pi-ultracode 0.9.0 → 0.10.0

package/src/prompts.ts

@@ -1,6 +1,6 @@
 /** Prompt text for Ultracode's adaptive analysis-depth modes. */
 
-import { ANALYSIS_DEPTHS, DEPTH_CRITERIA, DEPTH_SELECTION_RULES, type ActiveUltracodeMode, type AnalysisDepth } from "./depth.ts";
+import { ANALYSIS_DEPTHS, DEPTH_CRITERIA, DEPTH_SELECTION_RULES, type ActiveUltracodeMode } from "./depth.ts";
 import { WORKFLOW_EFFORT_GUIDELINES } from "./effort-policy.ts";
 
 /** One-line description shown by `/ultracode status` and the footer. */
@@ -8,10 +8,10 @@ export const ULTRACODE_TAGLINE = "semantic-depth workflow orchestration";
 
 /**
  * The standing system-prompt section body (Pi adds the XML wrapper). Injected
- * on every active turn. Auto uses Jev when available, otherwise the parent
- * routes in its normal turn; neither path needs a separate router agent.
+ * on every active turn. In auto, the parent routes using its full context
+ * in its normal turn without a separate router agent.
  */
-export function ultracodeSystemBlock(mode: ActiveUltracodeMode = "deep", initialDepth?: AnalysisDepth): string {
+export function ultracodeSystemBlock(mode: ActiveUltracodeMode = "deep"): string {
   return [
     `Configured mode: ${mode}.`,
     "Analysis depth is a semantic quality decision, never a wall-clock decision. Do not use elapsed time, deadlines, or duration limits to choose, lower, or stop analysis depth.",
@@ -22,7 +22,7 @@ export function ultracodeSystemBlock(mode: ActiveUltracodeMode = "deep", initial
     "Depth applicability and required verification:",
     ...ANALYSIS_DEPTHS.map((depth) => `- ${depth}: ${DEPTH_CRITERIA[depth]}`),
     "",
-    ...modeInstructions(mode, initialDepth),
+    ...modeInstructions(mode),
     "",
     "Evidence-driven escalation and stopping:",
     "- Escalate only for material correctness risk, missing direct evidence, conflicting findings, or an unresolved question that can change the answer.",
@@ -40,13 +40,11 @@ export function ultracodeSystemBlock(mode: ActiveUltracodeMode = "deep", initial
   ].join("\n");
 }
 
-function modeInstructions(mode: ActiveUltracodeMode, initialDepth?: AnalysisDepth): string[] {
+function modeInstructions(mode: ActiveUltracodeMode): string[] {
   if (mode === "auto") {
     return [
-      ...(initialDepth
-        ? [`Initial analysis depth: ${initialDepth} (Jev). Start with its evidence requirements; this is not a fixed mode. Do not repeat initial classification or spawn a router agent.`]
-        : ["Before acting, silently route this task to focused, standard, or deep using the criteria above. Do not spawn a router agent or make an extra model request for classification."]),
-      "Begin at the shallowest sufficient depth and escalate only when evidence triggers an escalation condition below. Relevant conversation or repository evidence unavailable to the initial selector can justify immediate escalation.",
+      "Before acting, silently route this task to focused, standard, or deep using the criteria above and relevant conversation and repository context. Do not spawn a router agent or make an extra model request for classification.",
+      "Begin at the shallowest sufficient depth and escalate only when evidence triggers an escalation condition below.",
     ];
   }
   return [
@@ -80,13 +78,14 @@ export const WORKFLOW_PROMPT_SNIPPET =
 
