agent-relay-server 0.121.5 → 0.122.0

package/src/maintenance/jobs.ts

@@ -1,7 +1,7 @@
 import { getArtifactStorage } from "../artifact-storage";
 import { deriveAgentBusyHealth } from "../agent-busy-health";
 import { expireStaleBusAgents } from "../bus";
-import { eventLoopLagMaxMs } from "../event-loop-lag";
+import { eventLoopLagGraceMs } from "../event-loop-lag";
 import { pruneOutbox } from "../bus-outbox";
 import { expireCommands } from "../commands-db";
 import { getRetentionConfig } from "../retention-config-store";
@@ -22,6 +22,7 @@ import {
   releaseExpiredClaims,
   releaseExpiredDriveLeases,
   releaseOrphanedTasks,
+  revokeOrphanedRuntimeTokens,
   runDbMaintenanceAsync,
   sweepArtifacts,
 } from "../db";
@@ -278,7 +279,7 @@ export const definitions: MaintenanceJobDefinition[] = [
     intervalMs: REAP_INTERVAL_MS,
     runOnStart: true,
     handler() {
-      const expired = expireStaleBusAgents(undefined, eventLoopLagMaxMs());
+      const expired = expireStaleBusAgents(undefined, eventLoopLagGraceMs());
       for (const id of expired.agentIds) {
         getLifecycleManager().onAgentDisappeared(id);
         // #636/#659 — only after the stale reconnect grace expires do we turn a bare
@@ -301,11 +302,13 @@ export const definitions: MaintenanceJobDefinition[] = [
     intervalMs: REAP_INTERVAL_MS,
     runOnStart: true,
     handler() {
-      // #1048 — gate staleness on the relay's OWN event-loop health. eventLoopLagMaxMs()
-      // is side-effect-free (does not consume the /health poller's spike max). During a
-      // relay self-stall this grace keeps live agents whose heartbeats we simply couldn't
+      // #1048/#1055 — gate staleness on the relay's OWN event-loop health.
+      // eventLoopLagGraceMs() is side-effect-free (does not consume the /health poller's
+      // spike max) and sums the retained window's lag, so BOTH one contiguous stall and
+      // sustained non-contiguous overload (many sub-TTL stalls whose backlog sums past the
+      // TTL) extend the grace. Keeps live agents whose heartbeats we simply couldn't
       // process from being reaped as dead.
-      const lagGraceMs = eventLoopLagMaxMs();
+      const lagGraceMs = eventLoopLagGraceMs();
       const reapedAgentIds = reapStaleAgents(STALE_TTL_MS, lagGraceMs);
       for (const id of reapedAgentIds) {
         emitAgentStatus(id);
@@ -336,6 +339,20 @@ export const definitions: MaintenanceJobDefinition[] = [
       return { prunedAgentIds };
     },
   },
+  {
+    id: "orphan-token-revoker",
+    title: "Orphaned runtime-token revoker",
+    description: "Revoke ('stale', re-mintable) the runtime tokens of agents whose process the orchestrator confirmed dead and that have not been heard from since.",
+    intervalMs: REAP_INTERVAL_MS,
+    runOnStart: false,
+    handler() {
+      // #1057(1) — same lag discipline as the stale reaper (#1048/#1055): while the relay's own
+      // event loop was stalled, a live replacement's heartbeats may still be unprocessed, so the
+      // grace widens by the observed lag instead of misreading the backlog as post-mortem silence.
+      const revokedOrphanTokens = revokeOrphanedRuntimeTokens(STALE_TTL_MS, eventLoopLagGraceMs());
+      return { revokedOrphanTokens };
+    },
+  },
   {
     id: "orphaned-session-reaper",
     title: "Orphaned session reaper",

package/src/managed-policy.ts

@@ -1,8 +1,7 @@
 import { getManifest } from "agent-relay-providers";
-import { DEFAULT_USER_ID } from "agent-relay-sdk";
 import { getAgentProfile } from "./config-store";
-import { resolveProjectForCwd, resolveScopedAnchor, withResolvedProvisioning } from "./db";
-import { composeSpawnInstructionsWithEvents } from "./project-instructions";
+import { withResolvedProvisioning } from "./db";
+import { composeProfileSpawnInstructions } from "./project-instructions";
 import { runnerRuntimeTokenEnv } from "./runtime-tokens";
 import { buildSpawnCommand, resolveSpawnModelParams } from "./spawn-command";
 import { applyDefaultSharedMcp } from "./shared-mcp";
@@ -58,16 +57,10 @@ export function buildManagedSpawnParams(policy: SpawnPolicy, requestId: string,
   // keepalive prompt folds in as the caller append → one ordered `--append-system-prompt` block,
   // no double-inject. The projection is deterministic (sorted + deduped), so re-running it on a
   // native-resume relaunch reproduces a byte-identical block rather than stacking a second copy.
-  const callerProject = resolveProjectForCwd(policy.cwd) ?? undefined;
-  const projectInstructions = agentProfile?.projectInstructions;
-  const profileAnchor = policy.profile ? resolveScopedAnchor("profile", policy.profile) ?? undefined : undefined;
-  const userAnchor = resolveScopedAnchor("user", DEFAULT_USER_ID) ?? undefined;
   const alwaysOnAppend = managedPolicyAppendSystemPrompt(policy);
-  const composed = composeSpawnInstructionsWithEvents({
-    ...(callerProject ? { callerProject } : {}),
-    ...(projectInstructions ? { projectInstructions } : {}),
-    ...(profileAnchor ? { profileAnchor } : {}),
-    ...(userAnchor ? { userAnchor } : {}),
+  const composed = composeProfileSpawnInstructions({
+    cwd: policy.cwd,
+    ...(policy.profile ? { profileName: policy.profile } : {}),
     ...(agentProfile ? { profile: agentProfile } : {}),
     ...(alwaysOnAppend ? { callerSystemPromptAppend: alwaysOnAppend } : {}),
   });

