@agimon-ai/po-workflow 0.0.0-alpha.37 → 0.0.0-alpha.39

package/dist/{RecoverWorkflowService-BLehH1qi.cjs → RecoverWorkflowService-CEYR10KF.cjs}

@@ -378,6 +378,7 @@ const StepFieldsSchema = zod.z.object({
 	artifacts: StepArtifactsSchema.optional(),
 	"timeout-minutes": zod.z.number().optional(),
 	env: CoercedEnvRecord.optional(),
+	secrets: zod.z.array(zod.z.string().regex(/^[A-Za-z_][A-Za-z0-9_]*$/, "Secret names are environment variable names.")).min(1).optional().describe("Env names a run step's command receives from its Po profile; values never reach logs or run records."),
 	with: zod.z.record(zod.z.string(), zod.z.string()).optional(),
 	"working-directory": zod.z.string().optional(),
 	if: zod.z.string().optional(),
@@ -418,6 +419,11 @@ function refineStep(step, context) {
 		message: `${key} is only supported with a templated interactiveRun.`,
 		path: [key]
 	});
+	if (step.secrets !== void 0 && (step.run === void 0 || step.interactiveRun || step.customRun)) context.addIssue({
+		code: "custom",
+		message: "secrets are only supported on run steps.",
+		path: ["secrets"]
+	});
 	if (step["restart-from"] !== void 0 && (step.run === void 0 || step.interactiveRun || step.customRun)) context.addIssue({
 		code: "custom",
 		message: "restart-from is only supported on run steps.",
@@ -750,6 +756,7 @@ const WorkflowLauncherMetadataSchema = zod.z.discriminatedUnion("type", [
 ]);
 const WorkflowRunRecordSchema = zod.z.object({
 	activeRepairId: zod.z.string().regex(/^\d+$/).optional(),
+	/** Read-only legacy metadata. New runs only write runner. */
 	cliAgent: zod.z.string().optional(),
 	continueOnError: zod.z.boolean().optional(),
 	displayName: zod.z.string(),
@@ -773,6 +780,7 @@ const WorkflowRunRecordSchema = zod.z.object({
 	runner: zod.z.string().optional(),
 	command: zod.z.string().optional().describe("Command the launch selected for templated interactiveRun steps."),
 	choice: zod.z.string().optional().describe("Choice the launch selected for steps that do not pin one."),
+	profile: zod.z.string().optional().describe("Po profile name the launch selected as the default runConfig.profile; never its secrets."),
 	runId: zod.z.string().uuid().optional(),
 	runKey: zod.z.string(),
 	secretFile: zod.z.string().optional(),
@@ -4745,7 +4753,6 @@ var WorkflowRegistryService = class {
 		const runId = (0, node_crypto.randomUUID)();
 		const runRecord = {
 			activeRepairId: input.activeRepairId,
-			cliAgent: input.cliAgent,
 			continueOnError: input.continueOnError,
 			displayName: input.displayName,
 			dryRun: input.dryRun,
@@ -4759,6 +4766,7 @@ var WorkflowRegistryService = class {
 			runner: input.runner,
 			...input.command === void 0 ? {} : { command: input.command },
 			...input.choice === void 0 ? {} : { choice: input.choice },
+			...input.profile === void 0 ? {} : { profile: input.profile },
 			runDirectory: input.runDirectory,
 			runId,
 			secretFile: input.secretFile,
@@ -6425,127 +6433,6 @@ const MAX_STEP_TIMEOUT_MINUTES = Math.floor(2147483647 / 6e4);
 const StepTimeoutMinutesSchema = zod.z.number().positive().finite().max(MAX_STEP_TIMEOUT_MINUTES);
 const StepTimeoutRetriesSchema = zod.z.number().int().min(0).max(STEP_TIMEOUT_RETRIES_LIMIT).default(STEP_TIMEOUT_MAX_RETRIES);
 //#endregion
-//#region src/services/CodexQuotaService/index.ts
-/**
-* CodexQuotaService
-*
-* DESIGN PATTERNS:
-* - Service pattern for business logic encapsulation
-* - Single responsibility principle
-*
-* CODING STANDARDS:
-* - Use async/await for asynchronous operations
-* - Throw descriptive errors for error cases
-* - Keep methods focused and well-named
-* - Document complex logic with comments
-*
-* AVOID:
-* - Mixing concerns (keep focused on single domain)
-* - Direct tool implementation (services should be tool-agnostic)
-*/
-const DEFAULT_CODEX_HOME_DIRNAME = ".codex";
-const AUTH_FILENAME = "auth.json";
-const CONFIG_FILENAME = "config.toml";
-const DEFAULT_CHATGPT_BASE_URL = "https://chatgpt.com/backend-api/";
-const CHATGPT_HOST = "https://chatgpt.com";
-const CHAT_OPENAI_HOST = "https://chat.openai.com";
-const BACKEND_API_SEGMENT = "/backend-api";
-const QUOTA_USER_AGENT = "codex-cli";
-const PRIMARY_WINDOW = "primary";
-const SECONDARY_WINDOW = "secondary";
-const QUOTA_REACHED_PERCENT = 100;
-var CodexQuotaService = class {
-	codexHome;
-	fetchFn;
-	now;
-	readTextFile;
-	constructor(runtime, deps = {}) {
-		this.codexHome = deps.codexHome ?? runtime.baseEnvironment.CODEX_HOME ?? (0, node_path.join)(runtime.homeDirectory, DEFAULT_CODEX_HOME_DIRNAME);
-		this.fetchFn = deps.fetchFn ?? fetch;
-		this.now = deps.now ?? (() => Date.now());
-		this.readTextFile = deps.readTextFile ?? (async (path) => (0, _agimon_ai_po_core_platform.getOrThrow)(await runtime.fs.readTextFile(path, runtime.ioContext)));
-	}
-	isCodexCommand(command, _sourceAgentKey) {
-		const trimmed = command.trim();
-		return trimmed === "codex" || trimmed.startsWith("codex ");
-	}
-	async getQuotaStatus() {
-		const auth = await this.readAuthFile();
-		const accessToken = auth?.tokens?.access_token?.trim();
-		const accountId = auth?.tokens?.account_id?.trim();
-		if (!accessToken || !accountId) return null;
-		const baseUrl = await this.readChatgptBaseUrl();
-		const response = await this.fetchFn(this.buildUsageUrl(baseUrl), { headers: {
-			Authorization: `Bearer ${accessToken}`,
-			"ChatGPT-Account-Id": accountId,
-			"User-Agent": QUOTA_USER_AGENT
-		} });
-		if (!response.ok) throw new Error(`codex quota request failed with HTTP ${response.status}`);
-		const payload = await response.json();
-		return {
-			blockingLimit: this.findBlockingLimit(payload),
-			planType: payload.plan_type ?? null
-		};
-	}
-	async readAuthFile() {
-		const raw = await this.readOptionalTextFile((0, node_path.join)(this.codexHome, AUTH_FILENAME));
-		if (!raw) return null;
-		return JSON.parse(raw);
-	}
-	async readChatgptBaseUrl() {
-		const match = (await this.readOptionalTextFile((0, node_path.join)(this.codexHome, CONFIG_FILENAME)))?.match(/^\s*chatgpt_base_url\s*=\s*"([^"]+)"/m);
-		return this.normalizeBaseUrl(match?.[1] ?? DEFAULT_CHATGPT_BASE_URL);
-	}
-	buildUsageUrl(baseUrl) {
-		return baseUrl.includes(BACKEND_API_SEGMENT) ? `${baseUrl}/wham/usage` : `${baseUrl}/api/codex/usage`;
-	}
-	normalizeBaseUrl(baseUrl) {
-		let normalized = baseUrl.trim().replace(/\/+$/, "");
-		if ((normalized.startsWith(CHATGPT_HOST) || normalized.startsWith(CHAT_OPENAI_HOST)) && !normalized.includes(BACKEND_API_SEGMENT)) normalized = `${normalized}${BACKEND_API_SEGMENT}`;
