n8n 2.28.4 → 2.29.1

package/dist/modules/instance-ai/instance-ai.service.js

@@ -55,7 +55,6 @@ const workflow_sdk_1 = require("@n8n/workflow-sdk");
 const n8n_core_1 = require("n8n-core");
 const n8n_workflow_1 = require("n8n-workflow");
 const nanoid_1 = require("nanoid");
-const uuid_1 = require("uuid");
 const constants_1 = require("../../constants");
 const event_service_1 = require("../../events/event.service");
 const source_control_preferences_service_ee_1 = require("../../modules/source-control.ee/source-control-preferences.service.ee");
@@ -63,6 +62,8 @@ const ai_service_1 = require("../../services/ai.service");
 const proxy_token_manager_1 = require("../../services/proxy-token-manager");
 const url_service_1 = require("../../services/url.service");
 const telemetry_1 = require("../../telemetry");
+const composite_local_mcp_server_1 = require("./browser/composite-local-mcp-server");
+const instance_ai_browser_session_service_1 = require("./browser/instance-ai-browser-session.service");
 const thread_credential_allowlist_service_1 = require("./eval/thread-credential-allowlist.service");
 const in_process_event_bus_1 = require("./event-bus/in-process-event-bus");
 const instance_ai_credit_service_1 = require("./instance-ai-credit.service");
@@ -72,6 +73,7 @@ const instance_ai_model_service_1 = require("./instance-ai-model.service");
 const instance_ai_run_probe_1 = require("./instance-ai-run-probe");
 const instance_ai_settings_service_1 = require("./instance-ai-settings.service");
 const instance_ai_temporary_workflow_service_1 = require("./instance-ai-temporary-workflow.service");
+const instance_ai_terminal_outcome_service_1 = require("./instance-ai-terminal-outcome.service");
 const instance_ai_adapter_service_1 = require("./instance-ai.adapter.service");
 const internal_messages_1 = require("./internal-messages");
 const liveness_1 = require("./liveness");
@@ -81,7 +83,6 @@ const output_redaction_config_1 = require("./output-redaction-config");
 const planned_task_action_runner_1 = require("./planned-task-action-runner");
 const instance_ai_pending_confirmation_repository_1 = require("./repositories/instance-ai-pending-confirmation.repository");
 const instance_ai_thread_grant_repository_1 = require("./repositories/instance-ai-thread-grant.repository");
-const run_trace_metadata_1 = require("./run-trace-metadata");
 const sandbox_1 = require("./sandbox");
 const db_iteration_log_storage_1 = require("./storage/db-iteration-log-storage");
 const db_snapshot_storage_1 = require("./storage/db-snapshot-storage");
@@ -89,7 +90,7 @@ const typeorm_agent_checkpoint_store_1 = require("./storage/typeorm-agent-checkp
 const typeorm_agent_memory_1 = require("./storage/typeorm-agent-memory");
 const suspended_run_restorer_service_1 = require("./suspended-run-restorer.service");
 const suspended_thread_persistence_service_1 = require("./suspended-thread-persistence.service");
-const trace_replay_state_1 = require("./trace-replay-state");
+const tracing_1 = require("./tracing");
 const workflow_verification_obligation_service_1 = require("./workflow-verification-obligation-service");
 const workflow_verification_task_projector_1 = require("./workflow-verification-task-projector");
 function getErrorMessage(error) {
@@ -112,6 +113,27 @@ function buildContextResourcesBlock(workflowAttachments) {
     ].join('\n');
     return `${internal_messages_1.EDITOR_CONTEXT_OPEN_TAG}\n${JSON.stringify(workflowAttachments)}\n\n${prose}\n${internal_messages_1.EDITOR_CONTEXT_CLOSE_TAG}`;
 }
+function buildHandoffContextBlock(context) {
+    if (!context)
+        return '';
+    const { credential } = context;
+    const lines = [
+        `- Credential type: \`${credential.credentialType}\` (${credential.displayName}).`,
+        credential.id ? `- Existing credential id: \`${credential.id}\`.` : '',
+        credential.nodeName ? `- Node name: "${credential.nodeName}".` : '',
+        credential.nodeType ? `- Node type: \`${credential.nodeType}\`.` : '',
+        credential.documentationUrl ? `- n8n documentation URL: ${credential.documentationUrl}` : '',
+        credential.oauthRedirectUrl
+            ? `- OAuth redirect/callback URL shown in the modal: ${credential.oauthRedirectUrl}`
+            : '',
+    ].filter(Boolean);
+    const prose = [
+        'The user opened this conversation from the credential setup modal and is asking for setup guidance.',
+        ...lines,
+        'Use this metadata only as setup context. Never ask the user to paste credential secrets into chat. For credential setup docs, load `n8n-docs-assistant` and use `n8n-docs` with `intent: "credential-setup"`.',
+    ].join('\n');
+    return `${internal_messages_1.CREDENTIAL_CONTEXT_OPEN_TAG}\n${JSON.stringify(context)}\n\n${prose}\n${internal_messages_1.CREDENTIAL_CONTEXT_CLOSE_TAG}`;
+}
 function isTelemetryConfigurableAgent(agent) {
     return (typeof agent === 'object' &&
         agent !== null &&
@@ -128,7 +150,6 @@ function isTextMessagePart(part) {
         'text' in part &&
         typeof part.text === 'string');
 }
-const ORCHESTRATOR_AGENT_ID = 'agent-001';
 function getUserFacingErrorMessage(error) {
     if (error instanceof n8n_workflow_1.UserError) {
         return error.message;
@@ -141,45 +162,6 @@ function getUserFacingErrorMessage(error) {
     }
     return 'Something went wrong before I could finish that response. Please try again.';
 }
-function getBackgroundOutcomeResponseId(outcome) {
-    return `background-outcome:${outcome.id}`;
-}
-function createTerminalOutcomeAgentTree(outcome, responseId) {
-    return {
-        agentId: ORCHESTRATOR_AGENT_ID,
-        role: 'orchestrator',
-        status: outcome.status === 'cancelled'
-            ? 'cancelled'
-            : outcome.status === 'failed'
-                ? 'error'
-                : 'completed',
-        textContent: outcome.userFacingMessage,
-        reasoning: '',
-        toolCalls: [],
-        children: [],
-        timeline: [{ type: 'text', content: outcome.userFacingMessage, responseId }],
-    };
-}
-function appendTerminalOutcomeToAgentTree(tree, outcome, responseId) {
-    const text = outcome.userFacingMessage.trim();
-    if (!text)
-        return { tree, appended: false };
-    const alreadyInTimeline = tree.timeline.some((entry) => entry.type === 'text' && entry.responseId === responseId);
-    if (alreadyInTimeline) {
-        return { tree, appended: false };
-    }
-    return {
-        appended: true,
-        tree: {
-            ...tree,
-            textContent: tree.textContent ? `${tree.textContent}\n\n${outcome.userFacingMessage}` : text,
-            timeline: [
-                ...tree.timeline,
-                { type: 'text', content: outcome.userFacingMessage, responseId },
-            ],
-        },
-    };
-}
 function createInertAbortSignal() {
     return new AbortController().signal;
 }
@@ -195,7 +177,6 @@ function getAbortReason(signal) {
         return reason.message;
     return typeof reason === 'string' ? reason : 'user_cancelled';
 }
-const INSTANCE_AI_FEEDBACK_NAMESPACE = 'c5be4c87-5b6e-49ed-afe1-9c5c1f99a5c0';
 const MAX_CONCURRENT_BACKGROUND_TASKS_PER_THREAD = 5;
 function stringifyForContextValue(value) {
     if (typeof value === 'string')
@@ -286,12 +267,13 @@ let InstanceAiService = class InstanceAiService {
         }
         return this._mcpClientManager;
     }
-    constructor(logger, globalConfig, instanceSettings, adapterService, eventBus, settingsService, gatewayService, memoryService, agentMemory, checkpointStore, aiService, threadGrantRepo, pendingConfirmationRepo, urlService, dbSnapshotStorage, dbIterationLogStorage, sourceControlPreferencesService, telemetry, mcpRegistryService, userRepository, temporaryWorkflowService, errorReporter, ssrfProtectionConfig, ssrfProtectionService, eventService, evalCredentialAllowlists, runProbe, modelService, creditService) {
+    constructor(logger, globalConfig, instanceSettings, adapterService, eventBus, settingsService, gatewayService, browserSessionService, memoryService, agentMemory, checkpointStore, aiService, threadGrantRepo, pendingConfirmationRepo, urlService, dbSnapshotStorage, dbIterationLogStorage, sourceControlPreferencesService, telemetry, mcpRegistryService, userRepository, temporaryWorkflowService, errorReporter, ssrfProtectionConfig, ssrfProtectionService, eventService, evalCredentialAllowlists, runProbe, modelService, creditService) {
         this.instanceSettings = instanceSettings;
         this.adapterService = adapterService;
         this.eventBus = eventBus;
         this.settingsService = settingsService;
         this.gatewayService = gatewayService;
+        this.browserSessionService = browserSessionService;
         this.memoryService = memoryService;
         this.agentMemory = agentMemory;
         this.checkpointStore = checkpointStore;
@@ -314,20 +296,16 @@ let InstanceAiService = class InstanceAiService {
         this.runState = new instance_ai_1.RunStateRegistry();
         this.backgroundTasks = new instance_ai_1.BackgroundTaskManager(MAX_CONCURRENT_BACKGROUND_TASKS_PER_THREAD);
         this.memoryTaskRegistry = new instance_ai_1.MemoryTaskRegistry();
-        this.traceContextsByRunId = new Map();
         this.reportedErrors = new WeakSet();
         this.domainAccessTrackersByThread = new Map();
         this.threadPushRef = new Map();
         this.planRequestsByThread = new Map();
         this.schedulerLocks = new Map();
         this.pendingCheckpointReentries = new Map();
-        this.pendingTerminalOutcomes = new Map();
-        this.traceReplay = new trace_replay_state_1.TraceReplayState();
         this.runDebugBuffer = new instance_ai_1.RunDebugBuffer();
         this.checkpointPruningStopped = true;
         this.inFlightExecutions = new Set();
         this.preserveHitlOnShutdown = new Set();
-        this.userMessagePersistenceByRun = new Map();
         this.logger = logger.scoped('instance-ai');
         runProbe.registerActiveRunCountProvider(() => this.runState.activeRunCount());
         this.workflowObligations = new workflow_verification_obligation_service_1.WorkflowVerificationObligationService(this.agentMemory);
@@ -337,7 +315,6 @@ let InstanceAiService = class InstanceAiService {
             logger: this.logger,
             config: this.instanceAiConfig,
             pendingConfirmationRepo: this.pendingConfirmationRepo,
-            agentMemory: this.agentMemory,
         });
         this.suspendedRunRestorer = new suspended_run_restorer_service_1.SuspendedRunRestorer({
             logger: this.logger,
@@ -367,6 +344,13 @@ let InstanceAiService = class InstanceAiService {
                 void this.suspendedThreads.dropPendingConfirmation(requestId);
             },
         });
+        this.tracing = new tracing_1.InstanceAiTracingService({
+            logger: this.logger,
+            eventBus: this.eventBus,
+            runState: this.runState,
+            dbSnapshotStorage: this.dbSnapshotStorage,
+            aiService: this.aiService,
+        });
         this.sandboxService = new sandbox_1.InstanceAiSandboxService({
             config: this.instanceAiConfig,
             logger: this.logger,
@@ -376,6 +360,20 @@ let InstanceAiService = class InstanceAiService {
             settingsService: this.settingsService,
             aiService: this.aiService,
         });
+        this.terminalOutcome = new instance_ai_terminal_outcome_service_1.InstanceAiTerminalOutcomeService({
+            eventBus: this.eventBus,
+            dbSnapshotStorage: this.dbSnapshotStorage,
+            agentMemory: this.agentMemory,
+            telemetry: this.telemetry,
+            logger: this.logger,
+            runState: this.runState,
+            suspendedThreads: this.suspendedThreads,
+            tracing: this.tracing,
+            publishRunFinish: (threadId, runId, status, reason) => {
+                this.publishRunFinish(threadId, runId, status, reason);
+            },
+            saveAgentTreeSnapshot: async (threadId, runId, snapshotStorage) => await this.saveAgentTreeSnapshot(threadId, runId, snapshotStorage),
+        });
         this.defaultTimeZone = globalConfig.generic.timezone;
         const restEndpoint = globalConfig.endpoints.rest;
         this.oauth2CallbackUrl = `${this.urlService.getInstanceBaseUrl()}/${restEndpoint}/oauth2-credential/callback`;
@@ -495,23 +493,17 @@ let InstanceAiService = class InstanceAiService {
             this.logger.info(`Observational memory task ${event.type}`, logContext);
         };
     }
-    storeTraceContext(runId, threadId, tracing, messageGroupId) {
-        const existing = this.traceContextsByRunId.get(runId);
-        if (existing?.tracing.traceWriter &&
-            existing.traceSlug &&
-            existing.tracing.traceWriter !== tracing.traceWriter) {
-            this.traceReplay.preserveWriterEvents(existing.traceSlug, existing.tracing.traceWriter.getEvents());
-        }
-        this.traceContextsByRunId.set(runId, {
-            threadId,
-            messageGroupId,
-            tracing,
-            traceSlug: this.traceReplay.getActiveSlug(),
+    subscribeToAgentErrors(agent, threadId, runId) {
+        agent.on("error", (event) => {
+            if (event.type !== "error" || !event.source)
+                return;
+            this.reportInstanceAiError(event.error, {
+                component: `instance-ai-${event.source}`,
+                threadId,
+                runId,
+            });
         });
     }
-    getTraceContext(runId) {
-        return this.traceContextsByRunId.get(runId)?.tracing;
-    }
     reportInstanceAiError(error, context) {
         if (typeof error === 'object' && error !== null) {
             if (this.reportedErrors.has(error))
@@ -588,282 +580,13 @@ let InstanceAiService = class InstanceAiService {
             label: record.label,
         }));
     }
-    getTraceContextForContinuation(threadId, messageGroupId) {
-        const entries = [...this.traceContextsByRunId.values()].reverse();
-        const sameGroup = messageGroupId === undefined
-            ? undefined
-            : entries.find((entry) => entry.threadId === threadId && entry.messageGroupId === messageGroupId)?.tracing;
-        return sameGroup ?? entries.find((entry) => entry.threadId === threadId)?.tracing;
-    }
-    async createOrchestratorResumeTraceContext(options) {
-        const baseTracing = options.baseTracing ??
