agent-relay-server 0.120.3 → 0.120.5

package/src/db/provisioning-resolve.ts

@@ -0,0 +1,245 @@
+// Profile provisioning resolution lives outside provisioning-registry.ts so the
+// registry CRUD/vendoring module stays under the file-size ratchet.
+
+import { existsSync, readdirSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { getManifest, type ProviderManifest } from "agent-relay-providers";
+import { isRecord } from "agent-relay-sdk";
+import type {
+  AgentProfile,
+  AgentProfileAssetRef,
+  AgentProfileProvider,
+  PluginAssetDefinition,
+  ProvisioningAssetKind,
+  ProvisioningMcpServer,
+  ProvisioningSkip,
+  ResolvedAssetDefinition,
+  ResolvedProvisioning,
+  SkillAssetDefinition,
+  SpawnProvider,
+} from "agent-relay-sdk";
+import { getDb } from "./connection.ts";
+import { parseJson } from "../utils";
+
+type ProviderBundledSkillSetDescriptor = NonNullable<NonNullable<ProviderManifest["provisioning"]>["bundledSkills"]>;
+
+interface ProvisioningCapabilityResolutionRow {
+  id: string;
+  slug: string;
+  kind: ProvisioningAssetKind;
+  status: string;
+}
+
+interface ProvisioningAssetResolutionRow {
+  kind: ProvisioningAssetKind;
+  name: string;
+  provider: AgentProfileProvider;
+  definition: string;
+  enabled: number;
+  approval_status?: string | null;
+  validation_status?: string | null;
+  validation_errors?: string | null;
+}
+
+interface RegistryResolution {
+  definition: ResolvedAssetDefinition | null;
+  skip?: ProvisioningSkip;
+}
+
+export function bundledSkillRefs(descriptor: ProviderBundledSkillSetDescriptor): string[] {
+  const skillsDir = resolve(import.meta.dir, "../../", descriptor.dir);
+  const entryFile = descriptor.entryFile ?? "SKILL.md";
+  if (!existsSync(skillsDir)) return [];
+  return readdirSync(skillsDir, { withFileTypes: true }).filter((entry) => entry.isDirectory() && existsSync(join(skillsDir, entry.name, entryFile)))
+    .map((entry) => descriptor.refPrefix + entry.name).sort();
+}
+
+export function stringRecord(value: Record<string, unknown>): Record<string, string> {
+  const out: Record<string, string> = {};
+  for (const [k, v] of Object.entries(value)) {
+    if (typeof v === "string") out[k] = v;
+  }
+  return out;
+}
+
+function rowDefinition(row: ProvisioningAssetResolutionRow): ResolvedAssetDefinition {
+  return parseJson<ResolvedAssetDefinition>(row.definition, { kind: row.kind, name: row.name } as ResolvedAssetDefinition);
+}
+
+function skip(kind: ProvisioningAssetKind, ref: string, provider: SpawnProvider, reason: ProvisioningSkip["reason"], detail: string): ProvisioningSkip {
+  return { kind, ref, provider, reason, detail };
+}
+
+function variantSkipReason(row: ProvisioningAssetResolutionRow): Pick<ProvisioningSkip, "reason" | "detail"> | null {
+  if (row.enabled !== 1) return { reason: "disabled", detail: "Registry variant is disabled." };
+  if (row.approval_status !== "approved") return { reason: "unapproved", detail: `Registry variant approval_status is ${row.approval_status ?? "unset"}.` };
+  if (row.validation_status !== "valid") {
+    const errors = parseJson<unknown[]>(row.validation_errors ?? "[]", []);
+    const detail = errors.length ? `Registry variant validation_status is ${row.validation_status}; ${JSON.stringify(errors)}` : `Registry variant validation_status is ${row.validation_status ?? "unset"}.`;
+    return { reason: "invalid", detail };
+  }
+  return null;
+}
+
+// Resolve a registry ref for a target provider: an approved/valid/enabled exact
+// provider match wins, else provider-neutral "any". MCP is intentionally
+// provider-neutral in v1, so only "any" MCP variants are candidates.
+function resolveRegistryDefinition(kind: ProvisioningAssetKind, ref: string, provider: SpawnProvider): RegistryResolution {
+  const capability = getDb()
+    .query("SELECT id, slug, kind, status FROM provisioning_capabilities WHERE kind = ? AND slug = ?")
+    .get(kind, ref) as ProvisioningCapabilityResolutionRow | undefined;
+  if (!capability) {
+    return { definition: null, skip: skip(kind, ref, provider, "missing", "No provisioning capability exists for this ref.") };
+  }
+
+  const rows = getDb()