-		return normalized;
-	}
-	async readOptionalTextFile(path) {
-		try {
-			return await this.readTextFile(path);
-		} catch (error) {
-			if (error.code === "ENOENT") return null;
-			throw error;
-		}
-	}
-	findBlockingLimit(payload) {
-		const blocks = [];
-		this.collectBlockingLimit(blocks, "codex", "codex", payload.rate_limit);
-		for (const additionalLimit of payload.additional_rate_limits ?? []) this.collectBlockingLimit(blocks, additionalLimit.metered_feature ?? additionalLimit.limit_name ?? "codex", additionalLimit.limit_name ?? additionalLimit.metered_feature ?? "codex", additionalLimit.rate_limit);
-		blocks.sort((left, right) => left.resetAt - right.resetAt || right.usedPercent - left.usedPercent);
-		return blocks[0] ?? null;
-	}
-	collectBlockingLimit(blocks, limitId, limitName, limit) {
-		if (!limit) return;
-		const windows = [{
-			payload: limit.primary_window,
-			window: PRIMARY_WINDOW
-		}, {
-			payload: limit.secondary_window,
-			window: SECONDARY_WINDOW
-		}];
-		for (const { payload, window } of windows) {
-			const resetAt = payload?.reset_at;
-			const usedPercent = payload?.used_percent ?? 0;
-			if (typeof resetAt !== "number") continue;
-			if (!(usedPercent >= QUOTA_REACHED_PERCENT || limit.limit_reached === true && resetAt * 1e3 > this.now() || limit.allowed === false && resetAt * 1e3 > this.now())) continue;
-			blocks.push({
-				limitId,
-				limitName,
-				resetAfterSeconds: payload?.reset_after_seconds ?? null,
-				resetAt,
-				usedPercent,
-				window,
-				windowSeconds: payload?.limit_window_seconds ?? null
-			});
-		}
-	}
-};
-//#endregion
 //#region src/services/StepRunnerService/index.ts
 /**
 * StepRunnerService
@@ -6620,6 +6507,10 @@ const INTERACTIVE_RUN_KEY = "interactiveRun";
 const CUSTOM_RUN_KEY = "customRun";
 const CUSTOM_RUN_UNSUPPORTED_MESSAGE = "customRun needs a host step executor and no run or interactiveRun fallback exists for step";
 const IN_PROCESS_ONLY_UNSUPPORTED_MESSAGE = "has no run template, and this host cannot run it in-process";
+const SECRETS_UNAVAILABLE_MESSAGE = "profile secrets are unavailable for step";
+const SECRETS_LOG_PREFIX = "secrets: ";
+const RUN_CONFIG_PROFILE_KEY = "profile";
+const REDACTED = "[redacted]";
 const WORKFLOW_RUN_CONFIG_ENV_KEY = "WORKFLOW_RUN_CONFIG";
 const DEFAULT_CHOICE = "default";
 const OUTPUT_TAIL_LINES = 50;
@@ -6704,38 +6595,35 @@ const WORKFLOW_STEP_NAME_ENV_KEY = "WORKFLOW_STEP_NAME";
 const WORKFLOW_STEP_DISPLAY_ENV_KEY = "WORKFLOW_STEP_DISPLAY";
 const WORKFLOW_STEP_ARTIFACTS_ENV_KEY = "WORKFLOW_STEP_ARTIFACTS";
 const WORKFLOW_TERMINAL_TITLE = "workflow-mcp";
-const STATUS_FILE_PREFIX = "workflow-step-";
-const STATUS_FILE_SUFFIX = ".status";
-const STATUS_FILE_COMPLETION_VALUE = "YES";
-const STATUS_FILE_COMPLETED_RESULT = { status: "status_completed" };
-const TRANSIENT_FS_ERROR_CODES = /* @__PURE__ */ new Set([
-	"ENOENT",
-	"EBUSY",
-	"EAGAIN",
-	"EPERM",
-	"not_found"
-]);
-const STATUS_FILE_POLL_INTERVAL_MS = 1e3;
 const STOP_REQUEST_POLL_INTERVAL_MS = 1e3;
-const STATUS_DONE = "done";
 const STATUS_STOP = "stop";
 const EXPLICIT_RUNNER_MISSING_PREFIX = "runner";
 const EXPLICIT_RUNNER_MISSING_MIDDLE = "not found for step";
 const EXPLICIT_RUNNER_AVAILABLE_PREFIX = "available runner keys:";
-const QUOTA_WAIT_POLL_INTERVAL_MS = 3e4;
-const QUOTA_WAIT_RESET_BUFFER_MS = 1e3;
-const QUOTA_WAIT_SOURCE = "StepRunnerService.waitForCodexQuota";
-const QUOTA_RETRY_REASON = "codex quota reached after failed step, retrying after reset";
 const RESULT_STATUS_COMPLETED = "completed";
 const RESULT_STATUS_SPAWN_ERROR = "spawn_error";
 const RESULT_STATUS_SIGNALED = "signaled";
 const RESULT_STATUS_TIMED_OUT = "timed_out";
-const RESULT_STATUS_STATUS_COMPLETED = "status_completed";
 const RESULT_STATUS_STOP_REQUESTED = "stop_requested";
 const RESULT_STATUS_PAUSE_REQUESTED = "pause_requested";
 /** The reason a step failure carries when nothing more specific was recorded. */
 const STEP_FAILED_REASON = "The step failed.";
 /**
+* Mask each secret value in step output, in its raw, JSON-escaped and
+* URL-encoded forms, and line by line for a value that spans lines.
+*/
+function secretRedactor(values) {
+	const forms = /* @__PURE__ */ new Set();
+	for (const value of values) for (const form of [
+		value,
+		JSON.stringify(value).slice(1, -1),
+		encodeURIComponent(value),
+		...value.split("\n")
+	]) if (form) forms.add(form);
+	const longestFirst = [...forms].sort((left, right) => right.length - left.length);
+	return (text) => longestFirst.reduce((current, form) => current.split(form).join(REDACTED), text);
+}
+/**
 * Executes workflow steps in child processes and tracks the active process so
 * the workflow runner can interrupt it safely.
 *
@@ -6748,16 +6636,15 @@ var StepRunnerService = class StepRunnerService {
 	runtime;
 	parser;
 	logger;
-	quotaService;
-	watchStatusFile;
+	watchControlFile;
 	runDirectoryService;
 	ownsTerminal;
 	stepExecutor;
+	resolveSecrets;
 	activeStep = null;
 	activeExternal = null;
 	lastInteractiveReap = null;
 	interruptedSignal = null;
-	activeQuotaWait = null;
 	commandSelection = {};
 	/** Runners of a parallel group's steps, which a stop must reach too. */
 	forks = /* @__PURE__ */ new Set();
@@ -6772,15 +6659,15 @@ var StepRunnerService = class StepRunnerService {
 	* must not hand a step's stdin to it, and must not `stty` or reset it
 	* afterwards, however cooperative the intent.
 	*/
-	constructor(runtime, parser, logger, quotaService = new CodexQuotaService(runtime), watchStatusFile = runtime.fs.watch.bind(runtime.fs), runDirectoryService = new RunDirectoryService(runtime), ownsTerminal = true, stepExecutor) {
+	constructor(runtime, parser, logger, watchControlFile = runtime.fs.watch.bind(runtime.fs), runDirectoryService = new RunDirectoryService(runtime), ownsTerminal = true, stepExecutor, resolveSecrets) {
 		this.runtime = runtime;
 		this.parser = parser;
 		this.logger = logger;
-		this.quotaService = quotaService;
-		this.watchStatusFile = watchStatusFile;
+		this.watchControlFile = watchControlFile;
 		this.runDirectoryService = runDirectoryService;
 		this.ownsTerminal = ownsTerminal;
 		this.stepExecutor = stepExecutor;
+		this.resolveSecrets = resolveSecrets;
 	}
 	/**
 	* Use a workflow's command templates and choices, and what the launch
@@ -6797,7 +6684,7 @@ var StepRunnerService = class StepRunnerService {
 	* Release it once its step has finished.