package/src/mcp-plan-tools.ts

@@ -1,5 +1,6 @@
-import { McpNotFoundError } from "./mcp-errors";
+import { McpAuthError, McpNotFoundError } from "./mcp-errors";
 import { ValidationError } from "./db";
+import { ServiceAuthError } from "./services/errors";
 import { authContextFromMcp } from "./services/auth-context";
 import {
   addPlanEdge,
@@ -126,6 +127,17 @@ function stringArg(value: unknown, field: string): string {
 }
 
 export function relayPlanTool(auth: McpAuthLike, name: string, args: Record<string, unknown>): Record<string, unknown> {
+  try {
+    return dispatchPlanTool(auth, name, args);
+  } catch (e) {
+    // A service-layer auth failure (e.g. #1043's message:send gate on the auto-mint) is an auth
+    // error on the wire — map it like the messaging tools do so the MCP edge returns 403.
+    if (e instanceof ServiceAuthError) throw new McpAuthError(e.message);
+    throw e;
+  }
+}
+
+function dispatchPlanTool(auth: McpAuthLike, name: string, args: Record<string, unknown>): Record<string, unknown> {
   const ctx = authContextFromMcp(auth);
   if (name === "relay_plan_create") return createPlan(args as unknown as Parameters<typeof createPlan>[0], ctx) as unknown as Record<string, unknown>;
   if (name === "relay_plan_add_node") {

package/src/project-instructions.ts

@@ -10,7 +10,8 @@
 // content — a policy switch here, zero schema/composer change. `project_entries.source`
 // is that lever: the included-source set is a policy PARAMETER, and the `vanilla`
 // policy includes `manual`+`promoted` while excluding `ingested`.
-import { resolveProjectEntries } from "./db";
+import { DEFAULT_USER_ID } from "agent-relay-sdk";
+import { resolveProjectEntries, resolveProjectForCwd, resolveScopedAnchor } from "./db";
 import { renderTemplate } from "./prompt-resolver";
 import { PROJECT_ENTRY_SOURCES, type AgentProfile, type Project, type ProjectEntryKind, type ProjectEntrySource, type RelayInjectionCategory, type ResolvedProjectEntry } from "./types";
 
@@ -57,7 +58,7 @@ interface SpawnInstructionInjectionEvent {
   detail: Record<string, unknown>;
 }
 
-interface ComposedSpawnInstructions {
+export interface ComposedSpawnInstructions {
   systemPromptAppend?: string;
   relayInjectionEvents: SpawnInstructionInjectionEvent[];
 }
@@ -295,6 +296,39 @@ export function composeSpawnInstructions(input: Parameters<typeof composeSpawnIn
   return composeSpawnInstructionsWithEvents(input).systemPromptAppend;
 }
 
+/**
+ * #1052 — the SINGLE home that resolves a profile's spawn-time knowledge world (project
+ * preamble for the cwd + scoped {profile|user} memory anchors) and runs
+ * `composeSpawnInstructionsWithEvents`. Every path that (re)builds a profile-bearing spawn —
+ * fresh managed spawn, managed-policy restart, AND the dashboard "restart Runner/Agent" relaunch
+ * for a NON-policy agent — must call this so a restarted agent is onboarded byte-identically to
+ * its first launch (role charter + project knowledge + scoped memory). Before #1052-v2 the
+ * dashboard-restart path for a dashboard-spawned (non-policy) coordinator called
+ * `buildSpawnCommand` WITHOUT this projection, so the relaunched process came back with EMPTY
+ * injection logs and silently reverted to provider-default IC behavior.
+ */
+export function composeProfileSpawnInstructions(input: {
+  cwd?: string;
+  profileName?: string;
+  profile?: Pick<AgentProfile, "instructions" | "maxSpawnedAgents" | "projectInstructions">;
+  callerSystemPromptAppend?: string;
+  /** Operator/user anchor key; defaults to the single-operator default store. */
+  operatorId?: string;
+}): ComposedSpawnInstructions {
+  const callerProject = input.cwd ? resolveProjectForCwd(input.cwd) ?? undefined : undefined;
+  const projectInstructions = input.profile?.projectInstructions;
+  const profileAnchor = input.profileName ? resolveScopedAnchor("profile", input.profileName) ?? undefined : undefined;
+  const userAnchor = resolveScopedAnchor("user", input.operatorId ?? DEFAULT_USER_ID) ?? undefined;
+  return composeSpawnInstructionsWithEvents({
+    ...(callerProject ? { callerProject } : {}),
+    ...(projectInstructions ? { projectInstructions } : {}),
+    ...(profileAnchor ? { profileAnchor } : {}),
+    ...(userAnchor ? { userAnchor } : {}),
+    ...(input.profile ? { profile: input.profile } : {}),
+    ...(input.callerSystemPromptAppend ? { callerSystemPromptAppend: input.callerSystemPromptAppend } : {}),
+  });
+}
+
 /**
  * Parse a spawn-transport's `projectInstructions` wire value into the normalized policy
  * (or undefined = OFF). Shared by the MCP and HTTP spawn paths so they cannot drift.