+    .query("SELECT * FROM provisioning_assets WHERE capability_id = ? ORDER BY CASE provider WHEN ? THEN 0 WHEN 'any' THEN 1 ELSE 2 END, provider")
+    .all(capability.id, provider) as ProvisioningAssetResolutionRow[];
+  const providerCandidates = rows.filter((row) => kind === "mcp" ? row.provider === "any" : row.provider === provider || row.provider === "any");
+  if (!providerCandidates.length) {
+    const label = getManifest(provider)?.label ?? provider;
+    return { definition: null, skip: skip(kind, ref, provider, "provider_mismatch", `No ${label} variant exists for capability ${ref}.`) };
+  }
+
+  for (const row of providerCandidates) {
+    if (!variantSkipReason(row)) return { definition: rowDefinition(row) };
+  }
+
+  const blocked = variantSkipReason(providerCandidates[0]!);
+  return { definition: null, skip: skip(kind, ref, provider, blocked?.reason ?? "missing", blocked?.detail ?? "No resolvable registry variant exists.") };
+}
+
+// A ref applies to a launch iff it's enabled and its provider scope includes the
+// target ("any"/undefined → all providers).
+function refAppliesToProvider(ref: AgentProfileAssetRef, provider: SpawnProvider): boolean {
+  return ref.enabled && (!ref.provider || ref.provider === "any" || ref.provider === provider);
+}
+
+function hasAssetRef(refs: AgentProfileAssetRef[], source: AgentProfileAssetRef["source"], ref: string): boolean {
+  return refs.some((item) => item.source === source && item.ref === ref);
+}
+
+function relayBundledProvisioningRefs(profile: AgentProfile, provider: SpawnProvider): Pick<AgentProfile, "skills" | "plugins"> {
+  const skills = [...(profile.skills ?? [])];
+  const plugins = [...(profile.plugins ?? [])];
+  const provisioning = getManifest(provider)?.provisioning;
+  if (profile.relay.skills !== false && provisioning?.bundledSkills) {
+    for (const ref of bundledSkillRefs(provisioning.bundledSkills)) {
+      if (!hasAssetRef(skills, "relay", ref)) skills.push({ source: "relay", ref, enabled: true, provider });
+    }
+  }
+  if (profile.relay.plugins !== false && provisioning?.bundledPlugin && !hasAssetRef(plugins, "relay", provisioning.bundledPlugin.ref)) {
+    plugins.push({ source: "relay", ref: provisioning.bundledPlugin.ref, enabled: true, provider });
+  }
+  return { skills, plugins };
+}
+
+function withRelayBundledProvisioningRefs(profile: AgentProfile, provider: SpawnProvider): AgentProfile {
+  const { skills, plugins } = relayBundledProvisioningRefs(profile, provider);
+  return { ...profile, skills, plugins };
+}
+
+function inlineFilesFromMeta(meta: Record<string, unknown> | undefined): { path: string; content: string }[] | undefined {
+  const raw = meta?.files;
+  if (!Array.isArray(raw)) return undefined;
+  const files = raw
+    .filter(isRecord)
+    .filter((f) => typeof f.path === "string" && typeof f.content === "string")
+    .map((f) => ({ path: f.path as string, content: f.content as string }));
+  return files.length ? files : undefined;
+}
+
+// Resolve a skill/plugin asset ref into a concrete definition. relay → registry;
+// inline → built from ref.meta (files or dir); repo → a cwd-relative dir token the
+// runner resolves against the launch cwd; provider → skipped (provider built-in).
+function resolveDirAssetRef(
+  kind: "skill" | "plugin",
+  ref: AgentProfileAssetRef,
+  provider: SpawnProvider,
+): { definition: SkillAssetDefinition | PluginAssetDefinition | null; skip?: ProvisioningSkip } {
+  if (ref.source === "relay") {
+    const resolved = resolveRegistryDefinition(kind, ref.ref, provider);
+    const def = resolved.definition;
+    return { definition: def && def.kind === kind ? def : null, skip: resolved.skip };
+  }
+  if (ref.source === "inline") {
+    const files = inlineFilesFromMeta(ref.meta);
+    const dir = typeof ref.meta?.dir === "string" ? ref.meta.dir : undefined;
+    if (!files && !dir) return { definition: null, skip: skip(kind, ref.ref, provider, "invalid_inline", `Inline ${kind} ref requires files or dir metadata.`) };
+    return { definition: { kind, name: ref.ref, ...(files ? { files } : {}), ...(dir ? { dir } : {}) } };
+  }
+  if (ref.source === "repo") {
+    return { definition: { kind, name: ref.ref, dir: ref.ref } };
+  }
+  return { definition: null };
+}
+