 	*/
 	fork(label) {
-		const child = new StepRunnerService(this.runtime, this.parser, labelledLogger(this.logger, label), this.quotaService, this.watchStatusFile, this.runDirectoryService, this.ownsTerminal, this.stepExecutor);
+		const child = new StepRunnerService(this.runtime, this.parser, labelledLogger(this.logger, label), this.watchControlFile, this.runDirectoryService, this.ownsTerminal, this.stepExecutor, this.resolveSecrets);
 		child.commandSelection = this.commandSelection;
 		child.interruptedSignal = this.interruptedSignal;
 		child.terminalLock = this.terminalLock;
@@ -6822,16 +6709,6 @@ var StepRunnerService = class StepRunnerService {
 			for (const child of this.forks) child.stopActiveStep(signal);
 			return;
 		}
-		if (this.activeQuotaWait) {
-			if (this.activeQuotaWait.controller.signal.aborted) {
-				this.logger.info(`    ${DIM$3}${STATUS_SKIP}${RESET$3}  ${this.activeQuotaWait.stepName} ${ALREADY_STOPPING_SUFFIX}`);
-				return;
-			}
-			this.activeQuotaWait.signal = signal;
-			this.activeQuotaWait.controller.abort();
-			this.logger.info(`    ${YELLOW$2}${STATUS_INTERRUPTED}${RESET$3}  cancelling quota wait for ${this.activeQuotaWait.stepName}`);
-			return;
-		}
 		if (this.activeExternal) {
 			if (this.activeExternal.stopSignal) {
 				this.logger.info(`    ${DIM$3}${STATUS_SKIP}${RESET$3}  ${this.activeExternal.stepName} ${ALREADY_STOPPING_SUFFIX}`);
@@ -6930,7 +6807,6 @@ var StepRunnerService = class StepRunnerService {
 			return false;
 		}
 		const { command, custom, inProcessOnly, interactive, template } = resolvedStepCommand;
-		const isCodexCommand = this.quotaService.isCodexCommand(command, resolvedStepCommand.agentKey);
 		const shouldContinue = step["continue-on-error"] || options.continueOnError;
 		let timeoutMs;
 		try {
@@ -6964,7 +6840,12 @@ var StepRunnerService = class StepRunnerService {
 		stepEnv[PROJECT_PATH_ENV_KEY] = workDir;
 		stepEnv[WORKFLOW_STEP_NAME_ENV_KEY] = stepName;
 		stepEnv[WORKFLOW_STEP_DISPLAY_ENV_KEY] = this.formatStepDisplay(stepEnv[WORKFLOW_JOB_NAME_ENV_KEY], stepName);
-		const runConfig = resolvedStepCommand?.runConfig ?? step.runConfig;
+		const stepRunConfig = resolvedStepCommand?.runConfig ?? step.runConfig;
+		const launchProfile = this.commandSelection.profile;
+		const runConfig = launchProfile === void 0 || stepRunConfig?.[RUN_CONFIG_PROFILE_KEY] !== void 0 ? stepRunConfig : {
+			...stepRunConfig,
+			[RUN_CONFIG_PROFILE_KEY]: launchProfile
+		};
 		stepEnv[WORKFLOW_RUN_CONFIG_ENV_KEY] = JSON.stringify(runConfig ?? {});
 		if (step.if !== void 0 && !options.dryRun) {
 			const condition = await this.evaluateStepCondition(step.if, stepContext, workDir, stepEnv, stepName, timeoutMs);
@@ -7015,15 +6896,11 @@ var StepRunnerService = class StepRunnerService {
 		}
 		const stepStartedAt = Date.now();
 		await this.logStepLifecycle("info", "workflow.step.started", stepEnv, { "workflow.step.interactive": interactive });
-		let statusFilePath;
-		if (interactive) {
-			statusFilePath = await this.createStatusFile();
-			stepEnv[STATUS_FILE_ENV_KEY] = statusFilePath;
-			this.logger.info(`    ${DIM$3}status-file${RESET$3}  ${statusFilePath}`);
-		} else delete stepEnv[STATUS_FILE_ENV_KEY];
+		delete stepEnv[STATUS_FILE_ENV_KEY];
 		if (options.dryRun) {
 			this.logger.info(`    ${CYAN$2}${STATUS_DRY}${RESET$3}  ${stepName}`);
 			this.logger.info(`${COMMAND_LOG_INDENT}${DIM$3}${COMMAND_LOG_PROMPT}${command.split(COMMAND_LINE_BREAK).join(COMMAND_LOG_CONTINUATION)}${RESET$3}`);
+			if (step.secrets !== void 0 && step.secrets.length > 0) this.logger.info(`${COMMAND_LOG_INDENT}${DIM$3}${SECRETS_LOG_PREFIX}${step.secrets.join(", ")}${RESET$3}`);
 			await this.logStepLifecycle("info", "workflow.step.finished", stepEnv, {
 				"workflow.step.duration_ms": Date.now() - stepStartedAt,
 				"workflow.step.outcome": "dry-run"
@@ -7055,9 +6932,20 @@ var StepRunnerService = class StepRunnerService {
 			this.logger.error(`    ${RED$2}${STATUS_FAIL}${RESET$3}  ${stepName}\n`);
 			return false;
 		}
-		let quotaFailureRetried = false;
+		let secretEnv;
+		if (step.secrets !== void 0 && step.secrets.length > 0) {
+			secretEnv = await this.resolveStepSecrets(step.secrets, runConfig, interactive || custom !== void 0 || inProcessOnly === true);
+			if (secretEnv === void 0) {
+				fail(`${SECRETS_UNAVAILABLE_MESSAGE} "${stepName}"`);
+				if (shouldContinue) {
+					this.logger.warn(`    ${YELLOW$2}${STATUS_FAIL}${RESET$3}  ${stepName} ${CONTINUE_ON_ERROR_SUFFIX}\n`);
+					return true;
+				}
+				this.logger.error(`    ${RED$2}${STATUS_FAIL}${RESET$3}  ${stepName}\n`);
+				return false;
+			}
+		}
 		for (let attempt = 0; attempt <= maxTimeoutRetries; attempt++) {
-			await this.waitForCodexQuotaAvailability(stepName, command, isCodexCommand);
 			if (decisionFilePath && decisionIdentity) await resetDecisionFile(this.runtime, decisionFilePath, decisionIdentity);
 			if (attempt > 0) this.logger.warn(`    ${YELLOW$2}${STATUS_RETRY}${RESET$3} ${STEP_TIMEOUT_RETRY_PREFIX} "${stepName}" (attempt ${attempt + 1}/${maxTimeoutRetries + 1})`);
 			else this.logger.info(`    ${CYAN$2}${STATUS_RUN}${RESET$3}  ${stepName}`);
@@ -7082,6 +6970,7 @@ var StepRunnerService = class StepRunnerService {
 				interactive,
 				onExecutionStarted: options.onExecutionStarted,
 				runConfig,
+				secretEnv,
 				stepEnv,
 				stepName,
 				jobEnvironment: this.definedEnv({
@@ -7093,7 +6982,7 @@ var StepRunnerService = class StepRunnerService {
 				timeoutMs,
 				workDir
 			}));
-			const executionResult = interactive && statusFilePath ? await this.raceInteractiveCompletion(executionPromise, statusFilePath, stepName, options.stopRequestPath, step["pause-policy"] ?? "replay") : options.stopRequestPath ? await this.raceStopRequest(executionPromise, stepName, options.stopRequestPath, step["pause-policy"] ?? "replay") : await executionPromise;
+			const executionResult = interactive ? await this.raceInteractiveCompletion(executionPromise, stepName, options.stopRequestPath, step["pause-policy"] ?? "replay") : options.stopRequestPath ? await this.raceStopRequest(executionPromise, stepName, options.stopRequestPath, step["pause-policy"] ?? "replay") : await executionPromise;
 			if (executionResult.status === RESULT_STATUS_PAUSE_REQUESTED) {
 				await this.logStepLifecycle("info", "workflow.step.pause_requested", stepEnv, {
 					"workflow.step.outcome": pausePolicy === "replay" ? "cancelled_for_pause" : "protected_boundary",
@@ -7150,7 +7039,6 @@ var StepRunnerService = class StepRunnerService {
 			}
 			const decision = decisionFilePath ? await readStepDecision(this.runtime, decisionFilePath) : void 0;
 			if (decision) {
-				if (statusFilePath) await this.cleanupStatusFile(statusFilePath);
 				if (decision.decision === "complete") {
 					const artifactProblem = artifactSnapshots ? await this.describeArtifactWarnings(stepEnv, artifactSnapshots) : void 0;
 					if (!artifactProblem) {
@@ -7184,15 +7072,7 @@ var StepRunnerService = class StepRunnerService {
 			}
 			if (executionResult.status === "timed_out") {
