agent-relay-server 0.60.0 → 0.61.0

package/runner/src/config.ts

@@ -2,8 +2,8 @@ import { execFileSync } from "node:child_process";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { homedir, hostname } from "node:os";
 import { join, resolve } from "node:path";
-import { DEFAULT_RELAY_URL, stringValue } from "agent-relay-sdk";
-import type { WorkspaceMetadata } from "agent-relay-sdk";
+import { DEFAULT_RELAY_URL, RELAY_TOKEN_HEADER, errMessage, stringValue } from "agent-relay-sdk";
+import type { SettingEntry, WorkspaceMetadata } from "agent-relay-sdk";
 import { sanitizeFsName } from "agent-relay-sdk/fs-name";
 import type { ProviderConfig } from "./adapter";
 
@@ -36,6 +36,7 @@ export function defaultProviderConfig(provider: string): ProviderConfig {
     defaultApprovalMode: "guarded",
     defaultTags: [],
     chatCaptureMode: "final",
+    reasoningCapture: true,
     headless: {
       tmuxPrefix: `${provider}-relay`,
       shutdownTimeoutMs: 10_000,
@@ -67,6 +68,7 @@ export function loadProviderConfig(provider: string, home = agentRelayHome()): L
     defaultApprovalMode: stringValue(raw.defaultApprovalMode) ?? defaults.defaultApprovalMode,
     defaultTags: stringArray(raw.defaultTags) ?? defaults.defaultTags,
     chatCaptureMode: enumValue(raw.chatCaptureMode, ["final", "full"]) ?? defaults.chatCaptureMode,
+    reasoningCapture: booleanValue(raw.reasoningCapture) ?? defaults.reasoningCapture,
     headless: {
       tmuxPrefix: stringValue(recordValue(raw.headless).tmuxPrefix) ?? defaults.headless.tmuxPrefix,
       shutdownTimeoutMs: positiveInteger(recordValue(raw.headless).shutdownTimeoutMs) ?? defaults.headless.shutdownTimeoutMs,
@@ -74,6 +76,24 @@ export function loadProviderConfig(provider: string, home = agentRelayHome()): L
   };
 }
 
+export async function loadProviderConfigFromRelay(
+  provider: string,
+  opts: { relayUrl: string; token?: string; home?: string; host?: string },
+): Promise<LoadedProviderConfig> {
+  const host = opts.host ?? hostname();
+  const home = opts.home ?? agentRelayHome();
+  const local = loadProviderConfig(provider, home);
+  const key = `${host}/${provider}`;
+
+  try {
+    const fetched = await fetchProviderConfig(provider, opts.relayUrl, opts.token, key);
+    if (fetched) return fetched;
+  } catch (error) {
+    console.warn(`[agent-relay] provider config relay read failed (${errMessage(error)}); using local fallback ${local.path}.`);
+  }
+  return local;
+}
+
 export function writeProviderConfig(provider: string, config: ProviderConfig, home = agentRelayHome()): LoadedProviderConfig {
   const dir = providersDir(home);
   mkdirSync(dir, { recursive: true });
@@ -93,6 +113,7 @@ export function providerConfigPublic(config: LoadedProviderConfig): Record<strin
     defaultApprovalMode: config.defaultApprovalMode,
     defaultTags: config.defaultTags,
     chatCaptureMode: config.chatCaptureMode,
+    reasoningCapture: config.reasoningCapture,
     headless: config.headless,
   };
 }
@@ -156,6 +177,10 @@ function enumValue<T extends string>(value: unknown, allowed: T[]): T | undefine
   return typeof value === "string" && allowed.includes(value as T) ? (value as T) : undefined;
 }
 
