agent-relay-server 0.121.0 → 0.121.2

package/src/routes/workspaces.ts

@@ -7,7 +7,7 @@ import { WORKSPACE_ACTIONS, applyWorkspaceAction, buildWorkspaceCleanupCommand,
 import { auditEvent, authAuditMetadata, authorizeRoute, emitCommand, error, json, parseBody, type Handler } from "./_shared";
 import { collectWorkspaceOrphans } from "../workspace-orphans";
 import { createCommand } from "../commands-db";
-import { LAND_STRATEGIES, isOwnerAlive, withOwnerOnline } from "../workspace-merge";
+import { LAND_STRATEGIES, isOwnerAlive, isOwnerProcessConfirmedGone, withOwnerOnline } from "../workspace-merge";
 import { isPathWithinBase } from "../utils";
 import { resolve } from "node:path";
 import { type WorkspaceAutoMergePolicy, type WorkspaceDiagnostics, type WorkspaceGitState, type WorkspaceMergeStrategy, type WorkspaceRecoveryBranch, type WorkspaceRecord, type WorkspaceStatus } from "../types";
@@ -340,8 +340,14 @@ async function fetchWorkspaceGitState(workspace: WorkspaceRecord): Promise<{ sta
   }
 }
 
-function recommendWorkspaceAction(input: { workspace: WorkspaceRecord; ownerOnline: boolean; gitState?: WorkspaceGitState; claim: ReturnType<typeof workspaceActiveClaim> }): WorkspaceDiagnostics["recommendation"] {
-  const { workspace, ownerOnline, gitState, claim } = input;
+function recommendWorkspaceAction(input: { workspace: WorkspaceRecord; ownerOnline: boolean; ownerProcessGone: boolean; gitState?: WorkspaceGitState; claim: ReturnType<typeof workspaceActiveClaim> }): WorkspaceDiagnostics["recommendation"] {
+  const { workspace, ownerOnline, ownerProcessGone, gitState, claim } = input;
+  // #1049 — `!ownerOnline` is a heartbeat lapse, which a relay self-stall fakes for LIVE
+  // agents (the 2026-07-04 cascade). It must NOT alone drive a destructive recommendation.
+  // Treat the owner as genuinely gone only when its process death was actually observed
+  // (orchestrator-reported exit); otherwise a maybe-alive owner gets recovery, not a nuke.
+  const ownerGone = !ownerOnline && ownerProcessGone;
+  const awaitingReview = workspace.status === "review_requested" || workspace.status === "conflict";
   if (claim) return { action: "wait", confidence: "high", reason: `claimed by ${claim.by ?? "steward"}` };
   if (TERMINAL_WORKSPACE_STATUSES.has(workspace.status)) return { action: "none", confidence: "high", reason: `workspace is ${workspace.status}` };
   if (!gitState || gitState.error) return { action: "review", confidence: "low", reason: gitState?.error ? `git state error: ${gitState.error}` : "git state unavailable" };
@@ -350,19 +356,31 @@ function recommendWorkspaceAction(input: { workspace: WorkspaceRecord; ownerOnli
   const landed = gitState.landed === true;
   if ((gitState.dirtyCount ?? 0) > 0) return { action: "review", confidence: "medium", reason: `${gitState.dirtyCount} uncommitted change(s)` };
   if (ahead === 0 || landed) {
-    if (!ownerOnline) return { action: "cleanup", confidence: "high", reason: landed ? "work already landed; owner offline" : "no unmerged commits; owner offline" };
+    if (!ownerOnline) {
+      if (ownerGone) return { action: "cleanup", confidence: "high", reason: landed ? "work already landed; owner process gone" : "no unmerged commits; owner process gone" };
+      // Offline but the process wasn't observed dying — likely a false exit (relay stall /
+      // transport gap). Don't clean up; surface for review so a live owner can reconnect.
+      return { action: "review", confidence: "medium", reason: landed ? "work already landed; owner offline but process not confirmed gone — recover, don't clean up" : "owner offline but process not confirmed gone — recover, don't clean up" };
+    }
     // Owner active but the workspace is awaiting attention with nothing to land (#230):
     // landing it is a safe no-op that resolves it to terminal `merged`, clearing the
     // queue (the host keeps a live owner's worktree). Otherwise there's genuinely
     // nothing to do.
-    if (workspace.status === "review_requested" || workspace.status === "conflict") {
+    if (awaitingReview) {
       return { action: "merge", confidence: "high", reason: landed ? "work already landed; resolve the no-op" : "nothing to merge; resolve the no-op" };
     }
     return { action: "none", confidence: "medium", reason: "nothing to merge; owner active" };
   }
-  if (ownerOnline && workspace.status !== "review_requested" && workspace.status !== "conflict") {
+  if (ownerOnline && !awaitingReview) {
     return { action: "wait", confidence: "medium", reason: "owner active and not awaiting review" };
   }
+  // ahead > 0 with the owner offline. A worker that explicitly signaled review/conflict
+  // before going offline asked for the land — honor it. But a worker that merely lapsed
+  // mid-work (not awaiting review) with its process NOT confirmed gone is a false-exit
+  // candidate; recommend recovery, never an auto-land of its unmerged commits (#1049).
+  if (!ownerOnline && !awaitingReview && !ownerGone) {
+    return { action: "review", confidence: "medium", reason: `${ahead} unmerged commit(s) but owner offline and process not confirmed gone — recover, don't land` };
+  }
   if (workspace.status === "conflict") return { action: "rebase", confidence: "high", reason: "conflict — rebase onto base and resolve" };
   if ((gitState.behind ?? 0) > 0) return { action: "rebase", confidence: "medium", reason: `${gitState.behind} behind base — rebase then merge` };
   return { action: "merge", confidence: "high", reason: `${ahead} commit(s) ready to land` };
@@ -397,7 +415,7 @@ export const getWorkspaceDiagnostics: Handler = async (_req, params) => {
     orchestrator: { id: orch?.id, online: orchOnline },
     ...(claim ? { claim: { by: claim.by, purpose: claim.purpose, expiresAt: claim.expiresAt } } : {}),
     ...(gitState ? { gitState } : { gitStateUnavailable: "unavailable" in fetched ? fetched.unavailable : "unknown" }),
-    recommendation: recommendWorkspaceAction({ workspace, ownerOnline, gitState, claim }),
+    recommendation: recommendWorkspaceAction({ workspace, ownerOnline, ownerProcessGone: isOwnerProcessConfirmedGone(workspace.ownerAgentId), gitState, claim }),
   };
   return json(diagnostics);
 };