-            this.getTraceContextForContinuation(options.threadId, options.messageGroupId);
-        if (!baseTracing)
-            return undefined;
-        const tracing = await (0, instance_ai_1.continueInstanceAiTraceContext)(baseTracing, {
-            threadId: options.threadId,
-            messageId: options.messageId,
-            messageGroupId: options.messageGroupId,
-            runId: options.runId,
-            userId: options.userId,
-            modelId: options.modelId,
-            input: options.input,
-            proxyConfig: options.proxyConfig ?? baseTracing?.proxyConfig,
-            metadata: {
-                resume_reason: options.resumeReason,
-                agent_id: ORCHESTRATOR_AGENT_ID,
-                ...options.metadata,
-            },
-            n8nVersion: constants_1.N8N_VERSION,
-            workflowSdkVersion: constants_1.WORKFLOW_SDK_VERSION,
-        });
-        if (tracing) {
-            await this.configureTraceReplayMode(tracing);
-            this.storeTraceContext(options.runId, options.threadId, tracing, options.messageGroupId);
-            this.runState.attachTracing(options.threadId, tracing);
-        }
-        return tracing;
-    }
-    async configureTraceReplayMode(tracing) {
-        await this.traceReplay.configureReplayMode(tracing);
-    }
-    async finalizeMessageTraceRoot(runId, tracing, options) {
-        if (tracing.rootRun.endTime)
-            return;
-        const outputs = options.outputs ?? {
-            status: options.status,
-            runId,
-            ...(options.outputText ? { response: options.outputText } : {}),
-            ...(options.reason ? { reason: options.reason } : {}),
-        };
-        const metadata = {
-            final_status: options.status,
-            ...(options.modelId !== undefined ? { model_id: options.modelId } : {}),
-            ...options.metadata,
-        };
-        try {
-            await tracing.finishRun(tracing.rootRun, {
-                outputs,
-                metadata,
-                ...(options.error
-                    ? { error: options.error }
-                    : options.status === 'error' && options.reason
-                        ? { error: options.reason }
-                        : {}),
-            });
-        }
-        catch (error) {
-            this.logger.warn('Failed to finalize Instance AI message trace root', {
-                runId,
-                threadId: tracing.rootRun.metadata?.thread_id,
-                error: getErrorMessage(error),
-            });
-        }
-        finally {
-            (0, instance_ai_1.releaseTraceClient)(tracing.rootRun.traceId);
-        }
-    }
-    async maybeFinalizeRunTraceRoot(runId, options) {
-        const tracing = this.getTraceContext(runId);
-        if (!tracing)
-            return;
-        await this.finalizeMessageTraceRoot(runId, tracing, options);
-    }
-    buildMessageTraceMetadata(threadId, runId, options) {
-        const traceOptions = {
-            status: options.status,
-            ...(options.cancellationReason !== undefined
-                ? { cancellationReason: options.cancellationReason }
-                : {}),
-            ...(options.runTimeout !== undefined ? { runTimeout: options.runTimeout } : {}),
-        };
-        return {
-            completion_source: 'orchestrator',
-            ...(0, run_trace_metadata_1.buildInstanceAiRunTraceMetadata)(this.eventBus.getEventsForRun(threadId, runId), traceOptions),
-        };
-    }
-    async finalizeRemainingMessageTraceRoots(threadId, options) {
-        const finalizedMessageRuns = new Set();
-        for (const [runId, entry] of this.traceContextsByRunId) {
-            if (entry.threadId !== threadId)
-                continue;
-            if (finalizedMessageRuns.has(entry.tracing.rootRun.id))
-                continue;
-            finalizedMessageRuns.add(entry.tracing.rootRun.id);
-            await this.finalizeMessageTraceRoot(runId, entry.tracing, options);
-        }
-    }
-    deleteTraceContextsForThread(threadId) {
-        for (const [runId, entry] of this.traceContextsByRunId) {
-            if (entry.threadId === threadId) {
-                (0, instance_ai_1.releaseTraceClient)(entry.tracing.rootRun.traceId);
-                if (entry.tracing.traceWriter && entry.traceSlug) {
-                    this.traceReplay.preserveWriterEvents(entry.traceSlug, entry.tracing.traceWriter.getEvents());
-                }
-                this.traceContextsByRunId.delete(runId);
-            }
-        }
-    }
-    deleteTraceContextsForSlug(slug) {
-        for (const [runId, entry] of this.traceContextsByRunId) {
-            if (entry.traceSlug === slug) {
-                (0, instance_ai_1.releaseTraceClient)(entry.tracing.rootRun.traceId);
-                this.traceContextsByRunId.delete(runId);
-            }
-        }
-    }
     clearTraceContextsForTest() {
-        for (const entry of this.traceContextsByRunId.values()) {
-            (0, instance_ai_1.releaseTraceClient)(entry.tracing.rootRun.traceId);
-        }
-        this.traceContextsByRunId.clear();
-    }
-    async finalizeDetachedTraceRun(taskId, traceContext, options) {
-        if (!traceContext)
-            return;
-        try {
-            if (traceContext.actorRun.id !== traceContext.rootRun.id &&
-                traceContext.actorRun.endTime === undefined) {
-                await traceContext.finishRun(traceContext.actorRun, {
-                    outputs: {
-                        status: options.status,
-                        ...options.outputs,
-                    },
-                    metadata: {
-                        final_status: options.status,
-                        ...options.metadata,
-                    },
-                    ...(options.error ? { error: options.error } : {}),
-                });
-            }
-            await traceContext.finishRun(traceContext.rootRun, {
-                outputs: {
-                    status: options.status,
-                    ...options.outputs,
-                },
-                metadata: {
-                    final_status: options.status,
-                    ...options.metadata,
-                },
-                ...(options.error ? { error: options.error } : {}),
-            });
-        }
-        catch (error) {
-            this.logger.warn('Failed to finalize Instance AI detached trace run', {
-                taskId,
-                traceRunId: traceContext.rootRun.id,
-                error: getErrorMessage(error),
-            });
-        }
-        finally {
-            (0, instance_ai_1.releaseTraceClient)(traceContext.rootRun.traceId);
-        }
-    }
-    async finalizeRunTracing(runId, tracing, options) {
-        if (!tracing)
-            return;
-        if (tracing.actorRun.endTime)
-            return;
-        const outputs = options.outputs ?? {
-            status: options.status,
-            runId,
-            ...(options.outputText ? { response: options.outputText } : {}),
-            ...(options.reason ? { reason: options.reason } : {}),
-        };
-        const metadata = {
-            final_status: options.status,
-            ...(options.modelId !== undefined ? { model_id: options.modelId } : {}),
-            ...options.metadata,
-        };
-        try {
-            await tracing.finishRun(tracing.actorRun, {
-                outputs,
-                metadata,
-                ...(options.status === 'error' && options.reason ? { error: options.reason } : {}),
-            });
-        }
-        catch (error) {
-            this.logger.warn('Failed to finalize Instance AI run tracing', {
-                runId,
-                threadId: tracing.actorRun.metadata?.thread_id,
-                error: getErrorMessage(error),
-            });
-        }
-    }
-    async finalizeBackgroundTaskTracing(task, status) {
-        await this.finalizeDetachedTraceRun(task.taskId, task.traceContext, {
-            status,
-            outputs: {
-                taskId: task.taskId,
-                agentId: task.agentId,
-                role: task.role,
-                ...(task.result ? { result: task.result } : {}),
-            },
-            ...(status === 'failed' && task.error ? { error: task.error } : {}),
-            metadata: {
-                ...(task.plannedTaskId ? { planned_task_id: task.plannedTaskId } : {}),
-                ...(task.workItemId ? { work_item_id: task.workItemId } : {}),
-            },
-        });
+        this.tracing.clearTraceContextsForTest();
     }
     async submitLangsmithFeedback(user, threadId, responseId, payload) {
-        const anchor = await this.dbSnapshotStorage.findLangsmithAnchor(threadId, responseId);
-        if (!anchor) {
-            this.logger.debug('No LangSmith anchor for feedback; skipping annotation', {
-                threadId,
-                responseId,
-            });
-            return;
-        }
-        let tracingProxyConfig;
-        if (this.aiService.isProxyEnabled()) {
-            try {
-                const client = await this.aiService.getClient();
-                const baseUrl = client.getApiProxyBaseUrl();
-                const manager = new proxy_token_manager_1.ProxyTokenManager(async () => await client.getBuilderApiProxyToken({ id: user.id }, { userMessageId: (0, nanoid_1.nanoid)() }));
-                tracingProxyConfig = {
-                    apiUrl: baseUrl + '/langsmith',
-                    getAuthHeaders: async () => await manager.getAuthHeaders(),
-                };
-            }
-            catch (error) {
-                this.logger.warn('Failed to build LangSmith proxy config for feedback', {
-                    threadId,
-                    responseId,
-                    error: getErrorMessage(error),
-                });
-                return;
-            }
-        }
-        const key = 'user_score';
-        const feedbackId = (0, uuid_1.v5)(`${key}:${responseId}`, INSTANCE_AI_FEEDBACK_NAMESPACE);
-        try {
-            await (0, instance_ai_1.submitLangsmithUserFeedback)({
-                langsmithRunId: anchor.langsmithRunId,
-                langsmithTraceId: anchor.langsmithTraceId,
-                key,
-                score: payload.rating === 'up' ? 1 : 0,
-                value: payload.rating,
-                comment: payload.comment,
-                feedbackId,
-                sourceInfo: {
-                    thread_id: threadId,
-                    response_id: responseId,
-                    user_id: user.id,
-                    rating: payload.rating,
-                },
-                proxyConfig: tracingProxyConfig,
-            });
-        }
-        catch (error) {
-            this.logger.warn('Failed to submit LangSmith feedback', {
-                threadId,
-                responseId,
-                error: getErrorMessage(error),
-            });
-        }
+        await this.tracing.submitLangsmithFeedback(user, threadId, responseId, payload);
     }
-    startRun(user, threadId, message, attachments, timeZone, pushRef) {
+    startRun(user, threadId, message, attachments, context, timeZone, pushRef) {
         this.liveness.clearThreadState(threadId);
         const { runId, abortController, messageGroupId } = this.runState.startRun({
             threadId,
@@ -875,12 +598,7 @@ let InstanceAiService = class InstanceAiService {
         if (pushRef !== undefined) {
             this.threadPushRef.set(threadId, pushRef);
         }
-        const userMessageId = (0, nanoid_1.nanoid)();
-        this.userMessagePersistenceByRun.set(runId, {
-            userId: user.id,
-            message: { id: userMessageId, text: message },
-        });
-        this.startExecuteRun(user, threadId, runId, message, abortController, attachments, messageGroupId, timeZone);
+        this.startExecuteRun(user, threadId, runId, message, abortController, attachments, context, messageGroupId, timeZone);
         return runId;
     }
     getMessageGroupId(threadId) {
@@ -899,7 +617,7 @@ let InstanceAiService = class InstanceAiService {
         const cancelledTasks = this.backgroundTasks.cancelThread(threadId);
         const user = this.runState.getThreadUser(threadId);
         for (const task of cancelledTasks) {
-            void this.finalizeBackgroundTaskTracing(task, 'cancelled');
+            void this.tracing.finalizeBackgroundTaskTracing(task, 'cancelled');
             this.eventBus.publish(threadId, {
                 type: 'agent-completed',
                 runId: task.runId,