 				fail(`${STEP_TIMEOUT_FAILURE_PREFIX} ${this.formatTimeoutMs(executionResult.timeoutMs)} "${stepName}" (${command.split(COMMAND_LINE_BREAK)[0]})`);
-				if (attempt < maxTimeoutRetries) {
-					if (statusFilePath) try {
-						(0, _agimon_ai_po_core_platform.getOrThrow)(await this.runtime.fs.writeFile(statusFilePath, "", this.runtime.ioContext));
-					} catch (error) {
-						this.logger.warn(`    ${YELLOW$2}${STATUS_WARN}${RESET$3}  status-file reset failed for ${stepName}: ${error instanceof Error ? error.message : String(error)}`);
-					}
-					continue;
-				}
-				if (statusFilePath) await this.cleanupStatusFile(statusFilePath);
+				if (attempt < maxTimeoutRetries) continue;
 				if (shouldContinue) {
 					await this.logStepLifecycle("warn", "workflow.step.finished", stepEnv, {
 						"workflow.step.duration_ms": Date.now() - stepStartedAt,
@@ -7209,7 +7089,6 @@ var StepRunnerService = class StepRunnerService {
 				});
 				return false;
 			}
-			if (statusFilePath) await this.cleanupStatusFile(statusFilePath);
 			if (decisionIdentity?.required && !(executionResult.status === "completed" && executionResult.failure !== void 0)) {
 				fail(`step "${stepName}" ended without a workflow decision (workflow-mcp step complete|fix|fail)`);
 				return this.failStep(stepName, stepEnv, stepStartedAt, shouldContinue, report);
@@ -7232,19 +7111,6 @@ var StepRunnerService = class StepRunnerService {
 				});
 				return true;
 			}
-			if (executionResult.status === "status_completed") {
-				const artifactProblem = artifactSnapshots ? await this.describeArtifactWarnings(stepEnv, artifactSnapshots) : void 0;
-				if (artifactProblem) {
-					fail(`step "${stepName}" ${artifactProblem}`);
-					return this.failStep(stepName, stepEnv, stepStartedAt, shouldContinue, report);
-				}
-				this.logger.info(`\n    ${GREEN$2}${STATUS_DONE}${RESET$3}  ${stepName} (status-file signaled completion)\n`);
-				await this.logStepLifecycle("info", "workflow.step.finished", stepEnv, {
-					"workflow.step.duration_ms": Date.now() - stepStartedAt,
-					"workflow.step.outcome": "success"
-				});
-				return true;
-			}
 			if (executionResult.status === "completed" && executionResult.exitCode === 0) {
 				const artifactProblem = artifactSnapshots ? await this.describeArtifactWarnings(stepEnv, artifactSnapshots) : void 0;
 				if (!artifactProblem) {
@@ -7258,12 +7124,6 @@ var StepRunnerService = class StepRunnerService {
 				fail(`step "${stepName}" ${artifactProblem}`);
 			}
 			if (executionResult.status === "completed" && executionResult.exitCode !== 0) fail(executionResult.failure ? `step "${stepName}" failed: ${executionResult.failure}` : `${STEP_EXIT_FAILURE_PREFIX} "${stepName}" ${STEP_EXIT_FAILURE_MIDDLE} ${executionResult.exitCode} (${command.split(COMMAND_LINE_BREAK)[0]})`);
-			if (!quotaFailureRetried && await this.shouldRetryForCodexQuota(stepName, isCodexCommand)) {
-				quotaFailureRetried = true;
-				this.logger.warn(`    ${YELLOW$2}${STATUS_RETRY}${RESET$3} ${QUOTA_RETRY_REASON}`);
-				attempt -= 1;
-				continue;
-			}
 			if (shouldContinue) {
 				await this.logStepLifecycle("warn", "workflow.step.finished", stepEnv, {
 					"workflow.step.duration_ms": Date.now() - stepStartedAt,
@@ -7342,10 +7202,30 @@ var StepRunnerService = class StepRunnerService {
 		};
 	}
 	/**
+	* Resolve a run step's secrets for its child alone, or undefined when they
+	* cannot be: this host has no resolver, the step is not a plain run, no
+	* profile applies, or the resolver fails. The failure stays generic so no
+	* value or alias detail reaches the log.
+	*/
+	async resolveStepSecrets(names, runConfig, hostedStep) {
+		const profile = runConfig?.[RUN_CONFIG_PROFILE_KEY];
+		if (this.resolveSecrets === void 0 || hostedStep || typeof profile !== "string" || profile === "") return;
+		try {
+			return await this.resolveSecrets({
+				cwd: this.runtime.cwd,
+				profile,
+				names
+			});
+		} catch {
+			return;
+		}
+	}
+	/**
 	* Spawn a child shell for the step command and normalize its termination
 	* into a typed result.
 	*/
-	async executeCommand(command, workDir, stepEnv, stepName, interactive, timeoutMs) {
+	async executeCommand(command, workDir, stepEnv, stepName, interactive, timeoutMs, secretEnv) {
+		const redact = secretEnv === void 0 ? void 0 : secretRedactor(Object.values(secretEnv));
 		if (interactive) this.logger.info(`    ${DIM$3}${INTERACTIVE_OUTPUT_NOTICE}${RESET$3}`);
 		return await new Promise((resolveResult) => {
 			const terminalState = interactive ? this.captureTerminalState() : null;
@@ -7372,6 +7252,7 @@ var StepRunnerService = class StepRunnerService {
 				detached: this.runtime.workflowHost.platform !== PLATFORM_WINDOWS,
 				env: {
 					...stepEnv,
+					...secretEnv,
 					[FORCE_COLOR_KEY]: FORCE_COLOR_VALUE
 				},
 				shell: DEFAULT_SHELL
@@ -7439,18 +7320,30 @@ var StepRunnerService = class StepRunnerService {
 				outputTail.push(line);
 				if (outputTail.length > OUTPUT_TAIL_LINES) outputTail.shift();
 			};
-			child.stdout?.on("data", (data) => {
-				for (const line of data.toString().split("\n")) if (line) {
-					keep(line);
-					this.logger.info(line);
-				}
-			});
-			child.stderr?.on("data", (data) => {
-				for (const line of data.toString().split("\n")) if (line) {
-					keep(line);
-					this.logger.error(line);
-				}
-			});
+			const lineReader = (emit) => {
+				let pending = "";
+				const show = (line) => {
+					if (!line) return;
+					const shown = redact === void 0 ? line : redact(line);
+					keep(shown);
+					emit(shown);
+				};
+				return {
+					push: (data) => {
+						const lines = (pending + data.toString()).split("\n");
+						pending = redact === void 0 ? "" : lines.pop() ?? "";
+						for (const line of lines) show(line);
+					},
+					flush: () => {
+						show(pending);
+						pending = "";
+					}
+				};
+			};
+			const stdout = lineReader((line) => this.logger.info(line));
+			const stderr = lineReader((line) => this.logger.error(line));
+			child.stdout?.on("data", stdout.push);
+			child.stderr?.on("data", stderr.push);
 			child.on("error", (error) => {
 				settle({
 					status: "spawn_error",
@@ -7465,6 +7358,8 @@ var StepRunnerService = class StepRunnerService {
 			child.on("exit", async (code, signal) => {
 				if (!interactive) await this.cleanupProcessGroup();
 				await outputDrained(child);
+				stdout.flush();
+				stderr.flush();
 				if (timedOut && timeoutMs !== null) {
 					settle({
 						status: "timed_out",
@@ -7506,6 +7401,7 @@ var StepRunnerService = class StepRunnerService {
 	*/
 	startStepExecution(request) {
 		const { command, custom, inProcessOnly, interactive, stepEnv, stepName, template, timeoutMs, workDir } = request;
+		if (request.secretEnv !== void 0) return this.executeCommand(command, workDir, stepEnv, stepName, false, timeoutMs, request.secretEnv);
 		const executor = this.stepExecutor;
 		const base = {
 			traceparent: request.traceparent,
@@ -7572,7 +7468,7 @@ var StepRunnerService = class StepRunnerService {
 	/**
 	* Await a host-owned execution and normalize it like a child process.