package/src/quota-advisory.ts

@@ -5,7 +5,7 @@ import { emitRelayEvent } from "./events";
 import { routeNotification } from "./notification-router";
 import { DEFAULT_QUOTA_THRESHOLD_CONFIG, validateQuotaThresholdConfig } from "./quota-threshold-config";
 import { parseJson } from "./utils";
-import { setProviderQuotaAdvisoryHandler, type ProviderQuotaAdvisoryInput } from "./db/provider-quotas.ts";
+import { setProviderQuotaAdvisoryHandler, type ProviderQuotaAdvisoryInput, type ProviderQuotaAdvisoryResult } from "./db/provider-quotas.ts";
 import { processBandTransitions } from "./quota-band-transition";
 import type { QuotaState } from "./types";
 
@@ -40,7 +40,7 @@ export function installQuotaAdvisoryHandler(): void {
   setProviderQuotaAdvisoryHandler(handleProviderQuotaAdvisory);
 }
 
-function handleProviderQuotaAdvisory(input: ProviderQuotaAdvisoryInput): string {
+function handleProviderQuotaAdvisory(input: ProviderQuotaAdvisoryInput): ProviderQuotaAdvisoryResult {
   const config = effectiveQuotaNotificationConfig().quotaThreshold;
   const state = parseJson<QuotaAdvisoryState>(input.previousAdvisoryState ?? "{}", {});
   const nextState: QuotaAdvisoryState = { ...state };
@@ -101,8 +101,10 @@ function handleProviderQuotaAdvisory(input: ProviderQuotaAdvisoryInput): string
     };
   }
 
-  processBandTransitions(input);
-  return JSON.stringify(nextState);
+  // #1074 — thread the persisted band-hysteresis state through the transition pipeline and return
+  // the new state so it is written back to quota_band_state, surviving relay restarts.
+  const bandState = processBandTransitions(input, input.previousBandState);
+  return { advisoryState: JSON.stringify(nextState), bandState };
 }
 
 function hasLastQuotaAdvisory(previous: QuotaAdvisoryWindowState | undefined): boolean {

package/src/quota-band-transition.ts

@@ -38,6 +38,7 @@ import { getSpawnCapableAgentIds } from "./routing-policy-push";
 import { getProviderBandInfo, quotaBandFromSignal, windowRecommendedAction } from "./spawn-targets";
 import type { ProviderBandInfo, ProviderBandWindow, QuotaBand } from "./spawn-targets";
 import type { ProviderQuotaAdvisoryInput } from "./db/provider-quotas";
+import { parseJson } from "./utils";
 
 const DEBOUNCE_SAMPLES = 3;
 // #798 — EMA time constant for the low-pass. "A few minutes": longer than the ~5-min poll-cadence
@@ -68,6 +69,13 @@ interface TransitionState {
   emaUpdatedAt: number;
 }
 
+// #1074 — the per-`provider:role` hysteresis state (EMA low-pass, lastNotifiedBand, debounce
+// counters, lastTransitionAt). Serialized to the provider_quotas.quota_band_state DB column so it
+// survives a relay restart: without it every restart re-seeds lastNotifiedBand="normal" and re-fires
+// an already-sent degradation to the whole fleet. Mirrors the previousAdvisoryState round-trip in
+// quota-advisory.ts — state is passed IN and returned OUT, this module holds no cross-call memory.
+type BandTransitionState = Record<string, TransitionState>;
+
 // #798 — dt-based EMA blend factor: 1 − e^(−dt/τ). dt = 0 (or first sample) → seed verbatim.
 function emaAlpha(dtMs: number): number {
   if (!(dtMs > 0)) return 1;
@@ -79,12 +87,6 @@ function emaStep(prev: number | null, value: number, dtMs: number): number {
   return prev + emaAlpha(dtMs) * (value - prev);
 }
 
-const bandState = new Map<string, TransitionState>();
-
-export function _resetBandTransitionStateForTesting(): void {
-  bandState.clear();
-}
-
 // Test hook: supply a controlled band-info function to exercise hysteresis logic
 // without a full DB setup. Set to null to restore the real implementation.
 let _bandInfoSupplier: ((provider: string, now: number) => ProviderBandInfo | undefined) | null = null;
@@ -95,15 +97,24 @@ export function _clearBandInfoSupplierForTesting(): void {
   _bandInfoSupplier = null;
 }
 
