agent-relay-server 0.120.6 → 0.121.1

package/src/retention-config.ts

@@ -0,0 +1,58 @@
+import { isRecord } from "agent-relay-sdk";
+import { ValidationError } from "./db/connection.ts";
+
+export const RETENTION_NAMESPACE = "retention";
+export const RETENTION_KEY = "default";
+
+export interface RetentionConfig {
+  messageRetentionDays: number;
+  activityEventRetentionDays: number;
+  activityEventMaxRows: number;
+  spawnCommandTerminalRetentionDays: number;
+  pruneBatchSize: number;
+}
+
+export const RETENTION_CONFIG_DEFAULTS: RetentionConfig = {
+  messageRetentionDays: 30,
+  activityEventRetentionDays: 14,
+  activityEventMaxRows: 100_000,
+  spawnCommandTerminalRetentionDays: 14,
+  pruneBatchSize: 10_000,
+};
+
+export const RETENTION_CONFIG_SCHEMA = {
+  type: "object",
+  properties: {
+    messageRetentionDays: { type: "integer", minimum: 1, maximum: 3650 },
+    activityEventRetentionDays: { type: "integer", minimum: 1, maximum: 3650 },
+    activityEventMaxRows: { type: "integer", minimum: 1, maximum: 10_000_000 },
+    spawnCommandTerminalRetentionDays: { type: "integer", minimum: 1, maximum: 3650 },
+    pruneBatchSize: { type: "integer", minimum: 1, maximum: 50_000 },
+  },
+  additionalProperties: false,
+} as const;
+
+function cleanInteger(value: unknown, field: string, fallback: number, min: number, max: number): number {
+  if (value === undefined || value === null) return fallback;
+  if (typeof value !== "number" || !Number.isSafeInteger(value) || value < min || value > max) {
+    throw new ValidationError(`${field} must be an integer between ${min} and ${max}`);
+  }
+  return value;
+}
+
+export function validateRetentionConfig(value: unknown): RetentionConfig {
+  if (!isRecord(value)) throw new ValidationError("retention config value must be an object");
+  return {
+    messageRetentionDays: cleanInteger(value.messageRetentionDays, "messageRetentionDays", RETENTION_CONFIG_DEFAULTS.messageRetentionDays, 1, 3650),
+    activityEventRetentionDays: cleanInteger(value.activityEventRetentionDays, "activityEventRetentionDays", RETENTION_CONFIG_DEFAULTS.activityEventRetentionDays, 1, 3650),
+    activityEventMaxRows: cleanInteger(value.activityEventMaxRows, "activityEventMaxRows", RETENTION_CONFIG_DEFAULTS.activityEventMaxRows, 1, 10_000_000),
+    spawnCommandTerminalRetentionDays: cleanInteger(
+      value.spawnCommandTerminalRetentionDays,
+      "spawnCommandTerminalRetentionDays",
+      RETENTION_CONFIG_DEFAULTS.spawnCommandTerminalRetentionDays,
+      1,
+      3650,
+    ),
+    pruneBatchSize: cleanInteger(value.pruneBatchSize, "pruneBatchSize", RETENTION_CONFIG_DEFAULTS.pruneBatchSize, 1, 50_000),
+  };
+}

package/src/routes/agents.ts

@@ -9,6 +9,7 @@ import { emitAgentRemoved, emitAgentStatus } from "../sse";
 import { notifyAgentReady } from "../agent-lifecycle-events";
 import { bindSpawnedTaskToReadyAgent } from "../services/register-agent";
 import { flushQueuedDirectMessages } from "../services/managed-running";
+import { flushIdleLineageReport } from "../services/send-message";
 import { isAgentUnavailable } from "../db/agent-predicates";
 import { getCompactionWatch } from "../compaction-watch";
 import { isRecord } from "agent-relay-sdk";
@@ -198,6 +199,9 @@ export const patchAgentStatus: Handler = async (req, params) => {
     const before = getAgent(params.id!);
     if (!setStatus(params.id!, body.status as (typeof VALID_AGENT_STATUSES)[number], guard)) return error("agent not found", 404);
     auditAgentStateTransition(params.id!, before, getAgent(params.id!));
+    // #1040 — the HTTP status PATCH is also a busy→idle edge (a runner without a live bus socket).
+    // Flush any held turn-final report-up so it reaches the spawner on this path too.
+    if (before?.status === "busy" && body.status !== "busy") flushIdleLineageReport(params.id!);
   } catch (e) {
     if (e instanceof ValidationError) return error(e.message, 400);
     throw e;