 	*
-	* The engine keeps ownership of the timeout; stop, pause and status-file
+	* The engine keeps ownership of the timeout; stop and pause
 	* completion reach the execution through `killActiveStep`, which calls its
 	* `stop`. A stopped execution reads as signalled so shutdown still interrupts
 	* the workflow, while the completion races report their own outcome.
@@ -7895,7 +7791,7 @@ var StepRunnerService = class StepRunnerService {
 		return [...keys];
 	}
 	resolveRunner(options) {
-		return options.runner ?? options.cliAgent;
+		return options.runner;
 	}
 	formatStepDisplay(jobName, stepName) {
 		return jobName ? `${jobName} > ${stepName}` : stepName;
@@ -7910,77 +7806,6 @@ var StepRunnerService = class StepRunnerService {
 	escapeShellArg(value) {
 		return `'${value.replace(/'/g, "'\\''")}'`;
 	}
-	async shouldRetryForCodexQuota(stepName, isCodexCommand) {
-		if (!isCodexCommand) return false;
-		return (await this.readCodexQuotaStatus(stepName))?.blockingLimit != null;
-	}
-	async waitForCodexQuotaAvailability(stepName, command, isCodexCommand) {
-		if (!isCodexCommand) return;
-		while (true) {
-			const quotaStatus = await this.readCodexQuotaStatus(stepName);
-			const blockingLimit = quotaStatus?.blockingLimit;
-			if (!blockingLimit) return;
-			const waitTargetMs = blockingLimit.resetAt * 1e3 + QUOTA_WAIT_RESET_BUFFER_MS;
-			const remainingMs = Math.max(waitTargetMs - Date.now(), QUOTA_WAIT_RESET_BUFFER_MS);
-			const waitDescription = new Date(waitTargetMs).toLocaleString();
-			const planSuffix = quotaStatus?.planType ? ` (${quotaStatus.planType})` : "";
-			this.logger.warn(`    ${YELLOW$2}${STATUS_WAIT}${RESET$3} codex quota ${blockingLimit.limitName}/${blockingLimit.window} is at ${blockingLimit.usedPercent}%${planSuffix}; waiting until ${waitDescription}`);
-			await this.waitForQuotaDelay(stepName, command, remainingMs);
-		}
-	}
-	async readCodexQuotaStatus(stepName) {
-		try {
-			return await this.quotaService.getQuotaStatus();
-		} catch (error) {
-			this.logger.warn(`    ${YELLOW$2}${STATUS_WARN}${RESET$3}  unable to read codex quota for "${stepName}" (${this.formatQuotaError(error)})`);
-			return null;
-		}
-	}
-	async waitForQuotaDelay(stepName, command, remainingMs) {
-		const controller = new AbortController();
-		this.activeQuotaWait = {
-			controller,
-			signal: null,
-			stepName
-		};
-		try {
-			let timeLeftMs = remainingMs;
-			while (timeLeftMs > 0) {
-				const sleepMs = Math.min(timeLeftMs, QUOTA_WAIT_POLL_INTERVAL_MS);
-				await this.waitForDelay(sleepMs, controller.signal);
-				timeLeftMs -= sleepMs;
-			}
-		} catch (error) {
-			if (controller.signal.aborted) throw new WorkflowInterruptedError(this.activeQuotaWait?.signal ?? TERMINATE_SIGNAL$1, {
-				cause: /* @__PURE__ */ new Error(`Interrupted while waiting for Codex quota reset`),
-				context: {
-					...this.createInterruptContext(stepName, command),
-					phase: QUOTA_WAIT_SOURCE
-				}
-			});
-			throw error;
-		} finally {
-			this.activeQuotaWait = null;
-		}
-	}
-	async waitForDelay(delayMs, signal) {
-		await new Promise((resolveDelay, rejectDelay) => {
-			const timeout = setTimeout(() => {
-				signal.removeEventListener("abort", onAbort);
-				resolveDelay();
-			}, delayMs);
-			const onAbort = () => {
-				clearTimeout(timeout);
-				signal.removeEventListener("abort", onAbort);
-				rejectDelay(/* @__PURE__ */ new Error("aborted"));
-			};
-			signal.addEventListener("abort", onAbort, { once: true });
-		});
-	}
-	formatQuotaError(error) {
-		if (error instanceof Error && error.message.trim().length > 0) return error.message;
-		return "unknown quota error";
-	}
 	/**
 	* Resolve the per-step timeout from workflow YAML into milliseconds.
 	*/
@@ -8125,10 +7950,8 @@ var StepRunnerService = class StepRunnerService {
 		return Number.isInteger(parsed) && parsed > 0 ? parsed : PROCESS_EXIT_WAIT_TIMEOUT_MS;
 	}
 	/**
-	* SIGTERM→SIGKILL grace on the completion path (status file signalled `YES`).
-	* Deliberately longer than the timeout-path `FORCE_KILL_GRACE_PERIOD_MS` so an
-	* interactive agent can flush its final telemetry batch (e.g. Claude Code's
-	* OTEL Stop-hook events) before SIGKILL. A fast graceful exit still settles
+	* Grace for interactive stop and pause teardown, allowing telemetry to flush.
+	* A fast graceful exit still settles
 	* immediately, so this only adds latency when a child lingers. Operator-tunable
 	* via `WORKFLOW_STEP_FORCE_KILL_GRACE_MS`; defaults to STEP_COMPLETION_KILL_GRACE_MS.
 	*/
@@ -8268,7 +8091,7 @@ var StepRunnerService = class StepRunnerService {
 	* Interactive TUIs such as Claude Code make themselves process-group leaders
 	* (pid === pgid) and spawn descendants into that group. Reaping by pid alone
 	* leaves anything spawned after the one-shot tree snapshot alive, which keeps
-	* the interactive session running after the Stop hook signalled completion.
+	* the interactive session running after a stop or pause request.
 	*/
 	collectInteractiveProcessGroupIds(processIds) {
 		if (processIds.length === 0) return [];
@@ -8371,38 +8194,17 @@ var StepRunnerService = class StepRunnerService {
 			return false;
 		}
 	}
-	/**
-	* Create an empty temp file that the Claude Code Stop hook will write
-	* YES to when the agent finishes its turn. The path is injected into
-	* WORKFLOW_STATUS_FILE so the hook can locate it directly — no fallback
-	* marker file is used.
-	*/
-	async createStatusFile() {
-		if (!this.runtime.temporaryDirectory) throw new Error("Workflow interactive status files require an admitted temporaryDirectory");
-		const filePath = (0, node_path.join)(this.runtime.temporaryDirectory, `${STATUS_FILE_PREFIX}${(0, node_crypto.randomUUID)()}${STATUS_FILE_SUFFIX}`);
-		(0, _agimon_ai_po_core_platform.getOrThrow)(await this.runtime.fs.writeFile(filePath, "", this.runtime.ioContext));
-		return filePath;
-	}
-	/**
-	* Race interactive step execution against agent completion and workflow stop files.