-export function processBandTransitions(input: ProviderQuotaAdvisoryInput): void {
+// #1074 — pure state-threading transition step. Takes the previously persisted band state
+// (serialized `quota_band_state`, may be null/empty on a fresh provider), applies the band-transition
+// hysteresis pipeline for this sample, and returns the new serialized state to persist. Holds no
+// module-level memory, so a relay restart that re-hydrates from the DB continues hysteresis seamlessly
+// instead of re-seeding to "normal" and re-firing an already-sent degradation.
+export function processBandTransitions(
+  input: ProviderQuotaAdvisoryInput,
+  previousBandState?: string | null,
+): string {
+  const bandState = parseJson<BandTransitionState>(previousBandState ?? "{}", {});
   const info = (_bandInfoSupplier ?? getProviderBandInfo)(input.provider, input.now);
-  if (!info) return;
+  if (!info) return JSON.stringify(bandState);
 
   for (const window of info.windows) {
     if (window.confidence === "low" || window.burnRatio === null) continue;
 
     const key = `${input.provider}:${window.role}`;
-    const state: TransitionState = bandState.get(key) ?? {
+    const state: TransitionState = bandState[key] ?? {
       lastNotifiedBand: "normal",
       pendingBand: null,
       pendingCount: 0,
@@ -124,7 +135,7 @@ export function processBandTransitions(input: ProviderQuotaAdvisoryInput): void
     state.emaUpdatedAt = input.now;
     // Persist immediately so the low-pass state survives every early-continue below (the state is
     // then mutated in place by reference — the EMA must carry across ticks to smooth excursions).
-    bandState.set(key, state);
+    bandState[key] = state;
     const smoothedBand = quotaBandFromSignal(emaPenalty, emaSlack, info.quotaBands, info.preferSlackAt);
 
     // #756 (layer 2): asymmetric hysteresis — recovery needs penalty HYSTERESIS_MARGIN below the
@@ -149,7 +160,6 @@ export function processBandTransitions(input: ProviderQuotaAdvisoryInput): void
       // #756: rate-limit recovery — it is not an actionable signal for coordinators.
       const isRecovery = bandRank(effectiveBand) < bandRank(state.lastNotifiedBand);
       if (isRecovery && input.now - state.lastTransitionAt < RECOVERY_MIN_INTERVAL_MS) {
-        bandState.set(key, state);
         continue;
       }
 
@@ -158,7 +168,6 @@ export function processBandTransitions(input: ProviderQuotaAdvisoryInput): void
       state.pendingBand = null;
       state.pendingCount = 0;
       state.lastTransitionAt = input.now;
-      bandState.set(key, state);
       emitBandTransition({
         provider: input.provider,
         window,
@@ -169,10 +178,10 @@ export function processBandTransitions(input: ProviderQuotaAdvisoryInput): void
         recommendedAction: windowRecommendedAction(effectiveBand, window.slack),
         now: input.now,
       });
-    } else {
-      bandState.set(key, state);
     }
   }
+
+  return JSON.stringify(bandState);
 }
 
 // Asymmetric hysteresis: degradation uses the normal (entry) threshold; recovery requires

package/src/routes/agent-sessions.ts

@@ -2,7 +2,7 @@
 import { RELAY_TOKEN_HEADER, isRecord, isSpawnProvider } from "agent-relay-sdk";
 import { VALID_AGENT_ACTIONS, agentControlActionIcon, auditEvent, authAuditMetadata, authorizeAgentRoute, authorizeRoute, canViewAgentRoute, cleanAttachmentRefs, dashboardAttribution, emitCommand, error, json, metaString, parseBody, requestUserAddress, requestUserId, spawnRequestId, type AgentControlAction, type Handler } from "./_shared";
 import { arbitrateDrive, currentDriver, drivingMessage, releaseDrive, type DriveArbitration } from "../agent-drive-arbiter";
-import { ValidationError, getAgent, getAgentTimeline, getOrchestrator, markReady, mergeAgentMeta, sendMessage, withResolvedProvisioning } from "../db";
+import { ValidationError, getAgent, getAgentTimeline, getOrchestrator, markReady, mergeAgentMeta, readSpawnCallerSystemPromptAppend, resolveAgentOwnership, sendMessage, withResolvedProvisioning } from "../db";
 import { announcePresence, viewersForAgent } from "../dashboard-presence";
 import { buildManagedSpawnParams } from "../managed-policy";
 import { buildSpawnCommand, generateSpawnRequestId, resolveSpawnModelParams } from "../spawn-command";
@@ -19,6 +19,7 @@ import { ShutdownAuthError, ShutdownTargetError, shutdownAgent } from "../servic
 import { type AgentCard, type SpawnApprovalMode } from "../types";
 import { type ProviderEffort } from "agent-relay-sdk/provider-catalog";
 import { getManifest } from "agent-relay-providers";
+import { composeProfileSpawnInstructions } from "../project-instructions";
 import { relayToken } from "../config";
 
 // 409 when a second human tries to drive an agent another user is already driving (#394). The
@@ -95,7 +96,7 @@ function managedControlOrchestrator(agent: AgentCard): NonNullable<ReturnType<ty
   return candidates.find((orch) => orch.status === "online") ?? null;
 }
 