package/src/routes/messages.ts

@@ -7,7 +7,7 @@ import { emitMessageClaimed, emitMessageDeleted, emitMessageDeliveryUpdated, emi
 import { errMessage, isMechanicalMessageKind, isRecord } from "agent-relay-sdk";
 import { injectMemoryForMessageDelivery } from "../memory-service";
 import { authContextFromRequest } from "../services/auth-context";
-import { sendMessageService } from "../services/send-message";
+import { sendMessagesBatchService, sendMessageService } from "../services/send-message";
 import { AmbiguousTargetError, ServiceAuthError } from "../services/errors";
 import { type AgentSessionGuard, type Message, type SendMessageInput } from "../types";
 
@@ -73,6 +73,7 @@ function isDirectTarget(to: string): boolean {
 }
 
 const VALID_MSG_KINDS = ["chat", "channel.event", "task", "pair", "control", "system", "session"];
+const MAX_MESSAGE_BATCH = 100;
 
 export const getQueuedMessagesRoute: Handler = (req) => {
   const url = new URL(req.url);
@@ -149,6 +150,17 @@ export const postMessage: Handler = async (req) => {
   const parsed = await parseBody<unknown>(req);
   if (!parsed.ok) return error(parsed.error, parsed.status);
   try {
+    if (isRecord(parsed.body) && Array.isArray(parsed.body.messages)) {
+      if (parsed.body.messages.length === 0 || parsed.body.messages.length > MAX_MESSAGE_BATCH) {
+        throw new ValidationError(`messages must contain 1-${MAX_MESSAGE_BATCH} items`);
+      }
+      const inputs = parsed.body.messages.map((message) => normalizeMessageInput(message));
+      if (inputs.some((input) => input.kind !== "session")) {
+        throw new ValidationError("batch messages only supports kind=session");
+      }
+      const results = sendMessagesBatchService(inputs, authContextFromRequest(req));
+      return json({ messages: results.map((result) => result.message) }, 201);
+    }
     const input = normalizeMessageInput(parsed.body);
     if (!input.idempotencyKey) {
       input.idempotencyKey = cleanString(req.headers.get("Idempotency-Key") ?? undefined, "idempotencyKey", { max: 240 });

package/src/routes/orchestrator-proxy.ts

@@ -5,7 +5,7 @@ import { authorizeRoute, cleanJsonArray, error, json, type Handler } from "./_sh
 import { cleanStringArray } from "../validation";
 import { emitOrchestratorStatus } from "../sse";
 import { type OrchestratorRuntimeInput, type SpawnProvider } from "../types";
-import { relayToken } from "../config";
+import { isTrustedOrchestratorApiUrl, relayToken } from "../config";
 import { isTerminalSessionRequestAuthorized } from "../terminal-authz";
 