@@ -910,7 +628,7 @@ let InstanceAiService = class InstanceAiService {
                     error: reason === liveness_1.INSTANCE_AI_RUN_TIMEOUT_REASON ? 'Timed out' : 'Cancelled by user',
                 },
             });
-            void this.recordBackgroundTerminalOutcome(task).finally(() => {
+            void this.terminalOutcome.recordBackgroundTerminalOutcome(task).finally(() => {
                 void this.saveAgentTreeSnapshot(threadId, task.runId, this.dbSnapshotStorage, true, task.messageGroupId);
             });
             if (user) {
@@ -941,14 +659,14 @@ let InstanceAiService = class InstanceAiService {
         const task = this.backgroundTasks.cancelTask(threadId, taskId);
         if (!task)
             return;
-        void this.finalizeBackgroundTaskTracing(task, 'cancelled');
+        void this.tracing.finalizeBackgroundTaskTracing(task, 'cancelled');
         this.eventBus.publish(threadId, {
             type: 'agent-completed',
             runId: task.runId,
             agentId: task.agentId,
             payload: { role: task.role, result: '', error: 'Cancelled by user' },
         });
-        void this.recordBackgroundTerminalOutcome(task).finally(() => {
+        void this.terminalOutcome.recordBackgroundTerminalOutcome(task).finally(() => {
             void this.saveAgentTreeSnapshot(threadId, task.runId, this.dbSnapshotStorage, true, task.messageGroupId);
         });
         const user = this.runState.getThreadUser(threadId);
@@ -959,7 +677,7 @@ let InstanceAiService = class InstanceAiService {
     cancelAllBackgroundTasks() {
         const cancelled = this.backgroundTasks.cancelAll();
         for (const task of cancelled) {
-            void this.finalizeBackgroundTaskTracing(task, 'cancelled');
+            void this.tracing.finalizeBackgroundTaskTracing(task, 'cancelled');
         }
         return cancelled.length;
     }
@@ -975,14 +693,14 @@ let InstanceAiService = class InstanceAiService {
         this.eventBus.publish(threadId, {
             type: 'run-start',
             runId,
-            agentId: ORCHESTRATOR_AGENT_ID,
+            agentId: (0, instance_ai_1.orchestratorAgentId)(runId),
             userId: user.id,
             payload: { messageId, messageGroupId },
         });
         this.eventBus.publish(threadId, {
             type: 'text-delta',
             runId,
-            agentId: ORCHESTRATOR_AGENT_ID,
+            agentId: (0, instance_ai_1.orchestratorAgentId)(runId),
             responseId: `test-background-start:${runId}`,
             payload: { text: messageText },
         });
@@ -991,7 +709,7 @@ let InstanceAiService = class InstanceAiService {
             runId,
             agentId,
             payload: {
-                parentId: ORCHESTRATOR_AGENT_ID,
+                parentId: (0, instance_ai_1.orchestratorAgentId)(runId),
                 role: 'workflow-builder',
                 tools: [],
                 taskId,
@@ -1037,7 +755,7 @@ let InstanceAiService = class InstanceAiService {
                 });
             },
             onSettled: async (task) => {
-                await this.recordBackgroundTerminalOutcome(task);
+                await this.terminalOutcome.recordBackgroundTerminalOutcome(task);
                 await this.saveAgentTreeSnapshot(threadId, runId, this.dbSnapshotStorage, true, messageGroupId);
             },
         });
@@ -1048,7 +766,7 @@ let InstanceAiService = class InstanceAiService {
         this.eventBus.publish(threadId, {
             type: 'run-finish',
             runId,
-            agentId: ORCHESTRATOR_AGENT_ID,
+            agentId: (0, instance_ai_1.orchestratorAgentId)(runId),
             userId: user.id,
             payload: { status: 'completed' },
         });
@@ -1065,13 +783,13 @@ let InstanceAiService = class InstanceAiService {
         await this.liveness.sweepTimedOutWork(now);
     }
     loadTraceEvents(slug, events) {
-        this.traceReplay.loadEvents(slug, events);
+        this.tracing.loadTraceEvents(slug, events);
     }
     getTraceEvents(slug) {
-        return this.traceReplay.getEventsWithWriterFallback(slug, this.traceContextsByRunId.values());
+        return this.tracing.getTraceEvents(slug);
     }
     hasRunningWorkForTest() {
-        const threadIds = new Set([...this.traceContextsByRunId.values()].map((entry) => entry.threadId));
+        const threadIds = new Set(this.tracing.getTrackedThreadIds());
         for (const threadId of threadIds) {
             if (this.runState.getActiveRunId(threadId))
                 return true;
@@ -1081,34 +799,33 @@ let InstanceAiService = class InstanceAiService {
         return false;
     }
     activateTraceSlug(slug) {
-        this.traceReplay.activateSlug(slug);
+        this.tracing.activateTraceSlug(slug);
     }
     clearTraceEvents(slug) {
-        this.deleteTraceContextsForSlug(slug);
-        this.traceReplay.clearEvents(slug);
+        this.tracing.clearTraceEvents(slug);
     }
     async clearThreadState(threadId) {
         this.liveness.clearThreadState(threadId);
         const { active, suspended } = this.runState.clearThread(threadId);
         if (active) {
             active.abortController.abort();
-            await this.finalizeRunTracing(active.runId, active.tracing, {
+            await this.tracing.finalizeRunTracing(active.runId, active.tracing, {
                 status: 'cancelled',
                 reason: 'thread_cleared',
             });
         }
         if (suspended) {
             suspended.abortController.abort();
-            await this.finalizeRunTracing(suspended.runId, suspended.tracing, {
+            await this.tracing.finalizeRunTracing(suspended.runId, suspended.tracing, {
                 status: 'cancelled',
                 reason: 'thread_cleared',
             });
         }
         for (const task of this.backgroundTasks.cancelThread(threadId)) {
             task.abortController.abort();
-            await this.finalizeBackgroundTaskTracing(task, 'cancelled');
+            await this.tracing.finalizeBackgroundTaskTracing(task, 'cancelled');
         }
-        await this.finalizeRemainingMessageTraceRoots(threadId, {
+        await this.tracing.finalizeRemainingMessageTraceRoots(threadId, {
             status: 'cancelled',
             reason: 'thread_cleared',
             metadata: { completion_source: 'service_cleanup' },
@@ -1119,7 +836,7 @@ let InstanceAiService = class InstanceAiService {
         this.threadPushRef.delete(threadId);
         this.planRequestsByThread.delete(threadId);
         this.memoryTaskRegistry.clearThread(threadId);
-        this.deleteTraceContextsForThread(threadId);
+        this.tracing.deleteTraceContextsForThread(threadId);
         await this.sandboxService.destroySandbox(threadId);
         await this.temporaryWorkflowService.reapForThreadCleanup(threadId);
         await this.suspendedThreads.dropPendingConfirmationsForThread(threadId);
@@ -1132,7 +849,7 @@ let InstanceAiService = class InstanceAiService {
         const threadsWithPendingHitl = new Set(pendingThreadIds);
         for (const run of activeRuns) {
             if (threadsWithPendingHitl.has(run.threadId)) {
-                await this.finalizeRunTracing(run.runId, run.tracing, {
+                await this.tracing.finalizeRunTracing(run.runId, run.tracing, {
                     status: 'cancelled',
                     reason: 'service_shutdown',
                 });
@@ -1142,14 +859,14 @@ let InstanceAiService = class InstanceAiService {
             }
             this.publishRunFinish(run.threadId, run.runId, 'cancelled', 'service_shutdown');
             await this.persistShutdownSnapshot(run.threadId, run.runId, run.messageGroupId);
-            await this.finalizeRunTracing(run.runId, run.tracing, {
+            await this.tracing.finalizeRunTracing(run.runId, run.tracing, {
                 status: 'cancelled',
                 reason: 'service_shutdown',
             });
             run.abortController.abort();
         }
         for (const run of suspendedRuns) {
-            await this.finalizeRunTracing(run.runId, run.tracing, {
+            await this.tracing.finalizeRunTracing(run.runId, run.tracing, {
                 status: 'cancelled',
                 reason: 'service_shutdown',
             });
@@ -1157,21 +874,22 @@ let InstanceAiService = class InstanceAiService {
         }
         for (const task of this.backgroundTasks.cancelAll()) {
             task.abortController.abort();
-            await this.finalizeBackgroundTaskTracing(task, 'cancelled');
+            await this.tracing.finalizeBackgroundTaskTracing(task, 'cancelled');
         }
         await this.drainInFlightExecutions(INSTANCE_AI_SHUTDOWN_DRAIN_TIMEOUT_MS);
-        const threadsWithTraces = new Set([...this.traceContextsByRunId.values()].map((entry) => entry.threadId));
+        const threadsWithTraces = new Set(this.tracing.getTrackedThreadIds());
         for (const threadId of threadsWithTraces) {
-            await this.finalizeRemainingMessageTraceRoots(threadId, {
+            await this.tracing.finalizeRemainingMessageTraceRoots(threadId, {
                 status: 'cancelled',
                 reason: 'service_shutdown',
                 metadata: { completion_source: 'service_cleanup' },
             });
         }
         this.gatewayService.disconnectAll();
+        await this.browserSessionService.shutdown();
         this.sandboxService.stopSandboxExpiryTimers();
         this.domainAccessTrackersByThread.clear();
-        this.traceContextsByRunId.clear();
+        this.tracing.clear();
         this.eventBus.clear();
         await this._mcpClientManager?.disconnect();
         this.logger.debug('Instance AI service shut down');
@@ -1210,14 +928,6 @@ let InstanceAiService = class InstanceAiService {
     shouldPreserveHitlOnShutdown(runId) {
         return this.preserveHitlOnShutdown.has(runId);
     }
-    async persistUserMessageOnFirstSuspend(threadId, runId) {
-        const entry = this.userMessagePersistenceByRun.get(runId);
-        if (!entry)
-            return;
-        const ok = await this.suspendedThreads.persistUserMessageOnSuspend(threadId, entry.userId, entry.message);
-        if (ok)
-            this.userMessagePersistenceByRun.delete(runId);
-    }
     async drainInFlightExecutions(timeoutMs) {
         if (this.inFlightExecutions.size === 0)
             return;
@@ -1302,6 +1012,7 @@ let InstanceAiService = class InstanceAiService {
                 await sync();
             },
             getBuildOutcome: async (workItemId) => await workflowTasks.getBuildOutcome(workItemId),
+            getLatestBuildOutcomeForWorkflow: async (workflowId) => await workflowTasks.getLatestBuildOutcomeForWorkflow(workflowId),
             getWorkflowLoopState: async (workItemId) => await workflowTasks.getWorkflowLoopState(workItemId),
         };
     }
@@ -1401,293 +1112,8 @@ let InstanceAiService = class InstanceAiService {
         const plannedTaskService = new instance_ai_1.PlannedTaskCoordinator(plannedTaskStorage);
         return { memory, taskStorage, plannedTaskService };
     }
-    evaluateTerminalResponse(threadId, runId, status, options = {}) {
-        const guard = new instance_ai_1.InstanceAiTerminalResponseGuard({
-            runId,
-            rootAgentId: ORCHESTRATOR_AGENT_ID,
-            messageGroupId: options.messageGroupId,
-            correlationId: options.correlationId,
-        });
-        const decision = guard.evaluateTerminal(this.getTerminalGuardEvents(threadId, runId, options.messageGroupId), status, {
-            workSummary: options.workSummary,
-            errorMessage: options.errorMessage,
-            suppressCompletedFallback: options.suppressCompletedFallback,
-        });
-        this.handleTerminalResponseDecision(threadId, runId, decision, options.messageGroupId);
-        return decision;
-    }
-    evaluateWaitingResponse(threadId, runId, confirmationEvent, options = {}) {
-        const guard = new instance_ai_1.InstanceAiTerminalResponseGuard({
-            runId,
-            rootAgentId: ORCHESTRATOR_AGENT_ID,
-            messageGroupId: options.messageGroupId,
-            correlationId: options.correlationId,
-        });
-        const decision = guard.evaluateWaiting(this.getTerminalGuardEvents(threadId, runId, options.messageGroupId), confirmationEvent);
-        this.handleTerminalResponseDecision(threadId, runId, decision, options.messageGroupId);
-        return decision;
-    }
-    getTerminalGuardEvents(threadId, runId, messageGroupId) {
