agent-relay-server 0.9.0 → 0.10.1

package/src/db.ts

@@ -19,6 +19,7 @@ import type {
   Message,
   Orchestrator,
   OrchestratorHealth,
+  OrchestratorRuntimeInput,
   OrchestratorStatus,
   PairActionInput,
   PairMessageInput,
@@ -120,6 +121,49 @@ export function initDb(path: string = "agent-relay.db"): Database {
     CREATE INDEX IF NOT EXISTS idx_tasks_target ON tasks(target);
     CREATE INDEX IF NOT EXISTS idx_tasks_updated ON tasks(updated_at);
 
+    CREATE TABLE IF NOT EXISTS automations (
+      id TEXT PRIMARY KEY,
+      kind TEXT NOT NULL,
+      name TEXT NOT NULL,
+      description TEXT,
+      enabled INTEGER NOT NULL DEFAULT 1,
+      schedule TEXT NOT NULL,
+      timezone TEXT NOT NULL,
+      next_run_at INTEGER,
+      catch_up_policy TEXT NOT NULL,
+      concurrency_policy TEXT NOT NULL,
+      orchestrator_id TEXT NOT NULL,
+      target_policy TEXT NOT NULL,
+      task_template TEXT NOT NULL,
+      created_at INTEGER NOT NULL,
+      updated_at INTEGER NOT NULL
+    );
+    CREATE INDEX IF NOT EXISTS idx_automations_enabled_next_run ON automations(enabled, next_run_at);
+
+    CREATE TABLE IF NOT EXISTS automation_runs (
+      id TEXT PRIMARY KEY,
+      automation_id TEXT NOT NULL,
+      status TEXT NOT NULL,
+      scheduled_for INTEGER NOT NULL,
+      started_at INTEGER,
+      finished_at INTEGER,
+      orchestrator_id TEXT NOT NULL,
+      target_agent_id TEXT,
+      spawned_agent_id TEXT,
+      task_id INTEGER,
+      message_id INTEGER,
+      control_message_id INTEGER,
+      error TEXT,
+      result TEXT,
+      meta TEXT NOT NULL DEFAULT '{}',
+      created_at INTEGER NOT NULL,
+      updated_at INTEGER NOT NULL,
+      shutdown_requested_at INTEGER
+    );
+    CREATE INDEX IF NOT EXISTS idx_automation_runs_automation ON automation_runs(automation_id, created_at);
+    CREATE INDEX IF NOT EXISTS idx_automation_runs_status ON automation_runs(status);
+    CREATE INDEX IF NOT EXISTS idx_automation_runs_task ON automation_runs(task_id);
+
     CREATE TABLE IF NOT EXISTS task_events (
       id INTEGER PRIMARY KEY AUTOINCREMENT,
       task_id INTEGER NOT NULL REFERENCES tasks(id) ON DELETE CASCADE,
@@ -252,6 +296,70 @@ export function initDb(path: string = "agent-relay.db"): Database {
       last_seen INTEGER NOT NULL,
       created_at INTEGER NOT NULL
     );
+
+    CREATE TABLE IF NOT EXISTS bus_outbox (
+      seq INTEGER PRIMARY KEY AUTOINCREMENT,
+      event_type TEXT NOT NULL,
+      source TEXT NOT NULL,
+      subject TEXT,
+      data TEXT NOT NULL,
+      timestamp INTEGER NOT NULL
+    );
+    CREATE INDEX IF NOT EXISTS idx_outbox_type ON bus_outbox(event_type);
+    CREATE INDEX IF NOT EXISTS idx_outbox_timestamp ON bus_outbox(timestamp);
+
+    CREATE TABLE IF NOT EXISTS commands (
+      id TEXT PRIMARY KEY,
+      type TEXT NOT NULL,
+      source TEXT NOT NULL,
+      target TEXT NOT NULL,
+      params TEXT NOT NULL DEFAULT '{}',
+      status TEXT NOT NULL DEFAULT 'pending',
+      result TEXT,
+      error TEXT,
+      correlation_id TEXT,
+      created_at INTEGER NOT NULL,
+      updated_at INTEGER NOT NULL,
+      expires_at INTEGER
+    );
+    CREATE INDEX IF NOT EXISTS idx_commands_target ON commands(target);
+    CREATE INDEX IF NOT EXISTS idx_commands_status ON commands(status);
+    CREATE INDEX IF NOT EXISTS idx_commands_created ON commands(created_at);
+    CREATE INDEX IF NOT EXISTS idx_commands_correlation ON commands(correlation_id);
+
+    CREATE TABLE IF NOT EXISTS recipe_instances (
+      id TEXT PRIMARY KEY,
+      recipe_name TEXT NOT NULL,
+      recipe_source TEXT NOT NULL,
+      cwd TEXT NOT NULL,
+      orchestrator_id TEXT NOT NULL,
+      status TEXT NOT NULL,
+      started_by TEXT NOT NULL,
+      error TEXT,
+      started_at INTEGER NOT NULL,
+      stopped_at INTEGER
+    );
+    CREATE TABLE IF NOT EXISTS recipe_agent_instances (
+      instance_id TEXT NOT NULL REFERENCES recipe_instances(id) ON DELETE CASCADE,
+      role TEXT NOT NULL,
+      agent_id TEXT NOT NULL,
+      provider TEXT NOT NULL,
+      status TEXT NOT NULL,
+      idx INTEGER,
+      PRIMARY KEY (instance_id, role, agent_id)
+    );
+    CREATE INDEX IF NOT EXISTS idx_recipe_instances_status ON recipe_instances(status);
+
+    CREATE TABLE IF NOT EXISTS tokens (
+      jti TEXT PRIMARY KEY,
+      sub TEXT NOT NULL,
+      role TEXT NOT NULL,
+      scope TEXT NOT NULL,
+      issued_at INTEGER NOT NULL,
+      expires_at INTEGER,
+      revoked_at INTEGER,
+      created_by TEXT
+    );
   `);
 
