pi-subagents 0.81.0 → 0.82.0

package/src/extension/index.js

@@ -73,10 +73,14 @@ import { loadConfig, resolveAsyncByDefault, resolveScheduledStoreRoot } from "./
 import { buildSubagentToolDescription, buildSubagentToolPromptMetadata } from "./tool-description.js";
 import { formatWorkflowPreflightSummary, normalizeWorkflowPreflight } from "../workflows/workflow-preflight.js";
 import { runtimeReplacedAbortReason } from "../workflows/workflow-reuse.js";
+import { autoResumeFailureText, cancelPendingWorkflowAutoResumes, finishWorkflowAutoResume, planWorkflowAutoResumes, WORKFLOW_AUTO_RESUME_MESSAGE_TYPE } from "../workflows/workflow-auto-resume.js";
+import { recordWorkflowResumeRefusal, releaseWorkflowResumeClaim, resumedRunStarted } from "../workflows/workflow-resume-claim.js";
+import { workflowResumeRefusal } from "../workflows/workflow-resume.js";
 import { finalizeToolResult } from "./tool-result.js";
 import { flattenSubagentToolOptions } from "./subagent-options.js";
 import { collectGoalContinuationNotices } from "../missions/goal-driver.js";
 import { restoreForegroundRunHistory } from "../runs/foreground/foreground-history.js";
+import { createInterruptedElsewhereCollector } from "../runs/background/interrupted-elsewhere.js";
 import { resolveMissionStoreLocation } from "../missions/store.js";
 import { listRetainedChildren } from "../runs/background/retained-children.js";
 import { DIRS, DEFAULT_ARTIFACT_CONFIG, SLASH_RESULT_TYPE, SLASH_TEXT_RESULT_TYPE, SUBAGENT_ASYNC_COMPLETE_EVENT, SUBAGENT_ASYNC_STARTED_EVENT, SUBAGENT_PROCESS_TERMINAL_EVENT, SUBAGENT_CONTROL_EVENT, SUBAGENT_STEERING_NOTICE_EVENT, WIDGET_KEY, resolveMaxSubagentSpawnsPerSession, } from "../shared/types.js";
@@ -434,6 +438,7 @@ export default function registerSubagentExtension(pi) {
             refreshResultDelivery();
         },
         onJobCleanup: (asyncId) => deliveredRunIds.delete(asyncId),
+        deliveryOwnerId: resultDeliveryOwnership.deliveryOwnerId,
         supervisorRequestState: supervisorChannel.getSupervisorRequestState,
         onJobsChanged: programStatus.sync,
     });
@@ -597,6 +602,60 @@ export default function registerSubagentExtension(pi) {
         await waitForAdvertisement();
         return (await getExecutor()).executePublic(id, params, signal, onUpdate, ctx);
     };
+    // Names this runtime's planned auto-resumes in the process-global registry.
+    const autoResumeOwner = {};
+    const postAutoResumeFailure = (sourceRunId, refusal) => {
+        pi.sendMessage({ customType: WORKFLOW_AUTO_RESUME_MESSAGE_TYPE, content: autoResumeFailureText(sourceRunId, refusal), display: true }, { triggerTurn: false });
+    };
+    // Each session start claims its interrupted workflows synchronously, then launches them here, off
+    // session start. Cleanup and the next session start cancel the launches that have not started.
+    const launchWorkflowAutoResume = async (entry, ctx) => {
+        const { prepared } = entry;
+        try {
+            // Let the rest of session start (agent advertisement, other handlers) run first.
+            await new Promise((resolve) => setImmediate(resolve));
+            await waitForAdvertisement();
+            const executor = await getExecutor();
+            if (entry.state !== "pending")
+                return;
+            entry.state = "started";
+            const outcome = await executor.executeWorkflowResume(randomUUID(), prepared, new AbortController().signal, ctx);
+            // The executor has given back the claim and recorded any refusal; nothing below may replace them.
+            // A run launched by a runtime that was cleaned up meanwhile would keep running through its stale context.
+            if (outcome.launched && runtimeCleaned)
+                state.workflowControllers?.get(prepared.newRunId)?.abort(runtimeReplacedAbortReason());
+            // A cleaned-up runtime's pi can no longer post; the refusal stays in the run for its notice.
+            if (outcome.launched || runtimeCleaned)
+                return;
+            try {
+                postAutoResumeFailure(prepared.sourceRunId, outcome.refusal);
+            }
+            catch (error) {
+                console.error(`Failed to post the auto-resume failure of workflow ${prepared.sourceRunId}:`, error);
+            }
+        }
+        catch (error) {
+            // A cancelled launch already gave its claim back.
+            if (entry.state === "cancelled")
+                return;
+            const message = error instanceof Error ? error.message : String(error);
+            console.error(`Failed to auto-resume workflow ${prepared.sourceRunId}:`, error);
+            try {
+                if (resumedRunStarted(prepared.sourceAsyncDir, prepared.newRunId))
+                    return;
+                releaseWorkflowResumeClaim(prepared.sourceAsyncDir, prepared.newRunId);
+                const refusal = workflowResumeRefusal("launch-failed", `launch failed: ${message}`, prepared.sourceRunId);
+                recordWorkflowResumeRefusal(prepared.sourceAsyncDir, { reason: refusal.reason, byHand: refusal.byHand, newRunId: prepared.newRunId });
+                postAutoResumeFailure(prepared.sourceRunId, refusal);
+            }
+            catch (cleanupError) {
+                console.error(`Failed to give back the auto-resume claim of workflow ${prepared.sourceRunId}:`, cleanupError);
+            }
+        }
+        finally {
+            finishWorkflowAutoResume(entry);
+        }
+    };
     const executeSubagentCollapsed = (id, params, signal, onUpdate, ctx) => {
         if (ctx.hasUI)
             ctx.ui.setToolsExpanded(false);
@@ -873,12 +932,31 @@ export default function registerSubagentExtension(pi) {
         resetJobs(ctx);
         logSlowPhase("reset-jobs", phaseStartedAt);
         phaseStartedAt = Date.now();
-        restoreForegroundRunHistory(state, { resultsDir: DIRS.results });
+        // Runs other sessions in this folder left when their Pi died, from what this restore reads anyway.
+        const interruptedElsewhere = ctx.hasUI ? createInterruptedElsewhereCollector({ currentSessionId: state.currentSessionId, cwd: ctx.cwd, now: Date.now() }) : undefined;
+        restoreForegroundRunHistory(state, { resultsDir: DIRS.results, observeForeign: interruptedElsewhere?.observeForegroundRun });
         logSlowPhase("foreground-history", phaseStartedAt);
         phaseStartedAt = Date.now();
-        restoreActiveJobs(ctx);
+        restoreActiveJobs(ctx, interruptedElsewhere?.observeStatus);
         logSlowPhase("active-job-restore", phaseStartedAt);
         phaseStartedAt = Date.now();
+        // Read-only and UI-only: never sent to the model, so prompts and history are unchanged.
+        if (interruptedElsewhere)
+            for (const line of interruptedElsewhere.lines())
+                ctx.ui.notify(line, "info");
+        logSlowPhase("cross-session-notice", phaseStartedAt);
+        // Before any stored result is delivered, so the interrupted run's notice can name its resume.
+        phaseStartedAt = Date.now();
+        // Launches an earlier session start of this runtime planned and has not started belong to that session.
+        cancelPendingWorkflowAutoResumes((entry) => entry.owner === autoResumeOwner);
+        // Not in a one-shot print run: its turn would then wait on the resumed workflow at settle.
+        if (recovering && ctx.hasUI && config.autoResume !== false) {
+            for (const entry of planWorkflowAutoResumes({ asyncDirRoot: DIRS.async, currentSessionId: state.currentSessionId, now: Date.now(), owner: autoResumeOwner })) {
+                void launchWorkflowAutoResume(entry, ctx);
+            }
+        }
+        logSlowPhase("workflow-auto-resume", phaseStartedAt);
+        phaseStartedAt = Date.now();
         scheduledRunManager.bindSession(ctx);
         logSlowPhase("scheduled-runs", phaseStartedAt);
         phaseStartedAt = Date.now();
@@ -903,6 +981,8 @@ export default function registerSubagentExtension(pi) {
             if (runtimeCleaned)
                 return;
             runtimeCleaned = true;
+            // Synchronously, so a reload's new runtime finds these runs unclaimed when it scans.
+            cancelPendingWorkflowAutoResumes((entry) => entry.owner === autoResumeOwner);
             programStatus.dispose(shutdownReason);
             releaseHostSessionLiveness();
             releaseHostSessionLiveness = () => { };