package/src/security.ts

@@ -153,6 +153,26 @@ export function isComponentAuthorizedFor(auth: ComponentToken, check: Authorizat
   return hasComponentScope(auth, check.scope) && constraintsAllow(auth, check.resource);
 }
 
+// #1024 — Orchestrator registration/upsert (POST /api/orchestrators) is a privileged bootstrap
+// operation: the row it writes carries an attacker-controllable `apiUrl` that the orchestrator
+// proxy later hands the relay MASTER token to (the C1 admin-token-exfil chain). The coarse scope
+// gate only requires `command:write` — which every routine provider-agent runtime token holds —
+// so gate it explicitly here. Allowed callers: the raw root/god credential, an admin
+// (`system:admin`) token, or an established orchestrator-host token (role "orchestrator", which
+// re-registers on every reconnect). A provider-agent runtime token is refused, closing the chain
+// at its entry point.
+export function isOrchestratorRegistrationAuthorized(req: Request): boolean {
+  const component = getComponentAuth(req);
+  if (component) {
+    return hasComponentScope(component, "system:admin") || component.role === "orchestrator";
+  }
+  // Not a component token: the raw root credential, an integration token, or no credential at all.
+  // The coarse gate (which runs before this handler) already governs those — a routine unauthorized
+  // request never reaches here, and the root credential is the legitimate bootstrap path. Mirror
+  // authorizeRoute's contract and don't impose a stricter bar than the rest of the route surface.
+  return true;
+}
+
 export function requiredScopeFor(method: string, pathname: string): string | null {
   if (pathname === "/api/stats") return "stats:read";
   if (pathname === "/api/health") return "health:read";
@@ -456,6 +476,21 @@ export function unauthorized(req: Request): Response {
   return applyCors(req, response);
 }
 
+// #1047 — the MCP endpoint speaks JSON-RPC, so a 401 must be a JSON-RPC error
+// envelope, not the bare {"error":"unauthorized"} body (which fails client schema
+// validation and reads as protocol noise). Mirrors the runner proxy's own auth
+// failure (runner/src/relay-mcp-proxy.ts). id is null: the coarse auth gate runs
+// before the JSON-RPC body is parsed, and a revoked-token caller can't be trusted
+// to have supplied a well-formed id anyway.
+export function unauthorizedMcp(req: Request): Response {
+  const response = Response.json(
+    { jsonrpc: "2.0", id: null, error: { code: -32001, message: "unauthorized: session invalid or expired" } },
+    { status: 401 },
+  );
+  response.headers.set("WWW-Authenticate", "Bearer");
+  return applyCors(req, response);
+}
+
 function authToken(): string {
   return relayToken();
 }

package/src/self-resume.ts

@@ -1,6 +1,7 @@
 import { isRecord } from "agent-relay-sdk";
 import { createCommand, listCommands } from "./commands-db";
 import { emitCommandEvent } from "./command-events";
+import { MAX_BODY_BYTES, REAP_INTERVAL_MS } from "./config";
 import { getSelfResumeConfig } from "./config-store";
 import {
   archiveContinuationSegment,
@@ -14,7 +15,7 @@ import {
 import { emitRelayEvent } from "./events";
 import { routeNotification } from "./notification-router";
 import { renderTemplate } from "./prompt-resolver";
-import type { AgentCard, Command, ContinuationDecisionEntry, ContinuationEnvelope, ContinuationLedgerEntry, SelfResumeMode } from "./types";
+import type { AgentCard, Command, CommandStatus, ContinuationDecisionEntry, ContinuationEnvelope, ContinuationLedgerEntry, SelfResumeMode } from "./types";
 