   // Migrations
@@ -335,6 +443,13 @@ export function initDb(path: string = "agent-relay.db"): Database {
     "UPDATE tasks SET claim_expires_at = coalesce(claimed_at, ?) + ? WHERE claimed_by IS NOT NULL AND claim_expires_at IS NULL",
   ).run(Date.now(), CLAIM_LEASE_MS);
 
+  // Migration: orchestrators.api_url
+  const orchCols = db.prepare("PRAGMA table_info(orchestrators)").all() as any[];
+  const orchColNames = orchCols.map((c: any) => c.name);
+  if (!orchColNames.includes("api_url")) {
+    db.run("ALTER TABLE orchestrators ADD COLUMN api_url TEXT");
+  }
+
   // message_reads: relational replacement for the read_by JSON array.
   db.run(`
     CREATE TABLE IF NOT EXISTS message_reads (
@@ -403,6 +518,11 @@ export function initDb(path: string = "agent-relay.db"): Database {
   return db;
 }
 
+export function getDb(): Database {
+  if (!db) throw new Error("database not initialized");
+  return db;
+}
+
 export class ValidationError extends Error {}
 class ClaimError extends Error {}
 
@@ -646,7 +766,31 @@ function bindingTargetToLegacyTarget(target: ChannelRouteTarget): string {
   return "";
 }
 