 export const getOrchestratorDirectories: Handler = async (req, params) => {
@@ -13,6 +13,9 @@ export const getOrchestratorDirectories: Handler = async (req, params) => {
   if (!orch) return error("orchestrator not found", 404);
   if (!orch.apiUrl) return error("orchestrator does not expose an API", 422);
   if (orch.status !== "online") return error("orchestrator is offline", 422);
+  // #1024 — never forward the relay master token (or the caller's query string) to an untrusted
+  // apiUrl. Refuse the proxy outright rather than leak credentials to an attacker-controlled host.
+  if (!isTrustedOrchestratorApiUrl(orch.apiUrl)) return error("orchestrator apiUrl is not a trusted origin", 502);
   const url = new URL(req.url);
   const path = url.searchParams.get("path") || "";
   const proxyUrl = `${orch.apiUrl}/api/directories${path ? `?path=${encodeURIComponent(path)}` : ""}`;
@@ -30,6 +33,9 @@ export const postOrchestratorCreateDirectory: Handler = async (req, params) => {
   if (!orch) return error("orchestrator not found", 404);
   if (!orch.apiUrl) return error("orchestrator does not expose an API", 422);
   if (orch.status !== "online") return error("orchestrator is offline", 422);
+  // #1024 — never forward the relay master token (or the caller's query string) to an untrusted
+  // apiUrl. Refuse the proxy outright rather than leak credentials to an attacker-controlled host.
+  if (!isTrustedOrchestratorApiUrl(orch.apiUrl)) return error("orchestrator apiUrl is not a trusted origin", 502);
   try {
     const body = await req.json();
     const res = await fetch(`${orch.apiUrl}/api/directories`, {
@@ -62,6 +68,9 @@ async function proxyOrchestratorGet(req: Request, orchestratorId: string, path:
   if (!orch) return error("orchestrator not found", 404);
   if (!orch.apiUrl) return error("orchestrator does not expose an API", 422);
   if (orch.status !== "online") return error("orchestrator is offline", 422);
+  // #1024 — never forward the relay master token (or the caller's query string) to an untrusted
+  // apiUrl. Refuse the proxy outright rather than leak credentials to an attacker-controlled host.
+  if (!isTrustedOrchestratorApiUrl(orch.apiUrl)) return error("orchestrator apiUrl is not a trusted origin", 502);
   const incoming = new URL(req.url);
   const proxyUrl = `${orch.apiUrl}${path}${incoming.search}`;
   const headers: Record<string, string> = {};
@@ -85,6 +94,9 @@ async function proxyOrchestratorPost(req: Request, orchestratorId: string, path:
   if (!orch) return error("orchestrator not found", 404);
   if (!orch.apiUrl) return error("orchestrator does not expose an API", 422);
   if (orch.status !== "online") return error("orchestrator is offline", 422);
+  // #1024 — never forward the relay master token (or the caller's query string) to an untrusted
+  // apiUrl. Refuse the proxy outright rather than leak credentials to an attacker-controlled host.
+  if (!isTrustedOrchestratorApiUrl(orch.apiUrl)) return error("orchestrator apiUrl is not a trusted origin", 502);
   const incoming = new URL(req.url);
   const proxyUrl = `${orch.apiUrl}${path}${incoming.search}`;
   const headers: Record<string, string> = {

package/src/routes/orchestrator.ts

@@ -11,6 +11,7 @@ import { createCommand, updateCommand } from "../commands-db";
 import { emitAgentStatus, emitOrchestratorStatus } from "../sse";
 import { getLifecycleManager } from "../lifecycle-manager";
 import { issueOrchestratorRuntimeToken } from "../runtime-tokens";
+import { isOrchestratorRegistrationAuthorized } from "../security";
 import { type ManagedAgent, type ManagedSessionExitDiagnostics, type OrchestratorRuntimeInput, type RegisterOrchestratorInput, type SpawnApprovalMode, type SpawnProvider } from "../types";
 
 function cleanProtocolVersion(value: unknown): number | undefined {
@@ -51,6 +52,9 @@ function cleanRuntimeCapabilities(value: unknown): RuntimeCapabilities | undefin
 }
 
 export const postOrchestrator: Handler = async (req) => {
+  // #1024 — registering/upserting an orchestrator is admin-class; a provider-agent runtime token
+  // must NOT be able to seed a rogue orchestrator row (its apiUrl is the master-token exfil sink).
+  if (!isOrchestratorRegistrationAuthorized(req)) return error("forbidden", 403);
   const parsed = await parseBody<unknown>(req);
   if (!parsed.ok) return error(parsed.error, parsed.status);
   try {