 interface CompactAndResumeInput {
   agentId: string;
@@ -89,7 +90,8 @@ export function compactAndResume(input: CompactAndResumeInput): CompactAndResume
     spentTokens: typeof agent.context?.tokensUsed === "number" ? agent.context.tokensUsed : 0,
     now,
   });
-  const continuation = renderContinuation(updated);
+  if (updated.droppedLedgerEntries.length) archiveDroppedLedgerEntries(agent.id, generation, updated.droppedLedgerEntries, now);
+  const continuation = renderContinuation(updated.envelope);
   const command = mode === "native"
     ? createNativeCompact(agent.id, generation, continuation)
     : createClearThenInject(agent.id, generation, continuation);
@@ -100,18 +102,55 @@ export function compactAndResume(input: CompactAndResumeInput): CompactAndResume
     generation,
     commandId: command.id,
     continuationChars: continuation.length,
-    ledgerEntries: updated.ledger.length,
+    ledgerEntries: updated.envelope.ledger.length,
   };
 }
 
-export function enqueueContinuationInjectionAfterSelfResume(command: Command): Command | null {
-  if (command.status !== "succeeded") return null;
+// #1023 — the ruledOut ledger bound (see updateContinuationAfterCompact) drops the
+// oldest entries once the persisted ledger grows past its cap instead of letting a
+// long-running agent render a multi-megabyte continuation. Dropped entries are not
+// destroyed: they're archived alongside the workingState segments so relay_recall
+// still finds them. Chunked well under archiveContinuationSegment's MAX_BODY_BYTES
+// limit since a large drop batch could otherwise exceed a single segment's cap.
+const DROPPED_LEDGER_ARCHIVE_CHUNK_BYTES = MAX_BODY_BYTES / 2;
+
+function archiveDroppedLedgerEntries(agentId: string, generation: number, dropped: ContinuationLedgerEntry[], now: number): void {
+  let chunk: string[] = [];
+  let chunkBytes = 0;
+  const flush = () => {
+    if (!chunk.length) return;
+    archiveContinuationSegment({
+      agentId,
+      generation,
+      segment: `Ruled-out ledger entries dropped for size (search via relay_recall):\n${chunk.join("\n")}`,
+      now,
+    });
+    chunk = [];
+    chunkBytes = 0;
+  };
+  for (const entry of dropped) {
+    const line = renderLedgerLine(entry);
+    const lineBytes = new TextEncoder().encode(line).byteLength;
+    if (chunk.length && chunkBytes + lineBytes > DROPPED_LEDGER_ARCHIVE_CHUNK_BYTES) flush();
+    chunk.push(line);
+    chunkBytes += lineBytes;
+  }
+  flush();
+}
+
+interface PendingInjection {
+  continuation: string;
+  mode: string;
+  generation?: number;
+}
+
+function extractPendingInjection(command: Command): PendingInjection | null {
   const resume = isRecord(command.params.selfResume) ? command.params.selfResume : undefined;
   const mode = typeof resume?.mode === "string" ? resume.mode : undefined;
   const shouldInject =
     command.type === "agent.clearContext" && mode === "clear-inject"
     || command.type === "agent.compact" && mode === "native";
-  if (!shouldInject) return null;
+  if (!shouldInject || !mode) return null;
   const continuation = typeof resume?.continuation === "string"
     ? resume.continuation
     : typeof command.params.instructions === "string"
@@ -119,6 +158,26 @@ export function enqueueContinuationInjectionAfterSelfResume(command: Command): C
       : undefined;
   if (!continuation) return null;
   const generation = typeof resume?.generation === "number" ? resume.generation : undefined;
+  return { continuation, mode, generation };
+}
+
+function buildInjectionParams(command: Command, injection: PendingInjection): Record<string, unknown> {
+  return {
+    reason: "self-resume-continuation",
+    content: injection.continuation,
+    selfResume: {
+      generation: injection.generation,
+      mode: injection.mode,
+      ...(command.type === "agent.clearContext" ? { afterClearCommandId: command.id } : {}),
+      ...(command.type === "agent.compact" ? { afterCompactCommandId: command.id } : {}),
+    },
+  };
+}
+
+export function enqueueContinuationInjectionAfterSelfResume(command: Command): Command | null {
+  if (command.status !== "succeeded") return null;
+  const injection = extractPendingInjection(command);
+  if (!injection) return null;
   const existing = listCommands({ target: command.target, type: "agent.injectContext", limit: 500 })
     .find((item) => item.correlationId === command.id);
   if (existing) return null;
@@ -127,16 +186,7 @@ export function enqueueContinuationInjectionAfterSelfResume(command: Command): C
     source: "system",
     target: command.target,
     correlationId: command.id,
-    params: {
-      reason: "self-resume-continuation",
-      content: continuation,
-      selfResume: {
-        generation,
-        mode,
-        ...(command.type === "agent.clearContext" ? { afterClearCommandId: command.id } : {}),
-        ...(command.type === "agent.compact" ? { afterCompactCommandId: command.id } : {}),
-      },
-    },
+    params: buildInjectionParams(command, injection),
   });
   emitCommandEvent(inject, "command.requested");
   return inject;
@@ -146,19 +196,101 @@ export function enqueueContinuationInjectionAfterClear(command: Command): Comman
   return enqueueContinuationInjectionAfterSelfResume(command);
 }
 