+function booleanValue(value: unknown): boolean | undefined {
+  return typeof value === "boolean" ? value : undefined;
+}
+
 function stringArray(value: unknown): string[] | undefined {
   return Array.isArray(value) && value.every((item) => typeof item === "string") ? value : undefined;
 }
@@ -178,3 +203,42 @@ function maskEnv(env: Record<string, string>): Record<string, string> {
   }
   return result;
 }
+
+async function fetchProviderConfig(
+  provider: string,
+  relayUrl: string,
+  token: string | undefined,
+  key: string,
+): Promise<LoadedProviderConfig | null> {
+  const url = new URL(`/api/settings/provider-config/${encodeURIComponent(key)}`, relayUrl);
+  const res = await fetch(url, {
+    headers: token ? { [RELAY_TOKEN_HEADER]: token } : undefined,
+    signal: AbortSignal.timeout(5_000),
+  });
+  if (res.status === 404) return null;
+  const body = await res.json().catch(() => null) as (Partial<SettingEntry> & { error?: string }) | null;
+  if (!res.ok) throw new Error(body?.error ? `${res.status}: ${body.error}` : `HTTP ${res.status}`);
+  if (body?.version === 0) return null;
+  return providerConfigFromValue(provider, body?.value, `config:provider-config/${key}`);
+}
+
+function providerConfigFromValue(provider: string, value: unknown, path: string): LoadedProviderConfig {
+  const raw = recordValue(value);
+  const defaults = defaultProviderConfig(provider);
+  return {
+    path,
+    command: stringValue(raw.command) ?? defaults.command,
+    defaultArgs: stringArray(raw.defaultArgs) ?? defaults.defaultArgs,
+    env: stringRecord(raw.env) ?? defaults.env,
+    pluginDirs: stringArray(raw.pluginDirs) ?? defaults.pluginDirs,
+    defaultCapabilities: stringArray(raw.defaultCapabilities) ?? defaults.defaultCapabilities,
+    defaultApprovalMode: stringValue(raw.defaultApprovalMode) ?? defaults.defaultApprovalMode,
+    defaultTags: stringArray(raw.defaultTags) ?? defaults.defaultTags,
+    chatCaptureMode: enumValue(raw.chatCaptureMode, ["final", "full"]) ?? defaults.chatCaptureMode,
+    reasoningCapture: booleanValue(raw.reasoningCapture) ?? defaults.reasoningCapture,
+    headless: {
+      tmuxPrefix: stringValue(recordValue(raw.headless).tmuxPrefix) ?? defaults.headless.tmuxPrefix,
+      shutdownTimeoutMs: positiveInteger(recordValue(raw.headless).shutdownTimeoutMs) ?? defaults.headless.shutdownTimeoutMs,
+    },
+  };
+}

package/src/automations.ts

@@ -16,7 +16,7 @@ import { createCommand } from "./commands-db";
 import { cleanEnum, cleanString, cleanStringArray, optionalEnum } from "./validation";
 import { getAgentProfile, getSpawnPolicy } from "./config-store";
 import { buildSpawnCommand, resolveSpawnModelParams } from "./spawn-command";
-import { resolveProviderSelection, type ProviderEffort, VALID_EFFORTS } from "agent-relay-sdk/provider-catalog";
+import { resolveProviderSelection, type ProviderEffort } from "agent-relay-sdk/provider-catalog"; import { effectiveProviderCatalogList } from "./provider-catalog-store";
 import { errMessage, VALID_WORKSPACE_MODES } from "agent-relay-sdk";
 import { runnerRuntimeTokenEnv } from "./runtime-tokens";
 import type {
@@ -38,7 +38,6 @@ import type {
   TaskSeverity,
   UpdateAutomationInput,
 } from "./types";
-
 const AUTOMATION_KIND = "scheduled_task";
 const DEFAULT_TIMEZONE = "UTC";
 const DEFAULT_CATCH_UP: AutomationCatchUpPolicy = "skip";
@@ -200,11 +199,11 @@ function normalizeTargetPolicy(value: unknown): AutomationTargetPolicy {
   }
   const provider = optionalEnum(input.provider, "targetPolicy.provider", ["claude", "codex"] as const, "codex");
   const model = cleanString(input.model, "targetPolicy.model", { max: 120 });
-  const effort = input.effort === undefined || input.effort === null ? undefined : cleanEnum(input.effort, "targetPolicy.effort", VALID_EFFORTS) as ProviderEffort;
+  const effort = cleanString(input.effort, "targetPolicy.effort", { max: 120 }) as ProviderEffort | undefined;
   const profile = cleanString(input.profile, "targetPolicy.profile", { max: 120 });
   if (profile && !getAgentProfile(profile)) throw new ValidationError("agent profile not found");
   try {
-    resolveProviderSelection({ provider, model, effort });
+    resolveProviderSelection({ provider, model, effort }, effectiveProviderCatalogList());
   } catch (error) {
     throw new ValidationError(errMessage(error));
   }