package/src/extension/schemas.js

@@ -205,7 +205,7 @@ const SubagentParamProperties = {
         description: "true: run the one ```js workflow block written in this same reply (false invalid). String with '/': script file read from request cwd. Other string: named workflow resource. Raw scripts (true or path) have no runs.host.",
     })),
     args: Type.Optional(Type.Unsafe({ type: "object", maxProperties: MAX_ARGS_FIELDS, additionalProperties: true, description: `Plain-JSON args for workflow; ${MAX_ARGS_FIELDS} fields/object, ${MAX_ARGS_ITEMS} items/array, depth ${MAX_ARGS_DEPTH}, ${MAX_ARGS_BYTES / 1024} KiB total; raw-script args are exposed deeply frozen and persisted, so do not include secrets.` })),
-    reuseFrom: Type.Optional(Type.String({ minLength: 1, description: "Exact id of a workflow run stopped by a session handoff or reload; this async workflow reuses its finished children and re-attaches to its running ones." })),
+    reuseFrom: Type.Optional(Type.String({ minLength: 1, description: "Exact id of a workflow run ended by a reload, handoff or Pi exit; this async workflow reuses its finished children and re-attaches to its running ones." })),
     globalConcurrencyLimit: Type.Optional(Type.Integer({ minimum: 1 })),
     maxSubagentSpawnsPerRun: Type.Optional(Type.Integer({ minimum: 1 })),
     preflight: Type.Optional(WorkflowPreflightOverride),
@@ -227,7 +227,7 @@ const SubagentParamProperties = {
     usageBudget: Type.Optional(UsageBudgetOverride),
     agentScope: Type.Optional(Type.String({ description: "user/project/both (default); project wins collisions." })),
     cwd: Type.Optional(Type.String({ description: "Execution/project-pane directory." })),
-    machine: Type.Optional(Type.String({ minLength: 1, maxLength: 128, description: "Herdr saved machine id or label; runs an external CLI agent there. cwd then means the directory on that machine." })),
+    machine: Type.Optional(Type.String({ minLength: 1, maxLength: 128, description: "Herdr saved machine id or label (runs an external CLI agent), a Rex host named in settings (runs a Pi child), or \"local\" (a Pi child in a Rex pane here). On another machine, cwd is a directory there." })),
     artifacts: Type.Optional(Type.Boolean({ description: "Debug artifacts; default true." })),
     includeProgress: Type.Optional(Type.Boolean({ description: "Full result progress; default false." })),
     share: Type.Optional(Type.Boolean({ description: "Upload session to GitHub Gist; default false." })),
@@ -306,6 +306,6 @@ const SubagentWaitParamsSchema = Type.Object({
     nonBlocking: Type.Optional(Type.Boolean({ description: "Subscribe to id's wake and return immediately; requires id, not with all." })),
     all: Type.Optional(Type.Boolean({ description: "Wait for all work active at call time." })),
     timeoutMs: Type.Optional(Type.Integer({ minimum: 1, description: "Max wait; default waitTool.defaultTimeoutMs, then 30 min." })),
-    stopOnAttention: Type.Optional(Type.Boolean({ description: "false: keep waiting through idle or long-thinking attention." })),
+    stopOnAttention: Type.Optional(Type.Boolean({ description: "false: keep waiting through all attention except supervisor requests." })),
 });
 export const SubagentWaitParams = keepTopLevelParameterDescriptions(SubagentWaitParamsSchema);

package/src/intercom/native-supervisor-channel.js

@@ -113,6 +113,8 @@ async function waitForReply(channelDir, requestId, initialDeadline, signal) {
         if (fs.existsSync(file)) {
             const parsed = JSON.parse(fs.readFileSync(file, "utf-8"));
             if (parsed.type === "subagent.supervisor.reply" && parsed.requestId === requestId && typeof parsed.message === "string") {
+                if (typeof parsed.error === "string")
+                    throw new Error(parsed.error);
                 return parsed;
             }
         }
@@ -761,6 +763,24 @@ export function createNativeSupervisorChannel(pi, state, deps = {}) {
                 cleanupRequestLifecycle(request, lifecycle);
                 continue;
             }
+            if (request.expectsReply && runState(request).blockingWorkflowChildren?.has(request.runId)) {
+                // Pi cannot deliver an ask behind the workflow tool call that awaits this child.
+                // Return a tool error instead of renewing an unreachable ask until the run deadline.
+                try {
+                    writePrivateAtomicJson(replyPath(channelDir, request.id), {
+                        type: "subagent.supervisor.reply", requestId: request.id, createdAt: now, message: "",
+                        error: "Supervisor unavailable: the parent is blocked in an async:false workflow and cannot answer this request. Report the blocker and any partial results, then stop. Relaunch the workflow with async:true to allow supervisor replies.",
+                    });
+                }
+                catch (error) {
+                    console.error(`Failed to report unreachable supervisor request ${request.id}; will retry:`, error);
+                    continue;
+                }
+                seenFiles.add(file);
+                observeRequestLifecycle(request, "resolved");
+                cleanupRequestLifecycle(request, "resolved");
+                continue;
+            }
             seenFiles.add(file);
             if (!request.expectsReply) {
                 // Progress is already visible through child activity; do not inject a

package/src/missions/lifecycle.js

@@ -253,7 +253,13 @@ export function readMissionBinding(asyncDir) {
     const bindingPath = path.join(asyncDir, MISSION_BINDING_FILE);
     if (!fs.existsSync(bindingPath))
         return undefined;
-    return parsePersistedBinding(JSON.parse(fs.readFileSync(bindingPath, "utf-8")), bindingPath);
+    const raw = fs.readFileSync(bindingPath, "utf-8");
+    try {
+        return parsePersistedBinding(JSON.parse(raw), bindingPath);
+    }
+    catch (error) {
+        throw new Error(`Invalid mission binding file '${bindingPath}': ${error instanceof Error ? error.message : String(error)}`, { cause: error });
+    }
 }
 export function syncMissionFromAsyncCompletion(value) {
     if (!value || typeof value !== "object" || Array.isArray(value))

package/src/runs/background/active-async-capacity.d.ts

@@ -34,6 +34,7 @@ interface CapacityOptions {
     abandonedSlotReleaseAfterMs?: number | false;
     pidLiveness?: (pid: number) => PidLiveness;
     pidNamespaceScope?: () => string | undefined;
+    bootId?: () => string | undefined;
     afterSlotRename?: (releasedDir: string) => void;
     writeOwner?: (filePath: string, owner: ActiveAsyncCapacityOwner) => void;
 }