 /** Guideline bullets appended to the Guidelines section when the tool is active. */
 export const WORKFLOW_GUIDELINES: string[] = [
-  "Use the workflow tool only when independent decomposition, targeted verification, isolation, or context scale adds value; use the parent agent directly for a bounded task.",
+  "Work directly by default. Use workflow only for substantive independent subtasks, a specific claim needing independent verification, necessary isolation, or material context pressure—not merely multiple steps or files. Before invoking it, state the concrete benefit and use the smallest workflow that delivers it.",
   "For an auto-depth workflow, log `analysis-depth: <level> — <reason>` before launching agents, `analysis-escalation: ...` when evidence requires more depth, and `analysis-stop: ...` when evidence is sufficient. Elapsed time must never determine depth.",
   "For workflow verification, run skeptics only for high-risk, conflicting, low-confidence, or weakly evidenced claims. Do not automatically attach a skeptic to every branch.",
   "For workflow synthesis, prefer structured results plus deterministic or parent-session merging. Start a synthesis/adjudication agent only for a material unresolved conflict, and normally give pure synthesis lower effort and no broad source-search mandate.",
   ...WORKFLOW_EFFORT_GUIDELINES,
   "For the workflow tool, provide workflow source with `script`, `scriptPath`, or `name`. Inline `script` must be one raw JavaScript string: no Markdown fences, no prose around the script.",
   "For the workflow tool, the script's first statement must be `export const meta = { name: 'short_snake_case', description: 'non-empty human description' }`. meta must be a pure literal: no variables, function calls, spreads, or template interpolation. meta.phases is optional and should mirror your phase() titles.",
+  "Provide real overall goals, acceptance checks, and known dependencies in the workflow description or optional literal meta fields when useful; never invent missing metadata. Jev uses existing meta/args and scheduler structure as shared background, not the raw script. Keep each agent prompt complete, including relevant upstream results: effort is judged for that task, not raised uniformly for the workflow.",
   "For the workflow tool, write plain JavaScript after the meta export. No TypeScript syntax, imports, require(), fs, network, Date/Intl/Temporal, Math.random(), binary memory constructors, WebAssembly, or dynamic method calls such as value[key](...) (they bypass deterministic checks or resource bounds). Stamp timestamps after the workflow returns; vary randomness by agent index.",
   "For the workflow tool, a useful workflow should call agent() at least once. Each agent() call should pass a short unique label (2-5 words) so live status and error reporting stay readable.",
   "For the workflow tool, DEFAULT TO pipeline(items, ...stages): items flow through stages independently with no barrier, so item A can be in stage 3 while item B is still in stage 1. Only use parallel() (a barrier that awaits all thunks) when a later stage genuinely needs ALL prior results together (dedup/merge across the full set, early-exit on zero, cross-item comparison).",

package/src/workflow/agent-runner.ts

@@ -14,6 +14,7 @@ import * as PiCodingAgent from "@earendil-works/pi-coding-agent";
 import {
   createAgentSession,
   createCodingTools,
+  createCodemodeExtension,
   DefaultResourceLoader,
   getAgentDir,
   SessionManager,
@@ -43,7 +44,7 @@ import {
   type ThinkingLevel,
 } from "../thinking.ts";
 import type { AgentTypeDef } from "./agent-types.ts";
-import { selectJevEffort } from "../jev.ts";
+import { selectJevEfforts, type JevRuntime, type JevSelection } from "../jev.ts";
 
 export type { ThinkingLevel } from "../thinking.ts";
 
@@ -77,12 +78,16 @@ export async function createWorkflowChildResourceLoader(
     agentDir: options.agentDir,
     settingsManager,
     noExtensions: true,
+    extensionFactories: [createCodemodeExtension({ mode: "on", models: false })],
     skillsOverride: ({ skills, diagnostics }) => ({
       skills: skills.filter((skill) => !PARENT_ONLY_CHILD_SKILLS.has(skill.name)),
       diagnostics,
     }),
   });
   await loader.reload();
+  settingsManager.applyOverrides({
+    defaultTools: [...(settingsManager.getDefaultTools() ?? []), "+codemode"],
+  });
   return loader;
 }
 
@@ -97,7 +102,7 @@ export interface ModelLike {
   thinkingLevelMap?: Partial<Record<ThinkingLevel, string | null>>;
 }
 
-export interface ModelRegistryLike {
+export interface ModelRegistryLike extends Partial<JevRuntime> {
   getAvailable(): ModelLike[];
   /** Legacy public projection retained for consumers of this structural type. */
   getAll?(): ModelLike[];
@@ -112,8 +117,8 @@ export interface ModelRegistryLike {
   getApiKeyForProvider?(provider: string): Promise<string | undefined>;
 }
 