-	* When the file contains YES, SIGTERM the step process and wait for
-	* it to exit before returning `status_completed`. Escalates to SIGKILL
-	* if the process ignores SIGTERM. The next job must not start until
-	* the child process tree has fully exited.
-	*/
-	async raceInteractiveCompletion(executionPromise, statusFilePath, stepName, stopRequestPath, pausePolicy) {
+	/** Race interactive execution against workflow stop and pause requests. */
+	async raceInteractiveCompletion(executionPromise, stepName, stopRequestPath, pausePolicy) {
 		return new Promise((resolveRace) => {
 			let settled = false;
-			let statusFileTriggered = false;
 			let stopRequestTriggered = false;
 			let pauseRequestTriggered = false;
 			const pauseRequestPath = stopRequestPath ? (0, node_path.join)((0, node_path.dirname)(stopRequestPath), PAUSE_REQUEST_FILENAME) : void 0;
 			let forceKillTimer = null;
 			let completionSettleTimer = null;
-			let watcher = null;
 			let stopWatcher = null;
 			let pauseWatcher = null;
-			let pollTimer = null;
 			let stopPollTimer = null;
 			let pausePollTimer = null;
 			let signalDelivered = false;
@@ -8410,7 +8212,6 @@ var StepRunnerService = class StepRunnerService {
 			const resolveCompletionSource = (result) => {
 				if (stopRequestTriggered) return "stop-request";
 				if (pauseRequestTriggered) return "pause-request";
-				if (statusFileTriggered) return "status-file";
 				switch (result.status) {
 					case RESULT_STATUS_TIMED_OUT: return "timed-out";
 					case RESULT_STATUS_SPAWN_ERROR: return "spawn-error";
@@ -8421,10 +8222,6 @@ var StepRunnerService = class StepRunnerService {
 			const settle = async (result) => {
 				if (settled) return;
 				settled = true;
-				if (watcher) {
-					await watcher.close(this.runtime.ioContext).catch((error) => this.logger.warn(`Workflow watcher cleanup failed: ${String(error)}`));
-					watcher = null;
-				}
 				if (stopWatcher) {
 					await stopWatcher.close(this.runtime.ioContext).catch((error) => this.logger.warn(`Workflow watcher cleanup failed: ${String(error)}`));
 					stopWatcher = null;
@@ -8433,10 +8230,6 @@ var StepRunnerService = class StepRunnerService {
 					await pauseWatcher.close(this.runtime.ioContext).catch((error) => this.logger.warn(`Workflow watcher cleanup failed: ${String(error)}`));
 					pauseWatcher = null;
 				}
-				if (pollTimer) {
-					clearInterval(pollTimer);
-					pollTimer = null;
-				}
 				if (stopPollTimer) {
 					clearInterval(stopPollTimer);
 					stopPollTimer = null;
@@ -8460,25 +8253,13 @@ var StepRunnerService = class StepRunnerService {
 				await this.recordInteractiveCompletion({
 					timestamp: (/* @__PURE__ */ new Date()).toISOString(),
 					stepName,
-					statusFilePath,
 					completionSource: resolveCompletionSource(settledResult),
-					statusFileSignaled: statusFileTriggered,
 					sigkillEscalated: sigkillEscalated || (this.lastInteractiveReap?.sigkillEscalated ?? false),
 					survivors: this.lastInteractiveReap?.survivors ?? []
 				});
 				this.lastInteractiveReap = null;
 				resolveRace(settledResult);
 			};
-			const statusFileHasCompletionValue = async () => {
-				try {
-					return await (0, _agimon_ai_po_core_platform.pathExists)(this.runtime.fs, statusFilePath, this.runtime.ioContext) && (0, _agimon_ai_po_core_platform.getOrThrow)(await this.runtime.fs.readTextFile(statusFilePath, this.runtime.ioContext)).trim() === STATUS_FILE_COMPLETION_VALUE;
-				} catch (error) {
-					const code = error.code;
-					if (!code || !TRANSIENT_FS_ERROR_CODES.has(code)) this.logger.warn(`    ${YELLOW$2}${STATUS_WARN}${RESET$3}  status-file read failed for ${stepName}: ${error instanceof Error ? error.message : String(error)}`);
-					else this.logger.info(`    ${DIM$3}status-file${RESET$3}  transient FS error (${code}) polling ${stepName}`);
-					return false;
-				}
-			};
 			const scheduleAbsoluteSettle = (result, delayMs) => {
 				if (settled || completionSettleTimer) return;
 				completionSettleTimer = setTimeout(() => {
@@ -8497,24 +8278,6 @@ var StepRunnerService = class StepRunnerService {
 					settle(result);
 				}, delayMs);
 			};
-			const checkFileContent = async () => {
-				if (!await statusFileHasCompletionValue() || settled || statusFileTriggered) return;
-				statusFileTriggered = true;
-				const graceMs = this.stepCompletionKillGraceMs();
-				signalDelivered = this.killActiveStep(TERMINATE_SIGNAL$1);
-				if (!signalDelivered) {
-					this.logger.warn(`    ${YELLOW$2}${STATUS_WARN}${RESET$3}  ${stepName} status-file: SIGTERM could not be delivered, process may have already exited`);
-					scheduleAbsoluteSettle(STATUS_FILE_COMPLETED_RESULT, PROCESS_EXIT_WAIT_TIMEOUT_MS);
-					return;
-				}
-				forceKillTimer = setTimeout(() => {
-					if (settled) return;
-					sigkillEscalated = true;
-					this.logger.warn(`    ${YELLOW$2}${STATUS_WARN}${RESET$3}  ${stepName} did not exit after status-file SIGTERM, forcing SIGKILL`);
-					this.killActiveStep(TERMINATE_FORCE_KILL_SIGNAL);
-				}, graceMs);
-				scheduleAbsoluteSettle(STATUS_FILE_COMPLETED_RESULT, graceMs + PROCESS_EXIT_WAIT_TIMEOUT_MS);
-			};
 			const stopRequestExists = async () => Boolean(stopRequestPath && await this.hasCurrentStopRequest(stopRequestPath));
 			const pauseRequestExists = async () => Boolean(pauseRequestPath && await (0, _agimon_ai_po_core_platform.pathExists)(this.runtime.fs, pauseRequestPath, this.runtime.ioContext) && await this.readControlAction(pauseRequestPath) === "pause");
 			const checkStopRequest = async () => {
@@ -8554,23 +8317,9 @@ var StepRunnerService = class StepRunnerService {
 				}, graceMs);
 				scheduleAbsoluteSettle({ status: RESULT_STATUS_PAUSE_REQUESTED }, graceMs + PROCESS_EXIT_WAIT_TIMEOUT_MS);
 			};
-			try {
-				this.watchStatusFile([{ path: statusFilePath }], () => {
-					checkFileContent().catch((error) => this.logger.warn(`Workflow control check failed: ${String(error)}`));
-				}, this.runtime.ioContext).then(async (result) => {
-					const admitted = (0, _agimon_ai_po_core_platform.getOrThrow)(result);
-					if (settled) await admitted.close(this.runtime.ioContext);
-					else watcher = admitted;
-				}).catch((error) => this.logger.warn(`Workflow status-file watcher unavailable, polling instead: ${String(error)}`));
-			} catch (error) {
-				this.logger.warn(`    ${YELLOW$2}${STATUS_WARN}${RESET$3}  status-file watcher setup failed for ${stepName}: ${error instanceof Error ? error.message : String(error)}`);
-			}
-			pollTimer = setInterval(() => {
-				checkFileContent().catch((error) => this.logger.warn(`Workflow control check failed: ${String(error)}`));
-			}, STATUS_FILE_POLL_INTERVAL_MS);
 			if (stopRequestPath) {
 				try {
-					this.watchStatusFile([{ path: stopRequestPath }], () => {
+					this.watchControlFile([{ path: stopRequestPath }], () => {
