Harden workflow runner for production

Author: robzilla1738

README.md

@@ -37,17 +37,24 @@ from Codex or from the CLI.
 
 ## What it includes
 
-- `bug-sweep`: broad codebase review, adversarial verification, repro planning,
-  and synthesis.
+- `bug-sweep`: bounded codebase review, adversarial verification, repro
+  planning, and synthesis.
+- `bug-sweep-deep`: larger opt-in fanout for deeper bug hunts.
 - `release-diff-review`: release-blocker review against a branch or diff.
 - `security-auth-review`: auth, permission, injection, secret, sandbox, and MCP
   boundary review.
 - Live dashboard with phases, agent rows, token/tool/time metrics, detail view,
   pause/resume/stop/restart/save controls, and final report path.
+- Workflow definitions can explicitly request up to 64 concurrent workers and
+  2000 total agents.
 - Durable run state under `${CODEX_HOME:-~/.codex}/codex-workflows/projects/<project-hash>/runs/<run-id>/`
   by default, so read-only bug hunts do not dirty the target repo.
 - Project-local storage remains available with `storageScope: "project"` or
   `--storage-scope project`.
+- Downstream verify, probe, and synthesize agents receive prior phase findings
+  as explicit context instead of guessing at earlier results.
+- Detached worker heartbeats let status reads and dashboards identify orphaned
+  runs when a background workflow process dies.
 - Isolated workflow script loading through QuickJS. Workflow scripts define
   phases and agent prompts; they do not get direct filesystem, shell, network,
   process, or Node built-in access.
@@ -85,6 +92,7 @@ pnpm test
 pnpm cwf validate workflows/bug-sweep.workflow.js
 pnpm cwf run workflows/bug-sweep.workflow.js --watch --adapter simulate
 pnpm cwf run workflows/bug-sweep.workflow.js --watch --adapter auto --model gpt-5.4-mini
+pnpm cwf run workflows/bug-sweep-deep.workflow.js --watch --adapter auto --model gpt-5.4-mini
 ```
 
 Useful local commands:

docs/architecture.md

@@ -40,6 +40,9 @@ started by either the CLI or MCP server.
 
 MCP launches use a detached worker process. That matters: a workflow should keep
 running if the Codex thread disconnects or the MCP request finishes.
+Detached workers write heartbeats into `status.json`; status/list/dashboard
+reads reconcile stale runs when the recorded runner process is gone and the
+heartbeat has aged out.
 
 ## Resume and restart
 
@@ -55,10 +58,17 @@ relaunches the workflow in resume mode.
 Workflow scripts are loaded in QuickJS. The script can define workflow metadata,
 phases, and agent prompts. It does not get Node globals, direct filesystem
 access, shell access, network access, process env, or dynamic imports.
+Workflow definitions may request up to 64 concurrent workers and 2000 total
+agents; the actual worker count is still determined by the agents declared in
+the workflow phases.
 
 Actual code review work happens in Codex worker adapters, under explicit sandbox
 and approval settings.
 
+Agents may declare `contextFrom` to receive prior phase findings. Built-in
+workflows use that for verify, probe, and synthesize phases so later agents
+review concrete earlier claims instead of generic instructions.
+
 ## Generated plugin
 
 `pnpm validate:plugin` builds the TypeScript packages, bundles the CLI and MCP

docs/claude-workflows-parity.md

@@ -139,8 +139,8 @@ Use a small DSL that mirrors Claude's model while staying vendor-neutral:
 export default workflow({
   name: "branch-review",
   version: "1",
-  maxConcurrency: 16,
-  maxAgents: 1000,
+  maxConcurrency: 64,
+  maxAgents: 2000,
   async run({ args, agent, phase, checkpoint, budget }) {
     const files = args.files;
 

docs/plugin-distribution.md

@@ -26,7 +26,7 @@ codex plugin add codex-workflows@codex-workflows
 Pinned install:
 