package/src/cli/index.ts

@@ -14,6 +14,7 @@ import { handleDevCommand } from "./dev";
 import { handleMemoryCommand } from "./memory";
 import { handleSlashOrPairCommand } from "./pair";
 import { handleWorkspaceCommand } from "./workspace";
+import { handleMergesCommand } from "./merges";
 import { handleStewardCommand } from "./steward";
 import { handleMessageCommand, handleGetMessageCommand, handleReactCommand } from "./message";
 import { handleReplyCommand } from "./reply";
@@ -44,6 +45,7 @@ Usage:
   agent-relay context-probe [print-status-line] [--wrap COMMAND] [--agent-id ID] [--state-dir DIR] [--standalone]
   agent-relay token <create|list|revoke|verify> [options]
   agent-relay pair <target|create|status|accept|reject|hangup|send> [options]
+  agent-relay merges <pause|resume|renew|list> [--repo PATH] [--base BRANCH] [--ttl 3m|--ttl-ms N] [--reason TEXT] [--holder TEXT] [--id ID] [--json]
   agent-relay workspace <status|diagnostics|ready|land|claim|release|list|cleanup-stale|deps> [--id ID] [--strategy ...] [--auto-merge on-green|on-approval|manual] [--reviewer HANDLE] [--purpose TEXT] [--repo PATH] [--wait] [--timeout SECONDS] [--check] [--execute] [--json]
   agent-relay steward <queue|inspect|checks> [WORKSPACE_ID] [--repo PATH] [--json]
   agent-relay message <target> <body> [options]
@@ -141,6 +143,11 @@ Token examples:
   agent-relay token list
   agent-relay token revoke JTI
 
+Merge pause examples:
+  agent-relay merges pause --repo /repo --reason release --ttl 5m
+  agent-relay merges renew --id PAUSE_ID --ttl 5m
+  agent-relay merges resume --id PAUSE_ID
+
 Context probe examples:
   agent-relay context-probe print-status-line --wrap 'ccstatusline'
   agent-relay context-probe --wrap 'ccstatusline'
@@ -345,6 +352,10 @@ export async function handleCli(args: string[]): Promise<"start" | "handled"> {
     await handleTagsCommand(args.slice(1));
     return "handled";
   }
+  if (command === "merges" || command === "merge") {
+    await handleMergesCommand(args.slice(1));
+    return "handled";
+  }
   if (command === "workspace" || command === "workspaces") {
     await handleWorkspaceCommand(args.slice(1));
     return "handled";

package/src/cli/merges.ts

@@ -0,0 +1,89 @@
+// Merge coordination CLI. Generic pause/resume lease for relay-owned auto-merge
+// sweeps; useful for release/build critical sections (#448).
+import { spawnSync } from "node:child_process";
+import { apiRequest } from "./_shared";
+
+const MERGES_USAGE = "Usage: agent-relay merges <pause|resume|renew|list> [--repo PATH] [--base BRANCH] [--ttl 3m|--ttl-ms N] [--reason TEXT] [--holder TEXT] [--id ID] [--json]";
+
+function gitRoot(): string | undefined {
+  const r = spawnSync("git", ["rev-parse", "--show-toplevel"], { encoding: "utf8", stdio: "pipe" });
+  return r.status === 0 ? r.stdout.trim() : undefined;
+}
+
+function parseDurationMs(raw: string): number {
+  const match = raw.trim().match(/^(\d+)(ms|s|m|h)?$/);
+  if (!match) throw new Error("--ttl must be a positive duration like 180s, 3m, 1h, or use --ttl-ms");
+  const value = Number(match[1]);
+  const unit = match[2] ?? "ms";
+  const multiplier = unit === "h" ? 60 * 60_000 : unit === "m" ? 60_000 : unit === "s" ? 1000 : 1;
+  const ms = value * multiplier;
+  if (!Number.isSafeInteger(ms) || ms <= 0) throw new Error("--ttl is out of range");
+  return ms;
+}
+
+function formatPause(pause: any): string {
+  const until = new Date(pause.expiresAt).toISOString();
+  return `Merge pause ${pause.id}: ${pause.repoRoot}#${pause.baseRef} held by ${pause.holder} until ${until}${pause.reason ? ` (${pause.reason})` : ""}`;
+}
+
+export async function handleMergesCommand(args: string[]): Promise<void> {
+  const action = args[0];
+  if (action === "--help" || action === "-h" || action === "help") {
+    console.log(MERGES_USAGE);
+    return;
+  }
+  if (!action || !["pause", "resume", "renew", "list"].includes(action)) throw new Error(MERGES_USAGE);
+
+  let repoRoot: string | undefined;
+  let baseRef = "main";
+  let ttlMs: number | undefined;
+  let reason: string | undefined;
+  let holder: string | undefined;
+  let id: string | undefined;
+  let json = false;
+
+  for (let i = 1; i < args.length; i++) {
+    const arg = args[i];
+    if (arg === "--repo" && i + 1 < args.length) repoRoot = args[++i];
+    else if (arg === "--base" && i + 1 < args.length) baseRef = args[++i]!;
+    else if (arg === "--ttl" && i + 1 < args.length) ttlMs = parseDurationMs(args[++i]!);
+    else if (arg === "--ttl-ms" && i + 1 < args.length) {
+      ttlMs = Number.parseInt(args[++i]!, 10);
+      if (!Number.isSafeInteger(ttlMs) || ttlMs <= 0) throw new Error("--ttl-ms must be a positive integer");
+    }
+    else if (arg === "--reason" && i + 1 < args.length) reason = args[++i];
+    else if (arg === "--holder" && i + 1 < args.length) holder = args[++i];
+    else if (arg === "--id" && i + 1 < args.length) id = args[++i];
+    else if (arg === "--json") json = true;
+    else throw new Error(`Unknown merges option "${arg}".`);
+  }
+
+  if (action === "list") {
+    const result = await apiRequest("GET", "/api/merges/pauses");
+    console.log(JSON.stringify(result, null, 2));
+    return;
+  }
+
+  if (action === "renew") {
+    if (!id) throw new Error("merges renew requires --id");
+    const result = await apiRequest("POST", "/api/merges/renew", { id, ttlMs });
+    if (json) console.log(JSON.stringify(result, null, 2));
+    else console.log(formatPause((result as any).pause));
+    return;
+  }
+
+  repoRoot = repoRoot ?? gitRoot();
+  if (action === "pause" && !repoRoot) throw new Error("No git repo detected. Pass --repo PATH.");
+  if (action === "resume" && !id && !repoRoot) throw new Error("No git repo detected. Pass --id ID or --repo PATH.");
+
+  if (action === "pause") {
+    const result = await apiRequest("POST", "/api/merges/pause", { repoRoot, baseRef, ttlMs, reason, holder });
+    if (json) console.log(JSON.stringify(result, null, 2));
+    else console.log(formatPause((result as any).pause));
+    return;
+  }
+
+  const result = await apiRequest("POST", "/api/merges/resume", id ? { id } : { repoRoot, baseRef });
+  if (json) console.log(JSON.stringify(result, null, 2));
+  else console.log((result as any).released ? "Merge pause released." : "No matching merge pause was active.");
+}