+const CLEAR_OR_COMPACT_TYPES = ["agent.clearContext", "agent.compact"] as const;
+const INJECTION_SWEEP_TERMINAL_STATUSES: CommandStatus[] = ["succeeded", "timed_out"];
+const INJECTION_SWEEP_LOOKBACK_MS = 24 * 60 * 60 * 1000;
+const MAX_INJECTION_ATTEMPTS = 3;
+const IN_FLIGHT_OR_DONE_STATUSES: CommandStatus[] = ["succeeded", "pending", "accepted", "running"];
+
+// #1023 — periodic backstop for the three silent mind-wipe windows found in the
+// self-resume audit (relay message #176981):
+//   1. runner->relay `command.update` lost in transit, so the clear/compact command
+//      never reaches "succeeded" and just times out — the reactive inject in
+//      enqueueContinuationInjectionAfterSelfResume never fires.
+//   2. relay crash between persisting "succeeded" and creating the inject command.
+//   3. the inject command itself fails once (e.g. provider momentarily unavailable)
+//      with no retry.
+// This re-derives the missing inject directly from the durably persisted command
+// params — the same idempotency key (correlationId = the clear/compact command id)
+// used by the reactive path, so running this concurrently with it is safe. A
+// timed-out clear/compact is treated the same as succeeded: we cannot always tell
+// whether the runner's destructive step actually completed before the update was
+// lost, and a redundant-but-harmless re-injection is preferable to a permanent
+// silent mind-wipe. Retries are capped at MAX_INJECTION_ATTEMPTS; once exhausted the
+// parent is notified once instead of retrying forever against an unreachable agent.
+export function sweepMissedContinuationInjections(now: number = Date.now()): { enqueuedCommandIds: string[] } {
+  const enqueuedCommandIds: string[] = [];
+  const since = now - INJECTION_SWEEP_LOOKBACK_MS;
+  for (const type of CLEAR_OR_COMPACT_TYPES) {
+    for (const command of listCommands({ type, since, limit: 500 })) {
+      if (!INJECTION_SWEEP_TERMINAL_STATUSES.includes(command.status)) continue;
+      const injection = extractPendingInjection(command);
+      if (!injection) continue;
+      if (!getAgent(command.target)) continue;
+      const attempts = listCommands({ target: command.target, type: "agent.injectContext", limit: 500 })
+        .filter((item) => item.correlationId === command.id);
+      if (attempts.some((item) => IN_FLIGHT_OR_DONE_STATUSES.includes(item.status))) continue;
+      if (attempts.length >= MAX_INJECTION_ATTEMPTS) {
+        notifyContinuationInjectionExhausted(command, attempts.length);
+        continue;
+      }
+      const inject = createCommand({
+        type: "agent.injectContext",
+        source: "system",
+        target: command.target,
+        correlationId: command.id,
+        params: buildInjectionParams(command, injection),
+      });
+      emitCommandEvent(inject, "command.requested");
+      enqueuedCommandIds.push(inject.id);
+    }
+  }
+  return { enqueuedCommandIds };
+}
+
+export const SELF_RESUME_INJECTION_SWEEP_JOB = {
+  id: "self-resume-injection-sweep",
+  title: "Self-resume injection sweep",
+  description: "Re-deliver self-resume continuations whose inject was lost to a transport blip, a relay crash between persisting the clear/compact and enqueuing the inject, or a failed inject attempt (#1023).",
+  intervalMs: REAP_INTERVAL_MS,
+  runOnStart: true,
+  handler() {
+    return sweepMissedContinuationInjections();
+  },
+};
+
+function notifyContinuationInjectionExhausted(command: Command, attempts: number): void {
+  const idempotencyKey = `self-resume-injection-exhausted:${command.target}:${command.id}`;
+  if (findMessageByIdempotencyKey(command.target, idempotencyKey)) return;
+  const agent = getAgent(command.target);
+  const payload = { kind: "agent.resume_injection_failed", agentId: command.target, commandId: command.id, attempts };
+  emitRelayEvent({ type: "agent.resume_injection_failed", source: "server", subject: command.target, data: payload });
+  const recipient = agent?.spawnedBy ?? "user";
+  routeNotification({
+    type: "agent.resume_injection_failed",
+    scope: { agentId: command.target, parent: agent?.spawnedBy },
+    recipients: [recipient],
+    message: {
+      subject: "Self-resume continuation failed to inject",
+      body: `Agent \`${command.target}\` completed a self-resume ${command.type === "agent.compact" ? "compact" : "clear"} but its continuation could not be delivered after ${attempts} attempt(s). The agent may be running with an empty or stale context — check it and consider a manual relay_compact_and_resume or restart.`,
+      payload,
+      idempotencyKey,
+      from: command.target,
+      replyExpected: false,
+    },
+  });
+}
+
 export function renderContinuation(
   envelope: ContinuationEnvelope,
   input: { intro?: string } = {},
 ): string {
-  const ledger = envelope.ledger.length
-    ? envelope.ledger.map((entry) => `- gen ${entry.gen} @ ${new Date(entry.at).toISOString()}: ${entry.ruledOut}${entry.why ? `; why: ${entry.why}` : ""}`).join("\n")
-    : "- none";
   const decisions = envelope.decisions.length ? envelope.decisions.map(renderDecisionEntry).join("\n") : "- none";
   return renderTemplate("continuation.envelope", {
     intro: input.intro ?? `You have been resumed by Agent Relay — generation ${envelope.generation}.`,
     generation: String(envelope.generation),
     objective: envelope.objective,
-    ruledOut: ledger,
+    ruledOut: renderLedger(envelope.ledger),
     decisions,
     workingState: envelope.workingState,
     archiveRefs: envelope.archiveRefs.length ? envelope.archiveRefs.join("\n") : "- none",
@@ -170,6 +302,31 @@ function renderDecisionEntry(entry: ContinuationDecisionEntry): string {
   return `- gen ${entry.gen} @ ${new Date(entry.at).toISOString()}${by}: ${entry.decision}${entry.rationale ? `; rationale: ${entry.rationale}` : ""}`;
 }
 