package/src/routing-policy-store.ts

@@ -278,7 +278,7 @@ function normalizeProviderQuotaConfig(raw: unknown, provider: string): ProviderQ
   if (!isRecord(raw)) throw new ValidationError(`providerQuota.${provider} must be an object`);
   const cfg: ProviderQuotaRoutingConfig = {};
   if (raw.hardBackstopUtilization !== undefined) {
-    cfg.hardBackstopUtilization = cleanFraction(raw.hardBackstopUtilization, `providerQuota.${provider}.hardBackstopUtilization`);
+    cfg.hardBackstopUtilization = cleanHardBackstopFraction(raw.hardBackstopUtilization);
   }
   if (raw.burnPenaltyUtilizationFloor !== undefined) {
     cfg.burnPenaltyUtilizationFloor = cleanFraction(raw.burnPenaltyUtilizationFloor, `providerQuota.${provider}.burnPenaltyUtilizationFloor`);
@@ -293,6 +293,16 @@ function cleanQuotaFraction(value: unknown, field: string): number {
   return value;
 }
 
+function cleanHardBackstopFraction(value: unknown): number {
+  // hardBackstopUtilization=0 is an intentional contract: disable the hard backstop
+  // for that provider. Other invalid values normalize to the default instead.
+  if (value === 0) return 0;
+  if (typeof value !== "number" || !Number.isFinite(value) || value < 0 || value > 1) {
+    return 0.99;
+  }
+  return value;
+}
+
 function cleanFraction(value: unknown, field: string): number {
   if (typeof value !== "number" || !Number.isFinite(value) || value < 0 || value > 1) {
     throw new ValidationError(`${field} must be a number between 0 and 1`);

package/src/security.ts

@@ -153,6 +153,26 @@ export function isComponentAuthorizedFor(auth: ComponentToken, check: Authorizat
   return hasComponentScope(auth, check.scope) && constraintsAllow(auth, check.resource);
 }
 
+// #1024 — Orchestrator registration/upsert (POST /api/orchestrators) is a privileged bootstrap
+// operation: the row it writes carries an attacker-controllable `apiUrl` that the orchestrator
+// proxy later hands the relay MASTER token to (the C1 admin-token-exfil chain). The coarse scope
+// gate only requires `command:write` — which every routine provider-agent runtime token holds —
+// so gate it explicitly here. Allowed callers: the raw root/god credential, an admin
+// (`system:admin`) token, or an established orchestrator-host token (role "orchestrator", which
+// re-registers on every reconnect). A provider-agent runtime token is refused, closing the chain
+// at its entry point.
+export function isOrchestratorRegistrationAuthorized(req: Request): boolean {
+  const component = getComponentAuth(req);
+  if (component) {
+    return hasComponentScope(component, "system:admin") || component.role === "orchestrator";
+  }
+  // Not a component token: the raw root credential, an integration token, or no credential at all.
+  // The coarse gate (which runs before this handler) already governs those — a routine unauthorized
+  // request never reaches here, and the root credential is the legitimate bootstrap path. Mirror
+  // authorizeRoute's contract and don't impose a stricter bar than the rest of the route surface.
+  return true;
+}
+
 export function requiredScopeFor(method: string, pathname: string): string | null {
   if (pathname === "/api/stats") return "stats:read";
   if (pathname === "/api/health") return "health:read";

package/src/self-resume.ts

@@ -1,6 +1,7 @@
 import { isRecord } from "agent-relay-sdk";
 import { createCommand, listCommands } from "./commands-db";
 import { emitCommandEvent } from "./command-events";
+import { MAX_BODY_BYTES, REAP_INTERVAL_MS } from "./config";
 import { getSelfResumeConfig } from "./config-store";
 import {
   archiveContinuationSegment,
@@ -14,7 +15,7 @@ import {
 import { emitRelayEvent } from "./events";
 import { routeNotification } from "./notification-router";
 import { renderTemplate } from "./prompt-resolver";
-import type { AgentCard, Command, ContinuationDecisionEntry, ContinuationEnvelope, ContinuationLedgerEntry, SelfResumeMode } from "./types";
+import type { AgentCard, Command, CommandStatus, ContinuationDecisionEntry, ContinuationEnvelope, ContinuationLedgerEntry, SelfResumeMode } from "./types";
 
