agent-relay-server 0.121.4 → 0.122.0

package/src/routes/workspaces.ts

@@ -433,6 +433,12 @@ export const postWorkspaceCleanupStale: Handler = async (req) => {
   const workspaceId = cleanString(body.workspaceId, "workspaceId", { max: 160 });
   const dryRun = body.dryRun !== false; // safe by default
   const landedOnly = true;
+  // #965 — an explicit operator force-discard for a genuinely-abandoned branch: clear even when
+  // git state is a conflict / unlanded / unprobeable. The land-safety gate is correct for LIVE
+  // work but wrong for a confirmed-abandoned branch, which otherwise left a raw DELETE as the only
+  // path. Gated hard on the owner NOT being online (force can never override liveness) and, like
+  // every mutation here, on `--execute` (dryRun:false) — the two together are the confirmation.
+  const force = body.force === true;
 
   const candidates = listWorkspaces().filter((ws) =>
     ws.mode === "isolated" && Boolean(ws.worktreePath) && !TERMINAL_WORKSPACE_STATUSES.has(ws.status)
@@ -455,22 +461,41 @@ export const postWorkspaceCleanupStale: Handler = async (req) => {
     const landed = gitState?.landed === true;
     // Safe = gone from disk, OR clean tree with no unmerged work (landed/empty).
     const safe = missing || (gitState !== undefined && (dirtyCount ?? 1) === 0 && (!landedOnly || landed || ahead === 0));
+    // #965 — a force-discard clears an unsafe (conflict/unlanded/unprobeable) row too, but only
+    // for an offline owner. #1066: the `ownerOnline` snapshot above predates the
+    // `fetchWorkspaceGitState` await, so it is stale by dispatch time; liveness is re-verified
+    // immediately before dispatch below. Force overrides the land-safety gate, NEVER liveness.
+    const forced = force && !safe;
+    const discardable = safe || force;
     const proof = { ownerStatus: owner?.status ?? "missing", ownerOnline, ahead, behind: gitState?.behind, landed, dirtyCount, missing, gitStateUnavailable: gitState ? undefined : ("unavailable" in fetched ? fetched.unavailable : undefined) };
-    const row: Record<string, unknown> = { workspaceId: ws.id, branch: ws.branch, worktreePath: ws.worktreePath, repoRoot: ws.repoRoot, safe, proof };
-    if (safe && !dryRun) {
-      const built = buildWorkspaceCleanupCommand(ws, "cleanup-stale");
-      if (built.ok) {
-        updateWorkspaceStatus(ws.id, "cleanup_requested", { lastWorkspaceAction: "cleanup-stale", lastWorkspaceActionAt: Date.now(), cleanupProof: proof });
-        emitCommand(built.command);
-        row.commandId = built.command.id;
-        cleaned.push(ws.id);
+    const row: Record<string, unknown> = { workspaceId: ws.id, branch: ws.branch, worktreePath: ws.worktreePath, repoRoot: ws.repoRoot, safe, discardable, ...(forced ? { forced: true } : {}), proof };
+    if (discardable && !dryRun) {
+      // #1066 — re-snapshot liveness AFTER the git-state probe, immediately before dispatch. An
+      // owner offline at the initial snapshot can reconnect during the probe window (relay lag —
+      // #1054), and `force` bypasses buildWorkspaceCleanupCommand's dispatch-time live-owner guard,
+      // so this route is the only place that can refuse a just-reconnected owner under force.
+      // Force may clear an unsafe/conflict/unlanded row, but it must never nuke a live owner's tree.
+      if (isOwnerAlive(ws.ownerAgentId)) {
+        row.discardable = false;
+        row.cleanupError = `workspace ${ws.id} owner reconnected during git-state probe; force cannot override liveness`;
+        row.proof = { ...proof, ownerOnline: true };
       } else {
-        row.cleanupError = built.error;
+        // Owner re-confirmed offline just above; force past buildWorkspaceCleanupCommand's
+        // live-owner guard and carry a reason so the host records an intentional force-discard.
+        const built = buildWorkspaceCleanupCommand(ws, "cleanup-stale", forced ? { force: true, reason: "operator force-discard: abandoned branch, owner offline" } : {});
+        if (built.ok) {
+          updateWorkspaceStatus(ws.id, "cleanup_requested", { lastWorkspaceAction: "cleanup-stale", lastWorkspaceActionAt: Date.now(), cleanupProof: { ...proof, forced } });
+          emitCommand(built.command);
+          row.commandId = built.command.id;
+          cleaned.push(ws.id);
+        } else {
+          row.cleanupError = built.error;
+        }
       }
     }
     rows.push(row);
   }
-  return json({ dryRun, landedOnly, repoRoot, ...(workspaceId ? { workspaceId } : {}), scanned: candidates.length, eligible: rows.filter((r) => r.safe).length, cleaned, candidates: rows }, dryRun ? 200 : 202);
+  return json({ dryRun, landedOnly, force, repoRoot, ...(workspaceId ? { workspaceId } : {}), scanned: candidates.length, eligible: rows.filter((r) => r.discardable).length, cleaned, candidates: rows }, dryRun ? 200 : 202);
 };
 
 export const postWorkspaceAction: Handler = async (req, params) => {

package/src/services/plan-graph.ts

@@ -1,4 +1,4 @@
-import { isRecord } from "agent-relay-sdk";
+import { hasScope, isRecord } from "agent-relay-sdk";
 import { addTaskDependency, createPlanRow, deletePlan, getAgent, getEntry, getPlan, getPlanByTeam, getPlanByThread, getTaskDetail, listPlansWithBoundOwner, planThreadExists, removeTaskDependency, replacePlan, sendMessage, setPlanArchived, ValidationError } from "../db";
 import { associateIssue, planNodeIssueEntityId, removeAssociation } from "../db/issue-associations";
 import { resolveIssueRefFromString } from "../db/issue-refs";
@@ -9,6 +9,7 @@ import { issueRepoForAgent } from "../agent-issue-repo";
 import { buildTaskGraphView, parseTaskId, planStatusToTaskStatus, projectPlanOverTasks } from "./task-plan-view";
 import { createTaskEntity, setTaskEntityStatus } from "./task-entity";
 import type { AuthContext } from "./auth-context";
+import { ServiceAuthError } from "./errors";
 import type { AgentCard, Plan, PlanEdge, PlanNode, PlanOwnerRef, PlanStatus } from "../types";
 
 export const PLAN_STATUSES = ["pending", "in-progress", "landed", "blocked"] as const;
@@ -37,7 +38,7 @@ interface PlanNodePatch {
 }
 
 interface PlanCreateInput {
-  threadId: unknown;
+  threadId?: unknown;
   teamId?: unknown;
   channel?: unknown;
   title?: unknown;
@@ -269,7 +270,9 @@ function emitPlan(type: "plan.created" | "plan.changed" | "plan.deleted", plan:
 // thread server-side by self-threading a lightweight system message (the same sendMessage path the
 // caller would have used). Sent AS the actor when that agent is registered, else the reserved
 // `system` sink, so the mint always passes the sender-registration gate.
-function mintPlanThread(actor: string, channel: string | undefined): number {
+function mintPlanThread(ctx: AuthContext, channel: string | undefined): number {
+  ensureCanMintThread(ctx);
+  const actor = actorId(ctx);
   const sender = getAgent(actor) ? actor : "system";
   const root = sendMessage({
     from: sender,
@@ -280,24 +283,39 @@ function mintPlanThread(actor: string, channel: string | undefined): number {
   return root.threadId ?? root.id;
 }
 