+function renderLedgerLine(entry: ContinuationLedgerEntry): string {
+  return `- gen ${entry.gen} @ ${new Date(entry.at).toISOString()}: ${entry.ruledOut}${entry.why ? `; why: ${entry.why}` : ""}`;
+}
+
+// #1023 — render-time backstop on top of the persisted bound in
+// updateContinuationAfterCompact. Even if that bound is ever bypassed by a future
+// bug, this guarantees the ledger section injected into a fresh context can't blow
+// past a fixed size; it keeps the newest entries and notes what was omitted rather
+// than truncating mid-entry.
+const MAX_RENDERED_LEDGER_CHARS = 300_000;
+
+function renderLedger(entries: ContinuationLedgerEntry[]): string {
+  if (!entries.length) return "- none";
+  const lines = entries.map(renderLedgerLine);
+  let start = 0;
+  let totalChars = lines.reduce((sum, line) => sum + line.length + 1, 0);
+  while (totalChars > MAX_RENDERED_LEDGER_CHARS && start < lines.length - 1) {
+    totalChars -= lines[start]!.length + 1;
+    start += 1;
+  }
+  if (start === 0) return lines.join("\n");
+  const omitted = start;
+  return `- (${omitted} older ruled-out ${omitted === 1 ? "entry" : "entries"} omitted for size — see relay_recall for the archived history)\n${lines.slice(start).join("\n")}`;
+}
+
 function assertResumeSupported(agent: AgentCard, mode: SelfResumeMode): void {
   const context = agent.providerCapabilities?.context;
   const resume = context?.resume ?? (context?.clear && context?.inject ? "clear-inject" : "none");
@@ -320,7 +477,7 @@ function notifySelfResumeBudgetWarning(agent: AgentCard, envelope: ContinuationE
 function parseRuledOut(value: unknown, generation: number, now: number): ContinuationLedgerEntry[] {
   if (value === undefined || value === null) return [];
   if (!Array.isArray(value)) throw new ValidationError("ruledOut must be an array");
-  return value.map((item, index) => {
+  const entries = value.map((item, index) => {
     if (typeof item === "string") return ledgerEntry(item, "", generation, now);
     if (!isRecord(item)) throw new ValidationError(`ruledOut[${index}] must be a string or object`);
     const ruledOut = typeof item.ruledOut === "string" ? item.ruledOut.trim() : "";
@@ -328,6 +485,13 @@ function parseRuledOut(value: unknown, generation: number, now: number): Continu
     if (!ruledOut) throw new ValidationError(`ruledOut[${index}].ruledOut required`);
     return ledgerEntry(ruledOut, why, generation, now);
   });
+  // #1023 — ruledOut had no size limit at all (unlike the sibling workingState/objective
+  // fields, both capped at/near MAX_BODY_BYTES): a single legal call could inject a
+  // multi-megabyte continuation straight into the fresh context it was meant to fit
+  // inside. Bound total new content per call to the same ceiling as workingState.
+  const totalBytes = entries.reduce((sum, entry) => sum + new TextEncoder().encode(entry.ruledOut).byteLength + new TextEncoder().encode(entry.why).byteLength, 0);
+  if (totalBytes > MAX_BODY_BYTES) throw new ValidationError(`ruledOut exceeds ${MAX_BODY_BYTES} bytes for a single call — split it across multiple relay_compact_and_resume calls`);
+  return entries;
 }
 
 function ledgerEntry(ruledOut: string, why: string, generation: number, now: number): ContinuationLedgerEntry {