-function restartSpawnParamsForAgent(
+export function restartSpawnParamsForAgent(
   agent: AgentCard,
   orchestrator: NonNullable<ReturnType<typeof getOrchestrator>> | null,
   policyName?: string,
@@ -103,7 +104,15 @@ function restartSpawnParamsForAgent(
   opts: { resumeId?: string } = {},
 ): Record<string, unknown> | undefined {
   if (!orchestrator) return undefined;
-  const requestId = spawnRequestId ?? spawnRequestIdForRestart();
+  // #1065 — mint a FRESH spawnRequestId for the successor, NEVER reuse the predecessor's. Reusing
+  // it voided the #1059 instance guard (exitCertificateMatchesInstance keys death-certificate
+  // identity on spawnRequestId): a late/duplicate exit report for the dead predecessor carried the
+  // same id as the live successor, so the guard treated the stale certificate as a match and
+  // false-reaped the running session (#1054/#1059 reopener). Every other respawn path mints fresh
+  // (lifecycle-manager, spawn-policy) and the runner documents the invariant (control.ts:284). The
+  // predecessor id (`spawnRequestId`) is still used below to recover the #1062 parent brief from the
+  // ORIGINAL agent.spawn command — read before the mint so the brief follows the agent, not the id.
+  const requestId = generateSpawnRequestId();
   const policy = policyName ? getSpawnPolicy(policyName) : null;
   const requestedBy = opts.resumeId ? "dashboard-resume" : "dashboard-restart";
   if (policy) {
@@ -124,6 +133,27 @@ function restartSpawnParamsForAgent(
   const agentProfile = resolvedProfile ? applyDefaultSharedMcp(resolvedProfile) : undefined;
   const workspaceMode = metaString(agent.meta, "workspaceMode") ?? "inherit";
   const resolvedModel = resolveSpawnModelParams(provider, model, effort, { onError: "passthrough", skipDefaultWhenEmpty: true });
+  // #1052-v2 — a dashboard-spawned agent has NO spawn policy, so its restart skips the
+  // `buildManagedSpawnParams` policy branch above and lands here. Re-project the profile role
+  // charter / project knowledge / scoped memory (the SAME projection a fresh spawn gets) so the
+  // relaunch is onboarded byte-identically instead of reverting to provider-default IC behavior.
+  // #1062 — two remaining fresh-spawn divergences closed here: (1) anchor the user/operator scoped
+  // memory to the agent's OWNER via resolveAgentOwnership (a fresh spawn does the same), not the
+  // default operator; and (2) re-thread the parent's ORIGINAL caller brief, recovered from the
+  // persisted agent.spawn command, so a restarted spawned child keeps its task brief.
+  // #1065 — key this on the PREDECESSOR id (`spawnRequestId`), NOT the freshly-minted `requestId`:
+  // the caller brief was persisted on the original agent.spawn command, which the successor's fresh
+  // id has no row for. Recovering it here re-injects the brief onto the new instance.
+  // #1067 — recovery must survive N restarts, not just one. Because #1065 rotates the id every
+  // restart and never writes an agent.spawn row for the successor, a naive single-hop lookup found
+  // the brief on restart #1 (predecessor = original id) but lost it on restart #2 (predecessor =
+  // the fresh id from restart #1, which has no spawn row). Fix: re-persist the RAW brief under the
+  // fresh id below (passed through to `callerSystemPromptAppend` on this restart's `restartSpawn`
+  // params — the SAME field a fresh agent.spawn stashes it in, see spawn-agent.ts). The reader then
+  // recovers it from either the original agent.spawn row OR a later agent.restart row, so each
+  // generation has its own recoverable copy and the brief follows the agent across every rotation.
+  const callerAppend = readSpawnCallerSystemPromptAppend(spawnRequestId);
+  const composed = composeProfileSpawnInstructions({ cwd, operatorId: resolveAgentOwnership(agent.id).ownerUserId, ...(profileName ? { profileName } : {}), ...(agentProfile ? { profile: agentProfile } : {}), ...(callerAppend ? { callerSystemPromptAppend: callerAppend } : {}) });
   const params = buildSpawnCommand({
     provider,
     modelParams: resolvedModel,
@@ -138,6 +168,12 @@ function restartSpawnParamsForAgent(
     approvalMode: approvalMode ?? "guarded",
     permissionMode: approvalMode ?? "guarded",
     providerArgs: providerArgs.length ? providerArgs : undefined,
+    ...(composed.systemPromptAppend ? { systemPromptAppend: composed.systemPromptAppend } : {}),
+    // #1067 — re-persist the RAW brief (pre-composition) under this restart's fresh spawnRequestId so
+    // the NEXT restart, whose predecessor id is this fresh id, can recover it. Without this the brief
+    // survives only one restart (the original agent.spawn row is keyed on the very first id).
+    ...(callerAppend ? { callerSystemPromptAppend: callerAppend } : {}),
+    ...(composed.relayInjectionEvents.length ? { relayInjectionEvents: composed.relayInjectionEvents } : {}),
     policyName: policyName || undefined,
     headless: true,
     spawnRequestId: requestId,
@@ -157,10 +193,6 @@ function restartSpawnParamsForAgent(
   return opts.resumeId ? withResumeParams(params, opts.resumeId, agent.id) : params;
 }
 