package/src/runs/background/active-async-capacity.js

@@ -4,7 +4,8 @@ import * as path from "node:path";
 import { writePrivateAtomicJson } from "../../shared/atomic-json.js";
 import { TEMP_ROOT_DIR } from "../../shared/types.js";
 import { readStatus } from "../../shared/utils.js";
-import { checkPidLiveness } from "./stale-run-reconciler.js";
+import { checkPidLiveness, checkRecordedPidLiveness } from "./stale-run-reconciler.js";
+import { currentBootId } from "./boot-id.js";
 import { currentPidNamespaceScope } from "./pid-namespace.js";
 import { readProcessTerminal } from "./process-terminal.js";
 import { isTerminalAsyncState as terminalState, readWorkflowChildEvidence, readWorkflowChildProcessEvidence } from "./workflow-terminal-proof.js";
@@ -201,9 +202,14 @@ function abandonedRunnerReleaseVerdict(status, proofState, options, anyTerminalS
     if (typeof status.pid !== "number" || !Number.isInteger(status.pid) || status.pid < 1)
         return { state: "retained", reason: `${proofReason}; runner PID is missing or invalid` };
     // A PID from another namespace can look dead here while the runner is alive.
-    if (status.pidNamespaceScope !== undefined && status.pidNamespaceScope !== (options.pidNamespaceScope ?? currentPidNamespaceScope)())
+    const observedScope = (options.pidNamespaceScope ?? currentPidNamespaceScope)();
+    if (status.pidNamespaceScope !== undefined && status.pidNamespaceScope !== observedScope)
         return { state: "retained", reason: `${proofReason}; runner PID namespace differs from this process, so liveness is unknown` };
-    const liveness = (options.pidLiveness ?? checkPidLiveness)(status.pid);
+    const liveness = checkRecordedPidLiveness({ pid: status.pid, pidNamespaceScope: status.pidNamespaceScope, bootId: status.bootId }, {
+        observedScope,
+        observedBootId: (options.bootId ?? currentBootId)(),
+        probe: options.pidLiveness ?? ((pid) => checkPidLiveness(pid)),
+    });
     if (liveness !== "dead")
         return { state: "retained", reason: `${proofReason}; runner PID liveness is ${liveness}` };
     const lastActivityAt = status.lastActivityAt ?? status.lastUpdate ?? status.endedAt;

