@@ -268,8 +279,114 @@ const definitions: MaintenanceJobDefinition[] = [
       return { prunedTokenJtis };
     },
   },
+  {
+    id: "workspace-conflict-scan",
+    title: "Workspace conflict scan",
+    description: "Probe active worktrees for divergence and auto-flag conflicts before merge time.",
+    intervalMs: CONFLICT_SCAN_INTERVAL_MS,
+    runOnStart: false,
+    timeoutMs: 60 * 1000,
+    handler: scanWorkspaceConflicts,
+  },
 ];
 
+function workspacePathWithinBase(path: string | undefined, baseDir: string | undefined): boolean {
+  if (!path || !baseDir) return false;
+  const rel = relative(resolve(baseDir), resolve(path));
+  return rel === "" || (!!rel && !rel.startsWith("..") && !isAbsolute(rel));
+}
+
+async function fetchHostMergePreview(apiUrl: string, workspace: WorkspaceRecord): Promise<WorkspaceMergePreview | { available: false } | null> {
+  const query = new URLSearchParams({ path: workspace.worktreePath });
+  if (workspace.baseRef) query.set("baseRef", workspace.baseRef);
+  if (workspace.baseSha) query.set("baseSha", workspace.baseSha);
+  const headers: Record<string, string> = {};
+  const token = process.env.AGENT_RELAY_TOKEN;
+  if (token) headers["X-Agent-Relay-Token"] = token;
+  try {
+    const res = await fetch(`${apiUrl}/api/workspace/merge-preview?${query.toString()}`, { headers, signal: AbortSignal.timeout(8_000) });
+    if (!res.ok) return null;
+    return await res.json() as WorkspaceMergePreview;
+  } catch {
+    return null;
+  }
+}
+
+// Iterate active worktrees and ask the owning host whether each can still merge
+// cleanly. Auto-flag `conflict` when a clean merge is no longer possible, and
+// auto-clear conflicts we set ourselves once they resolve (restoring the prior
+// status). Human-set conflicts are never cleared.
+async function scanWorkspaceConflicts(): Promise<Record<string, unknown>> {
+  const orchestrators = listOrchestrators().filter((orch) => orch.status === "online" && orch.apiUrl);
+  if (!orchestrators.length) return { scanned: 0, skipped: "no online orchestrators" };
+
+  const candidates = listWorkspaces().filter(
+    (ws) => ws.mode === "isolated" && Boolean(ws.worktreePath) && CONFLICT_SCAN_STATUSES.has(ws.status),
+  );
+  const flagged: string[] = [];
+  const cleared: string[] = [];
+  const notifiedStewards: string[] = [];
+
+  for (const ws of candidates) {
+    const orch = orchestrators.find((candidate) => workspacePathWithinBase(ws.sourceCwd, candidate.baseDir));
+    if (!orch?.apiUrl) continue;
+    const preview = await fetchHostMergePreview(orch.apiUrl, ws);
+    if (!preview || (preview as { available?: false }).available === false) continue;
+    const p = preview as WorkspaceMergePreview;
+    if (p.error || p.missing || p.conflict === undefined) continue;
+
+    const meta = ws.metadata as Record<string, unknown>;
+    if (p.conflict === true && ws.status !== "conflict") {
+      updateWorkspaceStatus(ws.id, "conflict", {
+        autoConflict: true,
+        preConflictStatus: ws.status,
+        conflictAhead: p.ahead,
+        conflictBehind: p.behind,
+        conflictBaseRef: p.baseRef,
+        conflictDetectedAt: Date.now(),
+      });
+      flagged.push(ws.id);
+      createActivityEvent({
+        clientId: "server-workspace-" + ws.id + "-conflict-" + Date.now(),
+        kind: "state",
+        title: "Merge conflict detected",
+        body: `${ws.branch ?? ws.id} can no longer merge cleanly into ${p.baseRef ?? "base"}`,
+        meta: ws.branch ?? ws.id,
+        icon: "ti-alert-triangle",
+        view: "orchestrators",
+        metadata: { source: "server", maintenanceJobId: "workspace-conflict-scan", workspaceId: ws.id, ahead: p.ahead, behind: p.behind },
+      });
+      // The steward is the repo's coordination point — ping it so a conflict
+      // gets resolved instead of silently rotting until merge time. Once-per-
+      // onset (we only enter this branch on the active→conflict transition).
+      if (ws.stewardAgentId) {
+        try {
+          const msg = sendMessage({
+            from: "system",
+            to: ws.stewardAgentId,
+            kind: "system",
+            subject: "Workspace merge conflict",
+            body: `Workspace \`${ws.branch ?? ws.id}\` in ${ws.repoRoot} can no longer merge cleanly into ${p.baseRef ?? "base"} (${p.ahead ?? "?"} ahead, ${p.behind ?? "?"} behind). As repo steward, please coordinate resolution.`,
+            payload: { kind: "workspace.conflict", workspaceId: ws.id, repoRoot: ws.repoRoot, branch: ws.branch, baseRef: p.baseRef, ahead: p.ahead, behind: p.behind },
+          });
+          emitNewMessage(msg);
+          notifiedStewards.push(ws.stewardAgentId);
+        } catch {
+          // Steward unregistered/stale — the activity event still records it.
+        }
+      }
+    } else if (p.conflict === false && ws.status === "conflict" && meta.autoConflict === true) {
+      const prior = typeof meta.preConflictStatus === "string" && meta.preConflictStatus !== "conflict"
+        ? meta.preConflictStatus as WorkspaceStatus
+        : "active";
+      updateWorkspaceStatus(ws.id, prior, { autoConflict: false, conflictClearedAt: Date.now() });
+      cleared.push(ws.id);
+    }
+  }
+
+  return { scanned: candidates.length, flagged, cleared, notifiedStewards };
+}
+
 let timer: Timer | null = null;
 
 export function startMaintenanceScheduler(): void {