-function spawnRequestIdForRestart(): string {
-  return generateSpawnRequestId();
-}
-
 function withResumeParams(params: Record<string, unknown>, resumeId: string, agentId: string): Record<string, unknown> {
   return {
     ...params,

package/src/routes/agents.ts

@@ -2,6 +2,7 @@
 import { VALID_AGENT_STATUSES, agentSessionStatus, auditEvent, canViewAgentRoute, error, json, memoryContext, memoryErrorResponse, normalizeAgentSessionGuard, parseBody, parseId, parseQueryInt, visibleAgentIdsForRequest, type Handler } from "./_shared";
 import { ValidationError, deleteAgent, getAgent, getAgentTimeline, getCrashReport, heartbeat, listAgentChatHistory, listAgents, listArtifactsForEntity, listContextSnapshots, listPendingReplyObligations, listQuotaSnapshots, markReady, searchAgents, setLabel, setStatus, setTags, validateAgentSession } from "../db";
 import { attachBranchState, attachBranchStates } from "../agent-branch-state";
+import { attachCommandActivities, attachCommandActivity } from "../agent-command-activity";
 import { attachIssueRepo, attachIssueRepos } from "../agent-issue-repo";
 import { cleanStringArray } from "../validation";
 import { clearActiveMemories, memoryBroker } from "../memory-service";
@@ -53,7 +54,7 @@ export const getAgents: Handler = (req) => {
   // (visibleAgentIdsForRequest returns every id), so today's list is byte-for-byte unchanged.
   const agents = listAgents({ tag, machine, status });
   const visible = visibleAgentIdsForRequest(req, agents.map((a) => a.id));
-  return json(attachIssueRepos(attachBranchStates(agents.filter((a) => visible.has(a.id)))));
+  return json(attachCommandActivities(attachIssueRepos(attachBranchStates(agents.filter((a) => visible.has(a.id))))));
 };
 
 export const findAgents: Handler = (req) => {
@@ -69,7 +70,7 @@ export const getAgentById: Handler = (req, params) => {
   if (!agent) return error("agent not found", 404);
   // #392: a non-visible agent must look indistinguishable from a missing one (no existence leak).
   if (!canViewAgentRoute(req, agent.id)) return error("agent not found", 404);
-  return json(attachIssueRepo(attachBranchState(agent)));
+  return json(attachCommandActivity(attachIssueRepo(attachBranchState(agent))));
 };
 
 // #636 — "why did it die" data source. The crash report outlives the agent row (separate table),

package/src/routes/tasks.ts

@@ -3,9 +3,9 @@ import { MAX_BODY_BYTES } from "../config";
 import { VALID_TASK_STATUSES, agentSessionStatus, auditEvent, dispatchTaskCallbacks, emitCommand, error, json, normalizeAgentSessionGuard, parseBody, parseId, parseQueryInt, resolveActorLabel, type Handler } from "./_shared";
 import { getComponentAuth, isFullReachRequest } from "../security";
 import { authContextFromRequest } from "../services/auth-context";
-import { agentIdFromComponent, isTaskDispatchAuthorized, isTaskReadAuthorized } from "../task-authz";
+import { agentIdFromComponent, hasTaskReadAdminScope, isTaskDispatchAuthorized, isTaskReadAuthorized } from "../task-authz";
 import { dispatchShapeArg, pinArg, runTaskDispatch } from "../mcp-dispatch-tools";
-import { ValidationError, claimTask, getMessage, getTask, listTaskEvents, listTasks, recordTaskEvent, renewTaskClaim, updateTaskStatus } from "../db";
+import { ValidationError, claimTask, getMessage, getTask, listTaskEvents, listTasks, recordTaskEvent, renewTaskClaim, updateTaskStatus, type TaskStatusActor } from "../db";
 import { readTaskMemoryEnvelope } from "../db/task-memory";
 import {
   addTaskEntityDependency, addTaskEntityRef, assignTaskEntityAgent, createTaskEntity, getTaskEntity,
@@ -531,9 +531,21 @@ export const patchTaskStatus: Handler = async (req, params) => {
   if (id === null) return error("invalid task id");
   const parsed = await parseBody<unknown>(req);
   if (!parsed.ok) return error(parsed.error, parsed.status);
+  // Ownership fence (#1063): bind the write to the AUTHENTICATED caller, not the request body.
+  // Full-reach/system callers and task-admin scopes bypass (same convention as isTaskDispatchAuthorized
+  // / #1043's ensureCanMintThread); an ordinary task:write holder is pinned to its own agent id and
+  // can only advance a task it actually owns. An unidentified non-privileged caller is refused rather
+  // than silently falling back to the owner id.
+  const ctx = authContextFromRequest(req);
+  const privileged = ctx.actor.kind === "system" || hasTaskReadAdminScope(ctx.scopes);
+  if (!privileged && !ctx.callerAgentId) return error("task status requires an identified caller", 403);
+  const actor: TaskStatusActor = privileged ? { privileged: true } : { agentId: ctx.callerAgentId };
   try {
-    const result = updateTaskStatus(id, normalizeTaskStatusInput(parsed.body));
-    if (!result.ok) return error(result.error!, result.error === "task not found" ? 404 : agentSessionStatus(result.error));
+    const result = updateTaskStatus(id, normalizeTaskStatusInput(parsed.body), actor);
+    if (!result.ok) {
+      const status = result.error === "task not found" ? 404 : result.conflict ? 409 : agentSessionStatus(result.error);
+      return error(result.error!, status);
+    }
     emitTaskChanged(result.task!, "task.status");
     const capturedMemory = result.task!.status === "done"
       ? await captureTaskResultMemory(result.task!, result.task!.result)