 interface CompactAndResumeInput {
   agentId: string;
@@ -89,7 +90,8 @@ export function compactAndResume(input: CompactAndResumeInput): CompactAndResume
     spentTokens: typeof agent.context?.tokensUsed === "number" ? agent.context.tokensUsed : 0,
     now,
   });
-  const continuation = renderContinuation(updated);
+  if (updated.droppedLedgerEntries.length) archiveDroppedLedgerEntries(agent.id, generation, updated.droppedLedgerEntries, now);
+  const continuation = renderContinuation(updated.envelope);
   const command = mode === "native"
     ? createNativeCompact(agent.id, generation, continuation)
     : createClearThenInject(agent.id, generation, continuation);
@@ -100,18 +102,55 @@ export function compactAndResume(input: CompactAndResumeInput): CompactAndResume
     generation,
     commandId: command.id,
     continuationChars: continuation.length,
-    ledgerEntries: updated.ledger.length,
+    ledgerEntries: updated.envelope.ledger.length,
   };
 }
 
-export function enqueueContinuationInjectionAfterSelfResume(command: Command): Command | null {
-  if (command.status !== "succeeded") return null;
+// #1023 — the ruledOut ledger bound (see updateContinuationAfterCompact) drops the
+// oldest entries once the persisted ledger grows past its cap instead of letting a
+// long-running agent render a multi-megabyte continuation. Dropped entries are not
+// destroyed: they're archived alongside the workingState segments so relay_recall
+// still finds them. Chunked well under archiveContinuationSegment's MAX_BODY_BYTES
+// limit since a large drop batch could otherwise exceed a single segment's cap.
+const DROPPED_LEDGER_ARCHIVE_CHUNK_BYTES = MAX_BODY_BYTES / 2;
+
+function archiveDroppedLedgerEntries(agentId: string, generation: number, dropped: ContinuationLedgerEntry[], now: number): void {
+  let chunk: string[] = [];
+  let chunkBytes = 0;
+  const flush = () => {
+    if (!chunk.length) return;
+    archiveContinuationSegment({
+      agentId,
+      generation,
+      segment: `Ruled-out ledger entries dropped for size (search via relay_recall):\n${chunk.join("\n")}`,
+      now,
+    });
+    chunk = [];
+    chunkBytes = 0;
+  };
+  for (const entry of dropped) {
+    const line = renderLedgerLine(entry);
+    const lineBytes = new TextEncoder().encode(line).byteLength;
+    if (chunk.length && chunkBytes + lineBytes > DROPPED_LEDGER_ARCHIVE_CHUNK_BYTES) flush();
+    chunk.push(line);
+    chunkBytes += lineBytes;
+  }
+  flush();
+}
+
+interface PendingInjection {
+  continuation: string;
+  mode: string;
+  generation?: number;
+}
+
+function extractPendingInjection(command: Command): PendingInjection | null {
   const resume = isRecord(command.params.selfResume) ? command.params.selfResume : undefined;
   const mode = typeof resume?.mode === "string" ? resume.mode : undefined;
   const shouldInject =
     command.type === "agent.clearContext" && mode === "clear-inject"
     || command.type === "agent.compact" && mode === "native";
-  if (!shouldInject) return null;
+  if (!shouldInject || !mode) return null;
   const continuation = typeof resume?.continuation === "string"
     ? resume.continuation
     : typeof command.params.instructions === "string"
@@ -119,6 +158,26 @@ export function enqueueContinuationInjectionAfterSelfResume(command: Command): C
       : undefined;
   if (!continuation) return null;
   const generation = typeof resume?.generation === "number" ? resume.generation : undefined;
+  return { continuation, mode, generation };
+}
+
+function buildInjectionParams(command: Command, injection: PendingInjection): Record<string, unknown> {
+  return {
+    reason: "self-resume-continuation",
+    content: injection.continuation,
+    selfResume: {
+      generation: injection.generation,
+      mode: injection.mode,
+      ...(command.type === "agent.clearContext" ? { afterClearCommandId: command.id } : {}),
+      ...(command.type === "agent.compact" ? { afterCompactCommandId: command.id } : {}),
+    },
+  };
+}
+
+export function enqueueContinuationInjectionAfterSelfResume(command: Command): Command | null {
+  if (command.status !== "succeeded") return null;
+  const injection = extractPendingInjection(command);
+  if (!injection) return null;
   const existing = listCommands({ target: command.target, type: "agent.injectContext", limit: 500 })
     .find((item) => item.correlationId === command.id);
   if (existing) return null;
@@ -127,16 +186,7 @@ export function enqueueContinuationInjectionAfterSelfResume(command: Command): C
     source: "system",
     target: command.target,
     correlationId: command.id,
-    params: {
-      reason: "self-resume-continuation",
-      content: continuation,
-      selfResume: {
-        generation,
-        mode,
-        ...(command.type === "agent.clearContext" ? { afterClearCommandId: command.id } : {}),
-        ...(command.type === "agent.compact" ? { afterCompactCommandId: command.id } : {}),
-      },
-    },
+    params: buildInjectionParams(command, injection),
   });
   emitCommandEvent(inject, "command.requested");
   return inject;
@@ -146,19 +196,101 @@ export function enqueueContinuationInjectionAfterClear(command: Command): Comman
   return enqueueContinuationInjectionAfterSelfResume(command);
 }
 