+// A profile.mcp.servers entry is either an inline server spec or a registry
+// reference (`{ source: "relay", ref }`). Returns the concrete server spec.
+function resolveMcpEntry(name: string, value: unknown, provider: SpawnProvider): { server: ProvisioningMcpServer | null; skip?: ProvisioningSkip } {
+  if (!isRecord(value)) return { server: null };
+  if (value.source === "relay" && typeof value.ref === "string") {
+    const resolved = resolveRegistryDefinition("mcp", value.ref, provider);
+    const def = resolved.definition;
+    return { server: def && def.kind === "mcp" ? def.server : null, skip: resolved.skip };
+  }
+  if (value.enabled === false) return { server: null };
+  // Inline spec: keep the recognized server fields only.
+  const server: ProvisioningMcpServer = {};
+  if (typeof value.type === "string") server.type = value.type as ProvisioningMcpServer["type"];
+  if (typeof value.command === "string") server.command = value.command;
+  if (Array.isArray(value.args)) server.args = value.args.filter((a): a is string => typeof a === "string");
+  if (isRecord(value.env)) server.env = stringRecord(value.env);
+  if (isRecord(value.configEnv)) server.configEnv = stringRecord(value.configEnv);
+  if (typeof value.url === "string") server.url = value.url;
+  if (isRecord(value.headers)) server.headers = stringRecord(value.headers);
+  return { server: server.command || server.url ? server : null, skip: server.command || server.url ? undefined : skip("mcp", name, provider, "invalid_inline", "Inline MCP server requires command or url.") };
+}
+
+// Resolve a profile's declared skill/plugin/MCP refs against the registry into the
+// concrete bundle the runner materializes. Relay-side (needs the DB); the result is
+// attached to the in-flight profile (profile.provisioning) before it's serialized
+// into the spawn env. Pure read — never mutates the registry.
+export function resolveProfileProvisioning(profile: AgentProfile, provider: SpawnProvider): ResolvedProvisioning {
+  const skills: SkillAssetDefinition[] = [];
+  const skipped: ProvisioningSkip[] = [];
+  for (const ref of profile.skills ?? []) {
+    if (!refAppliesToProvider(ref, provider)) {
+      if (ref.enabled && ref.source === "relay") skipped.push(skip("skill", ref.ref, provider, "provider_mismatch", `Profile ref is scoped to provider ${ref.provider}.`));
+      continue;
+    }
+    const resolved = resolveDirAssetRef("skill", ref, provider);
+    if (resolved.definition) skills.push(resolved.definition as SkillAssetDefinition);
+    else if (resolved.skip) skipped.push(resolved.skip);
+  }
+
+  const plugins: PluginAssetDefinition[] = [];
+  for (const ref of profile.plugins ?? []) {
+    if (!refAppliesToProvider(ref, provider)) {
+      if (ref.enabled && ref.source === "relay") skipped.push(skip("plugin", ref.ref, provider, "provider_mismatch", `Profile ref is scoped to provider ${ref.provider}.`));
+      continue;
+    }
+    const resolved = resolveDirAssetRef("plugin", ref, provider);
+    if (resolved.definition) plugins.push(resolved.definition as PluginAssetDefinition);
+    else if (resolved.skip) skipped.push(resolved.skip);
+  }
+
+  const mcpServers: Record<string, ProvisioningMcpServer> = {};
+  for (const [name, value] of Object.entries(profile.mcp?.servers ?? {})) {
+    const resolved = resolveMcpEntry(name, value, provider);
+    if (resolved.server) mcpServers[name] = resolved.server;
+    else if (resolved.skip) skipped.push(resolved.skip);
+  }
+
+  return { skills, plugins, mcpServers, ...(skipped.length ? { skipped } : {}) };
+}
+
+// Attach the resolved bundle to a spawn-bound profile. Returns a shallow copy so the
+// cached config-store value is never mutated. undefined passes through (an unresolved
+// profile name stays undefined so callers' not-found guards still fire); the runner
+// treats an absent and an empty bundle identically.
+export function withResolvedProvisioning(profile: AgentProfile | undefined, provider: SpawnProvider): AgentProfile | undefined {
+  if (!profile) return undefined;
+  const composed = withRelayBundledProvisioningRefs(profile, provider);
+  return { ...composed, provisioning: resolveProfileProvisioning(composed, provider) };
+}