-function channelTargetMatches(target: ChannelRouteTarget): AgentCard[] {
+function configuredChannelsForAgent(agent: AgentCard): string[] {
+  const channels = agent.meta?.channels;
+  if (!Array.isArray(channels)) return [];
+  return channels
+    .filter((item): item is string => typeof item === "string")
+    .map((item) => item.trim())
+    .filter((item) => item.length > 0);
+}
+
+function channelEntryMatches(channelId: string, entry: string): boolean {
+  const normalized = entry.trim();
+  if (!normalized) return false;
+  if (normalized === channelId) return true;
+  if (normalized.endsWith(":*")) return channelId.startsWith(normalized.slice(0, -1));
+  return channelId.startsWith(`${normalized}:`);
+}
+
+function agentCanServeChannel(agent: AgentCard, channelId?: string): boolean {
+  if (!channelId) return true;
+  const channels = configuredChannelsForAgent(agent);
+  if (channels.length === 0) return true;
+  return channels.some((entry) => channelEntryMatches(channelId, entry));
+}
+
+function channelTargetMatches(target: ChannelRouteTarget, channelId?: string): AgentCard[] {
   const candidates = listAgents().filter((agent) => (
     agent.id !== "user" &&
     agent.id !== "system" &&
@@ -657,11 +801,12 @@ function channelTargetMatches(target: ChannelRouteTarget): AgentCard[] {
     const agent = getAgent(target.id);
     return agent ? [agent] : [];
   }
-  if (target.type === "pool") return poolSelectorMatches(target.id, candidates);
-  if (target.type === "label") return candidates.filter((agent) => agent.label === target.id);
-  if (target.type === "tag") return candidates.filter((agent) => agent.tags.includes(target.id));
-  if (target.type === "capability") return candidates.filter((agent) => agent.capabilities.includes(target.id));
-  if (target.type === "broadcast") return candidates;
+  const channelCandidates = candidates.filter((agent) => agentCanServeChannel(agent, channelId));
+  if (target.type === "pool") return poolSelectorMatches(target.id, channelCandidates);
+  if (target.type === "label") return channelCandidates.filter((agent) => agent.label === target.id);
+  if (target.type === "tag") return channelCandidates.filter((agent) => agent.tags.includes(target.id));
+  if (target.type === "capability") return channelCandidates.filter((agent) => agent.capabilities.includes(target.id));
+  if (target.type === "broadcast") return channelCandidates;
   return [];
 }
 
@@ -697,7 +842,7 @@ function describeTarget(target: ChannelRouteTarget): string {
 function channelTargetHealth(binding: ChannelBinding, now: number = Date.now()): ChannelTargetHealth {
   const target = binding.target;
   const targetLabel = describeTarget(target);
-  const matches = channelTargetMatches(target);
+  const matches = channelTargetMatches(target, binding.channelId);
   const snapshots = matches.map(channelTargetMatchSnapshot);
 
   if (target.type === "pool") {
@@ -710,6 +855,9 @@ function channelTargetHealth(binding: ChannelBinding, now: number = Date.now()):
     if (!holder || holder.status === "offline") {
       return { status: "error", detail: `Pool ${targetLabel}: holder ${binding.poolAgentId} is offline`, target, matches: snapshots };
     }
+    if (!agentCanServeChannel(holder, binding.channelId)) {
+      return { status: "error", detail: `Pool ${targetLabel}: holder ${binding.poolAgentId} is not configured for ${binding.channelId}`, target, matches: snapshots };
+    }
     if (!holder.ready) {
       return { status: "warning", detail: `Pool ${targetLabel}: holder ${binding.poolAgentId} online but not ready`, target, matches: snapshots };
     }
@@ -730,6 +878,9 @@ function channelTargetHealth(binding: ChannelBinding, now: number = Date.now()):
     if (agent.status === "offline") {
       return { status: "error", detail: `Target ${targetLabel} is offline`, target, matches: snapshots };
     }
+    if (!agentCanServeChannel(agent, binding.channelId)) {
+      return { status: "error", detail: `Target ${targetLabel} is not configured for ${binding.channelId}`, target, matches: snapshots };
+    }
     if (!agent.ready) {
       return { status: "warning", detail: `Target ${targetLabel} is online but not ready`, target, matches: snapshots };
     }
@@ -1052,7 +1203,7 @@ function upsertChannelForAgent(agent: AgentCard): void {
     upsertChannelBinding({
       channelId,
       target: defaultTarget,
-      mode: (defaultTarget.type === "agent" || defaultTarget.type === "pool") ? "exclusive" : defaultTarget.type === "broadcast" ? "broadcast" : "claimable",
+      mode: defaultTarget.type === "broadcast" ? "broadcast" : "exclusive",
     });
   }
 }
@@ -1140,11 +1291,12 @@ export function upsertChannelBinding(input: {
     });
   })();
 