+const CLEAR_OR_COMPACT_TYPES = ["agent.clearContext", "agent.compact"] as const;
+const INJECTION_SWEEP_TERMINAL_STATUSES: CommandStatus[] = ["succeeded", "timed_out"];
+const INJECTION_SWEEP_LOOKBACK_MS = 24 * 60 * 60 * 1000;
+const MAX_INJECTION_ATTEMPTS = 3;
+const IN_FLIGHT_OR_DONE_STATUSES: CommandStatus[] = ["succeeded", "pending", "accepted", "running"];
+
+// #1023 — periodic backstop for the three silent mind-wipe windows found in the
+// self-resume audit (relay message #176981):
+//   1. runner->relay `command.update` lost in transit, so the clear/compact command
+//      never reaches "succeeded" and just times out — the reactive inject in
+//      enqueueContinuationInjectionAfterSelfResume never fires.
+//   2. relay crash between persisting "succeeded" and creating the inject command.
+//   3. the inject command itself fails once (e.g. provider momentarily unavailable)
+//      with no retry.
+// This re-derives the missing inject directly from the durably persisted command
+// params — the same idempotency key (correlationId = the clear/compact command id)
+// used by the reactive path, so running this concurrently with it is safe. A
+// timed-out clear/compact is treated the same as succeeded: we cannot always tell
+// whether the runner's destructive step actually completed before the update was
+// lost, and a redundant-but-harmless re-injection is preferable to a permanent
+// silent mind-wipe. Retries are capped at MAX_INJECTION_ATTEMPTS; once exhausted the
+// parent is notified once instead of retrying forever against an unreachable agent.
+export function sweepMissedContinuationInjections(now: number = Date.now()): { enqueuedCommandIds: string[] } {
+  const enqueuedCommandIds: string[] = [];
+  const since = now - INJECTION_SWEEP_LOOKBACK_MS;
+  for (const type of CLEAR_OR_COMPACT_TYPES) {
+    for (const command of listCommands({ type, since, limit: 500 })) {
+      if (!INJECTION_SWEEP_TERMINAL_STATUSES.includes(command.status)) continue;
+      const injection = extractPendingInjection(command);
+      if (!injection) continue;
+      if (!getAgent(command.target)) continue;
+      const attempts = listCommands({ target: command.target, type: "agent.injectContext", limit: 500 })
+        .filter((item) => item.correlationId === command.id);
+      if (attempts.some((item) => IN_FLIGHT_OR_DONE_STATUSES.includes(item.status))) continue;
+      if (attempts.length >= MAX_INJECTION_ATTEMPTS) {
+        notifyContinuationInjectionExhausted(command, attempts.length);
+        continue;
+      }
+      const inject = createCommand({
+        type: "agent.injectContext",
+        source: "system",
+        target: command.target,
+        correlationId: command.id,
+        params: buildInjectionParams(command, injection),
+      });
+      emitCommandEvent(inject, "command.requested");
+      enqueuedCommandIds.push(inject.id);
+    }
+  }
+  return { enqueuedCommandIds };