package/src/runs/background/async-execution.js

@@ -13,7 +13,7 @@ import { childCacheRetentionEnv } from "../../shared/child-cache-retention.js";
 import { buildEffectiveSystemPrompt } from "../shared/effective-system-prompt.js";
 import { currentCompletionOwnerId } from "../../shared/completion-owner.js";
 import { planChildLaunch, projectChainOutputSchemas, resolveStepBehavior, suppressProgressForReadOnlyTask } from "../shared/child-launch-plan.js";
-import { formatHerdrMachineRunnerUnsupported, resolveHerdrMachinePlacement } from "../shared/herdr-machine.js";
+import { formatHerdrMachineRunnerUnsupported, resolveMachinePlacement } from "../shared/herdr-machine.js";
 import { applyThinkingSuffix, projectLaunchResolvedChildExtensions, resolvePiLaunchToolPlan } from "../shared/child-tool-plan.js";
 import { assertClaudeCodeModelScope, isClaudeCodeAdapterId, resolveClaudeCodeOverride } from "../shared/claude-code-adapter.js";
 import { injectSingleOutputInstruction, normalizeSingleOutputOverride, resolveSingleOutputPath, validateFileOnlyOutputMode } from "../shared/single-output.js";
@@ -51,8 +51,9 @@ import { usageBudgetState } from "../shared/usage-budget.js";
 import { finalizeProcessTerminal, initializeProcessTerminal, readProcessTerminal } from "./process-terminal.js";
 import { persistRunnerStartupFailure } from "./runner-startup-failure.js";
 import { statusStepDescription } from "./chain-append.js";
+import { currentBootId, currentRecordedPid } from "./boot-id.js";
 import { currentPidNamespaceScope } from "./pid-namespace.js";
-import { checkPidLiveness } from "./stale-run-reconciler.js";
+import { checkRecordedPidLiveness } from "./stale-run-reconciler.js";
 import { lookupRunnerLauncher, resolveAgentRunnerLauncher, runnerLauncherPlacementError } from "../shared/runner-launcher.js";
 import { SUBAGENT_PROCESS_TERMINAL_EVENT } from "../../shared/types.js";
 import { assertAgentAllowedByCapabilityCeiling, intersectSubagentCapabilityCeilings, resolveCurrentSubagentCapabilityCeiling } from "../shared/capability-ceiling.js";
@@ -432,7 +433,12 @@ function spawnRunner(cfg, suffix, cwd, initialStatus, initialStatusPath, launchP
     const runnerProcessInstanceId = randomUUID();
     const hasRevivalLease = typeof cfg.revivalLease === "object";
     const launchBarrierToken = hasRevivalLease ? undefined : runnerProcessInstanceId;
-    const launchConfig = { ...cfg, runnerProcessInstanceId, ...(launchBarrierToken ? { launchBarrierToken } : {}) };
+    // A broker launcher may start the runner outside its own process, even under another kernel, so the
+    // spawned pid is only the wrapper's and only a direct runner shares Pi's boot id. The runner reports
+    // its own identity before it is allowed to proceed.
+    const launcher = cfg.launcher;
+    const bootId = launcher ? undefined : currentBootId();
+    const launchConfig = { ...cfg, runnerProcessInstanceId, ...(launchBarrierToken ? { launchBarrierToken } : {}), ...(bootId ? { bootId } : {}) };
     writePrivateAtomicJson(cfgPath, launchConfig);
     const command = binaryHost ?? nodeExecutable;
     const launchForStartup = launchConfig;
@@ -456,9 +462,6 @@ function spawnRunner(cfg, suffix, cwd, initialStatus, initialStatusPath, launchP
         fs.rmSync(startupConfirmPath, { force: true });
     if (startupProceedPath)
         fs.rmSync(startupProceedPath, { force: true });
-    // A broker launcher may start the runner outside its own process, so the spawned pid is only the
-    // wrapper's. The runner reports its own identity before it is allowed to proceed.
-    const launcher = launchConfig.launcher;
     const identityPath = launcher && launchBarrierToken && launchAsyncDir ? path.join(launchAsyncDir, "runner-startup.json") : undefined;
     if (identityPath)
         fs.rmSync(identityPath, { force: true });
@@ -550,7 +553,8 @@ function spawnRunner(cfg, suffix, cwd, initialStatus, initialStatusPath, launchP
                     }
                     // The runner may outlive its wrapper; only a confirmed-dead runner in this pid namespace finalizes here,
                     // otherwise status-pid reconciliation does it later.
-                    if (!runnerIdentity || runnerIdentity.pidNamespaceScope !== currentPidNamespaceScope() || checkPidLiveness(runnerIdentity.pid, process.kill, runnerIdentity.pidNamespaceScope !== undefined) !== "dead")
+                    if (!runnerIdentity || runnerIdentity.pidNamespaceScope !== currentPidNamespaceScope()
+                        || checkRecordedPidLiveness(runnerIdentity) !== "dead")