package/src/routes/workspaces.ts

@@ -433,6 +433,12 @@ export const postWorkspaceCleanupStale: Handler = async (req) => {
   const workspaceId = cleanString(body.workspaceId, "workspaceId", { max: 160 });
   const dryRun = body.dryRun !== false; // safe by default
   const landedOnly = true;
+  // #965 — an explicit operator force-discard for a genuinely-abandoned branch: clear even when
+  // git state is a conflict / unlanded / unprobeable. The land-safety gate is correct for LIVE
+  // work but wrong for a confirmed-abandoned branch, which otherwise left a raw DELETE as the only
+  // path. Gated hard on the owner NOT being online (force can never override liveness) and, like
+  // every mutation here, on `--execute` (dryRun:false) — the two together are the confirmation.
+  const force = body.force === true;
 
   const candidates = listWorkspaces().filter((ws) =>
     ws.mode === "isolated" && Boolean(ws.worktreePath) && !TERMINAL_WORKSPACE_STATUSES.has(ws.status)
@@ -455,22 +461,41 @@ export const postWorkspaceCleanupStale: Handler = async (req) => {
     const landed = gitState?.landed === true;
     // Safe = gone from disk, OR clean tree with no unmerged work (landed/empty).
     const safe = missing || (gitState !== undefined && (dirtyCount ?? 1) === 0 && (!landedOnly || landed || ahead === 0));
+    // #965 — a force-discard clears an unsafe (conflict/unlanded/unprobeable) row too, but only
+    // for an offline owner. #1066: the `ownerOnline` snapshot above predates the
+    // `fetchWorkspaceGitState` await, so it is stale by dispatch time; liveness is re-verified
+    // immediately before dispatch below. Force overrides the land-safety gate, NEVER liveness.
+    const forced = force && !safe;
+    const discardable = safe || force;
     const proof = { ownerStatus: owner?.status ?? "missing", ownerOnline, ahead, behind: gitState?.behind, landed, dirtyCount, missing, gitStateUnavailable: gitState ? undefined : ("unavailable" in fetched ? fetched.unavailable : undefined) };
-    const row: Record<string, unknown> = { workspaceId: ws.id, branch: ws.branch, worktreePath: ws.worktreePath, repoRoot: ws.repoRoot, safe, proof };
-    if (safe && !dryRun) {
-      const built = buildWorkspaceCleanupCommand(ws, "cleanup-stale");
-      if (built.ok) {
-        updateWorkspaceStatus(ws.id, "cleanup_requested", { lastWorkspaceAction: "cleanup-stale", lastWorkspaceActionAt: Date.now(), cleanupProof: proof });
-        emitCommand(built.command);
-        row.commandId = built.command.id;
-        cleaned.push(ws.id);
+    const row: Record<string, unknown> = { workspaceId: ws.id, branch: ws.branch, worktreePath: ws.worktreePath, repoRoot: ws.repoRoot, safe, discardable, ...(forced ? { forced: true } : {}), proof };
+    if (discardable && !dryRun) {
+      // #1066 — re-snapshot liveness AFTER the git-state probe, immediately before dispatch. An
+      // owner offline at the initial snapshot can reconnect during the probe window (relay lag —
+      // #1054), and `force` bypasses buildWorkspaceCleanupCommand's dispatch-time live-owner guard,
+      // so this route is the only place that can refuse a just-reconnected owner under force.
+      // Force may clear an unsafe/conflict/unlanded row, but it must never nuke a live owner's tree.
+      if (isOwnerAlive(ws.ownerAgentId)) {
+        row.discardable = false;
+        row.cleanupError = `workspace ${ws.id} owner reconnected during git-state probe; force cannot override liveness`;
+        row.proof = { ...proof, ownerOnline: true };
       } else {
-        row.cleanupError = built.error;
+        // Owner re-confirmed offline just above; force past buildWorkspaceCleanupCommand's
+        // live-owner guard and carry a reason so the host records an intentional force-discard.
+        const built = buildWorkspaceCleanupCommand(ws, "cleanup-stale", forced ? { force: true, reason: "operator force-discard: abandoned branch, owner offline" } : {});
+        if (built.ok) {
+          updateWorkspaceStatus(ws.id, "cleanup_requested", { lastWorkspaceAction: "cleanup-stale", lastWorkspaceActionAt: Date.now(), cleanupProof: { ...proof, forced } });
+          emitCommand(built.command);
+          row.commandId = built.command.id;
+          cleaned.push(ws.id);
+        } else {
+          row.cleanupError = built.error;
+        }
       }
     }
     rows.push(row);
   }
-  return json({ dryRun, landedOnly, repoRoot, ...(workspaceId ? { workspaceId } : {}), scanned: candidates.length, eligible: rows.filter((r) => r.safe).length, cleaned, candidates: rows }, dryRun ? 200 : 202);
+  return json({ dryRun, landedOnly, force, repoRoot, ...(workspaceId ? { workspaceId } : {}), scanned: candidates.length, eligible: rows.filter((r) => r.discardable).length, cleaned, candidates: rows }, dryRun ? 200 : 202);
 };
 