-        if (!messageGroupId)
-            return this.eventBus.getEventsForRun(threadId, runId);
-        const groupRunIds = this.getRunIdsForMessageGroup(messageGroupId);
-        return groupRunIds.length > 0
-            ? this.eventBus.getEventsForRuns(threadId, groupRunIds)
-            : this.eventBus.getEventsForRun(threadId, runId);
-    }
-    handleTerminalResponseDecision(threadId, runId, decision, messageGroupId) {
-        this.telemetry.track('instance_ai_terminal_response_decision', {
-            thread_id: threadId,
-            run_id: runId,
-            message_group_id: messageGroupId,
-            source: 'terminal_guard',
-            status: decision.status,
-            action: decision.action,
-            reason: decision.reason,
-            visibility_source: decision.visibilitySource,
-        });
-        if (decision.reason === 'completed-after-error') {
-            this.logger.warn('completed_after_error_event', {
-                threadId,
-                runId,
-                messageGroupId,
-            });
-        }
-        if (decision.reason === 'confirmation-invalid') {
-            this.logger.warn('invalid_confirmation_payload', {
-                threadId,
-                runId,
-                messageGroupId,
-            });
-        }
-        if (decision.action === 'emit' && decision.event) {
-            this.eventBus.publish(threadId, decision.event);
-        }
-    }
-    createTerminalOutcomeStorage() {
-        this.terminalOutcomeStorage ??= new instance_ai_1.TerminalOutcomeStorage(this.agentMemory);
-        return this.terminalOutcomeStorage;
-    }
-    async finishInvalidConfirmationRun(args) {
-        this.runState.cancelThread(args.threadId);
-        void this.suspendedThreads.dropPendingConfirmationsForThread(args.threadId);
-        args.abortController.abort();
-        await this.finalizeRunTracing(args.runId, args.tracing, {
-            status: 'error',
-            reason: 'invalid_confirmation_payload',
-        });
-        this.publishRunFinish(args.threadId, args.runId, 'errored', 'I need your input to continue, but I could not display the prompt. Please try again.');
-        await this.saveAgentTreeSnapshot(args.threadId, args.runId, args.snapshotStorage);
-        return {
-            status: 'error',
-            reason: 'invalid_confirmation_payload',
-            metadata: this.buildMessageTraceMetadata(args.threadId, args.runId, {
-                status: 'error',
-            }),
-        };
-    }
-    buildBackgroundTerminalOutcome(task) {
-        const status = task.status === 'failed' ? 'failed' : task.status === 'cancelled' ? 'cancelled' : 'completed';
-        const userFacingMessage = status === 'completed'
-            ? `The background ${task.role} task finished.`
-            : status === 'cancelled'
-                ? `The background ${task.role} task was cancelled.`
-                : `The background ${task.role} task failed before I could complete that part.`;
-        return {
-            id: `${task.messageGroupId ?? task.runId}:${task.taskId}:${status}`,
-            threadId: task.threadId,
-            runId: task.runId,
-            messageGroupId: task.messageGroupId,
-            correlationId: task.messageGroupId,
-            taskId: task.taskId,
-            agentId: task.agentId,
-            status,
-            userFacingMessage,
-            createdAt: new Date().toISOString(),
-        };
-    }
     async replayUndeliveredTerminalOutcomes(threadId, options = {}) {
-        const storage = this.createTerminalOutcomeStorage();
-        const persistedOutcomes = await storage.getUndelivered(threadId).catch((error) => {
-            this.logger.warn('Failed to load undelivered Instance AI terminal outcomes', {
-                threadId,
-                error: getErrorMessage(error),
-            });
-            return [];
-        });
-        const inMemoryOutcomes = [...this.pendingTerminalOutcomes.values()].filter((outcome) => outcome.threadId === threadId);
-        const outcomes = new Map();
-        for (const outcome of [...persistedOutcomes, ...inMemoryOutcomes]) {
-            outcomes.set(outcome.id, outcome);
-        }
-        const persistedOutcomeIds = new Set(persistedOutcomes.map((outcome) => outcome.id));
-        const delivery = options.delivery ?? 'snapshot';
-        for (const outcome of outcomes.values()) {
-            const responseId = getBackgroundOutcomeResponseId(outcome);
-            let snapshotDelivered = false;
-            try {
-                snapshotDelivered = await this.persistTerminalOutcomeLineToSnapshot(outcome, responseId);
-            }
-            catch (error) {
-                this.logger.warn('Failed to replay Instance AI terminal outcome', {
-                    threadId,
-                    runId: outcome.runId,
-                    taskId: outcome.taskId,
-                    error: getErrorMessage(error),
-                });
-                if (delivery === 'event') {
-                    const published = this.publishTerminalOutcomeLine(outcome, responseId);
-                    this.telemetry.track('instance_ai_terminal_response_decision', {
-                        thread_id: threadId,
-                        run_id: outcome.runId,
-                        message_group_id: outcome.messageGroupId,
-                        task_id: outcome.taskId,
-                        source: 'terminal_outcome_replay',
-                        status: outcome.status,
-                        action: published ? 'replay_event' : 'already-emitted',
-                        visibility_source: 'background-outcome',
-                    });
-                }
-                continue;
-            }
-            if (!snapshotDelivered)
-                continue;
-            let action = 'replay_snapshot';
-            if (delivery === 'event') {
-                const published = this.publishTerminalOutcomeLine(outcome, responseId);
-                action = published ? 'replay_event' : 'already-emitted';
-            }
-            if (persistedOutcomeIds.has(outcome.id)) {
-                await storage
-                    .markDelivered(threadId, outcome.id, new Date().toISOString())
-                    .catch((error) => {
-                    this.logger.warn('Failed to mark Instance AI terminal outcome as delivered', {
-                        threadId,
-                        runId: outcome.runId,
-                        taskId: outcome.taskId,
-                        error: getErrorMessage(error),
-                    });
-                });
-            }
-            this.pendingTerminalOutcomes.delete(outcome.id);
-            this.telemetry.track('instance_ai_terminal_response_decision', {
-                thread_id: threadId,
-                run_id: outcome.runId,
-                message_group_id: outcome.messageGroupId,
-                task_id: outcome.taskId,
-                source: 'terminal_outcome_replay',
-                status: outcome.status,
-                action,
-                visibility_source: 'background-outcome',
-            });
-        }
-    }
-    async persistTerminalOutcomeLineToSnapshot(outcome, responseId) {
-        const snapshot = await this.dbSnapshotStorage.getLatest(outcome.threadId, {
-            messageGroupId: outcome.messageGroupId,
-            runId: outcome.runId,
-        });
-        if (!snapshot) {
-            await this.dbSnapshotStorage.save(outcome.threadId, createTerminalOutcomeAgentTree(outcome, responseId), outcome.runId, {
-                messageGroupId: outcome.messageGroupId,
-                runIds: [outcome.runId],
-            });
-            return true;
-        }
-        const { tree } = appendTerminalOutcomeToAgentTree(snapshot.tree, outcome, responseId);
-        const runIds = new Set(snapshot.runIds ?? [snapshot.runId]);
-        runIds.add(outcome.runId);
-        await this.dbSnapshotStorage.updateLast(outcome.threadId, tree, snapshot.runId, {
-            messageGroupId: snapshot.messageGroupId ?? outcome.messageGroupId,
-            runIds: [...runIds],
-            langsmithRunId: snapshot.langsmithRunId,
-            langsmithTraceId: snapshot.langsmithTraceId,
-        });
-        return true;
-    }
-    publishTerminalOutcomeLine(outcome, responseId) {
-        const alreadyPublished = this.eventBus
-            .getEventsForRun(outcome.threadId, outcome.runId)
-            .some((event) => event.responseId === responseId);
-        if (alreadyPublished)
-            return false;
-        this.eventBus.publish(outcome.threadId, {
-            type: 'text-delta',
-            runId: outcome.runId,
-            agentId: ORCHESTRATOR_AGENT_ID,
-            responseId,
-            payload: { text: outcome.userFacingMessage },
-        });
-        return true;
-    }
-    async recordBackgroundTerminalOutcome(task) {
-        const outcome = this.buildBackgroundTerminalOutcome(task);
-        let persisted = false;
-        try {
-            await this.createTerminalOutcomeStorage().upsert(task.threadId, outcome);
-            persisted = true;
-        }
-        catch (error) {
-            this.pendingTerminalOutcomes.set(outcome.id, outcome);
-            this.logger.warn('Failed to persist Instance AI terminal outcome', {
-                threadId: task.threadId,
-                runId: task.runId,
-                taskId: task.taskId,
-                error: getErrorMessage(error),
-            });
-            this.telemetry.track('instance_ai_terminal_outcome_persistence_failure', {
-                thread_id: task.threadId,
-                run_id: task.runId,
-                task_id: task.taskId,
-                status: outcome.status,
-                phase: 'metadata',
-            });
-        }
-        const responseId = getBackgroundOutcomeResponseId(outcome);
-        const published = this.publishTerminalOutcomeLine(outcome, responseId);
-        this.telemetry.track('instance_ai_terminal_response_decision', {
-            thread_id: task.threadId,
-            run_id: task.runId,
-            message_group_id: task.messageGroupId,
-            task_id: task.taskId,
-            source: 'background_outcome',
-            status: outcome.status,
-            action: published ? 'emit' : 'already-emitted',
-            visibility_source: 'background-outcome',
-        });
-        let snapshotDelivered = false;
-        try {
-            snapshotDelivered = await this.persistTerminalOutcomeLineToSnapshot(outcome, responseId);
-        }
-        catch (error) {
-            this.logger.warn('Failed to persist Instance AI terminal outcome line to snapshot', {
-                threadId: task.threadId,
-                runId: task.runId,
-                taskId: task.taskId,
-                error: getErrorMessage(error),
-            });
-            this.telemetry.track('instance_ai_terminal_outcome_persistence_failure', {
-                thread_id: task.threadId,
-                run_id: task.runId,
-                task_id: task.taskId,
-                status: outcome.status,
-                phase: 'snapshot',
-            });
-        }
-        if (!persisted || !snapshotDelivered)
-            return;
-        try {
-            await this.createTerminalOutcomeStorage().markDelivered(task.threadId, outcome.id, new Date().toISOString());
-            this.pendingTerminalOutcomes.delete(outcome.id);
-        }
-        catch (error) {
-            this.logger.warn('Failed to mark Instance AI terminal outcome as delivered', {
-                threadId: task.threadId,
-                runId: task.runId,
-                taskId: task.taskId,
-                error: getErrorMessage(error),
-            });
-        }
+        await this.terminalOutcome.replayUndeliveredTerminalOutcomes(threadId, options);
     }
     async syncPlannedTasksToUi(threadId, graph) {
         const { taskStorage } = await this.createPlannedTaskState();
@@ -1696,7 +1122,7 @@ let InstanceAiService = class InstanceAiService {
         this.eventBus.publish(threadId, {
             type: 'tasks-update',
             runId: graph.planRunId,
-            agentId: ORCHESTRATOR_AGENT_ID,
+            agentId: (0, instance_ai_1.orchestratorAgentId)(graph.planRunId),
             payload: { tasks },
         });
     }
@@ -1711,7 +1137,7 @@ let InstanceAiService = class InstanceAiService {
             this.eventBus.publish(threadId, {
                 type: 'tasks-update',
                 runId: graph.planRunId,