+// #1043: the mint inserts a real message row through the db `sendMessage` path, which normally
+// lives behind the `message:send` scope. `plans:write` alone must not be a side-door around it, so
+// gate the mint on `message:send`. Internal `system` principals (empty-scope trusted callers) and
+// full-reach `*` tokens pass through untouched — `hasScope` short-circuits `*`.
+function ensureCanMintThread(ctx: AuthContext): void {
+  if (ctx.actor.kind === "system") return;
+  if (!hasScope(ctx.scopes, "message:send")) {
+    throw new ServiceAuthError("minting a plan thread requires the message:send scope");
+  }
+}
+
 export function createPlan(input: PlanCreateInput, ctx: AuthContext): Plan {
   const channel = cleanString(input.channel, "channel", { max: 120 });
   const actor = actorId(ctx);
-  const threadId = input.threadId === undefined || input.threadId === null
-    ? mintPlanThread(actor, channel)
-    : cleanThreadId(input.threadId);
-  if (!planThreadExists(threadId)) throw new ValidationError(`thread ${threadId} not found`);
   const explicitTeamId = cleanString(input.teamId, "teamId", { max: 120 });
   const teamId = explicitTeamId ?? (input.teamId === undefined || input.teamId === null ? getAgent(actor)?.teamId : undefined);
   const nodes = cleanNodes(input.nodes, actor, teamId);
   const edges = cleanEdges(input.edges);
   validateEdges(nodes, edges);
+  const title = cleanString(input.title, "title", { max: 240 });
+  const objective = cleanString(input.objective, "objective", { max: 4000 });
+  // Resolve the thread only AFTER the payload validates (#1043): auto-minting first left an orphan
+  // 'Plan thread root' row behind on every rejected create.
+  const threadId = input.threadId === undefined || input.threadId === null
+    ? mintPlanThread(ctx, channel)
+    : cleanThreadId(input.threadId);
+  if (!planThreadExists(threadId)) throw new ValidationError(`thread ${threadId} not found`);
   const plan = createPlanRow({
     threadId,
     teamId,
     channel,
-    title: cleanString(input.title, "title", { max: 240 }),
-    objective: cleanString(input.objective, "objective", { max: 4000 }),
+    title,
+    objective,
     nodes,
     edges,
     createdBy: actor,

package/src/services/register-agent.ts

@@ -91,7 +91,18 @@ export function registerAgent(input: RegisterAgentInput, ctx: AuthContext): Agen
   // Registration labels are spawn defaults. Runtime /label changes remain authoritative.
   const registrationInput = existing ? { ...input } : input;
   if (existing) delete registrationInput.label;
-  const agent = upsertAgent(registrationInput);
+  // #1051/#484 — instance takeover is where the restart-strand invariant fires now that a
+  // heartbeat lapse no longer revokes anything. When a FRESH runner process re-registers under
+  // this agent id, the epoch bump inside upsertAgent atomically revokes the PRIOR instance's
+  // runtime tokens "stale": refused for auth yet re-mintable via the orchestrator (#484). A
+  // same-instance reconnect keeps its instanceId, so the epoch is unchanged and the live token
+  // is left valid — the whole point of #1051 (in-band recovery after lag without a re-mint).
+  // #1057(3) — the ONLY jti spared from that revoke is server-verified: the token that
+  // authenticated THIS registration, and only when it resolves to this very agent (a
+  // same-credential instance rotation, e.g. a respawn reusing its unexpired env token).
+  // Client-sent meta.auth can no longer nominate jtis to keep.
+  const verifiedKeepJti = ctx.callerAgentId === input.id ? ctx.component?.jti : undefined;
+  const agent = upsertAgent(registrationInput, verifiedKeepJti ? { verifiedKeepJtis: [verifiedKeepJti] } : undefined);
 
   // Managed came-up-running reconcile — no-op for non-managed agents (the guard lives
   // in markManagedAgentRunning). Clears backoff, flushes the policy queue, transitions

package/src/services/send-message.ts

@@ -21,12 +21,13 @@
 //
 // OUT OF SCOPE (transport-edge, excluded from the parity facet): automatic memory injection
 // (needs request-derived context) and per-transport audit (HTTP domain row vs MCP tool-call row).
-import { canonicalHumanAgentId, isHumanAgentId, isMechanicalMessageKind, isRecord, isReservedAgentId } from "agent-relay-sdk";
+import { canonicalHumanAgentId, isHumanAgentId, isMechanicalMessageKind, isRecord, isReservedAgentId, isTurnFinalSession } from "agent-relay-sdk";
 import {
   ValidationError,
   flushDeferredLineageReport,
   getAgent,
   getMessage,
+  latestInboundMessage,
   listAgents,
   listRecentFinalResponseCaptures,
   promoteLineageCapturedResponse,
@@ -287,6 +288,14 @@ function emitSendResults(results: DbSendMessageResult[]): void {
   emitNewMessages(liveMessages);
 }
 
+// #976 — a spawned child (results-only profile) whose turn-final response Relay already promotes to
+// its spawn-parent does not also need to fire a bare ack/report via relay_send_message. Codex workers
+// do this routinely ("Noted.", "Cleared.", "Going forward I'll…", or a duplicate of the final report),
+// and each redundant message wakes the coordinator and burns the context coordinators exist to
+// protect. This ONE home suppresses such acks on BOTH transports (HTTP + MCP) and BOTH providers
+// (codex + claude): a reply-path ack collapses onto its parent; a standalone self→parent ack (no
+// replyTo — the codex relay_send_message leak) collapses onto the latest inbound it answers. A
+// genuine result (final capture, a session-final step, or non-ack body) always passes through.
 function suppressResultsOnlyAck(input: SendMessageInput): Message | null {
   if (input.kind && input.kind !== "chat" && input.kind !== "session") return null;
   const sender = getAgent(input.from);
@@ -296,21 +305,40 @@ function suppressResultsOnlyAck(input: SendMessageInput): Message | null {
   if (!isPassiveAck(input.body)) return null;
   if (isRecord(input.payload?.responseCapture)) return null;
   const session = isRecord(input.payload?.session) ? input.payload.session : undefined;
-  if (session?.final === true) return null;
-  return input.replyTo ? getMessage(input.replyTo) : null;
+  if (isTurnFinalSession(session)) return null;
+  // Reply-path: collapse onto the parent message being acked.
+  if (input.replyTo) return getMessage(input.replyTo);
+  // Standalone self→parent path (#976): only a spawned child acking its OWN spawn-parent. Anchor to
+  // the latest inbound from that parent so the drop mirrors the reply-path collapse; if there is no
+  // prior inbound to anchor to, deliver (never drop a message we can't attribute to a conversation).
+  if (sender?.spawnedBy && sender.spawnedBy === input.to) {
+    return latestInboundMessage(input.from, sender.spawnedBy);
+  }
+  return null;
 }
 
+// Exact-match ceremonial acks (after normalization). Kept an explicit set — high precision, so a
+// real short status ("Cleared the queue", "PASS") never matches, only the bare acknowledgement.
+const PASSIVE_ACK_PHRASES = new Set([
+  "noted", "noted standing by",
+  "acknowledged", "acknowledged standing by",
+  "standing by", "ok standing by", "okay standing by",
+  "understood", "understood standing by",
+  "cleared", "will do", "will do standing by", "will comply",
+  "on it", "got it", "roger", "roger that", "copy", "copy that",
+  "sounds good", "ok", "okay", "okay will do", "thanks", "thank you",
+  "no problem", "no worries",
+]);
+
+// A short SELF-REFERENTIAL acknowledgement of an instruction about the agent's OWN reporting
+// behavior ("Going forward, I'll only use Relay mid-task…"). Bounded length + it must name the
+// messaging/reporting channel, so a genuine forward-looking REPORT that happens to open with
+// "going forward" ("going forward the build fails unless we bump node") still passes through.
+const REPORTING_META_ACK = /^(going forward|from now on)\b.{0,160}\b(relay|messages?|acks?|reports?|reporting|pings?|notif\w*)\b/;
+
 function isPassiveAck(body: string): boolean {
-  const text = body.toLowerCase().replace(/[.!]+/g, "").replace(/\s+/g, " ").trim();
-  return [
-    "noted",
-    "noted standing by",
-    "acknowledged",
-    "acknowledged standing by",
-    "standing by",
-    "ok standing by",
-    "okay standing by",
-    "understood",
-    "understood standing by",
-  ].includes(text);
+  const text = body.toLowerCase().replace(/[.!,…]+/g, " ").replace(/\s+/g, " ").trim();
+  if (!text) return false;
+  if (PASSIVE_ACK_PHRASES.has(text)) return true;
+  return text.length <= 160 && REPORTING_META_ACK.test(text);
 }

