Agents: the workflow tool sends then attaches, so a crash no longer reports a run as failed; the CLI shows steered messages - #306

ℹ️ No critical issues. One small edge case in the CLI, noted inline.

Reviewed changes

I reviewed both commits: a session call made again to a workflow's main handler now attaches to the run instead of failing with 409, and the agents CLI now shows user messages that weren't typed in this terminal.

• attach_workflow binding: PyVM.attach_workflow wraps shared-core's AttachInvocationTarget::WorkflowId with scope: None. The field matches the vendored 8.4 crate. VMWrapper, ServerInvocationContext and the session host pass it through.
• Rejoin in CallFuture: ctx.call on a handler with kind == "workflow" gets a rejoin. If the call fails with a 409 whose message contains "already invoked", it awaits the attach. Cancellation 409s, shared handlers and generic_call by name keep their current behaviour.
• Agents/LangGraph docstrings: these now say a workflow runs once per id, and that a repeated key gets the earlier run's result.
• CLI Terminal: texts sent to chat are recorded with sending/unsent. _typed hides one user message per recorded text and shows every other user message, so steered messages and messages from other clients now appear.
• Tests: the fake host gains refusals and attached; there is an in-process rejoin test, an agents tool test, a Docker harness test on both stores, and a new tests/agents_cli.py.

  ^{｜ Fix all ➔ ｜ Fix 👍s ➔ ｜ View workflow run ｜ Using claude-opus-5-5 ｜ 𝕏}

✅ No new issues found. The CLI edge case from the last review is fixed.

Reviewed changes

Since the last review, one commit changed the agents CLI and added a test for it.

• History change uses up typed text: Terminal.show now calls _typed for every user message, including those in the first change (the conversation so far). It still shows them there. So text typed before that change arrives no longer stays in self.sent and hides a later message with the same text, such as a /steer message or one from another client.
• Test: tests/agents_cli.py adds a case that types Hi before the history arrives, then checks that a later Hi from another client is shown.

  ^{｜ View workflow run ｜ Using claude-opus-5-5 ｜ 𝕏}

✅ No new issues found. The workflow rejoin now lives in the agents' tools, and restate.sessions' ctx.call is back to its 1.5.0 behaviour.

Reviewed changes

Since the last review, one commit moved the rejoin for "already invoked" workflow calls out of restate.sessions and into the agents' tools.

• Reverted sessions call rejoin: _calls.py no longer has rejoin or already_invoked. _target and CallFuture are back to their original form, and the _api.py docstring and the sessions_harness.py rejoin test are gone. CallHost keeps attach_workflow, now typed Awaitable[bytes].
• Added sessions.internal.attach_workflow: it accepts only an attempt or view context, raises TypeError for any other context, and delegates to the call host.
• Added run_workflow in agents/_tools.py: it calls the main handler as before. When Restate refuses the call with a 409 whose message says "already invoked", it attaches to the run by its workflow id and deserializes the result with the handler's output serde. The workflow tool and LangGraph's nodes.workflow both use it. Any other 409 is raised again unchanged.
• Tests: tests/agents_tools.py covers both the rejoin and the non-rejoin 409 case. The new tests/agents_tools_server.py covers a crash after the run started, against a real Restate. In sessions_object.py, the rejoin tests are replaced by a test of internal.attach_workflow. Locally, agents_tools.py and sessions_object.py pass (34 tests) and ruff is clean. The Docker-backed tests can't run on this runner.

  ^{｜ View workflow run ｜ Using claude-opus-5-5 ｜ 𝕏}

✅ No new issues found. The workflow tool now sends, then attaches to the send's invocation, so nothing is matched on error text and the native attach_workflow binding is gone.

Reviewed changes

Since the last review, two commits replaced the "call, then attach on 409" approach. The workflow tool now always sends to the workflow and attaches to the invocation id of that send.

• Removed attach_workflow: src/lib.rs, vm.py, server_context.py, _ContextHost and internal no longer have it. Without it, the PR doesn't touch the native extension.
• Added internal.start and internal.attach_invocation: start sends right away with the new send_to helper and returns the send's invocation id. attach_invocation waits through the SDK's existing attach_invocation. Both accept only an attempt context.
• Simplified run_workflow: it is now start followed by attach_invocation, and the result is deserialized with the handler's output serde. already_invoked and the idempotency key parameter are gone. Both the workflow tool and LangGraph's nodes.workflow use it. Stopping a turn still cuts the wait short, because Stop.guard cancels the framework task that awaits the attach. Only the workflow run itself keeps going, which the docstring says.
• Updated tests: the fake host's generic_send now returns a handle whose invocation id is derived from the target. The tool test runs the tool twice and checks that this gives two sends, two attaches to the same id, and no calls. The server tests check that a second send gives the same invocation id and that the tool returns the result after a crash. Locally, agents_tools.py, sessions_object.py and agents_cli.py pass (37 tests), ruff is clean, and pyright reports no errors on sessions/ and _tools.py. The Docker-backed tests can't run on this runner.

  ^{｜ View workflow run ｜ Using claude-opus-5-5 ｜ 𝕏}