-                agentId: ORCHESTRATOR_AGENT_ID,
+                agentId: (0, instance_ai_1.orchestratorAgentId)(graph.planRunId),
                 payload: { tasks: { tasks: [] }, planItems: [] },
             });
         }
@@ -1730,6 +1156,7 @@ let InstanceAiService = class InstanceAiService {
         }
         const adminSettings = this.settingsService.getAdminSettings();
         const localGatewayDisabledGlobally = adminSettings.localGatewayDisabled;
+        const browserUseEnabledGlobally = adminSettings.browserUseEnabled;
         const localGatewayDisabledForUser = await this.settingsService.isLocalGatewayDisabledForUser(user.id);
         const userGateway = this.gatewayService.findGateway(user.id);
         const { searchProxyConfig, tracingProxyConfig, tokenManager, proxyBaseUrl } = proxyRunConfig ?? (await this.createProxyRunConfig(user));
@@ -1740,8 +1167,14 @@ let InstanceAiService = class InstanceAiService {
             projectId: boundProjectId,
             credentialIdAllowlist: this.evalCredentialAllowlists.get(threadId),
         });
-        if (!localGatewayDisabledForUser && userGateway?.isConnected) {
-            context.localMcpServer = userGateway;
+        this.gatewayService.applyToolPolicy(user.id);
+        const gatewayMcpServer = !localGatewayDisabledForUser && userGateway?.isConnected ? userGateway : undefined;
+        const browserMcpServer = browserUseEnabledGlobally
+            ? this.browserSessionService.findMcpServer(user.id)
+            : undefined;
+        const localMcpServer = (0, composite_local_mcp_server_1.composeLocalMcpServers)(gatewayMcpServer, browserMcpServer);
+        if (localMcpServer) {
+            context.localMcpServer = localMcpServer;
         }
         context.permissions = this.settingsService.getPermissions();
         if (this.sourceControlPreferencesService.getPreferences().branchReadOnly) {
@@ -1767,18 +1200,31 @@ let InstanceAiService = class InstanceAiService {
                 this.runDebugBuffer.recordWorkflowCode(runId, snapshot);
             };
         }
-        if (localGatewayDisabledGlobally) {
-            context.localGatewayStatus = { status: 'disabledGlobally' };
-        }
-        else if (!localGatewayDisabledForUser && userGateway?.isConnected) {
+        browserMcpServer?.setDomainGate({
+            tracker: domainTracker,
+            runId,
+            permissionMode: context.permissions?.fetchUrl,
+        });
+        if (gatewayMcpServer || browserMcpServer) {
+            const capabilities = new Set();
+            if (gatewayMcpServer) {
+                for (const { name, enabled } of gatewayMcpServer.getStatus().toolCategories) {
+                    if (enabled) {
+                        capabilities.add(name);
+                    }
+                }
+            }
+            if (browserMcpServer) {
+                capabilities.add(instance_ai_gateway_service_1.BROWSER_TOOL_CATEGORY);
+            }
             context.localGatewayStatus = {
                 status: 'connected',
-                capabilities: userGateway
-                    .getStatus()
-                    .toolCategories.filter(({ enabled }) => enabled)
-                    .map(({ name }) => name),
+                capabilities: [...capabilities],
             };
         }
+        else if (localGatewayDisabledGlobally && !browserUseEnabledGlobally) {
+            context.localGatewayStatus = { status: 'disabledGlobally' };
+        }
         else {
             context.localGatewayStatus = {
                 status: localGatewayDisabledForUser ? 'disabled' : 'disconnected',
@@ -1854,7 +1300,7 @@ let InstanceAiService = class InstanceAiService {
             messageGroupId,
             userId: user.id,
             projectId: boundProjectId,
-            orchestratorAgentId: ORCHESTRATOR_AGENT_ID,
+            orchestratorAgentId: (0, instance_ai_1.orchestratorAgentId)(runId),
             modelId,
             checkpointStore: this.checkpointStore,
             subAgentMaxSteps: this.instanceAiConfig.subAgentMaxSteps,
@@ -1876,7 +1322,6 @@ let InstanceAiService = class InstanceAiService {
             formBaseUrl: this.formBaseUrl,
             waitForConfirmation: async (requestId) => {
                 this.runState.touchActiveRun(threadId);
-                void this.persistUserMessageOnFirstSuspend(threadId, runId);
                 return await new Promise((resolve) => {
                     this.runState.registerPendingConfirmation(requestId, {
                         resolve,
@@ -1905,9 +1350,6 @@ let InstanceAiService = class InstanceAiService {
             schedulePlannedTasks: async () => await this.schedulePlannedTasks(user, threadId),
             iterationLog,
             sendCorrectionToTask: (taskId, correction) => this.sendCorrectionToTask(threadId, taskId, correction),
-            persistInFlightUserMessage: async () => {
-                await this.persistUserMessageOnFirstSuspend(threadId, runId);
-            },
             workflowTaskService: workflowTasks,
             workspace: runtimeWorkspace,
             workspaceRoot,
@@ -2029,7 +1471,7 @@ let InstanceAiService = class InstanceAiService {
                 }
                 this.collectWorkflowIds(task.outcome, ids);
             }
-            const tracing = this.getTraceContextForContinuation(threadId);
+            const tracing = this.tracing.getTraceContextForContinuation(threadId);
             for (const workflowId of [...ids]) {
                 const remappedWorkflowId = tracing?.idRemapper?.remapOutput(workflowId);
                 if (typeof remappedWorkflowId === 'string' && remappedWorkflowId.length > 0) {
@@ -2122,6 +1564,55 @@ let InstanceAiService = class InstanceAiService {
         };
         return `<workflow-setup-required>\n${JSON.stringify(payload, null, 2)}\n</workflow-setup-required>\n\n${internal_messages_1.AUTO_FOLLOW_UP_MESSAGE}`;
     }
+    getWorkflowSetupSuspensionWorkflowId(toolName, suspendPayload) {
+        if (toolName !== 'workflows' || !suspendPayload)
+            return undefined;
+        if (!Array.isArray(suspendPayload.setupRequests))
+            return undefined;
+        return typeof suspendPayload.workflowId === 'string' ? suspendPayload.workflowId : undefined;
+    }
+    async markWorkflowSetupHandled(threadId, workflowId, runId) {
+        const records = await this.listWorkflowLoopRecords(threadId);
+        if (records.length === 0)
+            return false;
+        const candidates = [];
+        for (const record of records) {
+            if (record.state.setupRoutedAt)
+                continue;
+            if (this.workflowObligations.isPlannedRecord(record))
+                continue;
+            const obligation = this.workflowObligations.obligationFromRecord(threadId, record, {
+                source: 'direct',
+            });
+            if (obligation.workflowId !== workflowId)
+                continue;
+            if (obligation.setupRequirement?.status !== 'required')
+                continue;
+            candidates.push({ record, obligation });
+        }
+        const sameRunCandidates = runId
+            ? candidates.filter(({ obligation, record }) => obligation.runId === runId || record.state.runId === runId)
+            : [];
+        const fallbackCandidates = candidates.filter((candidate) => !sameRunCandidates.includes(candidate));
+        for (const { record, obligation } of [...sameRunCandidates, ...fallbackCandidates]) {
+            const claim = await this.claimWorkItemSetupRouting(threadId, record);
+            if (!claim)
+                continue;
+            const marked = await this.markWorkItemSetupRouted(threadId, record.state.workItemId, claim.claimId);
+            if (!marked) {
+                await this.releaseWorkItemSetupRoutingClaim(threadId, record.state.workItemId, claim.claimId);
+                this.logger.warn('Workflow setup completed but routing marker was not saved', {
+                    threadId,
+                    workItemId: record.state.workItemId,
+                    workflowId,
+                });
+                continue;
+            }
+            this.trackWorkflowVerificationObligation(obligation, 'setup_completed_by_tool');
+            return true;
+        }
+        return false;
+    }
     async maybeStartWorkflowSetupFollowUp(user, threadId) {
         const records = await this.listWorkflowLoopRecords(threadId);
         if (records.length === 0)
@@ -2201,7 +1692,7 @@ let InstanceAiService = class InstanceAiService {
                 : isReplanFollowUp
                     ? 'replan'
                     : 'background_task_completed');
-        this.startExecuteRun(user, threadId, runId, message, abortController, undefined, messageGroupId, timeZone, isReplanFollowUp, checkpoint, resumeReason, plannedBuild);
+        this.startExecuteRun(user, threadId, runId, message, abortController, undefined, undefined, messageGroupId, timeZone, isReplanFollowUp, checkpoint, resumeReason, plannedBuild);
         return runId;
     }
     async schedulePlannedTasks(user, threadId) {
@@ -2291,7 +1782,7 @@ let InstanceAiService = class InstanceAiService {
     }
     async createPlannedTaskDispatchContext(user, threadId, graph) {
         const environment = await this.createExecutionEnvironment(user, threadId, graph.planRunId, createInertAbortSignal(), graph.messageGroupId, this.threadPushRef.get(threadId));
-        environment.orchestrationContext.tracing = this.getTraceContext(graph.planRunId);
+        environment.orchestrationContext.tracing = this.tracing.getTraceContext(graph.planRunId);
         return environment.orchestrationContext;
     }
     async doSchedulePlannedTasks(user, threadId) {
@@ -2326,8 +1817,7 @@ let InstanceAiService = class InstanceAiService {
                 return;
         }
     }
-    async executeRun(user, threadId, runId, message, abortController, attachments, messageGroupId, timeZone, isReplanFollowUp = false, checkpoint, resumeReason, plannedBuild) {
-        const userMessagePersistence = this.userMessagePersistenceByRun.get(runId)?.message;
+    async executeRun(user, threadId, runId, message, abortController, attachments, handoffContext, messageGroupId, timeZone, isReplanFollowUp = false, checkpoint, resumeReason, plannedBuild) {
         const fileAttachments = (attachments ?? []).filter((attachment) => attachment.type === 'file');
         const workflowAttachments = (attachments ?? []).filter((attachment) => attachment.type === 'workflow');
         const signal = abortController.signal;
@@ -2352,7 +1842,7 @@ let InstanceAiService = class InstanceAiService {
             };
             const proxyRunConfig = await this.createProxyRunConfig(user);
             if (resumeReason) {
-                tracing = await this.createOrchestratorResumeTraceContext({
+                tracing = await this.tracing.createOrchestratorResumeTraceContext({
                     threadId,
                     messageId,
                     messageGroupId,
@@ -2390,19 +1880,19 @@ let InstanceAiService = class InstanceAiService {
             this.eventBus.publish(threadId, {
                 type: 'run-start',
                 runId,
-                agentId: ORCHESTRATOR_AGENT_ID,
+                agentId: (0, instance_ai_1.orchestratorAgentId)(runId),
                 userId: user.id,
                 payload: { messageId, messageGroupId, ...(traceId ? { traceId } : {}) },
             });
             if (signal.aborted) {
-                this.evaluateTerminalResponse(threadId, runId, 'cancelled', {
+                this.terminalOutcome.evaluateTerminalResponse(threadId, runId, 'cancelled', {
                     messageGroupId,
                     correlationId: messageId,
                 });
                 this.eventBus.publish(threadId, {
                     type: 'run-finish',
                     runId,
-                    agentId: ORCHESTRATOR_AGENT_ID,
+                    agentId: (0, instance_ai_1.orchestratorAgentId)(runId),
                     payload: { status: 'cancelled', reason: 'user_cancelled' },
                 });
                 return;
@@ -2413,7 +1903,7 @@ let InstanceAiService = class InstanceAiService {
                     threadId,
                     runId,
                     tracing,
-                    agentId: ORCHESTRATOR_AGENT_ID,
+                    agentId: (0, instance_ai_1.orchestratorAgentId)(runId),
                     userId: user.id,
                     messageGroupId,
                     messageId,