package/src/config-store.ts

@@ -4,7 +4,7 @@ import { DEFAULT_CONTEXT_THRESHOLD_CONFIG, validateContextThresholdConfig } from
 import { DEFAULT_SELF_RESUME_CONFIG, validateSelfResumeConfig } from "./self-resume-config";
 import { TEAM_TEMPLATE_NAMESPACE, validateTeamTemplate } from "./team-template-config";
 import { resolveProviderSelection, type ProviderEffort } from "agent-relay-sdk/provider-catalog";
-import { errMessage, isRecord, SPAWN_PROVIDERS, VALID_EFFORTS, VALID_WORKSPACE_MODES } from "agent-relay-sdk";
+import { errMessage, isRecord, SPAWN_PROVIDERS, VALID_WORKSPACE_MODES } from "agent-relay-sdk"; import { effectiveProviderCatalogList } from "./provider-catalog-store";
 import type {
   AgentProfile,
   AgentProfileBase,
@@ -23,7 +23,6 @@ import type {
   WorkspaceConfig,
   WorkspaceLandingPolicy,
 } from "./types";
-
 const CONFIG_HISTORY_LIMIT = 50;
 const SPAWN_POLICY_NAMESPACE = "spawn-policy";
 const AGENT_PROFILE_NAMESPACE = "agent-profile";
@@ -342,7 +341,7 @@ function validateSpawnPolicy(key: string, value: unknown): SpawnPolicy {
     workspaceMode: value.workspaceMode === undefined || value.workspaceMode === null ? "inherit" : cleanEnum(value.workspaceMode, "workspaceMode", VALID_WORKSPACE_MODES),
     rig: cleanString(value.rig, "rig", { max: 120 }),
     model: cleanString(value.model, "model", { max: 120 }),
-    effort: value.effort === undefined || value.effort === null ? undefined : cleanEnum(value.effort, "effort", VALID_EFFORTS) as ProviderEffort,
+    effort: cleanString(value.effort, "effort", { max: 120 }) as ProviderEffort | undefined,
     profile: cleanString(value.profile, "profile", { max: 120 }),
     providerArgs: cleanStringArray(value.providerArgs, "providerArgs", { itemMax: 120, maxItems: 100 }) ?? [],
     prompt: cleanString(value.prompt, "prompt", { max: 16_000 }),
@@ -356,7 +355,7 @@ function validateSpawnPolicy(key: string, value: unknown): SpawnPolicy {
     backoff: cleanBackoff(value.backoff),
   };
   try {
-    resolveProviderSelection({ provider: policy.provider, model: policy.model, effort: policy.effort });
+    resolveProviderSelection({ provider: policy.provider, model: policy.model, effort: policy.effort }, effectiveProviderCatalogList());
   } catch (error) {
     throw new ValidationError(errMessage(error));
   }
@@ -408,7 +407,7 @@ function validateStewardConfig(value: unknown): StewardConfig {
     enabled: value.enabled === undefined ? false : cleanBoolean(value.enabled, "enabled"),
     provider: cleanEnum(value.provider, "provider", SPAWN_PROVIDERS) as SpawnProvider,
     model: cleanString(value.model, "model", { max: 120 }),
-    effort: value.effort === undefined || value.effort === null ? undefined : cleanEnum(value.effort, "effort", VALID_EFFORTS) as ProviderEffort,
+    effort: cleanString(value.effort, "effort", { max: 120 }) as ProviderEffort | undefined,
     permissionMode: (value.permissionMode === undefined || value.permissionMode === null
       ? "open"
       : cleanEnum(value.permissionMode, "permissionMode", VALID_PERMISSION_MODES)) as SpawnApprovalMode,
@@ -419,7 +418,7 @@ function validateStewardConfig(value: unknown): StewardConfig {
   // Reject a provider/model/effort combo the catalog can't resolve before it ever
   // reaches a spawn (same guard as spawn policies).
   try {
-    resolveProviderSelection({ provider: config.provider, model: config.model, effort: config.effort });
+    resolveProviderSelection({ provider: config.provider, model: config.model, effort: config.effort }, effectiveProviderCatalogList());
   } catch (error) {
     throw new ValidationError(errMessage(error));
   }