-/** Structural ModelRuntime seam that remains loadable on pre-0.80.8 Pi. */
-export interface ModelRuntimeLike {
+/** Structural ModelRuntime seam for SDK hosts and test doubles. */
+export interface ModelRuntimeLike extends Partial<JevRuntime> {
   getModel?(provider: string, modelId: string): ModelLike | undefined;
   registerProvider?(provider: string, config: any): void;
   /** Pi 0.81+ complete provider registration. */
@@ -231,7 +236,7 @@ export interface WorkflowAgentRunnerOptions {
   cwd: string;
   /** Parent session's immutable project-trust decision. */
   projectTrusted?: boolean;
-  /** Synchronous extension facade used only for model selection and state replay. */
+  /** Host registry for model selection, state replay and native classification/auth. */
   modelRegistry?: ModelRegistryLike;
   /** Canonical runtime to share across child sessions when supplied by an SDK host. */
   modelRuntime?: ModelRuntimeLike;
@@ -280,13 +285,30 @@ export interface AgentRunCall {
   agentTypeDef?: AgentTypeDef;
   /** Override cwd (worktree). */
   cwd?: string;
+  /** Scheduling hooks supplied only to runners declaring supportsSchedulingHooks. */
+  selectEffort?: (task?: JevSelection) => Promise<ThinkingLevel | undefined>;
+  /** Await after selectEffort and before execution; repeated calls share one permit. */
+  acquireExecution?: () => Promise<void>;
   /** Safe compact activity stream used by the inline workflow status. */
   onActivity?: (event: AgentActivityInput) => void;
   /** Private detailed stream used by the task transcript store. */
   onTelemetry?: (event: AgentTelemetryEvent) => void;
 }
 
-export class WorkflowAgentRunner {
+export interface AgentRunner {
+  /**
+   * Opt in to preparation outside the execution limit. Before executing, run()
+   * must await selectEffort exactly once (undefined skips classification), then
+   * await acquireExecution. Forwarding wrappers must declare this capability
+   * and forward both hooks. A runner without it receives no scheduling hooks;
+   * the runtime admits its entire run() and excludes it from classification.
+   */
+  readonly supportsSchedulingHooks?: boolean;
+  run(call: AgentRunCall): Promise<AgentRunResult>;
+}
+
+export class WorkflowAgentRunner implements AgentRunner {
+  readonly supportsSchedulingHooks = true;
   private readonly baseCwd: string;
   private readonly projectTrusted: boolean;
   private readonly modelRegistry?: ModelRegistryLike;
@@ -457,22 +479,24 @@ export class WorkflowAgentRunner {
       }
 
       const prompt = this.buildPrompt(call, Boolean(call.schema));
-      const jevApiKey = process.env.TYPESAFE_API_KEY?.trim();
-      if (jevApiKey && session.model) {
-        const supportedEfforts = session.getAvailableThinkingLevels();
-        // A single supported level leaves no decision to make.
-        if (supportedEfforts.length > 1) {
-          const effort = await selectJevEffort({
-            apiKey: jevApiKey,
-            task: prompt,
-            model: session.model,
-            supportedEfforts,
-            signal: call.signal,
-          });
-          if (call.signal?.aborted) throw abortedError();
-          if (effort !== undefined) session.setThinkingLevel(effort, { persist: false });
-        }
-      }
+      const supportedEfforts = session.model ? session.getAvailableThinkingLevels() : [];
+      // Classifier-only runtime keys belong to the host, not the child runtime's
+      // chat-provider replay. An explicit SDK runtime remains authoritative.
+      const classifierRuntime = this.providedModelRuntime ?? this.modelRegistry ?? modelRuntime;
+      const selectionTask: JevSelection | undefined = session.model && supportedEfforts.length > 1
+        ? { runtime: classifierRuntime, task: prompt, model: session.model, supportedEfforts }
+        : undefined;
+      const effort = call.selectEffort
+        ? await call.selectEffort(selectionTask)
+        : selectionTask
+          ? (await selectJevEfforts({ ...selectionTask, tasks: [selectionTask], signal: call.signal }))[0]
+          : undefined;
+      if (call.signal?.aborted) throw abortedError();
+      if (effort !== undefined) session.setThinkingLevel(effort, { persist: false });
+      // Idle session preparation and classification never hold an execution slot.
+      // The runtime retains the permit through result publication/worktree delivery.
+      await call.acquireExecution?.();
+      if (call.signal?.aborted) throw abortedError();
       actualEffort = session.thinkingLevel;
       safeEmitTelemetry(call.onTelemetry, {
         kind: "model_resolved",
@@ -497,6 +521,8 @@ export class WorkflowAgentRunner {
         });
       }
 