@@ -2480,10 +1970,10 @@ let InstanceAiService = class InstanceAiService {
             }
             if (tracing) {
                 orchestrationContext.tracing = tracing;
-                if (this.getTraceContext(runId) !== tracing) {
-                    await this.configureTraceReplayMode(tracing);
+                if (this.tracing.getTraceContext(runId) !== tracing) {
+                    await this.tracing.configureTraceReplayMode(tracing);
                     this.runState.attachTracing(threadId, tracing);
-                    this.storeTraceContext(runId, threadId, tracing, messageGroupId);
+                    this.tracing.storeTraceContext(runId, threadId, tracing, messageGroupId);
                 }
             }
             const thread = await memory.getThread(threadId);
@@ -2504,12 +1994,13 @@ let InstanceAiService = class InstanceAiService {
                 this.eventBus.publish(threadId, {
                     type: 'tasks-update',
                     runId,
-                    agentId: ORCHESTRATOR_AGENT_ID,
+                    agentId: (0, instance_ai_1.orchestratorAgentId)(runId),
                     payload: { tasks: existingTasks },
                 });
             }
             const enrichedMessage = await this.buildMessageWithRunningTasks(threadId, message);
             const contextResourcesBlock = buildContextResourcesBlock(workflowAttachments);
+            const handoffContextBlock = buildHandoffContextBlock(handoffContext);
             let nonStructuredAttachments = [];
             let attachmentManifest = '';
             let hasParseableAttachment = false;
@@ -2524,7 +2015,9 @@ let InstanceAiService = class InstanceAiService {
                 : attachmentManifest
                     ? `${enrichedMessage}\n\n${attachmentManifest}`
                     : enrichedMessage;
-            const messageWithContext = [contextResourcesBlock, messageBody].filter(Boolean).join('\n\n');
+            const messageWithContext = [contextResourcesBlock, handoffContextBlock, messageBody]
+                .filter(Boolean)
+                .join('\n\n');
             const fullMessage = (0, internal_messages_1.withCurrentDateTime)(messageWithContext, (0, instance_ai_1.getDateTimeSection)(timeZone ?? this.defaultTimeZone));
             const promptBuildRun = tracing
                 ? await tracing.startChildRun(tracing.messageRun, {
@@ -2540,7 +2033,7 @@ let InstanceAiService = class InstanceAiService {
                 : undefined;
             let streamInput;
             try {
-                if (nonStructuredAttachments.length > 0 || userMessagePersistence) {
+                if (nonStructuredAttachments.length > 0) {
                     const baseContent = [
                         { type: 'text', text: fullMessage },
                         ...nonStructuredAttachments.map((attachment) => ({
@@ -2551,7 +2044,6 @@ let InstanceAiService = class InstanceAiService {
                     ];
                     streamInput = [
                         {
-                            ...(userMessagePersistence ? { id: userMessagePersistence.id } : {}),
                             role: 'user',
                             content: baseContent,
                         },
@@ -2589,7 +2081,7 @@ let InstanceAiService = class InstanceAiService {
                     tags: ['orchestrator'],
                     metadata: {
                         agent_role: 'orchestrator',
-                        agent_id: ORCHESTRATOR_AGENT_ID,
+                        agent_id: (0, instance_ai_1.orchestratorAgentId)(runId),
                         execution_mode: 'foreground',
                         trace_kind: tracing.traceKind,
                     },
@@ -2598,6 +2090,8 @@ let InstanceAiService = class InstanceAiService {
                 tracing.actorRun = actorRun;
                 tracing.orchestratorRun = actorRun;
             }
+            const runControl = (0, instance_ai_1.createOrchestratorRunControl)(orchestrationContext);
+            const stopSignal = () => runControl.getStopSignal();
             const agent = await (0, instance_ai_1.createInstanceAgent)({
                 modelId,
                 context,
@@ -2610,28 +2104,31 @@ let InstanceAiService = class InstanceAiService {
                 onMemoryTaskEvent: this.memoryTaskObserverFor(threadId),
                 thinkingEnabled: this.instanceAiConfig.thinkingEnabled,
             });
+            this.subscribeToAgentErrors(agent, threadId, runId);
             const streamOptions = this.buildOrchestratorAgentStreamOptions(user, threadId, runId, signal);
             const result = tracing
                 ? await tracing.withActiveSpan(tracing.actorRun, async () => {
                     return await (0, instance_ai_1.streamAgentRun)(agent, streamInput, streamOptions, {
                         threadId,
                         runId,
-                        agentId: ORCHESTRATOR_AGENT_ID,
+                        agentId: (0, instance_ai_1.orchestratorAgentId)(runId),
                         signal,
                         eventBus: this.eventBus,
                         logger: this.logger,
                         onActivity: () => this.runState.touchActiveRun(threadId),
+                        stopSignal,
                         outputRedaction: (0, output_redaction_config_1.resolveOutputRedaction)(this.instanceAiConfig),
                     });
                 })
                 : await (0, instance_ai_1.streamAgentRun)(agent, streamInput, streamOptions, {
                     threadId,
                     runId,
-                    agentId: ORCHESTRATOR_AGENT_ID,
+                    agentId: (0, instance_ai_1.orchestratorAgentId)(runId),
                     signal,
                     eventBus: this.eventBus,
                     logger: this.logger,
                     onActivity: () => this.runState.touchActiveRun(threadId),
+                    stopSignal,
                     outputRedaction: (0, output_redaction_config_1.resolveOutputRedaction)(this.instanceAiConfig),
                 });
             if (result.status === 'suspended') {
@@ -2643,6 +2140,10 @@ let InstanceAiService = class InstanceAiService {
                         threadId,
                         user,
                         toolCallId: result.suspension.toolCallId,
+                        ...(result.suspension.toolName ? { toolName: result.suspension.toolName } : {}),
+                        ...(result.suspension.suspendPayload
+                            ? { suspendPayload: result.suspension.suspendPayload }
+                            : {}),
                         requestId: result.suspension.requestId,
                         abortController,
                         messageGroupId,
@@ -2651,6 +2152,7 @@ let InstanceAiService = class InstanceAiService {
                         modelId,
                         checkpoint,
                         plannedBuild,
+                        runHandoff: runControl.state,
                     });
                     void this.suspendedThreads.persistPendingConfirmation({
                         requestId: result.suspension.requestId,
@@ -2672,12 +2174,12 @@ let InstanceAiService = class InstanceAiService {
                         is_intermediate: true,
                     });
                 }
-                const waitingDecision = this.evaluateWaitingResponse(threadId, runId, result.confirmationEvent, {
+                const waitingDecision = this.terminalOutcome.evaluateWaitingResponse(threadId, runId, result.confirmationEvent, {
                     messageGroupId,
                     correlationId: messageId,
                 });
                 if (waitingDecision?.reason === 'confirmation-invalid') {
-                    messageTraceFinalization = await this.finishInvalidConfirmationRun({
+                    messageTraceFinalization = await this.terminalOutcome.finishInvalidConfirmationRun({
                         threadId,
                         runId,
                         abortController,
@@ -2700,7 +2202,7 @@ let InstanceAiService = class InstanceAiService {
                         : {}),
                     ...(result.suspension?.toolName ? { toolName: result.suspension.toolName } : {}),
                 };
-                await this.finalizeRunTracing(runId, tracing, {
+                await this.tracing.finalizeRunTracing(runId, tracing, {
                     status: 'suspended',
                     outputs: suspensionOutputs,
                     metadata: {
@@ -2740,21 +2242,23 @@ let InstanceAiService = class InstanceAiService {
                     threadId,
                     runId,
                     tracing,
-                    agentId: ORCHESTRATOR_AGENT_ID,
+                    agentId: (0, instance_ai_1.orchestratorAgentId)(runId),
                     userId: user.id,
                     messageGroupId,
                     messageId,
                 });
             }
-            this.evaluateTerminalResponse(threadId, runId, result.status, {
-                messageGroupId,
-                correlationId: messageId,
-                workSummary: result.workSummary,
-                suppressCompletedFallback: checkpoint?.isCheckpointFollowUp === true ||
-                    plannedBuild?.isPlannedBuildFollowUp === true,
-            });
+            if (runControl.shouldEmitTerminalOutcome(result.stopReason)) {
+                this.terminalOutcome.evaluateTerminalResponse(threadId, runId, result.status, {
+                    messageGroupId,
+                    correlationId: messageId,
+                    workSummary: result.workSummary,
+                    suppressCompletedFallback: checkpoint?.isCheckpointFollowUp === true ||
+                        plannedBuild?.isPlannedBuildFollowUp === true,
+                });
+            }
             const finalStatus = result.status === 'errored' ? 'error' : result.status;
-            await this.finalizeRunTracing(runId, tracing, {
+            await this.tracing.finalizeRunTracing(runId, tracing, {
                 status: finalStatus,
                 outputText,
                 modelId,
@@ -2763,7 +2267,7 @@ let InstanceAiService = class InstanceAiService {
                 status: finalStatus,
                 outputText,
                 modelId,
-                metadata: this.buildMessageTraceMetadata(threadId, runId, { status: finalStatus }),
+                metadata: this.tracing.buildMessageTraceMetadata(threadId, runId, { status: finalStatus }),
             };
             const archivedWorkflowIds = await this.temporaryWorkflowService.reapForRun(threadId, user, aiCreatedWorkflowIds, this.backgroundTasks.getRunningTasks(threadId).length);
             await this.finalizeRun(threadId, runId, result.status, snapshotStorage, {
@@ -2796,18 +2300,18 @@ let InstanceAiService = class InstanceAiService {
                 if (cancellationReason === liveness_1.INSTANCE_AI_RUN_TIMEOUT_REASON) {
                     this.liveness.publishRunTimeoutNotice(threadId, runId);
                 }
-                this.evaluateTerminalResponse(threadId, runId, 'cancelled', {
+                this.terminalOutcome.evaluateTerminalResponse(threadId, runId, 'cancelled', {
                     messageGroupId,
                     correlationId: messageId,
                 });
-                await this.finalizeRunTracing(runId, tracing, {
+                await this.tracing.finalizeRunTracing(runId, tracing, {
                     status: 'cancelled',
                     reason: cancellationReason,
                 });
                 messageTraceFinalization = {
                     status: 'cancelled',
                     reason: cancellationReason,
-                    metadata: this.buildMessageTraceMetadata(threadId, runId, {
+                    metadata: this.tracing.buildMessageTraceMetadata(threadId, runId, {
                         status: 'cancelled',
                         cancellationReason,
                         runTimeout,
@@ -2826,7 +2330,7 @@ let InstanceAiService = class InstanceAiService {
                 threadId,
                 runId,
                 tracing,
-                agentId: ORCHESTRATOR_AGENT_ID,
+                agentId: (0, instance_ai_1.orchestratorAgentId)(runId),
                 userId: user.id,
                 messageGroupId,
                 messageId,
@@ -2836,25 +2340,25 @@ let InstanceAiService = class InstanceAiService {
                 ...(0, observability_1.buildInstanceAiObservabilityContext)(errCtx),
             });