package/src/server.ts

@@ -16,6 +16,7 @@ import { startRelayScheduler } from "./services/scheduler";
 import { startEventLoopLagSampler } from "./event-loop-lag";
 import { recordWorkspaceIssueActivity } from "./services/spawn-issue-activity";
 import { onWorkspaceCreate } from "./db";
+import { warnIfNoHumanReachableEscalationTarget } from "./workspace-human-escalation";
 import { isTerminalSessionRequestAuthorized } from "./terminal-authz";
 import { resolve, sep } from "path";
 import { gzipSync, brotliCompressSync, constants as zlibConstants } from "node:zlib";
@@ -38,6 +39,7 @@ import {
   isScopedRequestAuthorized,
   isOriginAllowed,
   unauthorized,
+  unauthorizedMcp,
 } from "./security";
 import { startMaintenanceScheduler } from "./maintenance";
 import { RELAY_TOKEN_HEADER } from "agent-relay-sdk";
@@ -81,6 +83,7 @@ export function startServer(): void {
   getCompactionWatch().start();
   reconcileRelayVersion();
   startConnectorStatusPoller();
+  warnIfNoHumanReachableEscalationTarget();
   startEventLoopLagSampler();
   startMaintenanceScheduler();
   startRelayScheduler();
@@ -302,6 +305,11 @@ export function createFetchHandler(
           url.pathname.startsWith("/api/settings/");
         if (!isAuthorized(req)) {
           if (!integrationAuth) {
+            // #1047 — the MCP endpoint must fail with a JSON-RPC envelope, not the bare
+            // 401 body. This gate runs BEFORE postMcp (whose mcpAuthContext falls back to
+            // full server scope), so it stays the authoritative reject for a revoked/
+            // invalid session token — it just answers in the caller's protocol.
+            if (url.pathname === "/api/mcp") return unauthorizedMcp(req);
             return unauthorized(req);
           }
           if (!handlerOwnsScopedAuth && !isScopedRequestAuthorized(req)) return forbidden(req);

package/src/services/plan-graph.ts

@@ -1,10 +1,11 @@
 import { isRecord } from "agent-relay-sdk";
-import { addTaskDependency, createPlanRow, deletePlan, getAgent, getEntry, getPlan, getPlanByTeam, getPlanByThread, getTaskDetail, listPlansWithBoundOwner, planThreadExists, removeTaskDependency, replacePlan, setPlanArchived, ValidationError } from "../db";
+import { addTaskDependency, createPlanRow, deletePlan, getAgent, getEntry, getPlan, getPlanByTeam, getPlanByThread, getTaskDetail, listPlansWithBoundOwner, planThreadExists, removeTaskDependency, replacePlan, sendMessage, setPlanArchived, ValidationError } from "../db";
 import { associateIssue, planNodeIssueEntityId, removeAssociation } from "../db/issue-associations";
 import { resolveIssueRefFromString } from "../db/issue-refs";
 import { emitRelayEvent } from "../events";
 import { cleanString, cleanStringArray, optionalEnum } from "../validation";
 import { defaultIssueRepo } from "../config";
+import { issueRepoForAgent } from "../agent-issue-repo";
 import { buildTaskGraphView, parseTaskId, planStatusToTaskStatus, projectPlanOverTasks } from "./task-plan-view";
 import { createTaskEntity, setTaskEntityStatus } from "./task-entity";
 import type { AuthContext } from "./auth-context";
@@ -75,14 +76,25 @@ function cleanOwnerRef(value: unknown): PlanOwnerRef | undefined {
   return Object.keys(out).length ? out : undefined;
 }
 
-function cleanRefs(value: unknown): PlanNode["refs"] | undefined {
+// #220: a bare `#NNN` issueId ref needs a default repo to resolve against — issue-refs.ts
+// throws without one, contrary to its own error text advertising the bare form as accepted.
+// Resolve it the same way #533 resolves chat `#NNN` linkify: the CALLING agent's own project
+// (cwd → project → issueRepo), falling back to the single global env default. This scopes the
+// default to the actor's actual repo rather than guessing from teamId — agents have no
+// team→project FK; cwd is the only durable link (see agent-issue-repo.ts).
+function resolveDefaultIssueRepo(actor: string): string | undefined {
+  const agent = getAgent(actor);
+  return (agent ? issueRepoForAgent(agent) : undefined) ?? defaultIssueRepo();
+}
+
+function cleanRefs(value: unknown, actor: string): PlanNode["refs"] | undefined {
   if (value === undefined || value === null) return undefined;
   const ref = cleanRecordRef(value, "refs");
   if (!ref) return undefined;
   const out: PlanNode["refs"] = {};
   const issueId = cleanString(ref.issueId, "refs.issueId", { max: 1000 });
   if (issueId) {
-    out.issueId = resolveIssueRefFromString({ ref: issueId, defaultRepo: defaultIssueRepo() }).id;
+    out.issueId = resolveIssueRefFromString({ ref: issueId, defaultRepo: resolveDefaultIssueRepo(actor) }).id;
   }
   // #836: refs.taskId is the live binding seam to a durable Task. Validate it resolves to a
   // deliverable Task; store the canonical numeric id as a string. Once bound, the node's
@@ -147,12 +159,12 @@ function applyBoundStatus(node: PlanNode): PlanNode {
   return { ...node, status: boundStatusForAgent(getAgent(agentId)) ?? "pending" };
 }
 