package/src/routes/workspaces.ts

@@ -104,12 +104,27 @@ function latestWorkspaceByBranch(workspaces: WorkspaceRecord[]): Map<string, Wor
   return byBranch;
 }
 
-function owningOrchestratorForRepo(repoRoot: string) {
-  return listOrchestrators().find((candidate) => candidate.status === "online" && candidate.apiUrl && isPathWithinBase(repoRoot, candidate.baseDir));
+function owningOrchestratorsForRepo(repoRoot: string, orchestratorId?: string) {
+  const candidates = listOrchestrators().filter((candidate) => candidate.status === "online" && candidate.apiUrl);
+  if (orchestratorId) {
+    return candidates.filter((candidate) => candidate.id === orchestratorId);
+  }
+  const ownerIds = new Set(
+    listWorkspaces()
+      .filter((workspace) => workspace.orchestratorId && resolve(workspace.repoRoot) === resolve(repoRoot))
+      .map((workspace) => workspace.orchestratorId!),
+  );
+  const owners = candidates.filter((candidate) => ownerIds.has(candidate.id));
+  if (owners.length > 0) return owners;
+  const legacy = candidates.find((candidate) => isPathWithinBase(repoRoot, candidate.baseDir));
+  return legacy ? [legacy] : [];
+}
+
+function owningOrchestratorForRepo(repoRoot: string, orchestratorId?: string) {
+  return owningOrchestratorsForRepo(repoRoot, orchestratorId)[0];
 }
 