             this.reportInstanceAiError(error, { component: 'instance-ai-run', ...errCtx });
-            this.evaluateTerminalResponse(threadId, runId, 'errored', {
+            this.terminalOutcome.evaluateTerminalResponse(threadId, runId, 'errored', {
                 messageGroupId,
                 correlationId: messageId,
                 errorMessage: userFacingErrorMessage,
             });
-            await this.finalizeRunTracing(runId, tracing, {
+            await this.tracing.finalizeRunTracing(runId, tracing, {
                 status: 'error',
                 reason: errorMessage,
             });
             messageTraceFinalization = {
                 status: 'error',
                 reason: errorMessage,
-                metadata: this.buildMessageTraceMetadata(threadId, runId, { status: 'error' }),
+                metadata: this.tracing.buildMessageTraceMetadata(threadId, runId, { status: 'error' }),
             };
             const archivedWorkflowIds = await this.temporaryWorkflowService.reapForRun(threadId, user, aiCreatedWorkflowIds, this.backgroundTasks.getRunningTasks(threadId).length);
             this.eventBus.publish(threadId, {
                 type: 'run-finish',
                 runId,
-                agentId: ORCHESTRATOR_AGENT_ID,
+                agentId: (0, instance_ai_1.orchestratorAgentId)(runId),
                 payload: {
                     status: 'error',
                     reason: userFacingErrorMessage,
@@ -2867,10 +2371,9 @@ let InstanceAiService = class InstanceAiService {
         }
         finally {
             this.runState.clearActiveRun(threadId);
-            this.userMessagePersistenceByRun.delete(runId);
             this.domainAccessTrackersByThread.get(threadId)?.clearRun(runId);
             if (messageTraceFinalization) {
-                await this.maybeFinalizeRunTraceRoot(runId, messageTraceFinalization);
+                await this.tracing.maybeFinalizeRunTraceRoot(runId, messageTraceFinalization);
                 if (messageTraceFinalization.status !== 'cancelled') {
                     this.liveness.consumeRunTimeout(runId);
                 }
@@ -3086,6 +2589,7 @@ let InstanceAiService = class InstanceAiService {
             return { kind: 'env-failure', error };
         }
         const mcpServers = this.parseMcpServers(this.instanceAiConfig.mcpServers);
+        const runControl = (0, instance_ai_1.createOrchestratorRunControl)(environment.orchestrationContext);
         let agent;
         try {
             agent = await (0, instance_ai_1.createInstanceAgent)({
@@ -3100,6 +2604,7 @@ let InstanceAiService = class InstanceAiService {
                 onMemoryTaskEvent: this.memoryTaskObserverFor(orphan.threadId),
                 thinkingEnabled: this.instanceAiConfig.thinkingEnabled,
             });
+            this.subscribeToAgentErrors(agent, orphan.threadId, orphan.runId);
         }
         catch (error) {
             return { kind: 'agent-failure', error };
@@ -3122,6 +2627,7 @@ let InstanceAiService = class InstanceAiService {
                 checkpoint: orphan.checkpointTaskId
                     ? { isCheckpointFollowUp: true, checkpointTaskId: orphan.checkpointTaskId }
                     : undefined,
+                runHandoff: runControl.state,
             },
         };
     }
@@ -3153,7 +2659,7 @@ let InstanceAiService = class InstanceAiService {
             });
             return false;
         }
-        const { agent, runId, agentRunId, threadId, user, toolCallId, abortController, tracing, modelId, messageGroupId, checkpoint, plannedBuild, } = suspended;
+        const { agent, runId, agentRunId, threadId, user, toolCallId, toolName, suspendPayload, abortController, tracing, modelId, messageGroupId, checkpoint, plannedBuild, runHandoff, } = suspended;
         if (user.id !== requestingUserId)
             return false;
         const activeUser = await this.revalidateActiveUser(user.id);
@@ -3181,7 +2687,7 @@ let InstanceAiService = class InstanceAiService {
             ...(data.resourceDecision ? { resourceDecision: data.resourceDecision } : {}),
             ...(data.scope ? { scope: data.scope } : {}),
         };
-        const resumeTracing = await this.createOrchestratorResumeTraceContext({
+        const resumeTracing = await this.tracing.createOrchestratorResumeTraceContext({
             baseTracing: tracing,
             threadId,
             messageId: (0, nanoid_1.nanoid)(),
@@ -3214,6 +2720,8 @@ let InstanceAiService = class InstanceAiService {
             threadId,
             user: activeUser,
             toolCallId,
+            toolName,
+            suspendPayload,
             signal: abortController.signal,
             abortController,
             snapshotStorage: this.dbSnapshotStorage,
@@ -3221,11 +2729,13 @@ let InstanceAiService = class InstanceAiService {
             modelId,
             checkpoint,
             plannedBuild,
+            runHandoff,
         });
         return true;
     }
     async processResumedStream(agent, resumeData, opts) {
         let messageTraceFinalization;
+        let completedSetupWorkflowId;
         try {
             if (opts.tracing?.getTelemetry && isTelemetryConfigurableAgent(agent)) {
                 try {
@@ -3244,34 +2754,38 @@ let InstanceAiService = class InstanceAiService {
                 }
             }
             const resumeOptions = this.buildOrchestratorResumeAgentOptions(opts.user, opts.threadId, opts.runId, opts.agentRunId, opts.toolCallId);
+            const runControl = (0, instance_ai_1.createOrchestratorRunControlForState)(opts.runHandoff);
+            const stopSignal = () => runControl.getStopSignal();
             const result = opts.tracing
                 ? await opts.tracing.withActiveSpan(opts.tracing.actorRun, async () => {
                     return await (0, instance_ai_1.resumeAgentRun)(agent, resumeData, resumeOptions, {
                         threadId: opts.threadId,
                         runId: opts.runId,
-                        agentId: ORCHESTRATOR_AGENT_ID,
+                        agentId: (0, instance_ai_1.orchestratorAgentId)(opts.runId),
                         signal: opts.signal,
                         eventBus: this.eventBus,
                         logger: this.logger,
                         agentRunId: opts.agentRunId,
                         onActivity: () => this.runState.touchActiveRun(opts.threadId),
+                        stopSignal,
                         outputRedaction: (0, output_redaction_config_1.resolveOutputRedaction)(this.instanceAiConfig),
                     });
                 })
                 : await (0, instance_ai_1.resumeAgentRun)(agent, resumeData, resumeOptions, {
                     threadId: opts.threadId,
                     runId: opts.runId,
-                    agentId: ORCHESTRATOR_AGENT_ID,
+                    agentId: (0, instance_ai_1.orchestratorAgentId)(opts.runId),
                     signal: opts.signal,
                     eventBus: this.eventBus,
                     logger: this.logger,
                     agentRunId: opts.agentRunId,
                     onActivity: () => this.runState.touchActiveRun(opts.threadId),
+                    stopSignal,
                     outputRedaction: (0, output_redaction_config_1.resolveOutputRedaction)(this.instanceAiConfig),
                 });
             if (result.status === 'suspended') {
                 if (result.suspension) {
-                    const resumeMessageGroupId = this.traceContextsByRunId.get(opts.runId)?.messageGroupId;
+                    const resumeMessageGroupId = this.tracing.getMessageGroupId(opts.runId);
                     this.runState.suspendRun(opts.threadId, {
                         runId: opts.runId,
                         agentRunId: result.agentRunId,
@@ -3279,6 +2793,10 @@ let InstanceAiService = class InstanceAiService {
                         threadId: opts.threadId,
                         user: opts.user,
                         toolCallId: result.suspension.toolCallId,
+                        ...(result.suspension.toolName ? { toolName: result.suspension.toolName } : {}),
+                        ...(result.suspension.suspendPayload
+                            ? { suspendPayload: result.suspension.suspendPayload }
+                            : {}),
                         requestId: result.suspension.requestId,
                         abortController: opts.abortController,
                         messageGroupId: resumeMessageGroupId,
@@ -3287,6 +2805,7 @@ let InstanceAiService = class InstanceAiService {
                         ...(opts.modelId !== undefined ? { modelId: opts.modelId } : {}),
                         checkpoint: opts.checkpoint,
                         plannedBuild: opts.plannedBuild,
+                        runHandoff: runControl.state,
                     });
                     void this.suspendedThreads.persistPendingConfirmation({
                         requestId: result.suspension.requestId,
@@ -3308,10 +2827,10 @@ let InstanceAiService = class InstanceAiService {
                         is_intermediate: true,
                     });
                 }
-                const messageGroupId = this.traceContextsByRunId.get(opts.runId)?.messageGroupId;
-                const waitingDecision = this.evaluateWaitingResponse(opts.threadId, opts.runId, result.confirmationEvent, { messageGroupId });
+                const messageGroupId = this.tracing.getMessageGroupId(opts.runId);
+                const waitingDecision = this.terminalOutcome.evaluateWaitingResponse(opts.threadId, opts.runId, result.confirmationEvent, { messageGroupId });
                 if (waitingDecision?.reason === 'confirmation-invalid') {
-                    messageTraceFinalization = await this.finishInvalidConfirmationRun({
+                    messageTraceFinalization = await this.terminalOutcome.finishInvalidConfirmationRun({
                         threadId: opts.threadId,
                         runId: opts.runId,
                         abortController: opts.abortController,
@@ -3334,7 +2853,7 @@ let InstanceAiService = class InstanceAiService {
                         : {}),
                     ...(result.suspension?.toolName ? { toolName: result.suspension.toolName } : {}),
                 };
-                await this.finalizeRunTracing(opts.runId, opts.tracing, {
+                await this.tracing.finalizeRunTracing(opts.runId, opts.tracing, {
                     status: 'suspended',
                     outputs: suspensionOutputs,
                     metadata: {
@@ -3368,33 +2887,35 @@ let InstanceAiService = class InstanceAiService {
                 return;
             }
             const outputText = await (result.text ?? Promise.resolve(''));
-            const messageGroupId = this.traceContextsByRunId.get(opts.runId)?.messageGroupId;
+            const messageGroupId = this.tracing.getMessageGroupId(opts.runId);
             if (result.status === 'errored') {
                 this.reportInstanceAiError(result.error ?? new Error('Instance AI resumed stream errored'), {
                     component: 'instance-ai-stream',
                     threadId: opts.threadId,
                     runId: opts.runId,
                     tracing: opts.tracing,
-                    agentId: ORCHESTRATOR_AGENT_ID,
+                    agentId: (0, instance_ai_1.orchestratorAgentId)(opts.runId),
                     userId: opts.user.id,
                     messageGroupId,
                 });
             }
-            this.evaluateTerminalResponse(opts.threadId, opts.runId, result.status, {
-                messageGroupId,
-                workSummary: result.workSummary,
-                suppressCompletedFallback: opts.checkpoint?.isCheckpointFollowUp === true ||
-                    opts.plannedBuild?.isPlannedBuildFollowUp === true,
-            });
+            if (runControl.shouldEmitTerminalOutcome(result.stopReason)) {
+                this.terminalOutcome.evaluateTerminalResponse(opts.threadId, opts.runId, result.status, {
+                    messageGroupId,
+                    workSummary: result.workSummary,
+                    suppressCompletedFallback: opts.checkpoint?.isCheckpointFollowUp === true ||
+                        opts.plannedBuild?.isPlannedBuildFollowUp === true,
+                });
+            }
             const finalStatus = result.status === 'errored' ? 'error' : result.status;
-            await this.finalizeRunTracing(opts.runId, opts.tracing, {