+  evaluatePoolBindings(now);
   const row = db.prepare("SELECT * FROM channel_bindings WHERE id = ?").get(id) as any;
   return rowToChannelBinding(row);
 }
 
-export interface PoolBindingChange {
+interface PoolBindingChange {
   bindingId: string;
   channelId: string;
   previousAgentId: string | null;
@@ -1165,7 +1317,7 @@ export function evaluatePoolBindings(now: number = Date.now()): PoolBindingChang
     let holderValid = false;
     if (currentAgentId) {
       const holder = getAgent(currentAgentId);
-      if (holder && holder.status !== "offline" && holder.ready && holder.lastSeen > now - STALE_TTL_MS) {
+      if (holder && holder.status !== "offline" && holder.ready && holder.lastSeen > now - STALE_TTL_MS && agentCanServeChannel(holder, channelId)) {
         if (currentEpoch === null || holder.epoch === currentEpoch) {
           db.prepare("UPDATE channel_bindings SET pool_claim_expires_at = ? WHERE id = ?")
             .run(now + POOL_CLAIM_LEASE_MS, bindingId);
@@ -1185,6 +1337,7 @@ export function evaluatePoolBindings(now: number = Date.now()): PoolBindingChang
         a.id !== "user" && a.id !== "system" && a.kind !== "channel" && a.meta?.kind !== "channel"
       );
       const eligible = poolSelectorMatches(selector, candidates)
+        .filter((a) => agentCanServeChannel(a, channelId))
         .filter((a) => a.status !== "offline" && a.ready && a.lastSeen > now - STALE_TTL_MS)
         .sort((a, b) => b.lastSeen - a.lastSeen);
 
@@ -1222,17 +1375,13 @@ export function resolveChannelRoutes(channelId: string, conversationId?: string)
   return (exact.length ? exact : rows.filter((row) => row.conversation_key === "")).map(rowToChannelBinding);
 }
 
-export function resolveChannelRoute(channelId: string, conversationId?: string): ChannelBinding | null {
-  return resolveChannelRoutes(channelId, conversationId)[0] ?? null;
-}
-
 export function reapStaleAgents(ttlMs: number = STALE_TTL_MS): string[] {
   const now = Date.now();
   const cutoff = now - ttlMs;
   db.prepare("UPDATE agents SET last_seen = ? WHERE id IN ('user', 'system')").run(now);
   const rows = db
     .prepare(
-      "UPDATE agents SET status = 'offline', ready = 0 WHERE status != 'offline' AND last_seen < ? AND id NOT IN ('user', 'system') RETURNING id"
+      "UPDATE agents SET status = 'offline', ready = 0 WHERE status NOT IN ('offline', 'stale') AND last_seen < ? AND id NOT IN ('user', 'system') RETURNING id"
     )
     .all(cutoff) as any[];
   for (const row of rows) closeOpenPairsForAgent(row.id, now);
@@ -1530,6 +1679,63 @@ export function releaseExpiredClaims(now: number = Date.now()): { messageIds: nu
   })();
 }
 