+}
+
+export const SELF_RESUME_INJECTION_SWEEP_JOB = {
+  id: "self-resume-injection-sweep",
+  title: "Self-resume injection sweep",
+  description: "Re-deliver self-resume continuations whose inject was lost to a transport blip, a relay crash between persisting the clear/compact and enqueuing the inject, or a failed inject attempt (#1023).",
+  intervalMs: REAP_INTERVAL_MS,
+  runOnStart: true,
+  handler() {
+    return sweepMissedContinuationInjections();
+  },
+};
+
+function notifyContinuationInjectionExhausted(command: Command, attempts: number): void {
+  const idempotencyKey = `self-resume-injection-exhausted:${command.target}:${command.id}`;
+  if (findMessageByIdempotencyKey(command.target, idempotencyKey)) return;
+  const agent = getAgent(command.target);
+  const payload = { kind: "agent.resume_injection_failed", agentId: command.target, commandId: command.id, attempts };
+  emitRelayEvent({ type: "agent.resume_injection_failed", source: "server", subject: command.target, data: payload });
+  const recipient = agent?.spawnedBy ?? "user";
+  routeNotification({
+    type: "agent.resume_injection_failed",
+    scope: { agentId: command.target, parent: agent?.spawnedBy },
+    recipients: [recipient],
+    message: {
+      subject: "Self-resume continuation failed to inject",
+      body: `Agent \`${command.target}\` completed a self-resume ${command.type === "agent.compact" ? "compact" : "clear"} but its continuation could not be delivered after ${attempts} attempt(s). The agent may be running with an empty or stale context — check it and consider a manual relay_compact_and_resume or restart.`,
+      payload,
+      idempotencyKey,
+      from: command.target,
+      replyExpected: false,
+    },
+  });
+}
+
 export function renderContinuation(
   envelope: ContinuationEnvelope,
   input: { intro?: string } = {},
 ): string {
-  const ledger = envelope.ledger.length
-    ? envelope.ledger.map((entry) => `- gen ${entry.gen} @ ${new Date(entry.at).toISOString()}: ${entry.ruledOut}${entry.why ? `; why: ${entry.why}` : ""}`).join("\n")
-    : "- none";
   const decisions = envelope.decisions.length ? envelope.decisions.map(renderDecisionEntry).join("\n") : "- none";
   return renderTemplate("continuation.envelope", {
     intro: input.intro ?? `You have been resumed by Agent Relay — generation ${envelope.generation}.`,
     generation: String(envelope.generation),
     objective: envelope.objective,
-    ruledOut: ledger,
+    ruledOut: renderLedger(envelope.ledger),
     decisions,
     workingState: envelope.workingState,
     archiveRefs: envelope.archiveRefs.length ? envelope.archiveRefs.join("\n") : "- none",
@@ -170,6 +302,31 @@ function renderDecisionEntry(entry: ContinuationDecisionEntry): string {
   return `- gen ${entry.gen} @ ${new Date(entry.at).toISOString()}${by}: ${entry.decision}${entry.rationale ? `; rationale: ${entry.rationale}` : ""}`;
 }
 