+      // Observers can cancel synchronously; do not enter Pi's auth preflight afterward.
+      if (call.signal?.aborted) throw abortedError();
       await session.prompt(prompt, {
         // Pi invokes this after async input/before_agent_start preflight and
         // immediately before _runAgentPrompt(). Throwing here closes the window

package/src/workflow/runtime.ts

@@ -12,6 +12,8 @@
 import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
+import type { JsonObject } from "@earendil-works/pi-ai";
+import { createJevBatch } from "../jev.ts";
 import { parseWorkflowScript, type WorkflowMeta } from "./parser.ts";
 import { executeWorkflowScript, type ScriptExecutorHost } from "./script-executor.ts";
 import {
@@ -26,12 +28,13 @@ import {
   type PanelReservation,
 } from "./admission.ts";
 // Static import: a dynamic import() of this module misbehaves under Pi's jiti
-// loader ("WorkflowAgentRunner is not a constructor"). Tests inject a runner, so
-// they never construct this class; production builds it via getRunner().
+// loader ("WorkflowAgentRunner is not a constructor"). getRunner() constructs the
+// default runner unless the host injects one.
 import { resolveModelSelection, WorkflowAgentRunner } from "./agent-runner.ts";
 import type {
   AgentActivityInput,
   AgentRunResult,
+  AgentRunner,
   AgentTelemetryEvent,
   AgentUsage,
   ModelLike,
@@ -107,14 +110,14 @@ export interface WorkflowRunOptions {
   hostCallLimit?: number;
   /** Internal test seam for the script Worker's V8 old-generation heap cap. */
   workerMemoryLimitMb?: number;
-  /** Synchronous extension facade used for model selection. */
+  /** Host registry used for model selection and native classification/auth. */
   modelRegistry?: ModelRegistryLike;
   /** Canonical model/auth runtime shared across child sessions. */
   modelRuntime?: ModelRuntimeLike;
   model?: ModelLike;
   thinkingLevel?: ThinkingLevel;
-  /** Inject a runner (tests). */
-  runner?: { run: WorkflowAgentRunner["run"] };
+  /** Inject a runner; scheduling-aware wrappers must declare supportsSchedulingHooks. */
+  runner?: AgentRunner;
   journal?: RunJournal;
   /** Loads a saved workflow body by name; defaults to disk discovery. */
   loadSavedWorkflow?: (name: string) => { meta: WorkflowMeta; body: string };
@@ -169,6 +172,17 @@ interface ActivePanelTrace {
   calls: Array<{ callPath: string; status: "pending" | "success" | "failed" }>;
 }
 
+interface AgentPayload {
+  callPath?: unknown;
+  prompt: unknown;
+  options?: unknown;
+  assignedPhase?: string;
+  workflowPath?: string[];
+  workflowContext?: JsonObject;
+  scheduling?: JsonObject[];
+  reservationIds?: string[];
+}
+
 interface RuntimeState {
   currentPhase?: string;
   logs: string[];
@@ -208,7 +222,7 @@ export async function runWorkflow<T = unknown>(
   const started = Date.now();
   const maxAgents = normalizeMaxAgents(options.maxAgents ?? options.journal?.effectiveMaxAgents);
   const { meta, body } = parseWorkflowScript(rawScript);
-  const runtime = new Runtime(effectiveOptions, maxAgents);
+  const runtime = new Runtime(effectiveOptions, maxAgents, meta);
   const onOuterAbort = () => runtime.abort();
   options.signal?.addEventListener("abort", onOuterAbort, { once: true });
   if (options.signal?.aborted) runtime.abort();
@@ -261,9 +275,10 @@ class Runtime implements ScriptExecutorHost {
   readonly state: RuntimeState;
   private readonly options: WorkflowRunOptions;
   private readonly cwd: string;
-  private runnerInstance: { run: WorkflowAgentRunner["run"] } | undefined;
+  private runnerInstance: AgentRunner | undefined;
   private readonly agentTypes: Map<string, AgentTypeDef>;
-  private readonly limiter: <R>(fn: () => Promise<R>) => Promise<R>;
+  private readonly acquireExecution: () => Promise<() => void>;
+  private readonly workflowContext: JsonObject;
   private readonly pending = new Set<Promise<unknown>>();
   private readonly childController = new AbortController();
   private readonly scriptController = new AbortController();
@@ -275,7 +290,8 @@ class Runtime implements ScriptExecutorHost {
   private cleanupDeadline?: number;
   policyError: WorkflowPolicyError | undefined;
 