-async function fetchRecoveryBranchesForRepo(repoRoot: string, opts: { baseRef?: string; baseSha?: string } = {}): Promise<{ branches: WorkspaceRecoveryBranch[]; unavailable?: string }> {
-  const orch = owningOrchestratorForRepo(repoRoot);
+async function fetchRecoveryBranchesFromOrchestrator(repoRoot: string, orch: NonNullable<ReturnType<typeof owningOrchestratorForRepo>>, opts: { baseRef?: string; baseSha?: string } = {}): Promise<{ branches: WorkspaceRecoveryBranch[]; unavailable?: string }> {
   if (!orch?.apiUrl) return { branches: [], unavailable: "owning orchestrator offline" };
   const query = new URLSearchParams({ repoRoot });
   if (opts.baseRef) query.set("baseRef", opts.baseRef);
@@ -122,16 +137,36 @@ async function fetchRecoveryBranchesForRepo(repoRoot: string, opts: { baseRef?:
     if (!res.ok) return { branches: [], unavailable: `host returned ${res.status}` };
     const payload = await res.json() as unknown;
     if (!isRecord(payload) || !Array.isArray(payload.branches)) return { branches: [], unavailable: "host returned malformed recovery branch list" };
-    return { branches: payload.branches.filter(isRecord) as unknown as WorkspaceRecoveryBranch[] };
+    return {
+      branches: (payload.branches.filter(isRecord) as unknown as WorkspaceRecoveryBranch[]).map((branch) => ({
+        ...branch,
+        orchestratorId: orch.id,
+        orchestratorAgentId: orch.agentId,
+      })),
+    };
   } catch (e) {
     return { branches: [], unavailable: `orchestrator unreachable: ${(e as Error).message}` };
   }
 }
 
+async function fetchRecoveryBranchesForRepo(repoRoot: string, opts: { baseRef?: string; baseSha?: string; orchestratorId?: string } = {}): Promise<{ branches: WorkspaceRecoveryBranch[]; unavailable?: string }> {
+  const hosts = owningOrchestratorsForRepo(repoRoot, opts.orchestratorId);
+  if (hosts.length === 0) return { branches: [], unavailable: "owning orchestrator offline" };
+  const branches: WorkspaceRecoveryBranch[] = [];
+  const unavailable: string[] = [];
+  for (const orch of hosts) {
+    const fetched = await fetchRecoveryBranchesFromOrchestrator(repoRoot, orch, opts);
+    branches.push(...fetched.branches);
+    if (fetched.unavailable) unavailable.push(`${orch.id}: ${fetched.unavailable}`);
+  }
+  return { branches, ...(branches.length === 0 && unavailable.length > 0 ? { unavailable: unavailable.join("; ") } : {}) };
+}
+
 export const getWorkspaceRecoveryBranches: Handler = async (req) => {
   try {
     const url = new URL(req.url);
     const repoRoot = cleanString(url.searchParams.get("repoRoot") ?? undefined, "repoRoot", { max: 1000 });
+    const orchestratorId = cleanString(url.searchParams.get("orchestratorId") ?? undefined, "orchestratorId", { max: 200 });
     const baseRef = cleanString(url.searchParams.get("baseRef") ?? undefined, "baseRef", { max: 240 });
     const baseSha = cleanString(url.searchParams.get("baseSha") ?? undefined, "baseSha", { max: 80 });
     const includeActive = url.searchParams.get("includeActive") === "1";
@@ -142,7 +177,7 @@ export const getWorkspaceRecoveryBranches: Handler = async (req) => {
     const unavailable: Record<string, string> = {};
 