                         return;
                 }
                 finalizeProcessTerminal(asyncDir, runId, {
@@ -612,7 +616,7 @@ function spawnRunner(cfg, suffix, cwd, initialStatus, initialStatusPath, launchP
         try {
             writePrivateAtomicJson(initialStatusPath, {
                 ...initialStatus,
-                ...(launcher ? {} : { pid: proc.pid, pidNamespaceScope: currentPidNamespaceScope() }),
+                ...(launcher ? {} : { pid: proc.pid, pidNamespaceScope: currentPidNamespaceScope(), ...(bootId ? { bootId } : {}) }),
                 processTerminal: { version: 1, state: "pending", runId: initialStatus.runId, runnerProcessInstanceId },
             });
             // Aggregate waits must see the launch before the runner's first status update.
@@ -834,7 +838,7 @@ export function buildAsyncRunnerSteps(id, params) {
         let machineEnv;
         if (requestedMachine) {
             try {
-                const placement = resolveHerdrMachinePlacement({ machine: requestedMachine, cwd: runnerCwd, stepCwd: s.cwd ?? params.machineCwd });
+                const placement = resolveMachinePlacement({ machine: requestedMachine, cwd: runnerCwd, stepCwd: s.cwd ?? params.machineCwd });
                 machine = placement.machine;
                 machineEnv = placement.env;
             }
@@ -1331,6 +1335,7 @@ export function executeAsyncChain(id, params) {
     }
     const initialStatusAt = Date.now();
     const initialCompletionOwnerId = ctx.completionOwnerId ?? currentCompletionOwnerId();
+    const completionOwnerProcess = currentRecordedPid();
     const launchParentSessionId = ctx.parentSessionId ?? ctx.currentSessionId;
     try {
         writeRetainedRequiredChildExtensions(asyncDir, params.requiredExtensions ?? ctx.childRuntime?.requiredExtensions ?? resolveRequiredChildExtensions(launchParentSessionId ?? undefined));
@@ -1355,6 +1360,7 @@ export function executeAsyncChain(id, params) {
             asyncDir,
             sessionId: ctx.currentSessionId,
             completionOwnerId: ctx.completionOwnerId ?? currentCompletionOwnerId(),
+            completionOwnerProcess,
             ...(capabilityCeiling ? { capabilityCeiling } : {}),
             piPackageRoot,
             childSessionFactoryModule: childSessionFactoryModule(),
@@ -1393,6 +1399,7 @@ export function executeAsyncChain(id, params) {
             runId: id,
             ...(ctx.currentSessionId ? { sessionId: ctx.currentSessionId } : {}),
             ...(initialCompletionOwnerId ? { completionOwnerId: initialCompletionOwnerId } : {}),
+            completionOwnerProcess,
             mode: resultMode,
             state: "running",
             startedAt: initialStatusAt,
@@ -1620,7 +1627,7 @@ export function executeAsyncSingle(id, params) {
     let machineEnv;
     if (requestedMachine) {
         try {
-            const placement = resolveHerdrMachinePlacement({ machine: requestedMachine, cwd: runnerCwd, stepCwd: params.machineCwd });
+            const placement = resolveMachinePlacement({ machine: requestedMachine, cwd: runnerCwd, stepCwd: params.machineCwd });
             machine = placement.machine;
             machineEnv = placement.env;
         }
@@ -1895,6 +1902,7 @@ export function executeAsyncSingle(id, params) {
     let spawnResultOrPromise = {};
     const initialStatusAt = Date.now();
     const initialCompletionOwnerId = ctx.completionOwnerId ?? currentCompletionOwnerId();
+    const completionOwnerProcess = currentRecordedPid();
     const launchParentSessionId = ctx.parentSessionId ?? ctx.currentSessionId;
     try {
         spawnResultOrPromise = spawnRunner({
@@ -1977,6 +1985,7 @@ export function executeAsyncSingle(id, params) {
             asyncDir,
             sessionId: ctx.currentSessionId,
             completionOwnerId: ctx.completionOwnerId ?? currentCompletionOwnerId(),
+            completionOwnerProcess,
             ...(capabilityCeiling ? { capabilityCeiling } : {}),
             piPackageRoot,
             childSessionFactoryModule: childSessionFactoryModule(),
@@ -2018,6 +2027,7 @@ export function executeAsyncSingle(id, params) {
             runId: id,
             ...(ctx.currentSessionId ? { sessionId: ctx.currentSessionId } : {}),
             ...(initialCompletionOwnerId ? { completionOwnerId: initialCompletionOwnerId } : {}),
+            completionOwnerProcess,
             mode: "single",
             ...(params.toolCallId ? { toolCallId: params.toolCallId } : {}),
             state: "running",