package/src/services/spawn-agent.ts

@@ -647,6 +647,9 @@ export async function spawnAgent(input: SpawnAgentInput, ctx: AuthContext): Prom
       providerArgs: input.providerArgs ?? [],
       prompt: resolvedPrompt,
       systemPromptAppend,
+      // #1062 — stash the RAW caller brief (pre-composition) so a dashboard (non-policy) restart can
+      // re-thread it as callerSystemPromptAppend and stay fresh-spawn-identical instead of dropping it.
+      ...(resolvedSystemPromptAppend ? { callerSystemPromptAppend: resolvedSystemPromptAppend } : {}),
       relayInjectionEvents: composedInstructions.relayInjectionEvents,
       landStrategy: input.landStrategy,
       autoMerge: input.autoMerge,

package/src/spawn-command.ts

@@ -96,6 +96,13 @@ interface BuildSpawnCommandOptions {
   providerArgs?: string[];
   prompt?: string;
   systemPromptAppend?: string;
+  /**
+   * #1062 — the RAW caller/parent brief (before project/profile/memory composition), persisted
+   * alongside the composed `systemPromptAppend` so a dashboard (non-policy) restart can re-thread it
+   * as `callerSystemPromptAppend` and re-project the rest fresh — otherwise the restart re-composes
+   * project/profile/memory but silently drops the parent's original task brief.
+   */
+  callerSystemPromptAppend?: string;
   relayInjectionEvents?: unknown[];
   landStrategy?: WorkspaceLandingPolicy;
   autoMerge?: WorkspaceAutoMergePolicy;
@@ -170,6 +177,7 @@ export function buildSpawnCommand(opts: BuildSpawnCommandOptions): Record<string
     ...def(opts.providerArgs, "providerArgs"),
     ...def(opts.prompt, "prompt"),
     ...def(opts.systemPromptAppend, "systemPromptAppend"),
+    ...def(opts.callerSystemPromptAppend, "callerSystemPromptAppend"),
     ...def(opts.relayInjectionEvents, "relayInjectionEvents"),
     ...def(opts.landStrategy, "landStrategy"),
     ...def(opts.autoMerge, "autoMerge"),

package/src/spawn-targets.ts

@@ -6,7 +6,7 @@ import { renderTemplate } from "./prompt-resolver";
 import { getRoutingPolicy } from "./routing-policy-store";
 import { isPathWithinBase } from "./utils";
 import { McpNotFoundError } from "./mcp-errors";
-import { DEFAULT_QUOTA_PREFER_SLACK_AT, DEFAULT_QUOTA_TARGET_UTILIZATION, quotaPaceMetrics } from "agent-relay-sdk/provider-quota";
+import { DEFAULT_QUOTA_PREFER_SLACK_AT, DEFAULT_QUOTA_TARGET_UTILIZATION, quotaOvershootPenalty, quotaPaceMetrics } from "agent-relay-sdk/provider-quota";
 import { isSpawnProvider, type ProviderQuotaRoutingConfig } from "agent-relay-sdk";
 import type { Orchestrator, ProviderCatalogSummary, ProviderQuotaBurnRole, ProviderQuotaBurnWindow, ProviderQuotaRecord, QuotaState, SpawnProvider } from "./types";
 
@@ -82,13 +82,11 @@ interface SpawnQuotaBurnWindow {
   timeToWallMs: number | null;
   projectedWallAt: number | null;
   earlyWallMs: number | null;
-  earlyFraction: number | null;
   // #760 — symmetric underburn signal (see ProviderQuotaBurnWindow.slack), re-derived against
   // the per-provider target, plus the "prefer" flag for this window.
   projectedUtilAtReset: number | null;
   slack: number | null;
   prefer: boolean;
-  weight: 1 | 3;
   penalty: number;
   blockedNow: boolean;
 }
@@ -272,45 +270,34 @@ function spawnQuotaWindow(
 ): SpawnQuotaBurnWindow | undefined {
   if (!quotaWindow) return undefined;
   const timeToResetMs = typeof quotaWindow.resetsAt === "number" ? Math.max(0, quotaWindow.resetsAt - now) : null;
-  // earlyWallMs may be negative (#760 symmetric); the over-pace penalty only sees the positive half.
-  const earlyFraction = burnWindow.earlyWallMs !== null && timeToResetMs && timeToResetMs > 0
-    ? Math.max(0, burnWindow.earlyWallMs) / timeToResetMs
-    : null;
-  const weight = burnWindow.role === "7d" ? 3 : 1;
   const hardBackstop = providerCfg?.hardBackstopUtilization;
-  // #760 — floor default is now 0 (off). The projection/pace gate (earlyFraction≈0 when the
-  // recency-weighted rate projects no early wall) replaces the blunt utilization floor, which
-  // used to hide a legitimate low-util-high-burst alarm. Operators may still opt back in.
+  // #760 — floor default is now 0 (off). The evidence-capped projection replaces the blunt
+  // utilization floor (which hid a legitimate low-util-high-burst alarm); operators may still opt
+  // back in to raw-utilization suppression by setting a positive floor.
   const utilizationFloor = providerCfg?.burnPenaltyUtilizationFloor ?? 0;
-  const pacePenalty = (earlyFraction ?? 0) * weight;
 
-  // #760 — re-derive the pace projection against the PER-PROVIDER target (the stored burn used
-  // the default). Slack is the symmetric underburn signal; prefer flags a window with no
-  // over-pace penalty and ≥ preferSlackAt projected headroom at reset.
+  // #1072 — the band projection is evidence-capped at INGEST off the slow rate and is
+  // target-independent, so keep it as-is and re-derive only the per-provider-target slack + penalty
+  // from it. burnRatio (display) re-paces the same slow rate against the per-provider target.
   const target = providerCfg?.targetUtilization ?? DEFAULT_QUOTA_TARGET_UTILIZATION;
   const preferSlackAt = providerCfg?.preferSlackAt ?? DEFAULT_QUOTA_PREFER_SLACK_AT;
   const blockedNow = hardBackstop === 0 ? false : quotaWindow.utilization >= (hardBackstop ?? 0.99);
+  const projectedUtilAtReset = burnWindow.projectedUtilAtReset;
   let burnRatio = burnWindow.burnRatio;
-  let projectedUtilAtReset = burnWindow.projectedUtilAtReset;
-  let slack = burnWindow.slack;
   if (burnWindow.observedRatePerMs !== null && timeToResetMs !== null && timeToResetMs > 0) {
-    const pace = quotaPaceMetrics({ utilization: quotaWindow.utilization, observedRatePerMs: burnWindow.observedRatePerMs, timeToResetMs, target });
-    burnRatio = pace.burnRatio;
-    projectedUtilAtReset = pace.projectedUtilAtReset;
-    slack = pace.slack;
+    burnRatio = quotaPaceMetrics({ utilization: quotaWindow.utilization, observedRatePerMs: burnWindow.observedRatePerMs, timeToResetMs, target }).burnRatio;
   }
 