 						checkStopRequest().catch((error) => this.logger.warn(`Workflow control check failed: ${String(error)}`));
 					}, this.runtime.ioContext).then(async (result) => {
 						const admitted = (0, _agimon_ai_po_core_platform.getOrThrow)(result);
@@ -8586,7 +8335,7 @@ var StepRunnerService = class StepRunnerService {
 			}
 			if (pauseRequestPath) {
 				try {
-					this.watchStatusFile([{ path: pauseRequestPath }], () => {
+					this.watchControlFile([{ path: pauseRequestPath }], () => {
 						checkPauseRequest().catch((error) => this.logger.warn(`Workflow control check failed: ${String(error)}`));
 					}, this.runtime.ioContext).then(async (result) => {
 						const admitted = (0, _agimon_ai_po_core_platform.getOrThrow)(result);
@@ -8600,7 +8349,6 @@ var StepRunnerService = class StepRunnerService {
 					checkPauseRequest().catch((error) => this.logger.warn(`Workflow control check failed: ${String(error)}`));
 				}, STOP_REQUEST_POLL_INTERVAL_MS);
 			}
-			checkFileContent().catch((error) => this.logger.warn(`Workflow control check failed: ${String(error)}`));
 			checkStopRequest().catch((error) => this.logger.warn(`Workflow control check failed: ${String(error)}`));
 			checkPauseRequest().catch((error) => this.logger.warn(`Workflow control check failed: ${String(error)}`));
 			executionPromise.then(async (result) => {
@@ -8609,42 +8357,9 @@ var StepRunnerService = class StepRunnerService {
 					settle({ status: RESULT_STATUS_STOP_REQUESTED });
 					return;
 				}
-				const completedViaStatusFile = statusFileTriggered || await statusFileHasCompletionValue();
-				const protectedPauseEligible = result.status === RESULT_STATUS_STATUS_COMPLETED || result.status === RESULT_STATUS_COMPLETED && result.exitCode === 0;
-				if (pauseRequestTriggered && (pausePolicy !== "protected" || protectedPauseEligible) && (pausePolicy === "protected" || !statusFileTriggered)) {
-					settle({ status: RESULT_STATUS_PAUSE_REQUESTED });
-					return;
-				}
-				if (!completedViaStatusFile) {
-					settle(result);
-					return;
-				}
-				if (!statusFileTriggered) {
-					statusFileTriggered = true;
-					this.logger.info(`    ${GREEN$2}${STATUS_DONE}${RESET$3}  ${stepName} status-file observed during process exit handling`);
-				}
-				switch (result.status) {
-					case RESULT_STATUS_SPAWN_ERROR:
-					case RESULT_STATUS_TIMED_OUT:
-						settle(result);
-						return;
-					case RESULT_STATUS_SIGNALED:
-						if (sigkillEscalated) this.logger.warn(`    ${YELLOW$2}${STATUS_WARN}${RESET$3}  ${stepName} required SIGKILL escalation (work completed via status-file)`);
-						settle(STATUS_FILE_COMPLETED_RESULT);
-						return;
-					case RESULT_STATUS_COMPLETED:
-						if (sigkillEscalated) this.logger.warn(`    ${YELLOW$2}${STATUS_WARN}${RESET$3}  ${stepName} required SIGKILL escalation (work completed via status-file, exit code ${result.exitCode})`);
-						settle(STATUS_FILE_COMPLETED_RESULT);
-						return;
-					case RESULT_STATUS_STATUS_COMPLETED:
-						settle(result);
-						return;
-					case RESULT_STATUS_STOP_REQUESTED:
-					case RESULT_STATUS_PAUSE_REQUESTED:
-						settle(result);
-						return;
-					default: settle(result);
-				}
+				const protectedPauseEligible = result.status === RESULT_STATUS_COMPLETED && result.exitCode === 0;
+				if (pauseRequestTriggered && (pausePolicy !== "protected" || protectedPauseEligible)) settle({ status: RESULT_STATUS_PAUSE_REQUESTED });
+				else settle(result);
 			});
 		});
 	}
@@ -8693,7 +8408,7 @@ var StepRunnerService = class StepRunnerService {
 				}, FORCE_KILL_GRACE_PERIOD_MS);
 			};
 			try {
-				this.watchStatusFile([{ path: stopRequestPath }], () => {
+				this.watchControlFile([{ path: stopRequestPath }], () => {
 					checkStopRequest().catch((error) => this.logger.warn(`Workflow control check failed: ${String(error)}`));
 				}, this.runtime.ioContext).then(async (result) => {
 					const admitted = (0, _agimon_ai_po_core_platform.getOrThrow)(result);
@@ -8708,7 +8423,7 @@ var StepRunnerService = class StepRunnerService {
 			}, STOP_REQUEST_POLL_INTERVAL_MS);
 			checkStopRequest().catch((error) => this.logger.warn(`Workflow control check failed: ${String(error)}`));
 			executionPromise.then(async (result) => {
-				const protectedPauseEligible = result.status === RESULT_STATUS_STATUS_COMPLETED || result.status === RESULT_STATUS_COMPLETED && result.exitCode === 0;
+				const protectedPauseEligible = result.status === RESULT_STATUS_COMPLETED && result.exitCode === 0;
 				if (stopRequestTriggered) settle({ status: RESULT_STATUS_STOP_REQUESTED });
 				else if (pauseRequestTriggered && (pausePolicy !== "protected" || protectedPauseEligible)) settle({ status: RESULT_STATUS_PAUSE_REQUESTED });
 				else settle(result);
@@ -8818,16 +8533,6 @@ var StepRunnerService = class StepRunnerService {
 			this.logger.warn(`    ${YELLOW$2}${STATUS_WARN}${RESET$3}  failed to restore terminal state: ${String(error)}`);
 		}
 	}
-	/**
-	* Remove the temp status file and the well-known marker file after step completion.
-	*/
-	async cleanupStatusFile(statusFilePath) {
-		try {
-			if (await (0, _agimon_ai_po_core_platform.pathExists)(this.runtime.fs, statusFilePath, this.runtime.ioContext)) (0, _agimon_ai_po_core_platform.getOrThrow)(await this.runtime.fs.remove(statusFilePath, { force: true }, this.runtime.ioContext));
-		} catch (error) {
-			this.logger.warn(`    ${YELLOW$2}${STATUS_WARN}${RESET$3}  status-file cleanup failed: ${error instanceof Error ? error.message : String(error)}`);
-		}
-	}
 };
 //#endregion
 //#region src/services/TriggerService/index.ts
@@ -9551,7 +9256,7 @@ var RunWorkflowService = class {
 		this.launcherMetadata = dependencies.launcherMetadata;
 		this.parser = dependencies.parser ?? new WorkflowParserService(this.runtime);
 		this.serviceManager = dependencies.serviceManager ?? new BackgroundServiceManager(this.runtime, this.logger);
-		this.stepRunner = dependencies.stepRunner ?? new StepRunnerService(this.runtime, this.parser, this.logger, void 0, void 0, void 0, dependencies.ownsTerminal, dependencies.stepExecutor);
+		this.stepRunner = dependencies.stepRunner ?? new StepRunnerService(this.runtime, this.parser, this.logger, void 0, void 0, dependencies.ownsTerminal, dependencies.stepExecutor, dependencies.resolveSecrets);
 		this.registry = dependencies.registry ?? new WorkflowRegistryService(this.runtime);
 		this.runDirectoryService = dependencies.runDirectoryService ?? new RunDirectoryService(this.runtime, this.registry.writeCoordinator);
 		this.jobRunner = dependencies.jobRunner ?? new JobRunnerService(this.runtime, this.parser, this.stepRunner, this.logger, this.runDirectoryService);
@@ -9563,6 +9268,7 @@ var RunWorkflowService = class {
 	* Run the workflow from trigger preparation through cleanup.