package/src/runs/background/async-job-tracker.d.ts

@@ -1,6 +1,8 @@
 import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
 import * as fs from "node:fs";
 import { type AsyncJobState, type AsyncWidgetLayout, type ControlEvent, type SubagentState } from "../../shared/types.ts";
+import type { RawDrainStatusObserver } from "../shared/readonly-drain-observation.ts";
+import type { ResultDeliveryOwnership } from "./result-delivery-ownership.ts";
 interface AsyncJobTrackerOptions {
     completionRetentionMs?: number;
     /** Slow safety sweep for liveness repair when filesystem events are missed. */
@@ -12,6 +14,8 @@ interface AsyncJobTrackerOptions {
     platform?: NodeJS.Platform;
     onJobTerminal?: (job: AsyncJobState) => void;
     onJobCleanup?: (asyncId: string) => void;
+    /** Lets a run whose launching Pi exited hold its publication in the session that owns it. */
+    deliveryOwnerId?: ResultDeliveryOwnership["deliveryOwnerId"];
     watch?: typeof fs.watch;
     kill?: (pid: number, signal?: NodeJS.Signals | 0) => boolean;
     now?: () => number;
@@ -26,7 +30,8 @@ export declare function createAsyncJobTracker(pi: Pick<ExtensionAPI, "events">,
     handleStarted: (data: unknown) => void;
     handleComplete: (data: unknown) => void;
     resetJobs: (ctx?: ExtensionContext) => void;
-    restoreActiveJobs: (ctx?: ExtensionContext) => void;
+    /** `observeStatus` also sees the statuses of other sessions' runs that the listing skips. */
+    restoreActiveJobs: (ctx?: ExtensionContext, observeStatus?: RawDrainStatusObserver) => void;
     dispose: () => void;
 };
 export {};

package/src/runs/background/async-job-tracker.js

@@ -15,6 +15,7 @@ import { withWorkflowChildRunModel } from "./workflow-terminal-proof.js";
 import { validHostStepNodes } from "../shared/host-step-status.js";
 import { readProcessTerminal } from "./process-terminal.js";
 import { withCachedUiContext } from "../../shared/extension-context.js";
+import { OWNING_SESSION_COMPLETION_OWNER } from "../../shared/completion-owner.js";
 const CONTROL_EVENT_READ_CHUNK_BYTES = 64 * 1024;
 const MAX_CONTROL_EVENT_LINE_BYTES = 1024 * 1024;
 const CONTROL_EVENT_SCAN_WINDOW_BYTES = 2 * 1024 * 1024;
@@ -560,8 +561,11 @@ export function createAsyncJobTracker(pi, state, asyncDirRoot, options = {}) {
                 if (isTerminalJobStatus(job.status)) {
                     let publication = terminalPublications.get(job.asyncId);
                     if (!publication && status.mode !== "workflow" && status.processTerminal?.state === "pending"
-                        && status.runId === job.asyncId && status.sessionId === state.currentSessionId
-                        && status.completionOwnerId && status.completionOwnerId === state.completionOwnerId) {
+                        && status.runId === job.asyncId && status.completionOwnerId
+                        && ((status.sessionId === state.currentSessionId && status.completionOwnerId === state.completionOwnerId)
+                            // Also covers a session inherited after /new or /resume: deliveryOwnerId checks run ownership.
+                            || (typeof status.sessionId === "string"
+                                && options.deliveryOwnerId?.(status.sessionId, status.completionOwnerId, status.completionOwnerProcess, status.parentWorkflowRunId) === OWNING_SESSION_COMPLETION_OWNER))) {
                         publication = { instanceId: status.processTerminal.runnerProcessInstanceId, pending: true };
                         terminalPublications.set(job.asyncId, publication);
                     }
@@ -883,7 +887,7 @@ export function createAsyncJobTracker(pi, state, asyncDirRoot, options = {}) {
             rerenderWidget(ctx, []);
         }
     };
-    const restoreActiveJobs = (ctx) => {
+    const restoreActiveJobs = (ctx, observeStatus) => {
         if (ctx?.hasUI)
             state.lastUiContext = ctx;
         state.statusProjectionSessionId = null;
@@ -891,7 +895,8 @@ export function createAsyncJobTracker(pi, state, asyncDirRoot, options = {}) {
             return;
         let runs;
         try {
-            runs = listAsyncRuns(asyncDirRoot, { states: ["queued", "running"], sessionId: state.currentSessionId, resultsDir, kill: options.kill, now: options.now });
+            // A workflow whose Pi exited is repaired here, in the session that owns it, which then delivers its notice.
+            runs = listAsyncRuns(asyncDirRoot, { states: ["queued", "running"], sessionId: state.currentSessionId, resultsDir, kill: options.kill, now: options.now, adoptCompletionOwnerId: state.completionOwnerId }, observeStatus);
         }
         catch (error) {
             console.error(`Failed to restore active async jobs from '${asyncDirRoot}':`, error);