     for (const repo of repoRoots) {
-      const fetched = await fetchRecoveryBranchesForRepo(repo, { baseRef, baseSha });
+      const fetched = await fetchRecoveryBranchesForRepo(repo, { baseRef, baseSha, orchestratorId });
       if (fetched.unavailable) {
         unavailable[repo] = fetched.unavailable;
         continue;
@@ -186,6 +221,7 @@ export const postWorkspaceRecoveryBranchDiscard: Handler = async (req) => {
     if (!isRecord(parsed.body)) return error("body required");
     const repoRoot = cleanString(parsed.body.repoRoot, "repoRoot", { max: 1000 });
     const branch = cleanString(parsed.body.branch, "branch", { max: 240 });
+    const requestedOrchestratorId = cleanString(parsed.body.orchestratorId, "orchestratorId", { max: 200 });
     const baseRef = cleanString(parsed.body.baseRef, "baseRef", { max: 240 });
     const baseSha = cleanString(parsed.body.baseSha, "baseSha", { max: 80 });
     const reason = cleanString(parsed.body.reason, "reason", { max: 1000 });
@@ -193,11 +229,11 @@ export const postWorkspaceRecoveryBranchDiscard: Handler = async (req) => {
     if (!repoRoot || !branch) return error("repoRoot and branch required", 400);
     if (!branch.startsWith("agent/")) return error("only agent/* branches can be discarded through recovery cleanup", 400);
     if (force && !reason) return error("reason required for forced recovery branch discard", 400);
-    const orch = owningOrchestratorForRepo(repoRoot);
+    const fetched = await fetchRecoveryBranchesForRepo(repoRoot, { baseRef, baseSha, orchestratorId: requestedOrchestratorId });
+    const target = fetched.branches.find((item) => item.branch === branch);
+    const orch = target?.orchestratorId ? owningOrchestratorForRepo(repoRoot, target.orchestratorId) : owningOrchestratorForRepo(repoRoot);
     if (!orch?.agentId) return error("no online orchestrator owns this repo", 409);
-    const fetched = await fetchRecoveryBranchesForRepo(repoRoot, { baseRef, baseSha });
     if (fetched.unavailable) return error(fetched.unavailable, 409);
-    const target = fetched.branches.find((item) => item.branch === branch);
     if (!target) return error("recovery branch not found", 404);
     if (target.safeToDelete !== true && !force) {
       return error(`branch holds work or cannot be proven safe (${target.preserveReason ?? `${target.unmergedAhead ?? target.ahead ?? "?"} unlanded commit(s)`}); land it first or pass force:true with reason to discard`, 409);
@@ -242,25 +278,25 @@ export const postWorkspaceOrphanReclaim: Handler = async (req) => {
     // Refuse to reclaim a path that still backs a live workspace row.
     const live = listWorkspaces().find((ws) => ws.worktreePath && resolve(ws.worktreePath) === resolve(worktreePath) && !TERMINAL_WORKSPACE_STATUSES.has(ws.status));
     if (live) return error(`path backs live workspace ${live.id}; clean it through the workspace, not orphan reclaim`, 409);
-    const orch = listOrchestrators().find((candidate) => candidate.status === "online" && isPathWithinBase(repoRoot, candidate.baseDir));
-    if (!orch) return error("no online orchestrator owns this path", 409);
     // Land-safety gate (#244): reclaim force-removes the worktree, so refuse when
     // it holds un-landed work unless the caller explicitly opts into discarding
     // it. Mirrors the scheduled reaper — never destroy work on uncertainty.
     let baseRef: string | undefined;
     let baseSha: string | undefined;
-    if (!force) {
-      const { orphans } = await collectWorkspaceOrphans();
-      const target = orphans.find((o) => resolve(o.worktreePath) === resolve(worktreePath));
-      if (target && target.safeToReap !== true) {
-        const why = target.safeToReap === undefined
-          ? "land-state could not be determined"
-          : target.dirty ? "uncommitted changes" : `${target.unmergedAhead ?? target.ahead ?? "?"} un-landed commit(s)`;
-        return error(`worktree holds un-landed work (${why}); recover it first, or pass {"force":true} to discard`, 409);
-      }
-      baseRef = target?.baseRef;
-      baseSha = target?.baseSha;
+    const { orphans } = await collectWorkspaceOrphans();
+    const target = orphans.find((o) => resolve(o.worktreePath) === resolve(worktreePath));
+    if (target && !force && target.safeToReap !== true) {
+      const why = target.safeToReap === undefined
+        ? "land-state could not be determined"
+        : target.dirty ? "uncommitted changes" : `${target.unmergedAhead ?? target.ahead ?? "?"} un-landed commit(s)`;
+      return error(`worktree holds un-landed work (${why}); recover it first, or pass {"force":true} to discard`, 409);
     }
+    baseRef = target?.baseRef;
+    baseSha = target?.baseSha;
+    const orch = target?.orchestratorId
+      ? listOrchestrators().find((candidate) => candidate.id === target.orchestratorId && candidate.status === "online")
+      : listOrchestrators().find((candidate) => candidate.status === "online" && isPathWithinBase(repoRoot, candidate.baseDir));
+    if (!orch) return error("no online orchestrator owns this path", 409);
     const command = createCommand({
       type: "workspace.cleanup",
       source: "system",