+function renderLedgerLine(entry: ContinuationLedgerEntry): string {
+  return `- gen ${entry.gen} @ ${new Date(entry.at).toISOString()}: ${entry.ruledOut}${entry.why ? `; why: ${entry.why}` : ""}`;
+}
+
+// #1023 — render-time backstop on top of the persisted bound in
+// updateContinuationAfterCompact. Even if that bound is ever bypassed by a future
+// bug, this guarantees the ledger section injected into a fresh context can't blow
+// past a fixed size; it keeps the newest entries and notes what was omitted rather
+// than truncating mid-entry.
+const MAX_RENDERED_LEDGER_CHARS = 300_000;
+
+function renderLedger(entries: ContinuationLedgerEntry[]): string {
+  if (!entries.length) return "- none";
+  const lines = entries.map(renderLedgerLine);
+  let start = 0;
+  let totalChars = lines.reduce((sum, line) => sum + line.length + 1, 0);
+  while (totalChars > MAX_RENDERED_LEDGER_CHARS && start < lines.length - 1) {
+    totalChars -= lines[start]!.length + 1;
+    start += 1;
+  }
+  if (start === 0) return lines.join("\n");
+  const omitted = start;
+  return `- (${omitted} older ruled-out ${omitted === 1 ? "entry" : "entries"} omitted for size — see relay_recall for the archived history)\n${lines.slice(start).join("\n")}`;
+}
+
 function assertResumeSupported(agent: AgentCard, mode: SelfResumeMode): void {
   const context = agent.providerCapabilities?.context;
   const resume = context?.resume ?? (context?.clear && context?.inject ? "clear-inject" : "none");
@@ -320,7 +477,7 @@ function notifySelfResumeBudgetWarning(agent: AgentCard, envelope: ContinuationE
 function parseRuledOut(value: unknown, generation: number, now: number): ContinuationLedgerEntry[] {
   if (value === undefined || value === null) return [];
   if (!Array.isArray(value)) throw new ValidationError("ruledOut must be an array");
-  return value.map((item, index) => {
+  const entries = value.map((item, index) => {
     if (typeof item === "string") return ledgerEntry(item, "", generation, now);
     if (!isRecord(item)) throw new ValidationError(`ruledOut[${index}] must be a string or object`);
     const ruledOut = typeof item.ruledOut === "string" ? item.ruledOut.trim() : "";
@@ -328,6 +485,13 @@ function parseRuledOut(value: unknown, generation: number, now: number): Continu
     if (!ruledOut) throw new ValidationError(`ruledOut[${index}].ruledOut required`);
     return ledgerEntry(ruledOut, why, generation, now);
   });
+  // #1023 — ruledOut had no size limit at all (unlike the sibling workingState/objective
+  // fields, both capped at/near MAX_BODY_BYTES): a single legal call could inject a
+  // multi-megabyte continuation straight into the fresh context it was meant to fit
+  // inside. Bound total new content per call to the same ceiling as workingState.
+  const totalBytes = entries.reduce((sum, entry) => sum + new TextEncoder().encode(entry.ruledOut).byteLength + new TextEncoder().encode(entry.why).byteLength, 0);
+  if (totalBytes > MAX_BODY_BYTES) throw new ValidationError(`ruledOut exceeds ${MAX_BODY_BYTES} bytes for a single call — split it across multiple relay_compact_and_resume calls`);
+  return entries;
 }
 
 function ledgerEntry(ruledOut: string, why: string, generation: number, now: number): ContinuationLedgerEntry {

package/src/server.ts

@@ -13,8 +13,10 @@ import { installNotificationSubscriptionRule } from "./notification-subscription
 import { installQuotaAdvisoryHandler } from "./quota-advisory";
 import { startPlanLiveBindings } from "./services/plan-live-bindings";
 import { startRelayScheduler } from "./services/scheduler";
+import { startEventLoopLagSampler } from "./event-loop-lag";
 import { recordWorkspaceIssueActivity } from "./services/spawn-issue-activity";
 import { onWorkspaceCreate } from "./db";
+import { warnIfNoHumanReachableEscalationTarget } from "./workspace-human-escalation";
 import { isTerminalSessionRequestAuthorized } from "./terminal-authz";
 import { resolve, sep } from "path";
 import { gzipSync, brotliCompressSync, constants as zlibConstants } from "node:zlib";
@@ -80,6 +82,8 @@ export function startServer(): void {
   getCompactionWatch().start();
   reconcileRelayVersion();
   startConnectorStatusPoller();
+  warnIfNoHumanReachableEscalationTarget();
+  startEventLoopLagSampler();
   startMaintenanceScheduler();
   startRelayScheduler();