-  constructor(options: WorkflowRunOptions, maxAgents: number) {
+  constructor(options: WorkflowRunOptions, maxAgents: number, meta: WorkflowMeta) {
+    this.workflowContext = JSON.parse(JSON.stringify({ meta, args: options.args }));
     this.options = options;
     this.cwd = options.cwd ?? process.cwd();
     this.runnerInstance = options.runner;
@@ -294,7 +310,7 @@ class Runtime implements ScriptExecutorHost {
     const cores = (globalThis as any).navigator?.hardwareConcurrency ?? os.cpus().length ?? 8;
     const defaultConcurrency = Math.max(1, Math.min(Math.max(1, cores - 2), MAX_CONCURRENCY));
     const concurrency = normalizeConcurrency(options.concurrency, defaultConcurrency);
-    this.limiter = createLimiter(concurrency, this.childController.signal);
+    this.acquireExecution = createExecutionSemaphore(concurrency, this.childController.signal);
   }
 
   get agentsUsed(): number {
@@ -333,7 +349,7 @@ class Runtime implements ScriptExecutorHost {
   }
 
   /** Lazily construct the default in-memory runner (skipped when a runner is injected). */
-  private getRunner(): { run: WorkflowAgentRunner["run"] } {
+  private getRunner(): AgentRunner {
     if (!this.runnerInstance) {
       this.runnerInstance = new WorkflowAgentRunner({
         cwd: this.cwd,
@@ -353,6 +369,7 @@ class Runtime implements ScriptExecutorHost {
       cwd: this.cwd,
       args,
       name,
+      meta: this.workflowContext.meta,
       signal: this.scriptController.signal,
       stallTimeoutMs: this.options.stallTimeoutMs,
       hostCallLimit: this.options.hostCallLimit,
@@ -576,14 +593,17 @@ class Runtime implements ScriptExecutorHost {
     }
   }
 
-  async agent(payload: {
-    callPath?: unknown;
-    prompt: unknown;
-    options?: unknown;
-    assignedPhase?: string;
-    workflowPath?: string[];
-    reservationIds?: string[];
-  }): Promise<unknown> {
+  agent(payload: AgentPayload): Promise<unknown> {
+    return this.agentBatch([payload])[0];
+  }
+
+  agentBatch(payloads: AgentPayload[]): Promise<unknown>[] {
+    const members = createJevBatch(payloads.length, this.workflowContext, this.childController.signal);
+    return payloads.map((payload, index) =>
+      this.runAgent(payload, members[index]).finally(() => members[index].skip()));
+  }
+
+  private async runAgent(payload: AgentPayload, member: ReturnType<typeof createJevBatch>[number]): Promise<unknown> {
     this.throwIfAborted();
     const workerCallPath = requireString(payload.callPath, "agent callPath");
     if (this.seenCallPaths.has(workerCallPath)) {
@@ -702,7 +722,8 @@ class Runtime implements ScriptExecutorHost {
     }
 
     this.beginPanelAgent(callPath);
-    const run = this.limiter(async () => {
+    const run = (async () => {
+      let releaseExecution: (() => void) | undefined;
       this.notifyObserver(() => this.options.onAgentStart?.({
         id,
         callPath,
@@ -723,11 +744,22 @@ class Runtime implements ScriptExecutorHost {
       let observedUsage: AgentUsage | undefined;
       try {
         this.throwIfAborted();
+        const runner = this.getRunner();
+        let executionPermit: Promise<() => void> | undefined;
+        const acquireExecution = async () => {
+          // Forwarding runners can re-enter while acquisition is pending or complete.
+          releaseExecution = await (executionPermit ??= this.acquireExecution());
+          this.throwIfAborted();
+        };
+        // Only declared scheduling-aware runners prepare/classify before admission.
+        if (!runner.supportsSchedulingHooks) {
+          member.skip();
+          await acquireExecution();
+        }
         if (opts.isolation === "worktree") {
           worktree = this.createIsolatedWorktree(id);
         }
 