 ```bash
-codex plugin marketplace add robzilla1738/Codex-Workflows --ref v0.1.0
+codex plugin marketplace add robzilla1738/Codex-Workflows --ref v0.2.0
 codex plugin add codex-workflows@codex-workflows
 ```
 
@@ -82,7 +82,7 @@ reload plugin skills and MCP tools.
 7. Tag and push:
 
    ```bash
-   git tag v0.1.0
+   git tag v0.2.0
    git push origin main --tags
    ```
 

package.json

@@ -1,6 +1,6 @@
 {
   "name": "codex-workflows",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "private": true,
   "type": "module",
   "license": "MIT",

packages/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codex-workflows/cli",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "type": "module",
   "license": "MIT",
   "bin": {

packages/cli/src/dashboard.test.tsx

@@ -45,10 +45,13 @@ const fixture: RunSummary = {
       model: "Codex",
       sandbox: "read-only",
       status: "running",
-      tokens: 138500,
+      tokens: 0,
       tools: 95,
       elapsedMs: 554000,
-      attempts: 1
+      attempts: 1,
+      startedAt: new Date(Date.now() - 2 * 60 * 1000).toISOString(),
+      lastActivityAt: new Date(Date.now() - 15 * 1000).toISOString(),
+      lastMessage: "command_execution"
     }
   ],
   totals: {
@@ -70,4 +73,18 @@ describe("DashboardFrame", () => {
     expect(lastFrame()).toContain("find:reflow-engine");
     expect(lastFrame()).toContain("tok");
   });
+
+  it("shows pending token metrics and activity for running agents", () => {
+    const { lastFrame } = render(
+      <DashboardFrame
+        summary={fixture}
+        width={88}
+        selectedPhaseId="find"
+        selectedAgentId="find:concurrency"
+      />
+    );
+    expect(lastFrame()).toContain("tok pending");
+    expect(lastFrame()).toContain("idle");
+    expect(lastFrame()).toContain("command_execution");
+  });
 });

packages/cli/src/dashboard.tsx

@@ -53,6 +53,21 @@ const phaseColor = (status: string, active: boolean) => {
   return "gray";
 };
 
+const effectiveAgentElapsed = (agent: AgentSummary) =>
+  agent.status === "running" && agent.startedAt
+    ? Math.max(0, Date.now() - new Date(agent.startedAt).getTime())
+    : agent.elapsedMs;
+
+const formatAgentTokens = (agent: AgentSummary) =>
+  agent.status === "running" && agent.tokens === 0 ? "tok pending" : `${formatCount(agent.tokens)} tok`;
+
+const formatActivity = (at?: string) => {
+  if (!at) {
+    return "no activity";
+  }
+  return `idle ${formatDuration(Math.max(0, Date.now() - new Date(at).getTime()))}`;
+};
+
 export function DashboardFrame({
   summary,
   width,
@@ -168,8 +183,8 @@ export function DashboardFrame({
                 </Text>
               </Box>
               <Text color="gray">
-                {formatCount(agent.tokens)} tok · {agent.tools} tools ·{" "}
-                {formatDuration(agent.elapsedMs)}
+                {formatAgentTokens(agent)} · {agent.tools} tools ·{" "}
+                {formatDuration(effectiveAgentElapsed(agent))}
               </Text>
             </Box>
           ))}
@@ -197,11 +212,28 @@ export function DashboardFrame({
               </Text>
             ))
           ) : (
-            <Text color="gray">
-              {selectedAgent.status === "running"
-                ? "Agent is running. Live token/tool metrics update above."
-                : truncateMiddle(selectedAgent.error ?? selectedAgent.prompt, width - 4)}
-            </Text>
+            <>
+              <Text color="gray">
+                {selectedAgent.status === "running"
+                  ? truncateMiddle(
+                      `Agent is running. ${formatActivity(
+                        selectedAgent.lastActivityAt ?? selectedAgent.startedAt
+                      )}. ${selectedAgent.lastMessage ?? "Waiting for worker events."}`,
+                      width - 4
+                    )
+                  : truncateMiddle(selectedAgent.error ?? selectedAgent.prompt, width - 4)}
+              </Text>
+              {selectedAgent.lastActivityAt && selectedAgent.status !== "running" ? (
+                <Text color="gray">
+                  {truncateMiddle(
+                    `Last activity: ${selectedAgent.lastActivityAt}${
+                      selectedAgent.lastMessage ? ` · ${selectedAgent.lastMessage}` : ""
+                    }`,
+                    width - 4
+                  )}
+                </Text>
+              ) : null}
+            </>
           )}
         </Box>
       ) : null}

packages/cli/src/index.tsx

@@ -85,7 +85,7 @@ const storeFor = (cwd: string, storageScope: StorageScope = "codex-home", storeR
 program
   .name("cwf")
   .description("Codex workflow-as-code runtime")
-  .version("0.1.0");
+  .version("0.2.0");
 
 program
   .command("__run-worker", { hidden: true })
@@ -183,6 +183,7 @@ program
     const runs = await store.listRuns();
     console.log("Built-in workflows:");
     console.log("  workflows/bug-sweep.workflow.js");
+    console.log("  workflows/bug-sweep-deep.workflow.js");
     console.log("  workflows/release-diff-review.workflow.js");
     console.log("  workflows/security-auth-review.workflow.js");
     console.log("");
@@ -271,6 +272,7 @@ program
     const cwd = path.resolve(options.cwd);
     const storeRoot = options.storeRoot ?? defaultStoreRoot(cwd, options.storageScope);
     const store = storeFor(cwd, options.storageScope, storeRoot);
+    await store.clearControl(runId);
     const summary = await store.markAgentForRestart(runId, agentId);
     const manifest = await store.readManifest(runId);
     await runWorkflow({
@@ -299,7 +301,6 @@ program
       storeRoot,
       resume: true
     });
-    await store.writeControl(runId, { type: "restart-agent", at: nowIso(), agentId });
     console.log(`restarted ${agentId} in ${runId}`);
   });
 

packages/codex-adapter/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codex-workflows/codex-adapter",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "type": "module",
   "license": "MIT",
   "main": "dist/index.js",