+export function orphanTasksForAgent(agentId: string, now: number = Date.now()): Task[] {
+  return db.transaction(() => {
+    const rows = db
+      .prepare(`${TASK_SELECT} WHERE claimed_by = ? AND status IN ('claimed', 'in_progress')`)
+      .all(agentId) as any[];
+    if (rows.length === 0) return [];
+
+    db.prepare(`
+      UPDATE tasks
+      SET status = 'orphaned', updated_at = ?, last_seen_at = ?
+      WHERE claimed_by = ? AND status IN ('claimed', 'in_progress')
+    `).run(now, now, agentId);
+
+    for (const row of rows) {
+      insertTaskEvent(row.id, {
+        source: "agent-relay",
+        type: "task.orphaned",
+        severity: row.severity,
+        title: "Task orphaned",
+        body: `Claimed agent ${agentId} went offline`,
+        metadata: { agentId },
+      }, now);
+    }
+
+    return rows.map((row: any) => getTask(row.id)!);
+  })();
+}
+
+export function releaseOrphanedTasks(graceMs = 120_000, now: number = Date.now()): Task[] {
+  return db.transaction(() => {
+    const cutoff = now - graceMs;
+    const rows = db
+      .prepare(`${TASK_SELECT} WHERE status = 'orphaned' AND claimed_by IS NOT NULL AND updated_at <= ?`)
+      .all(cutoff) as any[];
+    if (rows.length === 0) return [];
+
+    db.prepare(`
+      UPDATE tasks
+      SET status = 'open', claimed_by = NULL, claimed_at = NULL, claim_expires_at = NULL, updated_at = ?
+      WHERE status = 'orphaned' AND claimed_by IS NOT NULL AND updated_at <= ?
+    `).run(now, cutoff);
+
+    for (const row of rows) {
+      insertTaskEvent(row.id, {
+        source: "agent-relay",
+        type: "orphan.released",
+        severity: row.severity,
+        title: "Orphaned task released",
+        body: "Task is available for claim again",
+        metadata: { previousAgentId: row.claimed_by },
+      }, now);
+    }
+
+    return rows.map((row: any) => getTask(row.id)!);
+  })();
+}
+
 export function claimTask(taskId: number, agentId: string, guard?: AgentSessionGuard): { ok: boolean; error?: string; task?: Task } {
   releaseExpiredClaims();
   const session = validateAgentSession(agentId, guard);
@@ -2548,6 +2754,7 @@ function rowToOrchestrator(row: any): Orchestrator {
     agentId: row.agent_id,
     providers: parseJson<SpawnProvider[]>(row.providers, []),
     baseDir: row.base_dir,
+    ...(row.api_url ? { apiUrl: row.api_url } : {}),
     envKeys: parseJson<string[]>(row.env_keys, []),
     ...(version ? { version } : {}),
     ...(Number.isFinite(protocolVersion) ? { protocolVersion } : {}),
@@ -2583,17 +2790,27 @@ function orchestratorHealth(version: string | undefined, protocolVersion: number
   };
 }
 
+function mergeOrchestratorRuntimeMeta(meta: Record<string, unknown>, input: OrchestratorRuntimeInput): Record<string, unknown> {
+  return {
+    ...meta,
+    ...(input.version ? { version: input.version } : {}),
+    ...(input.protocolVersion !== undefined ? { protocolVersion: input.protocolVersion } : {}),
+    ...(input.gitSha ? { gitSha: input.gitSha } : {}),
+  };
+}
+
 export function upsertOrchestrator(input: RegisterOrchestratorInput): Orchestrator {
   const now = Date.now();
   const agentId = `orchestrator-${input.id}`;
   const stmt = db.prepare(`
-    INSERT INTO orchestrators (id, hostname, status, agent_id, providers, base_dir, env_keys, meta, last_seen, created_at)
-    VALUES ($id, $hostname, 'online', $agentId, $providers, $baseDir, $envKeys, $meta, $now, $now)
+    INSERT INTO orchestrators (id, hostname, status, agent_id, providers, base_dir, api_url, env_keys, meta, last_seen, created_at)
+    VALUES ($id, $hostname, 'online', $agentId, $providers, $baseDir, $apiUrl, $envKeys, $meta, $now, $now)
     ON CONFLICT(id) DO UPDATE SET
       hostname = $hostname,
       status = 'online',
       providers = $providers,
       base_dir = $baseDir,
+      api_url = $apiUrl,
       env_keys = $envKeys,
       meta = $meta,
       last_seen = $now
@@ -2604,13 +2821,9 @@ export function upsertOrchestrator(input: RegisterOrchestratorInput): Orchestrat
     $agentId: agentId,
     $providers: JSON.stringify(input.providers),
     $baseDir: input.baseDir,
+    $apiUrl: input.apiUrl ?? null,
     $envKeys: JSON.stringify(input.envKeys ?? []),
-    $meta: JSON.stringify({
-      ...(input.meta ?? {}),
-      ...(input.version ? { version: input.version } : {}),
-      ...(input.protocolVersion !== undefined ? { protocolVersion: input.protocolVersion } : {}),
-      ...(input.gitSha ? { gitSha: input.gitSha } : {}),
-    }),
+    $meta: JSON.stringify(mergeOrchestratorRuntimeMeta(input.meta ?? {}, input)),
     $now: now,
   });
 