package/src/config.ts

@@ -33,6 +33,10 @@ export const POOL_CLAIM_LEASE_MS = envPositiveInt("AGENT_RELAY_POOL_CLAIM_LEASE_
 // repo. Held from when a workspace.merge command is dispatched until it settles
 // (or this TTL expires, in case the orchestrator never reports back).
 export const WORKSPACE_MERGE_LEASE_MS = envPositiveInt("AGENT_RELAY_WORKSPACE_MERGE_LEASE_MS", 900_000); // 15min
+// Opt-in release/build critical-section pause for relay-owned auto-merge sweeps.
+// This narrows the race window while the release script creates and pushes a tag;
+// expiry is the safety net so a killed holder cannot wedge the repo.
+export const MAIN_MERGE_PAUSE_TTL_MS = envPositiveInt("AGENT_RELAY_MAIN_MERGE_PAUSE_TTL_MS", 5 * 60_000); // 5min
 
 // Max body size for any POST/PATCH request (64 KiB).
 export const MAX_BODY_BYTES = 64 * 1024;

package/src/connectors.ts

@@ -4,6 +4,7 @@ import { dirname, join } from "node:path";
 import type { ConnectorAction, ConnectorActionResult, ConnectorManifest, ConnectorSummary } from "./types";
 import { ValidationError } from "./db";
 import { isRecord } from "agent-relay-sdk";
+import { registerConnectorConfigSetting, validateConnectorConfig } from "./settings/modules";
 
 const CONNECTOR_SCHEMA = "agent-relay.connector.v1";
 const VALID_KINDS = new Set(["channel", "event", "provider", "orchestrator"]);
@@ -99,6 +100,7 @@ function stringArray(value: unknown, field: string): string[] {
 
 export function registerConnectorManifest(manifest: ConnectorManifest, opts: { config?: Record<string, unknown>; state?: Record<string, unknown> } = {}): ConnectorSummary {
   const normalized = normalizeConnectorManifest(manifest);
+  registerConnectorConfigSetting(normalized, { defaults: opts.config });
   const dir = connectorDir(normalized.id);
   mkdirSync(dir, { recursive: true, mode: 0o700 });
   writeFileSync(join(dir, "manifest.json"), JSON.stringify(normalized, null, 2) + "\n", { mode: 0o600 });
@@ -165,6 +167,9 @@ export function readConnectorConfig(id: string): Record<string, unknown> {
 
 export function writeConnectorConfig(id: string, config: Record<string, unknown>): Record<string, unknown> {
   if (!isRecord(config)) throw new ValidationError("connector config must be an object");
+  const connector = getConnector(id);
+  if (!connector) throw new ValidationError(`connector ${id} not found`);
+  validateConnectorConfig(connector.manifest, config);
   const path = join(connectorDir(id), "config.json");
   mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
   writeFileSync(path, JSON.stringify(config, null, 2) + "\n", { mode: 0o600 });

