fix(server): keep Claude workflows alive while they report progress

[maria-rcks]

Fixes #16697.

Long background Claude Workflow runs were stopped mid-batch with query.close. The session was left stopped with lastError: null, so the thread looked finished. ProviderSessionManager started its 4-hour idle pin the first time it deferred release, and only a new turn reset it. Provider events from a workflow that was still running never extended it.

• Provider events now restart the pin budget. The 4-hour cap now stops only background work that has reported nothing for that long.
• local_workflow stays on the subagent path. That path already counts it as running pending work.

Verification:

• End-to-end with a real Claude Sonnet 5.5 background workflow, using a local dev server with timers shortened to 60s idle and a 150s cap. The workflow ran a 75s silent step, 20s steps until past the cap, then a second 75s silent step.
  • Unfixed code: query.close came during the second silent step while the workflow was still running, and the session went stopped with lastError: null.
  • This branch: the session survived, the workflow finished, and Claude replied with its result.
• On a Blacksmith testbox, vp test run apps/server/src/orchestration-v2/ProviderSessionManager.test.ts passes (57 tests). The new test fails when the pin reset is removed. apps/server typecheck and lint on the changed files are clean.

🤖 Generated with Claude Code

[macroscopeapp]

Approvability

Verdict: Approved at 2436b15

Macroscope's review found this PR approvable — This is a localized session-lifecycle bug fix that keeps active provider workflows alive while preserving timeout behavior for silent sessions. The production change is small and covered by a focused regression test.

Notes:

• No code objects were reviewed. Approvability was decided on eligibility alone.

^{You can add or adjust custom eligibility rules. Learn more.}

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Path: .coderabbit.config.ts
• Review profile: CHILL
• Plan: Advanced
• Run ID: 8391eb94-e657-48dc-8e49-292ef254e500

---

---

📥 Commits

Reviewing files that changed from the base of the PR and between 4ea7356 and 8a6a6c3.

---

---

📒 Files selected for processing (3)

• apps/server/src/orchestration-v2/Adapters/ClaudeAdapterV2.test.ts
• apps/server/src/orchestration-v2/ProviderSessionManager.test.ts
• apps/server/src/orchestration-v2/ProviderSessionManager.ts

---

---

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 4 remain after this review.

---

---

---

📝 Walkthrough

📝 Walkthrough

Walkthrough

Provider-session idle handling now resets the background-work pin on non-terminal provider activity and records a no-progress detail when pending work reaches the pin limit. Tests cover release after progress stops and Claude workflows that remain active across member-command notifications.

Changes

Background workflow liveness

Layer / File(s)	Summary
Provider activity and pin expiry apps/server/src/orchestration-v2/ProviderSessionManager.ts, apps/server/src/orchestration-v2/ProviderSessionManager.test.ts	Non-terminal provider events reset the pin budget. Idle release records a detail when pending work reaches the pin limit. Tests verify that pending work remains pinned during provider updates and that the session stops after progress ends.
Claude workflow across member-command notifications apps/server/src/orchestration-v2/Adapters/ClaudeAdapterV2.test.ts	Parameterized tests verify that failed and completed member-command notifications do not end the workflow or close the CLI process. They also check pending background work, continuation requests, and model changes.

Priority: ➖ Normal

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Bug fix · Severity of issue fixed: Medium

Suggested reviewers: juliusmarminge

---

---

Merge Risk: ⚪ Minimal · up to 8a6a6

Background workflows that keep reporting progress stay alive. Work that goes silent past the cap is now stopped with a visible reason. No merge-blocking risk was identified.

Security Architecture Review

Security architecture risk: 🔵 Low · up to 8a6a6

Active background workflows can now run longer while reporting activity, and silent-work termination becomes visible. A narrow session-replacement timing risk remains: delayed activity from an old session could renew the replacement’s timeout. No new externally reachable operation or permission expansion was identified.

Retained concerns

• Low · security · inferred: Pin renewal is not bound to the runtime that produced the activity. The event pump supplies only the provider-session ID, and the scheduler clears the pin timestamp on whichever idle entry currently owns that ID. If delayed or teardown-buffered events from a released runtime overlap a same-ID replacement, they can renew the replacement’s no-progress budget and delay process release and release-triggered credential cleanup. The ID-only scheduling weakness existed at the base; this PR adds pin-budget reset to its consequences. Normal query closure and guarded release contain ordinary execution, but they do not establish that late activity cannot reach this mutation.

Security review details

Security Blast Radius

• inferred — The identified timing concern is bounded to a replacement using the same provider-session ID and the resources and attached-thread credentials managed by that session. The examined path does not establish cross-tenant reachability, new privileges or broader infrastructure exposure.

Security Findings and Attack Paths

• inferred — A conditional path is delayed old-runtime activity reaching the still-manager-scoped event pump, followed by an ID-only lookup that resets the idle replacement’s pin timestamp. Exploitation would require influence over provider activity and suitable replacement timing; neither a remote trigger nor a working exploit was established. The canonical security brief contains no retained findings.

Trust Boundaries and Controls

• observed — Status persistence and session-scoped request ingestion reject events whose originating runtime is no longer current. Pending-work deferral also checks runtime identity, and idle removal revalidates generation and busy state. Activity renewal occurs before these event-ownership checks and lacks the equivalent runtime binding.

Resilience and Maintainability Implications

• observed — Existing release handling time-boxes scope closure to 30 seconds, logs late completion and retries failed release records. These recovery mechanisms are unchanged and mitigate cleanup stalls; they do not guarantee rejection of stale activity before pin renewal.

Hardening Proposals

• proposed — Bind activity renewal to the originating runtime and atomically revalidate runtime identity and timer generation when installing a renewed timer. Exercise delayed old-runtime events and concurrent scheduling during same-ID replacement to establish the containment invariant.

---

Pre-merge checks | 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check		The changes address the coding requirements in #16697. Provider activity resets the background-work pin, so progress can keep an unfinished workflow session alive. The adapter regression test covers m…
Out of Scope Changes check		The production changes are limited to provider-session pin renewal and interruption reporting. The added tests directly verify workflow liveness and pin-expiry behavior required by #16697. No unrelate…
Description check		The description explains the problem, change, linked issue, scope, verification steps, observed results, and known limitation. It identifies Claude Code usage, although it does not explicitly name the…
Title check		The title is concise, specific, and accurately describes the main change: keeping Claude workflows alive while they report progress.

---

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

---

---

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}

Dismissing prior approval to re-evaluate 1ff672a

Dismissing prior approval to re-evaluate 2436b15