-  // #798 — position penalty: an idle provider whose (de-biased) projection lands AT/OVER target is
-  // already over-extended, but its forward-wall pace penalty is 0 (no burn) — so without this the
-  // band would flip to "normal" and route big jobs onto a near-exhausted provider. Derive a STABLE
-  // penalty from the overshoot magnitude (slack < 0 ⇒ projectedUtilAtReset − target), decoupled
-  // from the jittery forward-burn term. Gated to idle (observedRatePerMs collapsed to 0): an ACTIVE
-  // provider is still governed entirely by the pace penalty (effective = max of the two), so this
-  // adds a floor for the parked-high case WITHOUT changing active routing. Under-target idle ⇒ 0.
-  const idle = burnWindow.observedRatePerMs !== null && burnWindow.observedRatePerMs <= 0;
-  const overshoot = slack !== null ? Math.max(0, -slack) : 0;
-  const positionPenalty = idle ? Math.min(1, overshoot / Math.max(1e-9, 1 - target)) * weight : 0;
-  const rawPenalty = Math.max(pacePenalty, positionPenalty);
+  // #1072 — ONE unified overshoot penalty (replaces #760 earlyFraction, the #1071 7d ×3 weight,
+  // and the #798 idle position penalty). The measured current overshoot counts at full weight; the
+  // projected trend overshoot is scaled by the continuous confidence, so thin evidence cannot
+  // hard-escalate on an extrapolated slope. Idle and active share this single formula — an idle
+  // over-target provider is held by the current-overshoot term (confidence-independent, so the
+  // band is flat tick-to-tick), an active climb escalates as the confidence-weighted trend crosses.
+  const confidence = burnWindow.confidenceScore ?? 0;
+  const { slack, penalty: rawPenalty } = projectedUtilAtReset !== null
+    ? quotaOvershootPenalty(projectedUtilAtReset, quotaWindow.utilization, target, confidence)
+    : { slack: burnWindow.slack, penalty: 0 };
   const penalty = quotaWindow.utilization < utilizationFloor ? 0 : rawPenalty;
   const prefer = !blockedNow && penalty === 0
     && quotaPenaltyBandFor(penalty) === "normal"
@@ -327,11 +314,9 @@ function spawnQuotaWindow(
     timeToWallMs: burnWindow.timeToWallMs,
     projectedWallAt: burnWindow.projectedWallAt,
     earlyWallMs: burnWindow.earlyWallMs,
-    earlyFraction,
     projectedUtilAtReset,
     slack,
     prefer,
-    weight,
     penalty,
     blockedNow,
   };

package/src/sse.ts

@@ -4,7 +4,7 @@ import { projectAgentStatusData } from "./agent-card-projection";
 import { emitRelayEvent, subscribeRelayEvents, type RelayEvent } from "./events";
 import { messageMatchesAgent, targetMatchesAgent } from "./agent-ref";
 import type { ActivityEvent, AgentCard, Message, RelayInjectionCategory, RelayNotification, Task } from "./types";
-import { isRecord } from "agent-relay-sdk";
+import { isRecord, isWorkFinalMessagePayload } from "agent-relay-sdk";
 import { agentProviderState } from "./provider-state";
 
 interface Connection {
@@ -165,6 +165,10 @@ function fanout(event: RelayEvent): void {
     sendNewMessages(batchMessages(event.data), event.seq);
     return;
   }
+  if (event.type === "message.finalized") {
+    sendMessageUpdate("message.finalized", event.data as unknown as Message, event.seq);
+    return;
+  }
   if (event.type === "task.updated" || event.type === "task.created" || event.type === "task.claimed" || event.type === "task.status") {
     sendTaskChanged(event.data as unknown as Task, event.type, event.seq);
     return;
@@ -203,6 +207,15 @@ function sendNewMessages(messages: Message[], seq?: number): void {
   }
 }
 
+function sendMessageUpdate(eventName: string, msg: Message, seq?: number): void {
+  const chunk = sseFrame(eventName, msg, seq);
+  const agentCache = new Map<string, AgentCard | null>();
+  for (const conn of connections.values()) {
+    if (conn.agentId && !messageMatchesAgent(msg, conn.agentId, fanoutAgent(conn.agentId, agentCache))) continue;
+    sendEncoded(conn, chunk);
+  }
+}
+
 function batchMessages(data: Record<string, unknown>): Message[] {
   const messages = (data as { messages?: unknown }).messages;
   return Array.isArray(messages) ? messages as Message[] : [];
@@ -329,6 +342,10 @@ export function emitMessageReactionUpdated(msg: Message) {
   emitRelayEvent({ type: "message.reaction_updated", source: "server", subject: String(msg.id), data: msg as unknown as Record<string, unknown> });
 }
 
+export function emitMessageFinalized(msg: Message) {
+  emitRelayEvent({ type: "message.finalized", source: "server", subject: String(msg.id), data: msg as unknown as Record<string, unknown> });
+}
+
 function sendTaskChanged(task: Task, eventType = "task.updated", seq?: number): void {
   const chunk = sseFrame(eventType, task, seq);
   const agentCache = new Map<string, AgentCard | null>();
@@ -387,6 +404,12 @@ function sendReplayEvent(conn: Connection, event: RelayEvent, agentCache: Map<st
     send(conn, "message.new", msg, event.seq);
     return;
   }
+  if (event.type === "message.finalized" && conn.agentId) {
+    const msg = event.data as unknown as Message;
+    if (!messageMatchesAgent(msg, conn.agentId, fanoutAgent(conn.agentId, agentCache))) return;
+    send(conn, "message.finalized", msg, event.seq);
+    return;
+  }
   if (event.type.startsWith("task.") && conn.agentId) {
     const task = event.data as unknown as Task;
     if (!targetMatchesAgent(task.target, conn.agentId, fanoutAgent(conn.agentId, agentCache))) return;
@@ -481,8 +504,7 @@ function isInboundChannelMessage(msg: Message): boolean {
 
 function isBadgeWorthyMessage(msg: Message): boolean {
   if (msg.kind !== "session") return false;
-  const session = isRecord(msg.payload?.session) ? msg.payload.session : undefined;
-  return session?.final === true;
+  return isWorkFinalMessagePayload(msg.payload);
 }
 
 function notificationForMessage(msg: Message): RelayNotification | undefined {

package/src/workspace-merge.ts

@@ -3,6 +3,7 @@ import { isRecord, stringValue } from "agent-relay-sdk";
 import { createCommand } from "./commands-db";
 import {
   acquireMergeLease,
+  exitCertificateMatchesInstance,
   getActiveMergePause,
   getAgent,
   listAgents,
@@ -11,6 +12,7 @@ import {
   setMergeLeaseCommand,
   updateWorkspaceStatus,
 } from "./db";
+import { OFFLINE_PRUNE_MS } from "./config";
 import { getLandingConfig } from "./config-store";
 import type {
   Command,
@@ -149,15 +151,33 @@ export function withOwnerOnline<T extends { ownerAgentId?: string }>(workspace:
 // the 2026-07-04 cascade). A genuine process exit is only known when the owning
 // orchestrator REPORTS it: it stamps `meta.lastExit` (routes/orchestrator.ts). So
 // require both offline AND a reported exit before treating the owner as gone — never
-// nuke/land a worktree on a heartbeat gap alone. Conservative by design: an unmanaged
-// agent with no orchestrator never gets `lastExit`, so it reads as maybe-alive and the
-// orphan reaper's land-safety + grace window handle its eventual cleanup instead.
+// nuke/land a worktree on a heartbeat gap alone.
+//
+// The confirmed-gone signal is the reconciling primitive between two opposing failures:
+//   • false POSITIVE (#1054/#1059) — reaping a live-but-lagging owner. Guarded by requiring
+//     a reported exit AND that the exit certificate belongs to the CURRENT instance: a stale
+//     report for a superseded session carries a different `spawnRequestId` and is rejected.
+//   • false NEGATIVE (#1060) — leaking a genuinely-gone owner's worktree. A MISSING row (pruned
+//     after OFFLINE_PRUNE_MS offline, or an explicit deleteAgent) can't be a live process under
+//     relay management, so it is gone; likewise an owner offline past the prune horizon is about
+//     to be pruned anyway and can't be a mere heartbeat-lagging owner (that window is bounded by
+//     OFFLINE_PRUNE_MS). Both restore the pre-#1054 isOwnerAlive reapability the #1054 gate lost.
 export function isOwnerProcessConfirmedGone(ownerAgentId: string | undefined): boolean {
   if (!ownerAgentId) return false;
   const agent = getAgent(ownerAgentId);
-  if (!agent || agent.status !== "offline") return false;
+  // #1060 — the owner row is gone (24h-offline prune or deleteAgent): genuinely gone, reapable.
+  if (!agent) return true;
+  if (agent.status !== "offline") return false;
+  // #1060(3) — offline past the prune horizon: can't be a live-but-lagging owner and is about to
+  // become a missing row anyway. Covers an unmanaged owner that never gets meta.lastExit.
+  if (Date.now() - agent.lastSeen >= OFFLINE_PRUNE_MS) return true;
   const meta = isRecord(agent.meta) ? agent.meta : undefined;
-  return Boolean(meta && meta.lastExit);
+  if (!meta) return false;
+  const lastExit = isRecord(meta.lastExit) ? meta.lastExit : undefined;
+  if (!lastExit) return false;
+  // #1059 — the reported exit must be for THIS instance, not a stale certificate stamped by a
+  // late report for a superseded predecessor (see exitCertificateMatchesInstance).
+  return exitCertificateMatchesInstance(meta, lastExit);
 }
 