package/src/db/merge-lease.ts

@@ -12,7 +12,7 @@ import {
   parseRuntimePackage,
   type RuntimeContracts,
 } from "../contracts";
-import { STALE_TTL_MS, DAY_MS, CLAIM_LEASE_MS, POOL_CLAIM_LEASE_MS, WORKSPACE_MERGE_LEASE_MS } from "../config";
+import { STALE_TTL_MS, DAY_MS, CLAIM_LEASE_MS, POOL_CLAIM_LEASE_MS, WORKSPACE_MERGE_LEASE_MS, MAIN_MERGE_PAUSE_TTL_MS } from "../config";
 import { matchAgents } from "../agent-ref";
 import { getDb } from "./connection.ts";
 import type {
@@ -158,3 +158,97 @@ export function releaseMergeLease(opts: { repoRoot?: string; commandId?: string;
   return getDb().query(`DELETE FROM workspace_merge_leases WHERE ${where.join(" AND ")}`).run(...params).changes > 0;
 }
 
+// --- Per-target merge pause lease (issue #448) -----------------------------
+
+export interface MergePauseRecord {
+  id: string;
+  repoRoot: string;
+  baseRef: string;
+  holder: string;
+  reason?: string;
+  createdAt: number;
+  updatedAt: number;
+  expiresAt: number;
+}
+
+export function rowToMergePause(row: any): MergePauseRecord {
+  return {
+    id: row.id,
+    repoRoot: row.repo_root,
+    baseRef: row.base_ref,
+    holder: row.holder,
+    reason: row.reason ?? undefined,
+    createdAt: row.created_at,
+    updatedAt: row.updated_at,
+    expiresAt: row.expires_at,
+  };
+}
+
+export function getMergePause(id: string): MergePauseRecord | null {
+  const row = getDb().query("SELECT * FROM workspace_merge_pauses WHERE id = ?").get(id) as any;
+  return row ? rowToMergePause(row) : null;
+}
+
+export function getActiveMergePause(repoRoot: string, baseRef = "main", now: number = Date.now()): MergePauseRecord | null {
+  const row = getDb().query("SELECT * FROM workspace_merge_pauses WHERE repo_root = ? AND base_ref = ? AND expires_at > ?")
+    .get(repoRoot, baseRef, now) as any;
+  return row ? rowToMergePause(row) : null;
+}
+
+export function listMergePauses(): MergePauseRecord[] {
+  return (getDb().query("SELECT * FROM workspace_merge_pauses ORDER BY updated_at DESC").all() as any[]).map(rowToMergePause);
+}
+
+export function acquireMergePause(input: {
+  repoRoot: string;
+  baseRef?: string;
+  holder: string;
+  reason?: string;
+  ttlMs?: number;
+  now?: number;
+}): { ok: true; pause: MergePauseRecord } | { ok: false; pause: MergePauseRecord } {
+  return getDb().transaction(() => {
+    const now = input.now ?? Date.now();
+    const baseRef = input.baseRef || "main";
+    const existing = getActiveMergePause(input.repoRoot, baseRef, now);
+    if (existing) return { ok: false as const, pause: existing };
+    const id = randomUUID();
+    const expiresAt = now + (input.ttlMs ?? MAIN_MERGE_PAUSE_TTL_MS);
+    getDb().query(`
+      INSERT INTO workspace_merge_pauses (id, repo_root, base_ref, holder, reason, created_at, updated_at, expires_at)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+      ON CONFLICT(repo_root, base_ref) DO UPDATE SET
+        id = excluded.id,
+        holder = excluded.holder,
+        reason = excluded.reason,
+        created_at = excluded.created_at,
+        updated_at = excluded.updated_at,
+        expires_at = excluded.expires_at
+    `).run(id, input.repoRoot, baseRef, input.holder, input.reason ?? null, now, now, expiresAt);
+    return { ok: true as const, pause: getMergePause(id)! };
+  })();
+}
+
+export function renewMergePause(id: string, ttlMs: number = MAIN_MERGE_PAUSE_TTL_MS, now: number = Date.now()): MergePauseRecord | null {
+  const current = getMergePause(id);
+  if (!current || current.expiresAt <= now) return null;
+  getDb().query("UPDATE workspace_merge_pauses SET updated_at = ?, expires_at = ? WHERE id = ?").run(now, now + ttlMs, id);
+  return getMergePause(id);
+}
+
+export function releaseMergePause(opts: { id?: string; repoRoot?: string; baseRef?: string }): boolean {
+  const where: string[] = [];
+  const params: string[] = [];
+  if (opts.id) { where.push("id = ?"); params.push(opts.id); }
+  if (opts.repoRoot) { where.push("repo_root = ?"); params.push(opts.repoRoot); }
+  if (opts.baseRef) { where.push("base_ref = ?"); params.push(opts.baseRef); }
+  if (!where.length) return false;
+  return getDb().query(`DELETE FROM workspace_merge_pauses WHERE ${where.join(" AND ")}`).run(...params).changes > 0;
+}
+
+export function releaseExpiredMergePauses(now: number = Date.now()): string[] {
+  const expired = getDb().query("SELECT id FROM workspace_merge_pauses WHERE expires_at <= ?").all(now) as Array<{ id: string }>;
+  if (!expired.length) return [];
+  getDb().query("DELETE FROM workspace_merge_pauses WHERE expires_at <= ?").run(now);
+  return expired.map((r) => r.id);
+}