-        const runner = this.getRunner();
         const onActivity: ((e: AgentActivityInput) => void) | undefined = this.options.onAgentActivity
           ? (e: AgentActivityInput) =>
               this.options.onAgentActivity!({ id, callPath, label, phase: assignedPhase, workflowPath, ...e })
@@ -742,6 +774,25 @@ class Runtime implements ScriptExecutorHost {
           label,
           schema: opts.schema,
           signal: this.childController.signal,
+          ...(runner.supportsSchedulingHooks ? {
+            acquireExecution,
+            selectEffort: (task) => {
+              if (!task) {
+                member.skip();
+                return Promise.resolve(undefined);
+              }
+              return member.select({
+                ...task,
+                context: {
+                  callPath,
+                  workflowPath,
+                  scheduling: payload.scheduling ?? [],
+                  ...(assignedPhase ? { phase: assignedPhase } : {}),
+                  ...(payload.workflowContext ? { workflow: payload.workflowContext } : {}),
+                },
+              });
+            },
+          } : {}),
           instructions: buildInstructions(assignedPhase, opts),
           modelPattern: opts.model,
           agentTypeDef,
@@ -858,6 +909,7 @@ class Runtime implements ScriptExecutorHost {
         }));
         return null;
       } finally {
+        releaseExecution?.();
         if (worktree && worktreeSettled && !keepWorktree) {
           try {
             removeWorktree(worktree);
@@ -866,7 +918,7 @@ class Runtime implements ScriptExecutorHost {
           }
         }
       }
-    });
+    })();
     this.track(run);
     return await run;
   }
@@ -1224,7 +1276,7 @@ async function raceWithCleanupTimeout(
   }
 }
 
-function createLimiter(limit: number, signal: AbortSignal): <T>(fn: () => Promise<T>) => Promise<T> {
+function createExecutionSemaphore(limit: number, signal: AbortSignal): () => Promise<() => void> {
   let active = 0;
   const queue: Array<{ resolve: () => void; reject: (error: Error) => void }> = [];
 
@@ -1258,13 +1310,9 @@ function createLimiter(limit: number, signal: AbortSignal): <T>(fn: () => Promis
     waiter.resolve();
   };
 
-  return async <T>(fn: () => Promise<T>): Promise<T> => {
+  return async () => {
     await acquire();
-    try {
-      return await fn();
-    } finally {
-      release();
-    }
+    return release;
   };
 }
 

package/src/workflow/script-executor.ts

@@ -14,6 +14,8 @@ import {
 
 export interface ScriptExecutorHost {
   agent(payload: any): Promise<unknown>;
+  /** Sealed ready calls; promises settle independently, without a result barrier. */
+  agentBatch?(payloads: any[]): Promise<unknown>[];
   /** Cancel child work after a fatal script policy without terminating branch finally blocks. */
   abortChildren?(error: Error): void;
   reservePanel(payload: {
@@ -43,6 +45,7 @@ export interface ScriptExecutorOptions {
   cwd: string;
   args?: unknown;
   name: string;
+  meta?: unknown;
   signal: AbortSignal;
   checkpointLimit?: number;
   /** Internal test seam: how long the worker may go without a heartbeat. Not a public workflow option. */
@@ -70,6 +73,7 @@ export async function executeWorkflowScript(
       args: options.args,
       cwd: options.cwd,
       name: options.name,
+      meta: options.meta,
       checkpointLimit: options.checkpointLimit ?? DEFAULT_WORKFLOW_CHECKPOINT_LIMIT,
       hostCallLimit: normalizeHostCallLimit(options.hostCallLimit),
     },
@@ -185,14 +189,14 @@ export async function executeWorkflowScript(
           }
           return;
         }
+        if (message.type === "agentBatch") {
+          const calls = message.calls as Array<{ payload: unknown }>;
+          const results = host.agentBatch?.(calls.map((call) => call.payload));
+          for (const [index, call] of calls.entries()) dispatchRpc(call, results?.[index]);
+          return;
+        }
         if (message.type === "rpc") {
-          pendingRpcCount++;
-          lastProgress = Date.now();
-          void handleRpc(message).finally(() => {
-            pendingRpcCount = Math.max(0, pendingRpcCount - 1);
-            lastProgress = Date.now();
-            maybeSettleFatal();
-          });
+          dispatchRpc(message);
           return;
         }
         if (message.type === "result") {
@@ -238,13 +242,23 @@ export async function executeWorkflowScript(
         }
       });
 
-      async function handleRpc(message: any): Promise<void> {
+      function dispatchRpc(message: any, agentResult?: Promise<unknown>): void {
+        pendingRpcCount++;
+        lastProgress = Date.now();
+        void handleRpc(message, agentResult).finally(() => {
+          pendingRpcCount = Math.max(0, pendingRpcCount - 1);
+          lastProgress = Date.now();
+          maybeSettleFatal();
+        });
+      }
+
+      async function handleRpc(message: any, agentResult?: Promise<unknown>): Promise<void> {
         const { id, op, payload } = message;
         try {
           let value: unknown;
           switch (op) {
             case "agent":
-              value = await host.agent(payload);
+              value = await (agentResult ?? host.agent(payload));
               break;
             case "reservePanel":
               value = await host.reservePanel(payload);