 function workspaceOwnerHostKeys(workspace: WorkspaceRecord): Set<string> {

package/src/workspace-orphans.ts

@@ -26,7 +26,7 @@ import { createCommand } from "./commands-db";
 import { emitRelayEvent } from "./events";
 import { isPathWithinBase } from "./utils";
 import { TERMINAL_WORKSPACE_STATUSES, worktreeReapable, type WorktreeReapState } from "./workspace-phase";
-import { isOwnerAlive, liveAgentCwds, worktreeInUseByLiveAgent } from "./workspace-merge";
+import { isOwnerAlive, isOwnerProcessConfirmedGone, liveAgentCwds, worktreeInUseByLiveAgent } from "./workspace-merge";
 import { applyWorkspaceAction } from "./workspace-actions";
 import { workspaceOwnerOrchestrator } from "./workspace-host";
 import { UNLANDED_FLAG_COOLDOWN_MS, orphanGraceMs, orphanWorktreeReapEnabled, relayToken } from "./config";
@@ -606,14 +606,21 @@ export async function reapOrphanedWorktrees(): Promise<Record<string, unknown>>
     const key = `dead-owner:${resolve(workspace.worktreePath)}`;
     liveDeadOwnerKeys.add(key);
 
-    if (isOwnerAlive(workspace.ownerAgentId)) {
-      deadOwnerTracker.delete(key); // owner alive — reset the grace window (regression vs #278)
+    // #1054 — gate on PROCESS-confirmed death, not heartbeat-only liveness. A live
+    // owner that is falsely marked `offline` (sustained relay lag / network partition
+    // >30min) has no orchestrator-reported `meta.lastExit`; isOwnerAlive alone would
+    // treat it as reap-eligible and destroy its landed+clean worktree — killing the
+    // live session's cwd. worktreeInUseByLiveAgent can't protect it (offline owners are
+    // excluded from liveCwds). Require offline AND a reported exit before the grace clock
+    // even starts, so only a genuinely-gone owner's worktree is ever reaped.
+    if (!isOwnerProcessConfirmedGone(workspace.ownerAgentId)) {
+      deadOwnerTracker.delete(key); // alive, or falsely-offline live — reset the grace window (#1054/#278)
       continue;
     }
 
-    // Owner observed dead. Require continuous dead-ness for the grace window so a
-    // reconnecting agent isn't raced; the in-memory tracker re-arms on restart. A
-    // grace of 0 reaps on the first dead observation (the env's escape hatch).
+    // Owner process confirmed gone. Require continuous confirmed-gone-ness for the grace
+    // window so a reconnecting agent isn't raced; the in-memory tracker re-arms on
+    // restart. A grace of 0 reaps on the first confirmed-gone observation (env escape hatch).
     const tracked = deadOwnerTracker.get(key);
     const firstSeenDeadAt = tracked?.firstSeenDeadAt ?? now;
     if (!tracked) deadOwnerTracker.set(key, { firstSeenDeadAt });