package/src/runs/background/async-status.d.ts

@@ -142,6 +142,8 @@ interface AsyncRunListOptions {
     includeNested?: boolean;
     /** Explicit repair/debug escape hatch. Normal runtime paths must not set this. */
     repairScan?: boolean;
+    /** This process's completion owner, adopted by an owner-exited workflow repair of a run the session owns; needs `sessionId`. */
+    adoptCompletionOwnerId?: string;
 }
 type TargetedAsyncRunResolution = {
     kind: "exact";

package/src/runs/background/async-status.js

@@ -37,6 +37,9 @@ function isAsyncStatusIsolationError(asyncDir, error) {
         || message.startsWith(`Invalid host step '${statusPath}`)
         || /^(workflowChildren|Invalid workflowChildren)/.test(message);
 }
+// Status path -> last logged signature. A corrupt run is re-scanned on every
+// status poll, so the line repeats only when the file or the outcome changes.
+const reportedCorruptStatus = new Map();
 function isolateCorruptActiveRun(asyncDir, runId, error, now) {
     const statusPath = path.join(asyncDir, "status.json");
     const processTerminal = readProcessTerminal(asyncDir, { runId });
@@ -61,7 +64,20 @@ function isolateCorruptActiveRun(asyncDir, runId, error, now) {
             markerAction = `failed to release active marker: ${getErrorMessage(releaseError)}`;
         }
     }
-    console.error(`[pi-subagents] Skipping corrupt active async run '${runId}' at '${statusPath}': ${getErrorMessage(error)}; ${markerAction}.`);
+    const line = `[pi-subagents] Skipping corrupt active async run '${runId}' at '${statusPath}': ${getErrorMessage(error)}; ${markerAction}.`;
+    let fileSignature = "";
+    try {
+        const stat = fs.statSync(statusPath);
+        fileSignature = `${stat.size}:${stat.mtimeMs}`;
+    }
+    catch {
+        // A missing file still gets the line once; its message carries the cause.
+    }
+    const signature = `${fileSignature}\n${line}`;
+    if (reportedCorruptStatus.get(statusPath) === signature)
+        return;
+    reportedCorruptStatus.set(statusPath, signature);
+    console.error(line);
 }
 function isNotFoundError(error) {
     return typeof error === "object"
@@ -425,16 +441,19 @@ export function listAsyncRuns(asyncDirRoot, options = {}, observeStatus) {
         let status;
         try {
             // Reconciliation can rewrite state; session-scoped discovery does not own foreign runs.
+            let owned = false;
             if (owners) {
                 const stored = readStatus(asyncDir);
                 if (stored && !owners.has(stored.sessionId)) {
                     observeStatus?.(stored);
                     continue;
                 }
+                owned = stored !== null;
             }
+            // Only a run this session owns may adopt the caller's completion owner.
             const reconciliation = options.reconcile === false
                 ? undefined
-                : reconcileAsyncRun(asyncDir, { resultsDir: options.resultsDir, kill: options.kill, now: options.now }, observeStatus);
+                : reconcileAsyncRun(asyncDir, { resultsDir: options.resultsDir, kill: options.kill, now: options.now, adoptCompletionOwnerId: owned ? options.adoptCompletionOwnerId : undefined }, observeStatus);
             status = (reconciliation?.status ?? readStatus(asyncDir));
             if (options.reconcile === false)
                 observeStatus?.(status);