package/src/task-dispatcher.ts

@@ -382,7 +382,8 @@ function rerouteForBand(
 // no burn data yet. Prefer "prefer" band, then "normal"; never a blocked one.
 //
 // When mustResolveAvailable is set (#901 degrade-never-refuse), widens search in tiers when
-// no prefer/normal provider is available: caution → avoid-large → least-utilized blockedNow.
+// no prefer/normal provider is available: caution → avoid-large → hard-avoid-but-not-blocked
+// → least-utilized blockedNow.
 // A `degraded` flag + `degradedReason` signals to the caller to emit a louder warning.
 function healthiestAlternative(
   avoid: SpawnProvider,
@@ -415,11 +416,19 @@ function healthiestAlternative(
     .sort((a, b) => bandRank(a.band) - bandRank(b.band));
   if (avoidLargeAlt[0]) return { ...avoidLargeAlt[0], degraded: true, degradedReason: "avoid-large band (tier 2 degraded)" };
 
-  // Tier 3 degradation: least-utilized blockedNow (last resort — emit the loudest warning).
+  // Tier 3 degradation: hard-avoid is still better than a provider that is actively blocked.
+  // This is the exact shape a release auto-heal can hit: Claude session limit is blockedNow,
+  // Codex is over pace (hard-avoid) but still runnable.
+  const hardAvoidAlt = all
+    .filter((c) => !c.blockedNow && c.band === "hard-avoid")
+    .sort((a, b) => bandRank(a.band) - bandRank(b.band));
+  if (hardAvoidAlt[0]) return { ...hardAvoidAlt[0], degraded: true, degradedReason: "hard-avoid band (tier 3 degraded)" };
+
+  // Tier 4 degradation: least-utilized blockedNow (last resort — emit the loudest warning).
   // Sort by bandRank so the healthiest (lowest penalty) blocked provider is picked first,
   // not whichever happens to be earliest in catalog order.
   const blockedAlts = all.filter((c) => c.blockedNow).sort((a, b) => bandRank(a.band) - bandRank(b.band));
-  if (blockedAlts[0]) return { ...blockedAlts[0], degraded: true, degradedReason: "blockedNow provider (tier 3 last-resort — ALL providers at capacity)" };
+  if (blockedAlts[0]) return { ...blockedAlts[0], degraded: true, degradedReason: "blockedNow provider (tier 4 last-resort — ALL providers at capacity)" };
 
   return undefined;
 }

package/src/workspace-orphans.ts

@@ -252,6 +252,8 @@ export async function collectWorkspaceOrphans(): Promise<CollectOrphansResult> {
         const orphan: WorkspaceOrphan = {
           worktreePath: worktree.path,
           repoRoot,
+          orchestratorId: orch.id,
+          orchestratorAgentId: orch.agentId,
           branch: worktree.branch,
           headSha: worktree.headSha,
           baseRef: probe.branch,
@@ -366,7 +368,9 @@ export async function reapOrphanedWorktrees(): Promise<Record<string, unknown>>
   const liveCwds = liveAgentCwds();
 
   for (const orphan of orphans) {
-    const orch = orchestrators.find((candidate) => isPathWithinBase(orphan.repoRoot, candidate.baseDir));
+    const orch = orphan.orchestratorId
+      ? orchestrators.find((candidate) => candidate.id === orphan.orchestratorId)
+      : orchestrators.find((candidate) => isPathWithinBase(orphan.repoRoot, candidate.baseDir));
     if (!orch) continue;
 
     if (orphan.safeToReap === true) {