package/public/assets/display-exQDWum3.js

@@ -1,3 +0,0 @@
-import{d as e,g as t,h as n,o as r,p as i,s as a}from"./types-uVOXgvMT.js";var o=`user`,s=o,c=5e3,l=new Set([`done`,`failed`,`canceled`]),u=new Set([`open`,`blocked`]),d={online:0,idle:0,busy:2,offline:3},f={idle:0,online:0,busy:2,offline:4},p={from:``,to:``,body:``,channel:``,subject:``,claimable:!1},m={toMode:`agent`,to:``,body:``,channel:``,subject:``,claimable:!1},h={pairId:``,from:``,body:``,subject:``},ee={requesterId:``,targetId:``,objective:``},te={user:`User`,system:`Server`,channel:`MessagesSquare`,agent:`Bot`},ne={user:`Human operator`,system:`System`,channel:`Channel`,agent:`Agent`};({...te,...Object.fromEntries(i().map(e=>[e,`Bot`]))}),{...ne,...Object.fromEntries(i().map(e=>[e,`${n(e)} agent`]))};var re=[{key:`overview`,label:`Overview`,icon:`LayoutDashboard`},{key:`chat`,label:`Chat`,icon:`MessageCircle`},{key:`agents`,label:`Agents`,icon:`Bot`},{key:`managed`,label:`Managed Agents`,icon:`Workflow`},{key:`teams`,label:`Teams`,icon:`Users`},{key:`profiles`,label:`Agent Profiles`,icon:`UserCog`},{key:`orchestrators`,label:`Orchestrators`,icon:`Server`},{key:`workspaces`,label:`Workspaces`,icon:`GitBranch`},{key:`files`,label:`Files`,icon:`FolderTree`},{key:`channels`,label:`Channels`,icon:`MessagesSquare`},{key:`connectors`,label:`Connectors`,icon:`Plug`},{key:`integrations`,label:`Integrations`,icon:`PlugZap`},{key:`security`,label:`Security`,icon:`Shield`},{key:`memory`,label:`Memory`,icon:`BrainCircuit`},{key:`activity`,label:`Activity`,icon:`Activity`},{key:`pairs`,label:`Pairs`,icon:`Link`},{key:`messages`,label:`Messages`,icon:`Mail`},{key:`work`,label:`Work Queue`,icon:`ListChecks`},{key:`tasks`,label:`Tasks`,icon:`ClipboardList`},{key:`automation`,label:`Automation`,icon:`CalendarClock`},{key:`analytics`,label:`Analytics`,icon:`AreaChart`},{key:`insights`,label:`Insights`,icon:`Lightbulb`},{key:`projects`,label:`Projects`,icon:`Boxes`},{key:`prompts`,label:`Prompts`,icon:`FileText`},{key:`registry`,label:`Registry`,icon:`PackagePlus`},{key:`maintenance`,label:`Maintenance`,icon:`Wrench`},{key:`settings`,label:`Settings`,icon:`Settings`}],ie={critical:`text-red-400 bg-red-500/10`,warning:`text-yellow-400 bg-yellow-500/10`,info:`text-blue-400 bg-blue-500/10`},ae={active:`bg-emerald-500/20 text-emerald-400`,pending:`bg-yellow-500/20 text-yellow-400`,ended:`bg-zinc-500/20 text-zinc-400`,rejected:`bg-red-500/20 text-red-400`,expired:`bg-red-500/20 text-red-400`};function g(e){let t=typeof e==`number`?e:new Date(e||0).getTime();return Number.isFinite(t)?t:0}var _=[`lifecycle.`,`commands.`,`capabilities.`],v={"+1":`👍`,":+1:":`👍`,thumbsup:`👍`,":thumbsup:":`👍`,"thumbs-up":`👍`,":thumbs-up:":`👍`,thumbs_up:`👍`,":thumbs_up:":`👍`,thumb_up:`👍`,":thumb_up:":`👍`,like:`👍`,":like:":`👍`,heart:`❤️`,":heart:":`❤️`,redheart:`❤️`,red_heart:`❤️`,":red_heart:":`❤️`,check:`✅`,":check:":`✅`,checkmark:`✅`,":checkmark:":`✅`,white_check_mark:`✅`,":white_check_mark:":`✅`,eyes:`👀`,":eyes:":`👀`};function y(e){let t=e.trim();return v[t.toLowerCase()]??t}function oe(e){return e.filter(e=>!_.some(t=>e.startsWith(t)))}function se(e,t=2){if(!e)return``;let n=e.replace(/\/+$/,``).split(`/`);return n.length<=t?e:n.slice(-t).join(`/`)}function b(e){return e.trim().replace(/\\/g,`/`).replace(/\/+$/,``)||`/`}function ce(e,t){if(!e?.trim()||!t?.trim())return!1;let n=b(e),r=b(t);return r===`/`?n.startsWith(`/`):n===`/`?!1:n===r||n.startsWith(r+`/`)}function x(e){return e?.meta?.builtin===!0||e?.id===`user`||e?.id===`system`}function S(e){let t=e?.tags||[],n=e?.capabilities||[],r=typeof e?.meta?.policyName==`string`?e.meta.policyName:``;return e?.kind===`channel`||e?.meta?.kind===`channel`||t.includes(`channel`)||t.some(e=>e.startsWith(`channel:`))||n.includes(`channel`)||n.some(e=>e.startsWith(`channel:`))||t.includes(`telegram`)||n.includes(`telegram`)||r===`telegram-main`}function C(e){return!!(typeof e?.meta?.automationId==`string`||typeof e?.meta?.automationRunId==`string`||e?.tags?.includes(`automation`))}function w(e){return x(e)||S(e)||C(e)}function T(e){if(e?.id===`user`)return`user`;if(e?.id===`system`)return`system`;if(S(e))return`channel`;let t=i(),n=typeof e?.meta?.provider==`string`?e.meta.provider.toLowerCase():void 0;if(n&&t.includes(n))return n;let r=[...e?.tags||[],e?.meta?.client,e?.meta?.runtime,e?.meta?.agentType].filter(e=>typeof e==`string`).map(e=>e.toLowerCase());for(let e of t)if(r.some(t=>t.includes(e)))return e;return`agent`}function E(t,n){if(!n?.lastSeen||n.status===`offline`||n.id===`user`||n.id===`system`)return!1;let r=n.meta?.transport;if(e(r)&&r.connected===!0)return!1;let i=new Date(n.lastSeen).getTime();return Number.isFinite(i)?t-i>6e4:!1}function D(e,t){if(!e||x(e)||S(e)||t===`resume`)return!1;if(t===`interrupt`)return e.providerCapabilities?.liveSession?.interrupt===!0&&e.status===`busy`;if(k(e)&&(t===`restart`||t===`shutdown`||t===`compact`||t===`clearContext`)&&!O(e))return!1;let n=e.providerCapabilities?.lifecycle;if(n){if(t===`restart`)return n.restartHard===!0;if(t===`shutdown`)return n.shutdownHard===!0;if(t===`reconnect`)return n.reconnect===!0}return t===`compact`?e.providerCapabilities?.context?.compact===!0:t===`clearContext`?e.providerCapabilities?.context?.clear===!0:e.meta?.runnerManaged===!0&&(t===`restart`||t===`shutdown`)}function O(e){return typeof e.meta?.tmuxSession==`string`&&e.meta.tmuxSession.trim().length>0}function k(e){return(typeof e?.meta?.provider==`string`?t(e.meta.provider):void 0)?.capabilityDefaults?.terminal?.mode===`live`}function A(e){return D(e,`restart`)||D(e,`shutdown`)||D(e,`reconnect`)||D(e,`compact`)||D(e,`clearContext`)}function j(e){return!!(e&&!x(e)&&!S(e)&&!A(e)&&(e.status===`offline`||e.status===`stale`))}function M(e,t){if(e.status!==`offline`)return!1;let n=typeof e.meta?.policyName==`string`?e.meta.policyName:``;if(!n)return!1;let r=t.find(e=>e.policy.name===n);return!!(r?.state.agentId&&r.state.agentId!==e.id)}function N(e,t,n=[]){let r=e.filter(e=>!M(e,n));return t?r:r.filter(e=>!w(e))}function P(e){return e?e.label||e.name||e.id.slice(-12):`?`}function F(e,t){let n=a(e);return n?t[n]:void 0}function I(e,t){let n=F(e,t);return n?.displayName?.trim()||n?.handle?.trim()||`User`}var L=[`text-sky-300`,`text-amber-300`,`text-emerald-300`,`text-violet-300`,`text-rose-300`,`text-cyan-300`];function R(e){let t=a(e)||``,n=0;for(let e=0;e<t.length;e++)n=n*31+t.charCodeAt(e)>>>0;return L[n%L.length]}function z(e,t){if(!e)return`?`;if(e===`broadcast`)return`broadcast`;if(e.startsWith(`tag:`))return`#`+e.slice(4);if(e.startsWith(`cap:`))return e.slice(4);if(e.startsWith(`label:`))return e.slice(6);if(e.startsWith(`team:`)){let n=e.slice(5),r=Object.values(t).find(e=>e.teamId===n);return r?`team:${P(r)}`:`team:${n.slice(-8)}`}let n=t[e];return n?P(n):e.slice(-8)}function B(e){if(!e)return``;let t=e.payload||{},n=t.message;if(n&&typeof n==`object`&&typeof n.text==`string`&&n.text.trim())return n.text;let r=t.interaction;if(r&&typeof r==`object`){let e=typeof r.title==`string`?r.title.trim():``,t=typeof r.description==`string`?r.description.trim():``;if(e&&t)return e+`