package/src/runs/background/await-async-run.js

@@ -2,9 +2,8 @@ import * as fs from "node:fs";
 import { readStatus } from "../../shared/utils.js";
 import { workflowAwaitedAsyncResultPath } from "./async-execution.js";
 import { waitForImportedAsyncRoot } from "./chain-root-attachment.js";
-import { currentPidNamespaceScope } from "./pid-namespace.js";
 import { resultPayloadPathForSessionRun, resultSnapshotReplaced, withResultRunLease } from "./result-files.js";
-import { checkPidLiveness } from "./stale-run-reconciler.js";
+import { checkRecordedPidLiveness } from "./stale-run-reconciler.js";
 function errorMessage(error) {
     return error instanceof Error ? error.message : String(error);
 }
@@ -13,11 +12,8 @@ function runnerExitedWithoutResult(asyncDir, runId, resultPath) {
     const status = readStatus(asyncDir);
     if (!status || (status.state !== "running" && status.state !== "queued") || typeof status.pid !== "number")
         return false;
-    const observedScope = currentPidNamespaceScope();
-    if (status.pidNamespaceScope !== undefined && status.pidNamespaceScope !== observedScope)
-        return false;
-    const pidScopeVerified = status.pidNamespaceScope !== undefined && status.pidNamespaceScope === observedScope;
-    if (checkPidLiveness(status.pid, undefined, pidScopeVerified) !== "dead")
+    // A pid from another namespace never reads as dead here, so the runner is not presumed gone.
+    if (checkRecordedPidLiveness({ pid: status.pid, pidNamespaceScope: status.pidNamespaceScope, bootId: status.bootId }) !== "dead")
         return false;
     return !fs.existsSync(resultPath) && !(status.sessionId && resultPayloadPathForSessionRun(asyncDir, status.sessionId, runId));
 }

package/src/runs/background/boot-id.d.ts

@@ -0,0 +1,12 @@
+import type { RecordedPid } from "./stale-run-reconciler.ts";
+/**
+ * Identity of the current machine boot, read once per process. A pid recorded under a
+ * different boot id cannot still be running. Undefined when the platform has none.
+ */
+export declare function currentBootId(): string | undefined;
+/** This process as a recorded pid, without the fields the platform does not have. */
+export declare function currentRecordedPid(): RecordedPid;
+/** Fixes the boot id without reading the OS; runners take Pi's value from their config. */
+export declare function primeBootId(value: string | undefined): void;
+/** Clears the cache so the next read calls `nextReader` (default: the OS reader). */
+export declare function resetBootIdForTesting(nextReader?: () => string | undefined): void;

package/src/runs/background/boot-id.js

@@ -0,0 +1,47 @@
+import { execFileSync } from "node:child_process";
+import * as fs from "node:fs";
+import { currentPidNamespaceScope } from "./pid-namespace.js";
+function readBootIdFromOs() {
+    try {
+        if (process.platform === "linux")
+            return fs.readFileSync("/proc/sys/kernel/random/boot_id", "utf-8").trim() || undefined;
+        if (process.platform === "darwin") {
+            return execFileSync("sysctl", ["-n", "kern.bootsessionuuid"], { encoding: "utf-8", timeout: 1000, stdio: ["ignore", "pipe", "ignore"] }).trim() || undefined;
+        }
+    }
+    catch {
+        // An unreadable boot id only means liveness falls back to probing the pid.
+    }
+    return undefined;
+}
+// Process-wide, so the bundled extension and the compiled runner modules share one value.
+const BOOT_ID_KEY = Symbol.for("pi-subagents.boot-id.v1");
+const runtime = globalThis;
+let reader = readBootIdFromOs;
+/**
+ * Identity of the current machine boot, read once per process. A pid recorded under a
+ * different boot id cannot still be running. Undefined when the platform has none.
+ */
+export function currentBootId() {
+    const cached = runtime[BOOT_ID_KEY];
+    if (cached)
+        return cached.value;
+    const value = reader();
+    runtime[BOOT_ID_KEY] = { value };
+    return value;
+}
+/** This process as a recorded pid, without the fields the platform does not have. */
+export function currentRecordedPid() {
+    const pidNamespaceScope = currentPidNamespaceScope();
+    const bootId = currentBootId();
+    return { pid: process.pid, ...(pidNamespaceScope ? { pidNamespaceScope } : {}), ...(bootId ? { bootId } : {}) };
+}
+/** Fixes the boot id without reading the OS; runners take Pi's value from their config. */
+export function primeBootId(value) {
+    runtime[BOOT_ID_KEY] = { value };
+}
+/** Clears the cache so the next read calls `nextReader` (default: the OS reader). */
+export function resetBootIdForTesting(nextReader) {
+    reader = nextReader ?? readBootIdFromOs;
+    delete runtime[BOOT_ID_KEY];
+}

package/src/runs/background/interrupted-elsewhere.d.ts

@@ -0,0 +1,22 @@
+import type { ForegroundResumeRun } from "../../shared/types.ts";
+import type { RawDrainStatusObserver } from "../shared/readonly-drain-observation.ts";
+interface InterruptedElsewhereCollector {
+    /** Observer for the async statuses session start already reads; keeps foreign ones that may be interrupted. */
+    observeStatus: RawDrainStatusObserver;
+    /** Receives the foreground records of other sessions that session start already reads. */
+    observeForegroundRun: (run: ForegroundResumeRun) => void;
+    /** One line per other session that can be reopened and has runs whose Pi is dead. */
+    lines: () => string[];
+}
+/**
+ * Collects runs of other sessions in this folder that were cut off because their Pi died, from what
+ * session start reads anyway. Read-only: nothing is written to those runs or sessions. The cheap
+ * filters run as records arrive; `lines` reads each session file's header once, then probes each
+ * candidate's pid once.
+ */
+export declare function createInterruptedElsewhereCollector(input: {
+    currentSessionId: string;
+    cwd: string;
+    now: number;
+}): InterruptedElsewhereCollector;
+export {};