@@ -2644,9 +2857,12 @@ export function listOrchestrators(): Orchestrator[] {
   return (db.prepare("SELECT * FROM orchestrators ORDER BY hostname").all() as any[]).map(rowToOrchestrator);
 }
 
-export function orchestratorHeartbeat(id: string): Orchestrator | null {
+export function orchestratorHeartbeat(id: string, runtime: OrchestratorRuntimeInput = {}): Orchestrator | null {
   const now = Date.now();
-  db.prepare("UPDATE orchestrators SET last_seen = ?, status = 'online' WHERE id = ?").run(now, id);
+  const row = db.prepare("SELECT meta FROM orchestrators WHERE id = ?").get(id) as { meta?: string } | undefined;
+  if (!row) return null;
+  const meta = mergeOrchestratorRuntimeMeta(parseJson<Record<string, unknown>>(row.meta ?? "{}", {}), runtime);
+  db.prepare("UPDATE orchestrators SET last_seen = ?, status = 'online', meta = ? WHERE id = ?").run(now, JSON.stringify(meta), id);
   // Also heartbeat the agent
   const orch = getOrchestrator(id);
   if (orch) {
@@ -2655,15 +2871,6 @@ export function orchestratorHeartbeat(id: string): Orchestrator | null {
   return orch;
 }
 
-export function setOrchestratorStatus(id: string, status: OrchestratorStatus): Orchestrator | null {
-  db.prepare("UPDATE orchestrators SET status = ?, last_seen = ? WHERE id = ?").run(status, Date.now(), id);
-  const orch = getOrchestrator(id);
-  if (orch) {
-    setStatus(orch.agentId, status === "online" ? "online" : "offline");
-  }
-  return orch;
-}
-
 export function updateManagedAgents(id: string, agents: ManagedAgent[]): Orchestrator | null {
   db.prepare("UPDATE orchestrators SET managed_agents = ?, last_seen = ? WHERE id = ?")
     .run(JSON.stringify(agents), Date.now(), id);

package/src/events.ts

@@ -0,0 +1,33 @@
+import { appendEvent } from "./bus-outbox";
+
+export interface RelayEvent {
+  seq: number;
+  type: string;
+  source: string;
+  subject?: string;
+  data: Record<string, unknown>;
+  timestamp: number;
+}
+
+type Listener = (event: RelayEvent) => void;
+
+const listeners = new Set<Listener>();
+
+export function emitRelayEvent(input: Omit<RelayEvent, "seq" | "timestamp">): RelayEvent {
+  const timestamp = Date.now();
+  const seq = appendEvent(input.type, input.source, input.data, input.subject);
+  const event: RelayEvent = { ...input, seq, timestamp };
+  for (const listener of listeners) {
+    try {
+      listener(event);
+    } catch {
+      // Event projections are isolated so one transport cannot block another.
+    }
+  }
+  return event;
+}
+
+export function subscribeRelayEvents(listener: Listener): () => void {
+  listeners.add(listener);
+  return () => listeners.delete(listener);
+}