-`+t;if(e)return e;if(t)return t}let i=t.reaction;if(i&&typeof i==`object`){let e=typeof i.name==`string`?i.name:``,t=typeof i.emoji==`string`?i.emoji:``,n=typeof i.value==`string`?i.value:``;return[`Reaction`,y(t||e||n)].filter(Boolean).join(`: `)}let a=t.activity;return a&&typeof a==`object`?[typeof a.kind==`string`?a.kind:`activity`,typeof a.state==`string`?a.state:``].filter(Boolean).join(` `):typeof t.text==`string`&&t.text.trim()?t.text:typeof t.message==`string`&&t.message.trim()?t.message:U(e.body||``)??(e.body||``)}function V(e){if(!e?.payload)return!1;let t=e.payload.event;return e.payload.reactionNotification===!0||t?.type===`message.reaction`}function H(e){if(!e)return null;let t=e.trim();if(!t.startsWith(`{`))return null;try{let e=JSON.parse(t);if(typeof e!=`object`||!e||Array.isArray(e))return null;let n=typeof e.text==`string`?e.text:typeof e.message==`string`?e.message:null;if(!n?.trim())return null;let r=new Set([`text`,`message`]);return{text:n,meta:Object.entries(e).filter(([e,t])=>!r.has(e)&&(typeof t==`string`||typeof t==`number`||typeof t==`boolean`)).map(([e,t])=>[e,String(t)]),raw:e}}catch{return null}}function U(e){return H(e)?.text??null}function W(e){let t=e?.subject||B(e)||``;return t.length>90?t.slice(0,90)+`...`:t}function G(e){return r(e.from)&&e.to?e.to:r(e.to)&&e.from?e.from:``}function K(e){return r(e.to)&&!r(e.from)}function le(e){if(e.kind!==`session`)return!1;let t=e.payload?.session?.type;return t===`reasoning`||t===`tool`}function q(e){return e.kind===`session`&&e.payload?.session?.final===!0}function ue(e,t){let n=e.trim(),r=t.trim();return r?n===r?!0:n.startsWith(`${r}\n\n`)||n.endsWith(`\n\n${r}`)||n.includes(`\n\n${r}\n\n`):!1}function de(e,t,n){if(!K(n)||!q(n)||(n.readBy||[]).includes(`user`))return!1;let r=Number(e[t]||0);return n.id>(Number.isFinite(r)?r:0)}function J(e){return(e.kind??`claim`)===`claim`&&u.has(e.status)&&!e.claimedBy}function fe(e){return!!(e.claimable&&!e.claimedBy&&!(e.kind===`task`&&Number.isSafeInteger(e.payload?.taskId)))}function pe(e,t){return!e||!t?!1:e===`broadcast`||e===t.id?!0:e.startsWith(`tag:`)?(t.tags||[]).includes(e.slice(4)):e.startsWith(`cap:`)?(t.capabilities||[]).includes(e.slice(4)):e.startsWith(`label:`)?t.label===e.slice(6):e.startsWith(`team:`)?t.teamId===e.slice(5):!1}function me(e,t){return e?t.from===e||t.to===e||t.resolvedToAgent===e:!1}function he(e,t){if(!e||!t)return!1;let n=[t.id,t.type,...t.topicChannels||[]].filter(Boolean);if(e.channel&&n.includes(e.channel))return!0;let r=e.payload?.channel;if(r&&typeof r==`object`){let e=[r.agentId,r.provider,r.accountId].filter(Boolean);if(e.includes(t.id)||e.includes(t.type)||t.accountId&&e.includes(t.accountId))return!0}return!!(t.agentId&&(e.from===t.agentId||e.to===t.agentId))}function Y(t){let n=t?.meta?.providerState;return!e(n)||typeof n.state!=`string`?null:{state:n.state,reason:typeof n.reason==`string`?n.reason:void 0,label:typeof n.label==`string`&&n.label?n.label:n.state,recommendedAction:typeof n.recommendedAction==`string`?n.recommendedAction:void 0,source:typeof n.source==`string`?n.source:void 0,raw:n.raw,updatedAt:typeof n.updatedAt==`number`?n.updatedAt:void 0,pendingApproval:ge(n.pendingApproval)}}function ge(t){if(!e(t)||typeof t.id!=`string`)return;let n=Array.isArray(t.choices)?t.choices.filter(e).map(e=>({id:e.id,label:typeof e.label==`string`?e.label:String(e.id||``)})).filter(e=>(e.id===`approve`||e.id===`approve-session`||e.id===`deny`||e.id===`abort`)&&!!e.label):[],r=Array.isArray(t.questions)?t.questions.filter(e).map(t=>({question:typeof t.question==`string`?t.question:``,header:typeof t.header==`string`?t.header:void 0,multiSelect:t.multiSelect===!0,options:Array.isArray(t.options)?t.options.filter(e).map(e=>({label:typeof e.label==`string`?e.label:String(e.label??``),description:typeof e.description==`string`?e.description:void 0})).filter(e=>!!e.label):[]})).filter(e=>!!e.question&&e.options.length>0):void 0;return{id:t.id,provider:typeof t.provider==`string`?t.provider:void 0,kind:typeof t.kind==`string`?t.kind:void 0,title:typeof t.title==`string`&&t.title?t.title:`Permission request`,body:typeof t.body==`string`?t.body:``,choices:n,...r&&r.length?{questions:r}:{}}}function X(e){let t=Y(e);return t?.state===`blocked`?t:null}function _e(e){return!!e?.id}function ve(e){return _e(X(e)?.pendingApproval)}function Z(t){let n=t?.meta?.activeSubagents;if(!Array.isArray(n)){let e=typeof t?.meta?.activeSubagentCount==`number`?t.meta.activeSubagentCount:0;return e>0?Array.from({length:e},(e,t)=>({id:`subagent-${t+1}`,label:`Subagent ${t+1}`})):[]}return n.filter(e).map((e,t)=>{let n=typeof e.id==`string`&&e.id?e.id:`subagent-${t+1}`,r=typeof e.role==`string`&&e.role?e.role:void 0;return{id:n,label:typeof e.label==`string`&&e.label?e.label:r||n,role:r,startedAt:typeof e.startedAt==`number`?e.startedAt:void 0}})}function Q(t){let n=t?.meta?.activeWork;if(!Array.isArray(n))return null;let r=n.find(t=>e(t)&&t.kind===`background-script`);return!r||!e(r)?null:typeof r.label==`string`&&r.label?r.label:`background script`}function ye(e,t,n,r){let i=typeof t?.meta?.lifecycleAction==`string`?t.meta.lifecycleAction:``,a=E(e,t),o=t?.status!==`offline`&&!t?.ready&&a,s=t?.status!==`offline`&&!t?.ready&&!a,c=n.unread>0&&t?.status!==`busy`,l=X(t),u=be(t,n,r);if(t?.status===`offline`)return{label:`offline`,tone:`secondary`,icon:`PlugZap`,stale:!1,reconnecting:!1,badges:u};if(i.startsWith(`finalizing-`))return{label:`wrapping up (${i.slice(11)})`,tone:`warning`,icon:`Hourglass`,stale:a,reconnecting:o,badges:u};if(i===`shutting-down`)return{label:`shutting down`,tone:`warning`,icon:`Power`,stale:a,reconnecting:o,badges:u};if(i===`killing`)return{label:`killing`,tone:`danger`,icon:`Power`,stale:a,reconnecting:o,badges:u};if(i===`restarting`)return{label:`restarting`,tone:`warning`,icon:`RefreshCw`,stale:a,reconnecting:o,badges:u};if(t?.status===`stale`)return{label:`stale`,tone:`danger`,icon:`RefreshCw`,stale:!0,reconnecting:!0,badges:u};if(o)return{label:`reconnecting`,tone:`danger`,icon:`RefreshCw`,stale:a,reconnecting:o,badges:u};if(s)return{label:`online, not ready`,tone:`warning`,icon:`Loader`,stale:a,reconnecting:o,badges:u};if(l)return{label:`blocked: ${l.label}`,tone:`danger`,icon:`AlertCircle`,stale:a,reconnecting:o,badges:u};if(t?.status===`busy`){let e=Array.isArray(t?.meta?.busyReasons)?t.meta.busyReasons:[];return Q(t)&&!e.includes(`provider-turn`)&&!e.includes(`subagent`)?{label:`running background work`,tone:`warning`,icon:`Play`,stale:a,reconnecting:o,badges:u}:{label:`busy in turn`,tone:`warning`,icon:`Play`,stale:a,reconnecting:o,badges:u}}return r?.status===`active`?{label:`paired`,tone:`success`,icon:`Link`,stale:a,reconnecting:o,badges:u}:c?