 export const postWorkspaceAction: Handler = async (req, params) => {

package/src/services/plan-graph.ts

@@ -1,4 +1,4 @@
-import { isRecord } from "agent-relay-sdk";
+import { hasScope, isRecord } from "agent-relay-sdk";
 import { addTaskDependency, createPlanRow, deletePlan, getAgent, getEntry, getPlan, getPlanByTeam, getPlanByThread, getTaskDetail, listPlansWithBoundOwner, planThreadExists, removeTaskDependency, replacePlan, sendMessage, setPlanArchived, ValidationError } from "../db";
 import { associateIssue, planNodeIssueEntityId, removeAssociation } from "../db/issue-associations";
 import { resolveIssueRefFromString } from "../db/issue-refs";
@@ -9,6 +9,7 @@ import { issueRepoForAgent } from "../agent-issue-repo";
 import { buildTaskGraphView, parseTaskId, planStatusToTaskStatus, projectPlanOverTasks } from "./task-plan-view";
 import { createTaskEntity, setTaskEntityStatus } from "./task-entity";
 import type { AuthContext } from "./auth-context";
+import { ServiceAuthError } from "./errors";
 import type { AgentCard, Plan, PlanEdge, PlanNode, PlanOwnerRef, PlanStatus } from "../types";
 
 export const PLAN_STATUSES = ["pending", "in-progress", "landed", "blocked"] as const;
@@ -37,7 +38,7 @@ interface PlanNodePatch {
 }
 
 interface PlanCreateInput {
-  threadId: unknown;
+  threadId?: unknown;
   teamId?: unknown;
   channel?: unknown;
   title?: unknown;
@@ -269,7 +270,9 @@ function emitPlan(type: "plan.created" | "plan.changed" | "plan.deleted", plan:
 // thread server-side by self-threading a lightweight system message (the same sendMessage path the
 // caller would have used). Sent AS the actor when that agent is registered, else the reserved
 // `system` sink, so the mint always passes the sender-registration gate.
-function mintPlanThread(actor: string, channel: string | undefined): number {
+function mintPlanThread(ctx: AuthContext, channel: string | undefined): number {
+  ensureCanMintThread(ctx);
+  const actor = actorId(ctx);
   const sender = getAgent(actor) ? actor : "system";
   const root = sendMessage({
     from: sender,
@@ -280,24 +283,39 @@ function mintPlanThread(actor: string, channel: string | undefined): number {
   return root.threadId ?? root.id;
 }
 
+// #1043: the mint inserts a real message row through the db `sendMessage` path, which normally
+// lives behind the `message:send` scope. `plans:write` alone must not be a side-door around it, so
+// gate the mint on `message:send`. Internal `system` principals (empty-scope trusted callers) and
+// full-reach `*` tokens pass through untouched — `hasScope` short-circuits `*`.
+function ensureCanMintThread(ctx: AuthContext): void {
+  if (ctx.actor.kind === "system") return;
+  if (!hasScope(ctx.scopes, "message:send")) {
+    throw new ServiceAuthError("minting a plan thread requires the message:send scope");
+  }
+}
+
 export function createPlan(input: PlanCreateInput, ctx: AuthContext): Plan {
   const channel = cleanString(input.channel, "channel", { max: 120 });
   const actor = actorId(ctx);
-  const threadId = input.threadId === undefined || input.threadId === null
-    ? mintPlanThread(actor, channel)
-    : cleanThreadId(input.threadId);
-  if (!planThreadExists(threadId)) throw new ValidationError(`thread ${threadId} not found`);
   const explicitTeamId = cleanString(input.teamId, "teamId", { max: 120 });
   const teamId = explicitTeamId ?? (input.teamId === undefined || input.teamId === null ? getAgent(actor)?.teamId : undefined);
   const nodes = cleanNodes(input.nodes, actor, teamId);
   const edges = cleanEdges(input.edges);
   validateEdges(nodes, edges);
+  const title = cleanString(input.title, "title", { max: 240 });
+  const objective = cleanString(input.objective, "objective", { max: 4000 });
+  // Resolve the thread only AFTER the payload validates (#1043): auto-minting first left an orphan
+  // 'Plan thread root' row behind on every rejected create.
+  const threadId = input.threadId === undefined || input.threadId === null
+    ? mintPlanThread(ctx, channel)
+    : cleanThreadId(input.threadId);
+  if (!planThreadExists(threadId)) throw new ValidationError(`thread ${threadId} not found`);
   const plan = createPlanRow({
     threadId,
     teamId,
     channel,
-    title: cleanString(input.title, "title", { max: 240 }),
-    objective: cleanString(input.objective, "objective", { max: 4000 }),
+    title,
+    objective,
     nodes,
     edges,
     createdBy: actor,