package/src/index.ts

@@ -1,7 +1,13 @@
 #!/usr/bin/env bun
-import { initDb, reapStaleAgents, pruneOfflineAgents, pruneOldMessages, releaseExpiredClaims, evaluatePoolBindings } from "./db";
+import { initDb, reapStaleAgents, pruneOfflineAgents, pruneOldMessages, releaseExpiredClaims, releaseOrphanedTasks, evaluatePoolBindings } from "./db";
 import { matchRoute } from "./routes";
-import { emitAgentStatus, emitAgentRemoved, emitMessageClaimReleased, emitTaskChanged, emitPoolBindingChanged } from "./sse";
+import { emitAgentStatus, emitAgentRemoved, emitMessageClaimReleased, emitNewMessage, emitTaskChanged, emitPoolBindingChanged } from "./sse";
+import { busHandleClose, busHandleMessage, busHandleOpen, expireStaleBusAgents, handleBusUpgrade } from "./bus";
+import { pruneOutbox } from "./bus-outbox";
+import { expireCommands } from "./commands-db";
+import { applyCommandToRecipe } from "./recipe-runner";
+import { emitRelayEvent } from "./events";
+import { reconcileAutomationRuns, runDueAutomations, type AutomationDispatchResult, type AutomationReconcileResult } from "./automations";
 import { resolve, sep } from "path";
 import {
   REAP_INTERVAL_MS,
@@ -15,6 +21,7 @@ import {
   assertSafeNetworkConfig,
   corsPreflight,
   forbidden,
+  getComponentAuth,
   getIntegrationAuth,
   isAuthorized,
   isScopedRequestAuthorized,
@@ -34,6 +41,9 @@ function startServer(): void {
   const HOST = process.env.HOST || "127.0.0.1";
   const DB_PATH = process.env.DB_PATH || "agent-relay.db";
   const RETENTION_DAYS = Number(process.env.RETENTION_DAYS) || 30;
+  const OUTBOX_RETENTION_MS = Number(process.env.AGENT_RELAY_OUTBOX_RETENTION_MS) || 60 * 60 * 1000;
+  const AUTOMATION_INTERVAL_MS = Number(process.env.AGENT_RELAY_AUTOMATION_INTERVAL_MS) || 30 * 1000;
+  const IDLE_TIMEOUT_SECONDS = Number(process.env.AGENT_RELAY_IDLE_TIMEOUT_SECONDS) || 255;
   const LOG_REQUESTS = process.env.AGENT_RELAY_LOG_REQUESTS === "1";
 
   assertSafeNetworkConfig(HOST);
@@ -47,6 +57,20 @@ function startServer(): void {
       for (const task of released.tasks) emitTaskChanged(task, "task.updated");
     }
 
+    const expiredCommands = expireCommands();
+    for (const command of expiredCommands) {
+      applyCommandToRecipe(command);
+      emitRelayEvent({ type: "command.timed_out", source: command.source, subject: command.id, data: { command } });
+    }
+
+    const staleExpired = expireStaleBusAgents();
+    if (staleExpired.agentIds.length > 0) {
+      console.log(`expired ${staleExpired.agentIds.length} stale bus agent(s)`);
+    }
+
+    const releasedOrphans = releaseOrphanedTasks();
+    for (const task of releasedOrphans) emitTaskChanged(task, "task.updated");
+
     const reaped = reapStaleAgents(STALE_TTL_MS);
     if (reaped.length > 0) {
       console.log(`reaped ${reaped.length} stale agent(s)`);
@@ -71,25 +95,85 @@ function startServer(): void {
     if (pruned > 0) console.log(`pruned ${pruned} old message(s)`);
   }, DAY_MS);
 