{label:`idle, unread`,tone:`danger`,icon:`Bell`,stale:a,reconnecting:o,badges:u}:{label:t?.status===`idle`?`idle`:`ready`,tone:`success`,icon:`CircleCheck`,stale:a,reconnecting:o,badges:u}}function be(e,t,n){let r=[],i=X(e),a=Z(e).length;i&&r.push({label:i.reason?`blocked: ${i.reason}`:`blocked`,className:`bg-red-500/20 text-red-400`}),a&&r.push({label:a===1?`1 subagent`:a+` subagents`,className:`bg-cyan-500/20 text-cyan-300`});let o=Q(e);return o&&r.push({label:o,className:`bg-indigo-500/20 text-indigo-300`}),n?.status===`active`&&r.push({label:`paired`,className:`bg-emerald-500/20 text-emerald-400`}),n?.status===`pending`&&r.push({label:`pair invite`,className:`bg-yellow-500/20 text-yellow-400`}),t.needsHumanResponse&&r.push({label:`needs response`,className:`bg-amber-500/20 text-amber-300`}),t.unread&&r.push({label:t.unread+` unread`,className:`bg-red-500/20 text-red-400`}),t.claimableTasks&&r.push({label:t.claimableTasks+` claimable`,className:`bg-orange-500/20 text-orange-400`}),r}function xe(){return{unread:0,needsHumanResponse:!1,pendingPairInvite:!1,claimableTasks:0,total:0,score:0}}function $(e){return!e||e.status===`offline`?!1:e.targetHealth?.status===`ok`?!0:e.targetHealth?.status===`error`||e.targetHealth?.status===`warning`?!1:e.ready}function Se(e){return e?e.targetHealth?.status===`error`?{label:`target broken`,tone:`danger`,icon:`AlertTriangle`,badges:[]}:e.targetHealth?.status===`warning`?{label:`target warning`,tone:`warning`,icon:`AlertCircle`,badges:[]}:e.status===`offline`?{label:`offline`,tone:`secondary`,icon:`PlugZap`,badges:[]}:e.status===`busy`?{label:`busy`,tone:`warning`,icon:`Activity`,badges:[]}:$(e)?{label:`ready`,tone:`success`,icon:`CircleCheck`,badges:[]}:{label:`not ready`,tone:`warning`,icon:`Loader`,badges:[]}:{label:`unknown`,tone:`secondary`,icon:`PlugZap`,badges:[]}}function Ce(e){let t=e?.runtime||{};return t.status===`error`?{label:`error`,tone:`danger`,icon:`AlertTriangle`,badges:[]}:t.status===`warn`?{label:`warning`,tone:`warning`,icon:`AlertCircle`,badges:[]}:t.running?{label:`running`,tone:`success`,icon:`CircleCheck`,badges:[]}:t.enabled===!1?{label:`disabled`,tone:`secondary`,icon:`Pause`,badges:[]}:t.status===`ok`?{label:`ok`,tone:`success`,icon:`CircleCheck`,badges:[]}:{label:`unknown`,tone:`secondary`,icon:`HelpCircle`,badges:[]}}function we(e){let t=e?.taskStats||{};return(t.waitingTasks||0)>0?{label:`waiting`,tone:`warning`,icon:`AlertCircle`,badges:[]}:(t.openTasks||0)>0?{label:`active`,tone:`info`,icon:`Activity`,badges:[]}:e?.configured?e.observed?{label:`quiet`,tone:`success`,icon:`CircleCheck`,badges:[]}:{label:`configured`,tone:`primary`,icon:`PlugZap`,badges:[]}:{label:`observed only`,tone:`secondary`,icon:`Eye`,badges:[]}}function Te(e){let t=e?.health;return!t||t.status===`ok`?e?.version||e?.package?.version?`compatible`:`unknown version`:t.status===`upgrade-required`?`upgrade required`:t.status===`restart-required`?`restart required`:t.status===`unknown`?`unknown contract`:(t.issues||[]).some(e=>e.code===`protocol-mismatch`)?`protocol mismatch`:(t.issues||[]).some(e=>e.code===`package-drift`)?`package drift`:t.restartRequired?`restart required`:t.status}function Ee(e){let t=e?.health?.status;return t===`upgrade-required`?`text-red-400 bg-red-500/10`:t===`warn`||t===`restart-required`?`text-yellow-400 bg-yellow-500/10`:t===`unknown`?`text-zinc-400 bg-zinc-500/10`:`text-emerald-400 bg-emerald-500/10`}function De(e,t){if(!t)return``;let n=new Date(t).getTime();if(!Number.isFinite(n))return``;let r=Math.max(0,(e-n)/1e3);return r<60?Math.floor(r)+`s ago`:r<3600?Math.floor(r/60)+`m ago`:r<86400?Math.floor(r/3600)+`h ago`:Math.floor(r/86400)+`d ago`}function Oe(e){return e?new Date(e).toLocaleString():``}function ke(e){return String(e||`export`).replace(/[^a-z0-9._-]+/gi,`-`).replace(/^-+|-+$/g,``).slice(0,80)||`export`}function Ae(e){return e.filter(e=>e.status!==`ok`).map(e=>{let t={name:e.name,status:e.status,detail:e.detail||e.name,impact:je(e),subjects:e.subjects||[],actions:[{label:`Inspect logs`,icon:`FileSearch`,copy:`agent-relay daemon logs`},{label:`Restart daemon`,icon:`RefreshCw`,copy:`agent-relay daemon restart`},{label:`Copy env`,icon:`Copy`,copy:`agent-relay doctor`}]};return e.name===`stale-live-agents`?t.actions.unshift({label:`Run reaper`,icon:`Eraser`,api:`POST`,path:`/system/reap`},{label:`Show stale`,icon:`Filter`,view:`agents`,preset:`offline_stale`}):e.name===`channel-delivery-targets`?t.actions.unshift({label:`Open channels`,icon:`MessagesSquare`,view:`channels`},{label:`Run reaper`,icon:`Eraser`,api:`POST`,path:`/system/reap`}):[`expired-message-claims`,`expired-task-claims`,`offline-claimed-tasks`].includes(e.name)&&t.actions.unshift({label:`Run reaper`,icon:`Eraser`,api:`POST`,path:`/system/reap`},{label:`Open work`,icon:`ListChecks`,view:`work`}),t})}function je(e){return{database:`Relay persistence is unavailable; messages, state, and audit writes may fail.`,"stale-live-agents":`Agents may look online even though their heartbeat has stopped.`,"expired-message-claims":`Claimable messages may be stuck until the reaper releases expired claims.`,"expired-task-claims":`Tasks can appear owned by agents that no longer hold a live lease.`,"offline-claimed-tasks":`Offline agents are still shown as owners for active work.`,"channel-delivery-targets":`Inbound channel messages may be accepted but routed to no live delivery agent.`}[e.name]||`Relay health is degraded for this check.`}function Me(e){return{success:`text-emerald-400`,warning:`text-yellow-400`,danger:`text-red-400`,info:`text-blue-400`,primary:`text-blue-400`,secondary:`text-zinc-400`}[e]||`text-zinc-400`}function Ne(e,t){return!e||e.status===`offline`?`bg-zinc-500 opacity-50`:typeof e.meta?.lifecycleAction==`string`&&e.meta.lifecycleAction.startsWith(`finalizing-`)?`bg-amber-500 animate-pulse`:e.meta?.lifecycleAction===`shutting-down`||e.meta?.lifecycleAction===`restarting`?`bg-yellow-500 animate-pulse`:e.meta?.lifecycleAction===`killing`||X(e)?`bg-red-500 animate-pulse`:e.status===`busy`?`bg-yellow-500`:t&&E(t,e)?`bg-red-500 animate-pulse`:e.ready?`bg-emerald-500 shadow-[0_0_6px_theme(colors.emerald.500)]`:`bg-emerald-500 animate-pulse`}function Pe(e,t,n){if(typeof document>`u`||typeof URL>`u`||typeof Blob>`u`)return;let r=URL.createObjectURL(new Blob([t],{type:n})),i=document.createElement(`a`);i.href=r,i.download=e,i.click(),URL.revokeObjectURL(r)}export{p as $,me as A,Y as B,fe as C,le as D,V as E,Ee as F,Ne as G,ue as H,Te as I,Me as J,De as K,H as L,W as M,b as N,de as O,y as P,l as Q,ce as R,q as S,K as T,ke as U,F as V,se as W,N as X,oe as Y,f as Z,R as _,D as a,c as at,we as b,Se as c,ie as ct,P as d,m as et,z as f,Ae as g,Oe as h,ye as i,s as it,he as j,B as k,Ce as l,d as lt,xe as m,j as n,h as nt,T as o,re as ot,Pe as p,g as q,ve as r,o as rt,$ as s,ae as st,Z as t,ee as tt,pe as u,I as v,J as w,E as x,G as y,X as z};
-//# sourceMappingURL=display-exQDWum3.js.map