-function cleanNode(input: PlanNodeInput, planTeamId?: string): PlanNode {
+function cleanNode(input: PlanNodeInput, actor: string, planTeamId?: string): PlanNode {
   if (!isRecord(input)) throw new ValidationError("node must be an object");
   const scopeBlurb = cleanString(input.scopeBlurb, "node.scopeBlurb", { max: 2000 });
   const ownerRef = cleanOwnerRef(input.ownerRef);
   const lane = cleanString(input.lane, "node.lane", { max: 120 });
-  const refs = cleanRefs(input.refs);
+  const refs = cleanRefs(input.refs, actor);
   const blackboardRefs = cleanBlackboardRefs(input.blackboardRefs, planTeamId);
   const statusSource = cleanStatusSource(input.statusSource);
   return applyBoundStatus({
@@ -168,10 +180,10 @@ function cleanNode(input: PlanNodeInput, planTeamId?: string): PlanNode {
   });
 }
 
-function cleanNodes(value: unknown, planTeamId?: string): PlanNode[] {
+function cleanNodes(value: unknown, actor: string, planTeamId?: string): PlanNode[] {
   if (value === undefined || value === null) return [];
   if (!Array.isArray(value)) throw new ValidationError("nodes must be an array");
-  const nodes = value.map((item) => cleanNode(item as PlanNodeInput, planTeamId));
+  const nodes = value.map((item) => cleanNode(item as PlanNodeInput, actor, planTeamId));
   assertUnique(nodes.map((node) => node.id), "node id");
   return nodes;
 }
@@ -252,14 +264,32 @@ function emitPlan(type: "plan.created" | "plan.changed" | "plan.deleted", plan:
   emitRelayEvent({ type, source: actor, subject: plan.id, data: { plan, actor } });
 }
 
+// #1035: a plan anchors to a messages.thread_id, but a fresh coordinator has no thread yet —
+// forcing it to send a throwaway message just to mint one. When no threadId is supplied, mint the
+// thread server-side by self-threading a lightweight system message (the same sendMessage path the
+// caller would have used). Sent AS the actor when that agent is registered, else the reserved
+// `system` sink, so the mint always passes the sender-registration gate.
+function mintPlanThread(actor: string, channel: string | undefined): number {
+  const sender = getAgent(actor) ? actor : "system";
+  const root = sendMessage({
+    from: sender,
+    to: "system",
+    body: "Plan thread root",
+    ...(channel ? { channel } : {}),
+  });
+  return root.threadId ?? root.id;
+}
+
 export function createPlan(input: PlanCreateInput, ctx: AuthContext): Plan {
-  const threadId = cleanThreadId(input.threadId);
-  if (!planThreadExists(threadId)) throw new ValidationError(`thread ${threadId} not found`);
   const channel = cleanString(input.channel, "channel", { max: 120 });
   const actor = actorId(ctx);
+  const threadId = input.threadId === undefined || input.threadId === null
+    ? mintPlanThread(actor, channel)
+    : cleanThreadId(input.threadId);
+  if (!planThreadExists(threadId)) throw new ValidationError(`thread ${threadId} not found`);
   const explicitTeamId = cleanString(input.teamId, "teamId", { max: 120 });
   const teamId = explicitTeamId ?? (input.teamId === undefined || input.teamId === null ? getAgent(actor)?.teamId : undefined);
-  const nodes = cleanNodes(input.nodes, teamId);
+  const nodes = cleanNodes(input.nodes, actor, teamId);
   const edges = cleanEdges(input.edges);
   validateEdges(nodes, edges);
   const plan = createPlanRow({
@@ -279,7 +309,7 @@ export function createPlan(input: PlanCreateInput, ctx: AuthContext): Plan {
 
 export function addPlanNode(planId: string, nodeInput: PlanNodeInput, ctx: AuthContext): Plan {
   const plan = existingPlan(planId);
-  const node = cleanNode(nodeInput, plan.teamId);
+  const node = cleanNode(nodeInput, actorId(ctx), plan.teamId);
   if (plan.nodes.some((item) => item.id === node.id)) throw new ValidationError(`node ${node.id} already exists`);
   const updated = replacePlan({ ...plan, nodes: [...plan.nodes, node] }, actorId(ctx));
   syncPlanNodeIssueAssociation(updated.id, node);
@@ -299,7 +329,7 @@ export function updatePlanNode(planId: string, nodeId: string, patch: PlanNodePa
     ...(patch.ownerRef !== undefined ? optionalProp("ownerRef", cleanOwnerRef(patch.ownerRef)) : {}),
     ...(patch.lane !== undefined ? optionalProp("lane", cleanString(patch.lane, "lane", { max: 120 })) : {}),
     ...(patch.status !== undefined ? { status: optionalEnum(patch.status, "status", PLAN_STATUSES) as PlanStatus } : {}),
-    ...(patch.refs !== undefined ? optionalProp("refs", cleanRefs(patch.refs)) : {}),
+    ...(patch.refs !== undefined ? optionalProp("refs", cleanRefs(patch.refs, actorId(ctx))) : {}),
     ...(patch.blackboardRefs !== undefined ? optionalProp("blackboardRefs", cleanBlackboardRefs(patch.blackboardRefs, plan.teamId)) : {}),
     statusSource,
   };