package/src/db/migrations.ts

@@ -117,6 +117,21 @@ export function applyMigrations(): void {
   normalizeExistingMessageReactions();
 
   // Migrations
+  getDb().run(`
+    CREATE TABLE IF NOT EXISTS workspace_merge_pauses (
+      id TEXT PRIMARY KEY,
+      repo_root TEXT NOT NULL,
+      base_ref TEXT NOT NULL,
+      holder TEXT NOT NULL,
+      reason TEXT,
+      created_at INTEGER NOT NULL,
+      updated_at INTEGER NOT NULL,
+      expires_at INTEGER NOT NULL,
+      UNIQUE(repo_root, base_ref)
+    )
+  `);
+  getDb().run("CREATE INDEX IF NOT EXISTS idx_workspace_merge_pauses_expires ON workspace_merge_pauses(expires_at)");
+
   const cols = getDb().query("PRAGMA table_info(messages)").all() as any[];
   const colNames = cols.map((c: any) => c.name);
   if (!colNames.includes("thread_id")) {
@@ -379,6 +394,12 @@ export function applyMigrations(): void {
     "UPDATE tasks SET claim_expires_at = coalesce(claimed_at, ?) + ? WHERE claimed_by IS NOT NULL AND claim_expires_at IS NULL",
   ).run(Date.now(), CLAIM_LEASE_MS);
 
+  const providerModelOverrideCols = getDb().query("PRAGMA table_info(provider_model_overrides)").all() as any[];
+  const providerModelOverrideColNames = providerModelOverrideCols.map((c: any) => c.name);
+  if (!providerModelOverrideColNames.includes("disabled")) {
+    getDb().run("ALTER TABLE provider_model_overrides ADD COLUMN disabled INTEGER NOT NULL DEFAULT 0");
+  }
+
   // Migration: orchestrators.api_url
   const orchCols = getDb().query("PRAGMA table_info(orchestrators)").all() as any[];
   const orchColNames = orchCols.map((c: any) => c.name);

package/src/db/schema.ts

@@ -829,7 +829,7 @@ export function initDb(path: string = "agent-relay.db"): Database {
       provider TEXT NOT NULL,
       alias TEXT NOT NULL,
       entry TEXT NOT NULL DEFAULT '{}',
-      deleted INTEGER NOT NULL DEFAULT 0,
+      deleted INTEGER NOT NULL DEFAULT 0, disabled INTEGER NOT NULL DEFAULT 0,
       updated_at INTEGER NOT NULL,
       updated_by TEXT,
       PRIMARY KEY (provider, alias)

package/src/index.ts

@@ -268,13 +268,16 @@ export function createFetchHandler(
       if (!publicPaths.includes(url.pathname)) {
         const integrationAuth = getIntegrationAuth(req);
         const componentAuth = getComponentAuth(req);
+        const handlerOwnsScopedAuth = url.pathname === "/api/tokens/me" ||
+          url.pathname === "/api/settings" ||
+          url.pathname.startsWith("/api/settings/");
         if (!isAuthorized(req)) {
           if (!integrationAuth) {
             return unauthorized(req);
           }
-          if (!isScopedRequestAuthorized(req)) return forbidden(req);
+          if (!handlerOwnsScopedAuth && !isScopedRequestAuthorized(req)) return forbidden(req);
         }
-        if (componentAuth && !isScopedRequestAuthorized(req)) return forbidden(req);
+        if (componentAuth && !handlerOwnsScopedAuth && !isScopedRequestAuthorized(req)) return forbidden(req);
       }
       const response = await matched.handler(req, matched.params);
       applyCors(req, response);