+            await this.tracing.finalizeRunTracing(opts.runId, opts.tracing, {
                 status: finalStatus,
                 outputText,
             });
             messageTraceFinalization = {
                 status: finalStatus,
                 outputText,
-                metadata: this.buildMessageTraceMetadata(opts.threadId, opts.runId, {
+                metadata: this.tracing.buildMessageTraceMetadata(opts.threadId, opts.runId, {
                     status: finalStatus,
                 }),
             };
@@ -3407,6 +2928,7 @@ let InstanceAiService = class InstanceAiService {
             });
             await this.creditService.claimRunUsage(opts.user, opts.threadId, result.agentRunId || opts.runId, result.usage?.usage ?? [], result.status);
             if (result.status === 'completed') {
+                completedSetupWorkflowId = this.getWorkflowSetupSuspensionWorkflowId(opts.toolName, opts.suspendPayload);
                 this.telemetry.track('Builder sent message', {
                     thread_id: opts.threadId,
                     message: outputText,
@@ -3421,7 +2943,7 @@ let InstanceAiService = class InstanceAiService {
                 if (this.shouldPreserveHitlOnShutdown(opts.runId)) {
                     return;
                 }
-                const messageGroupId = this.traceContextsByRunId.get(opts.runId)?.messageGroupId;
+                const messageGroupId = this.tracing.getMessageGroupId(opts.runId);
                 const runTimeout = this.liveness.consumeRunTimeout(opts.runId);
                 const cancellationReason = runTimeout.timedOut
                     ? liveness_1.INSTANCE_AI_RUN_TIMEOUT_REASON
@@ -3429,17 +2951,17 @@ let InstanceAiService = class InstanceAiService {
                 if (cancellationReason === liveness_1.INSTANCE_AI_RUN_TIMEOUT_REASON) {
                     this.liveness.publishRunTimeoutNotice(opts.threadId, opts.runId);
                 }
-                this.evaluateTerminalResponse(opts.threadId, opts.runId, 'cancelled', {
+                this.terminalOutcome.evaluateTerminalResponse(opts.threadId, opts.runId, 'cancelled', {
                     messageGroupId,
                 });
-                await this.finalizeRunTracing(opts.runId, opts.tracing, {
+                await this.tracing.finalizeRunTracing(opts.runId, opts.tracing, {
                     status: 'cancelled',
                     reason: cancellationReason,
                 });
                 messageTraceFinalization = {
                     status: 'cancelled',
                     reason: cancellationReason,
-                    metadata: this.buildMessageTraceMetadata(opts.threadId, opts.runId, {
+                    metadata: this.tracing.buildMessageTraceMetadata(opts.threadId, opts.runId, {
                         status: 'cancelled',
                         cancellationReason,
                         runTimeout,
@@ -3452,12 +2974,12 @@ let InstanceAiService = class InstanceAiService {
             }
             const errorMessage = getErrorMessage(error);
             const userFacingErrorMessage = getUserFacingErrorMessage(error);
-            const messageGroupId = this.traceContextsByRunId.get(opts.runId)?.messageGroupId;
+            const messageGroupId = this.tracing.getMessageGroupId(opts.runId);
             const errCtx = {
                 threadId: opts.threadId,
                 runId: opts.runId,
                 tracing: opts.tracing,
-                agentId: ORCHESTRATOR_AGENT_ID,
+                agentId: (0, instance_ai_1.orchestratorAgentId)(opts.runId),
                 userId: opts.user.id,
                 messageGroupId,
             };
@@ -3466,18 +2988,18 @@ let InstanceAiService = class InstanceAiService {
                 ...(0, observability_1.buildInstanceAiObservabilityContext)(errCtx),
             });
             this.reportInstanceAiError(error, { component: 'instance-ai-run', ...errCtx });
-            this.evaluateTerminalResponse(opts.threadId, opts.runId, 'errored', {
+            this.terminalOutcome.evaluateTerminalResponse(opts.threadId, opts.runId, 'errored', {
                 messageGroupId,
                 errorMessage: userFacingErrorMessage,
             });
-            await this.finalizeRunTracing(opts.runId, opts.tracing, {
+            await this.tracing.finalizeRunTracing(opts.runId, opts.tracing, {
                 status: 'error',
                 reason: errorMessage,
             });
             messageTraceFinalization = {
                 status: 'error',
                 reason: errorMessage,
-                metadata: this.buildMessageTraceMetadata(opts.threadId, opts.runId, {
+                metadata: this.tracing.buildMessageTraceMetadata(opts.threadId, opts.runId, {
                     status: 'error',
                 }),
             };
@@ -3485,7 +3007,7 @@ let InstanceAiService = class InstanceAiService {
             this.eventBus.publish(opts.threadId, {
                 type: 'run-finish',
                 runId: opts.runId,
-                agentId: ORCHESTRATOR_AGENT_ID,
+                agentId: (0, instance_ai_1.orchestratorAgentId)(opts.runId),
                 payload: {
                     status: 'error',
                     reason: userFacingErrorMessage,
@@ -3497,7 +3019,7 @@ let InstanceAiService = class InstanceAiService {
         finally {
             this.runState.clearActiveRun(opts.threadId);
             if (messageTraceFinalization) {
-                await this.maybeFinalizeRunTraceRoot(opts.runId, messageTraceFinalization);
+                await this.tracing.maybeFinalizeRunTraceRoot(opts.runId, messageTraceFinalization);
                 if (messageTraceFinalization.status !== 'cancelled') {
                     this.liveness.consumeRunTimeout(opts.runId);
                 }
@@ -3513,6 +3035,9 @@ let InstanceAiService = class InstanceAiService {
                     await this.schedulePlannedTasks(opts.user, opts.threadId);
                 }
                 await this.drainPendingCheckpointReentries(opts.user, opts.threadId);
+                if (completedSetupWorkflowId) {
+                    await this.markWorkflowSetupHandled(opts.threadId, completedSetupWorkflowId, opts.runId);
+                }
                 await this.taskProjector.syncFromWorkflowLoop(opts.threadId, opts.runId);
                 await this.maybeStartWorkflowSetupFollowUp(opts.user, opts.threadId);
             }
@@ -3534,7 +3059,7 @@ let InstanceAiService = class InstanceAiService {
             parentCheckpointId: opts.parentCheckpointId,
             run: opts.run,
             onLimitReached: async (errorMessage) => {
-                await this.finalizeDetachedTraceRun(opts.taskId, opts.traceContext, {
+                await this.tracing.finalizeDetachedTraceRun(opts.taskId, opts.traceContext, {
                     status: 'failed',
                     outputs: {
                         taskId: opts.taskId,
@@ -3559,7 +3084,7 @@ let InstanceAiService = class InstanceAiService {
                 });
             },
             onCompleted: async (task) => {
-                await this.finalizeBackgroundTaskTracing(task, 'completed');
+                await this.tracing.finalizeBackgroundTaskTracing(task, 'completed');
                 this.eventBus.publish(opts.threadId, {
                     type: 'agent-completed',
                     runId,
@@ -3572,7 +3097,7 @@ let InstanceAiService = class InstanceAiService {
                 }
             },
             onFailed: async (task) => {
-                await this.finalizeBackgroundTaskTracing(task, 'failed');
+                await this.tracing.finalizeBackgroundTaskTracing(task, 'failed');
                 this.reportInstanceAiError(new Error(task.error ?? 'Instance AI background task failed'), {
                     component: 'instance-ai-background-task',
                     threadId: opts.threadId,
@@ -3595,7 +3120,7 @@ let InstanceAiService = class InstanceAiService {
                 }
             },
             onSettled: async (task) => {
-                await this.recordBackgroundTerminalOutcome(task);
+                await this.terminalOutcome.recordBackgroundTerminalOutcome(task);
                 await this.saveAgentTreeSnapshot(opts.threadId, runId, snapshotStorage, true, task.messageGroupId);
                 if (task.plannedTaskId)
                     return;
@@ -3665,7 +3190,7 @@ let InstanceAiService = class InstanceAiService {
                 workflowId: opts.dedupeKey?.workflowId,
                 role: opts.role,
             });
-            void this.finalizeDetachedTraceRun(opts.taskId, opts.traceContext, {
+            void this.tracing.finalizeDetachedTraceRun(opts.taskId, opts.traceContext, {
                 status: 'cancelled',
                 outputs: {
                     taskId: opts.taskId,
@@ -3758,17 +3283,17 @@ let InstanceAiService = class InstanceAiService {
         if (reason === liveness_1.INSTANCE_AI_RUN_TIMEOUT_REASON) {
             this.liveness.publishRunTimeoutNotice(suspended.threadId, suspended.runId);
         }
-        await this.finalizeRunTracing(suspended.runId, suspended.tracing, {
+        await this.tracing.finalizeRunTracing(suspended.runId, suspended.tracing, {
             status: 'cancelled',
             reason,
         });
         const archivedWorkflowIds = await this.temporaryWorkflowService.reapForRun(suspended.threadId, suspended.user, undefined, this.backgroundTasks.getRunningTasks(suspended.threadId).length);
         this.publishRunFinish(suspended.threadId, suspended.runId, 'cancelled', reason, archivedWorkflowIds, suspended.user.id);
         await this.saveAgentTreeSnapshot(suspended.threadId, suspended.runId, this.dbSnapshotStorage, true);
-        await this.maybeFinalizeRunTraceRoot(suspended.runId, {
+        await this.tracing.maybeFinalizeRunTraceRoot(suspended.runId, {
             status: 'cancelled',
             reason,
-            metadata: this.buildMessageTraceMetadata(suspended.threadId, suspended.runId, {
+            metadata: this.tracing.buildMessageTraceMetadata(suspended.threadId, suspended.runId, {
                 status: 'cancelled',
                 cancellationReason: reason,
                 ...(runTimeout ? { runTimeout } : {}),
@@ -3782,7 +3307,7 @@ let InstanceAiService = class InstanceAiService {
         this.eventBus.publish(threadId, {
             type: 'run-finish',
             runId,
-            agentId: ORCHESTRATOR_AGENT_ID,
+            agentId: (0, instance_ai_1.orchestratorAgentId)(runId),
             payload: {
                 status: effectiveStatus,
                 ...(status === 'cancelled' ? { reason: reason ?? 'user_cancelled' } : {}),
@@ -3833,7 +3358,7 @@ let InstanceAiService = class InstanceAiService {
             if (userTexts.length === 0)
                 return;
             const userText = userTexts.join('\n');
-            const baseTracing = this.getTraceContextForContinuation(threadId);
+            const baseTracing = this.tracing.getTraceContextForContinuation(threadId);
             const titleTracing = await (0, instance_ai_1.createInternalOperationTraceContext)({
                 threadId,
                 conversationId: threadId,
@@ -3902,7 +3427,7 @@ let InstanceAiService = class InstanceAiService {
             this.eventBus.publish(threadId, {
                 type: 'thread-title-updated',
                 runId: '',
-                agentId: ORCHESTRATOR_AGENT_ID,
+                agentId: 'orchestrator',
                 payload: { title: llmTitle },
             });
         }
@@ -3946,7 +3471,7 @@ let InstanceAiService = class InstanceAiService {
                 return;
             }
             const agentTree = (0, instance_ai_1.buildAgentTreeFromEvents)(events);
-            const tracing = this.traceContextsByRunId.get(runId)?.tracing;
+            const tracing = this.tracing.getTraceContext(runId);
             const saveOptions = {
                 messageGroupId,
                 runIds: groupRunIds,
@@ -4001,6 +3526,7 @@ exports.InstanceAiService = InstanceAiService = __decorate([
         in_process_event_bus_1.InProcessEventBus,
         instance_ai_settings_service_1.InstanceAiSettingsService,
         instance_ai_gateway_service_1.InstanceAiGatewayService,
+        instance_ai_browser_session_service_1.InstanceAiBrowserSessionService,
         instance_ai_memory_service_1.InstanceAiMemoryService,
         typeorm_agent_memory_1.TypeORMAgentMemory,
         typeorm_agent_checkpoint_store_1.TypeORMAgentCheckpointStore,