+  setInterval(() => {
+    emitAutomationReconciliations(reconcileAutomationRuns());
+    emitAutomationDispatches(runDueAutomations());
+  }, AUTOMATION_INTERVAL_MS);
+
+  setInterval(() => {
+    const pruned = pruneOutbox(OUTBOX_RETENTION_MS);
+    if (pruned > 0) console.log(`pruned ${pruned} bus outbox event(s)`);
+  }, 5 * 60 * 1000);
+
   Bun.serve({
     port: PORT,
     hostname: HOST,
+    idleTimeout: IDLE_TIMEOUT_SECONDS,
     fetch: createFetchHandler({ logRequests: LOG_REQUESTS }),
+    websocket: {
+      open: busHandleOpen,
+      message: busHandleMessage,
+      close: busHandleClose,
+    },
   });
 
   console.log(`agent-relay ${VERSION} running on http://${HOST}:${PORT}`);
 }
 
+function emitAutomationDispatches(results: AutomationDispatchResult[]): void {
+  for (const result of results) {
+    if (result.command) emitAutomationCommand(result.command);
+    if (result.message) emitNewMessage(result.message);
+    if (result.task) emitTaskChanged(result.task, "task.created");
+    emitRelayEvent({
+      type: "automation.run",
+      source: "server",
+      subject: result.run.id,
+      data: { automation: result.automation, run: result.run, task: result.task },
+    });
+  }
+}
+
+function emitAutomationReconciliations(results: AutomationReconcileResult[]): void {
+  for (const result of results) {
+    if (result.command) emitAutomationCommand(result.command);
+    if (result.task) emitTaskChanged(result.task, "task.updated");
+    emitRelayEvent({
+      type: "automation.run",
+      source: "server",
+      subject: result.run.id,
+      data: { run: result.run, task: result.task },
+    });
+  }
+}
+
+function emitAutomationCommand(command: { id: string; source: string; status: string }): void {
+  emitRelayEvent({
+    type: command.status === "pending" ? "command.requested" : `command.${command.status}`,
+    source: command.source,
+    subject: command.id,
+    data: { command },
+  });
+}
+
 export function createFetchHandler(
   opts: { publicDir?: string; logRequests?: boolean } = {},
-): (req: Request) => Promise<Response> {
-  const publicDir = opts.publicDir ?? resolve(import.meta.dir, "../public");
+): {
+  (req: Request): Promise<Response>;
+  (req: Request, server: Bun.Server<any>): Promise<Response | undefined>;
+} {
+  const publicDir = resolve(opts.publicDir ?? resolve(import.meta.dir, "../public"));
   const publicDirPrefix = publicDir + sep;
   const logRequests = opts.logRequests ?? false;
 
-  return async function fetch(req: Request): Promise<Response> {
+  return async function fetch(req: Request, server?: Bun.Server<any>): Promise<Response | undefined> {
     const url = new URL(req.url);
 
+    if (url.pathname === "/bus") {
+      if (!server) return new Response("WebSocket upgrade unavailable", { status: 400 });
+      return handleBusUpgrade(req, server);
+    }
+
     if (req.method === "OPTIONS") {
       return corsPreflight(req);
     }
@@ -101,12 +185,14 @@ export function createFetchHandler(
     const matched = matchRoute(req.method, url.pathname);
     if (matched) {
       const integrationAuth = getIntegrationAuth(req);
+      const componentAuth = getComponentAuth(req);
       if (!isAuthorized(req)) {
         if (!integrationAuth) {
           return unauthorized(req);
         }
         if (!isScopedRequestAuthorized(req)) return forbidden(req);
       }
+      if (componentAuth && !isScopedRequestAuthorized(req)) return forbidden(req);
       const response = await matched.handler(req, matched.params);
       applyCors(req, response);
       if (logRequests && url.pathname.startsWith("/api/")) {
@@ -129,6 +215,9 @@ export function createFetchHandler(
     }
 
     return Response.json({ error: "not found" }, { status: 404 });
+  } as {
+    (req: Request): Promise<Response>;
+    (req: Request, server: Bun.Server<any>): Promise<Response | undefined>;
   };
 }