package/src/maintenance.ts

@@ -13,6 +13,7 @@ import {
   expireQueuedMessages,
   getAgent,
   getDb,
+  getActiveMergePause,
   getRepoSteward,
   getWorkspace,
   listActiveTeams,
@@ -64,6 +65,7 @@ import { pruneExpiredTokenRecords } from "./token-db";
 import { dissolveTeamById } from "./services/team";
 import { reapTransientAgents, resetTransientTrackerForTests } from "./services/transient-agent-reaper";
 import { resumeRateLimitedAgents, resetRateLimitResumeTrackerForTests } from "./services/rate-limit-resume";
+import { MERGE_PAUSE_MAINTENANCE_JOB } from "./merge-pause-maintenance";
 import type { Command, MaintenanceJob, MaintenanceJobRun } from "./types";
 
 const DEFAULT_TIMEOUT_MS = 30_000;
@@ -197,6 +199,7 @@ const definitions: MaintenanceJobDefinition[] = [
       };
     },
   },
+  MERGE_PAUSE_MAINTENANCE_JOB,
   {
     id: "task-orphan-release",
     title: "Orphaned task release",
@@ -659,9 +662,8 @@ async function scanWorkspaceConflicts(): Promise<Record<string, unknown>> {
   const candidates = listWorkspaces().filter(
     (ws) => ws.mode === "isolated" && Boolean(ws.worktreePath) && CONFLICT_SCAN_STATUSES.has(ws.status),
   );
-  const flagged: string[] = [], cleared: string[] = [], merged: string[] = [], notifiedStewards: string[] = [];
+  const flagged: string[] = [], cleared: string[] = [], merged: string[] = [], notifiedStewards: string[] = [], prRecycled: string[] = [];
   const reviewerArmed: string[] = [], reviewerChangesRequested: string[] = [], relayPrMerged: string[] = [], relayPrWaiting: string[] = [];
-  const prRecycled: string[] = [];
 
   for (const ws of candidates) {
     const orch = orchestrators.find((candidate) => workspacePathWithinBase(ws.sourceCwd, candidate.baseDir));
@@ -708,6 +710,7 @@ async function scanWorkspaceConflicts(): Promise<Record<string, unknown>> {
     const prAction = preparePrCompletionScan(ws, p, orch.agentId);
     if (prAction.armCommand) { emitCommand(prAction.armCommand); reviewerArmed.push(ws.id); continue; }
     if (prAction.notifiedOwner) { reviewerChangesRequested.push(ws.id); continue; }
+    if (prAction.refreshCommand) { emitCommand(prAction.refreshCommand); continue; }
     if (prAction.mergeCommand) { emitCommand(prAction.mergeCommand); relayPrMerged.push(ws.id); continue; }
     if (prAction.waitReason) relayPrWaiting.push(`${ws.id}:${prAction.waitReason}`);
     if (prAction.stop) continue;
@@ -786,16 +789,13 @@ async function autoMergeCleanFastForwards(): Promise<Record<string, unknown>> {
   );
   const stewardEnabled = getStewardConfig().enabled;
   const merged: string[] = [];
-  const heldByLease: string[] = [];
-  const heldByClaim: string[] = [];
-  const heldAwaitingApproval: string[] = [];
-  const leftForSteward: string[] = [];
-  const wokeStewards: string[] = [];
+  const heldByLease: string[] = [], heldByClaim: string[] = [], heldByPause: string[] = [], heldAwaitingApproval: string[] = [], leftForSteward: string[] = [], wokeStewards: string[] = [];
 
   for (const ws of candidates) {
     if (isAwaitingReviewerApproval(ws)) { heldAwaitingApproval.push(ws.id); continue; }
     // A claimed workspace is being validated by a steward — don't race it (#208).
     if (workspaceActiveClaim(ws)) { heldByClaim.push(ws.id); continue; }
+    if (getActiveMergePause(ws.repoRoot, ws.baseRef ?? "main")) { heldByPause.push(ws.id); continue; }
     const orch = orchestrators.find((candidate) => workspacePathWithinBase(ws.sourceCwd, candidate.baseDir));
     if (!orch?.apiUrl) continue;
     const preview = await fetchHostMergePreview(orch.apiUrl, ws);
@@ -857,7 +857,7 @@ async function autoMergeCleanFastForwards(): Promise<Record<string, unknown>> {
     });
   }
 
-  return { scanned: candidates.length, merged, heldByLease, heldByClaim, heldAwaitingApproval, leftForSteward, wokeStewards };
+  return { scanned: candidates.length, merged, heldByLease, heldByClaim, heldByPause, heldAwaitingApproval, leftForSteward, wokeStewards };
 }
 
 // Route a GC notification, swallowing failures (a stale/missing/misconfigured target must never