package/src/services/register-agent.ts

@@ -10,7 +10,7 @@
 // status broadcast, the single timeline note, the spawned-child parent-wake, and
 // the first-registration audit row.
 import { errMessage, isReservedAgentId } from "agent-relay-sdk";
-import { ValidationError, createActivityEvent, deliverableTaskIdsBySpawnRequestId, getAgent, getTaskDetail, seedSpawnPromptMirror, seedSpawnReplyObligation, upsertAgent } from "../db";
+import { ValidationError, createActivityEvent, deliverableTaskIdsBySpawnRequestId, getAgent, getTaskDetail, mergeAgentMeta, readSpawnReportVerbosity, seedSpawnPromptMirror, seedSpawnReplyObligation, upsertAgent } from "../db";
 import { emitAgentStatus, emitNewMessage } from "../sse";
 import { noteAgentTimelineEvent } from "../compaction-watch";
 import { agentProviderTimelineEvent } from "../provider-timeline-event";
@@ -128,6 +128,10 @@ export function registerAgent(input: RegisterAgentInput, ctx: AuthContext): Agen
     // spawner so it can't idle with its verdict undelivered (vent #121). First-registration only.
     const spawnRequestId = metaStr(agent.meta, "spawnRequestId");
     const provider = metaStr(agent.meta, "provider");
+    // #1037 — stamp the spawner-chosen report-up verbosity onto the child's meta from the persisted
+    // spawn command, so the lineage report-up delivery gate can read it (defaults to quiet if absent).
+    const reportVerbosity = readSpawnReportVerbosity(spawnRequestId);
+    if (reportVerbosity) mergeAgentMeta(agent.id, { reportVerbosity });
     const promptMirror = seedSpawnPromptMirror(agent.id, spawnRequestId);
     if (promptMirror?.created || promptMirror?.updated) emitNewMessage(promptMirror.message);
     seedSpawnReplyObligation(agent.id, agent.spawnedBy, spawnRequestId);

package/src/services/send-message.ts

@@ -24,9 +24,11 @@
 import { canonicalHumanAgentId, isHumanAgentId, isMechanicalMessageKind, isRecord, isReservedAgentId } from "agent-relay-sdk";
 import {
   ValidationError,
+  flushDeferredLineageReport,
   getAgent,
   getMessage,
   listAgents,
+  listRecentFinalResponseCaptures,
   promoteLineageCapturedResponse,
   sendMessagesBatchWithResult,
   sendMessageWithResult,
@@ -225,6 +227,40 @@ function prepareSendMessage(input: SendMessageInput, ctx: AuthContext, opts: Sen
   return { receipt, suppressedParent: suppressResultsOnlyAck(input) };
 }
 
+/**
+ * #1037 — the child transitioned out of busy (idle/awaiting-input). Deliver its deferred turn-final
+ * report-up (a quiet child's last turn, held back so mid-work narration never reached the spawner)
+ * and fan it out over SSE. No-op when nothing was deferred. Driven off the bus turn-end edge.
+ */
+export function flushIdleLineageReport(childId: string): void {
+  const promoted = flushDeferredLineageReport(childId);
+  if (promoted?.created) emitNewMessages([promoted.message]);
+}
+
+/** How far back the startup sweep re-scans for held-but-lost turn-final captures (#1040). A report
+ * is only ever deferred while its child is mid-turn, so any capture lost across a restart is recent;
+ * a day is a generous ceiling that still bounds the scan. */
+const LINEAGE_STARTUP_SWEEP_WINDOW_MS = 24 * 60 * 60 * 1000;
+
+/**
+ * #1040 — startup re-promotion sweep. `deferredLineageReports` is an in-memory Map, so a relay
+ * restart drops every held turn-final report-up. The captures are persisted, though, so re-run
+ * promotion for recent final response captures: an idle child whose report was lost gets it
+ * delivered now, an already-delivered one is a no-op (idempotency key), and a still-busy child
+ * re-defers (re-arming the in-memory hold so a later idle edge flushes it). Idempotent and safe to
+ * run periodically.
+ */
+export function sweepDeferredLineageReportsOnStartup(now: number = Date.now()): { promoted: number; scanned: number } {
+  const captures = listRecentFinalResponseCaptures(now - LINEAGE_STARTUP_SWEEP_WINDOW_MS);
+  const emitted: Message[] = [];
+  for (const capture of captures) {
+    const promoted = promoteLineageCapturedResponse(capture);
+    if (promoted?.created) emitted.push(promoted.message);
+  }
+  if (emitted.length > 0) emitNewMessages(emitted);
+  return { promoted: emitted.length, scanned: captures.length };
+}
+
 function emitSendResults(results: DbSendMessageResult[]): void {
   const liveMessages: Message[] = [];
   for (const result of results) {