 	*/
 	async run(input) {
+		if ("cliAgent" in input) throw new Error("cliAgent is retired. Use runner explicitly.");
 		this.stepRunner.resetInterruption();
 		this.triggerService.resetInterruption();
 		this.outputLines = [];
@@ -9745,12 +9451,12 @@ var RunWorkflowService = class {
 			commands: workflow.commands,
 			choices: workflow.choices,
 			command: input.command,
-			choice: input.choice
+			choice: input.choice,
+			profile: input.profile
 		});
 	}
 	resolveRunner(input, workflow) {
-		if (input.runner && input.cliAgent && input.runner !== input.cliAgent) throw new Error(`Conflicting runner selectors: runner="${input.runner}" cliAgent="${input.cliAgent}"`);
-		return input.runner ?? input.cliAgent ?? (workflow ? this.resolveWorkflowRunner(workflow) : void 0);
+		return input.runner ?? (workflow ? this.resolveWorkflowRunner(workflow) : void 0);
 	}
 	/**
 	* Execute the workflow after signal handlers are installed.
@@ -9883,7 +9589,6 @@ var RunWorkflowService = class {
 			if (dryRun && input.recovery) registryRun = await this.createRecoveryDryRunHandle(input, resolvedWorkspace);
 			else registryRun = await this.registry.createRun({
 				activeRepairId: input.recovery?.activeRepairId,
-				cliAgent: input.cliAgent,
 				continueOnError: input.continueOnError,
 				displayName: workflowName,
 				dryRun,
@@ -9897,6 +9602,7 @@ var RunWorkflowService = class {
 				runner,
 				command: input.command,
 				choice: input.choice,
+				profile: input.profile,
 				runDirectory: workflow["run-directory"],
 				secretFile: input.secretFile,
 				skipLaunch: input.skipLaunch,
@@ -9975,7 +9681,6 @@ var RunWorkflowService = class {
 			}
 			if (!await this.triggerService.handleAgentDecision(workflow, workflowEnv, inputs, secrets, {
 				runner,
-				cliAgent: input.cliAgent,
 				dryRun,
 				continueOnError,
 				stopRequestPath: registryRun.stopRequestPath,
@@ -10014,7 +9719,6 @@ var RunWorkflowService = class {
 					this.logger.info(`  ${"─".repeat(50)}`);
 					if (!await this.worktreeService.runHook(workflow.worktree.beforeCreate, workflowDir, workflowEnv, inputs, secrets, {
 						runner,
-						cliAgent: input.cliAgent,
 						dryRun,
 						continueOnError,
 						stopRequestPath: registryRun.stopRequestPath,
@@ -10046,7 +9750,6 @@ var RunWorkflowService = class {
 						this.logger.info(`  ${"─".repeat(50)}`);
 						if (!await this.worktreeService.runHook(workflow.worktree.afterCreate, worktreePath, workflowEnv, inputs, secrets, {
 							runner,
-							cliAgent: input.cliAgent,
 							dryRun,
 							continueOnError,
 							stopRequestPath: registryRun.stopRequestPath,
@@ -10079,7 +9782,6 @@ var RunWorkflowService = class {
 				const preStopRequestPath = registryRun.stopRequestPath;
 				if (!await this.recordPhase(progress, PRE_PHASE_JOB, () => this.runPreBlock(preBlock, workflowEnv, inputs, secrets, {
 					runner,
-					cliAgent: input.cliAgent,
 					dryRun,
 					continueOnError,
 					progress,
@@ -10157,7 +9859,6 @@ var RunWorkflowService = class {
 						runDirectory: workflow["run-directory"]
 					}, {
 						runner,
-						cliAgent: input.cliAgent,
 						dryRun,
 						continueOnError,
 						stopRequestPath,
@@ -10264,7 +9965,6 @@ var RunWorkflowService = class {
 					} : void 0
 				}, {
 					runner,
-					cliAgent: input.cliAgent,
 					dryRun,
 					continueOnError,
 					stopRequestPath: registryRun.stopRequestPath,
@@ -10475,7 +10175,6 @@ var RunWorkflowService = class {
 				this.logger.info(`  ${"─".repeat(50)}`);
 				if (!await this.worktreeService.runHook(workflow.worktree.beforeCompleted, worktreePath, workflowEnv, inputs, secrets, {
 					runner,
-					cliAgent: input.cliAgent,
 					dryRun,
 					continueOnError
 				})) {
@@ -10500,7 +10199,6 @@ var RunWorkflowService = class {
 				try {
 					if (!await this.recordPhase(progress, POST_PHASE_JOB, () => this.runPostBlock(postBlock, workflowEnv, inputs, secrets, {
 						runner,
-						cliAgent: input.cliAgent,
 						dryRun,
 						continueOnError,
 						progress,
@@ -10527,7 +10225,6 @@ var RunWorkflowService = class {
 				this.logger.info(`  ${"─".repeat(50)}`);
 				if (!await this.worktreeService.runHook(workflow.worktree.afterCompleted, originalDir, workflowEnv, inputs, secrets, {
 					runner,
-					cliAgent: input.cliAgent,
 					dryRun,
 					continueOnError
 				})) {
@@ -10888,6 +10585,7 @@ var RunWorkflowService = class {
 		if (runner) parts.push("--runner", require_workflowCommandTemplate.escapeShellArg(runner));
 		if (input.command) parts.push("--command", require_workflowCommandTemplate.escapeShellArg(input.command));
 		if (input.choice) parts.push("--choice", require_workflowCommandTemplate.escapeShellArg(input.choice));
+		if (input.profile) parts.push("--profile", require_workflowCommandTemplate.escapeShellArg(input.profile));
 		if (input.dryRun) parts.push("--dry-run");
 		if (input.continueOnError) parts.push("--continue-on-error");
 		if (input.keepWorktree) parts.push("--keep-worktree");
@@ -11201,16 +10899,21 @@ var RecoverWorkflowService = class {
 		if (!recoveredJob) throw new Error(`Workflow run "${record.workspace}/${record.runKey}" does not include a recoverable failed job`);
 		if (record.worktreePath && !await (0, _agimon_ai_po_core_platform.pathExists)(this.runtime.fs, record.worktreePath, this.runtime.ioContext)) throw new Error(`Recoverable worktree not found: ${record.worktreePath}`);
 		const runner = input.runner ?? record.runner ?? record.cliAgent;
-		const cliAgent = runner === record.cliAgent ? record.cliAgent : void 0;
+		if ([runner, record.command].some((value) => value !== void 0 && [
+			"claude",
+			"claude-code",
+			"codex",
+			"antigravity"
+		].includes(value))) throw new Error("Retired workflow execution cannot be replayed. Select a supported runner explicitly.");
 		const originalJob = fixRestartFrom && !activeRepair ? void 0 : record.job;
 		if (!this.parser.resolveJobOrder(workflow.jobs, originalJob ?? null).includes(recoveredJob)) throw new Error(`Workflow run "${record.workspace}/${record.runKey}" recovery target "${recoveredJob}" is not in the workflow job order`);
 		const ownerSessionId = claimedOwnerSessionId?.trim();
 		const envOverrides = ownerSessionId ? { [PI_SESSION_ENV]: ownerSessionId } : void 0;
 		return await this.runner.run({
-			cliAgent,
 			runner,
 			command: record.command,
 			choice: record.choice,
+			profile: record.profile,
 			workflowPath: record.workflowPath,
 			job: recoveredJob,
 			inputs: record.inputs,
@@ -11263,12 +10966,6 @@ var RecoverWorkflowService = class {
 	}
 };
 //#endregion
-Object.defineProperty(exports, "CodexQuotaService", {
-	enumerable: true,
-	get: function() {
-		return CodexQuotaService;
-	}
-});
 Object.defineProperty(exports, "NativeTerminalService", {
 	enumerable: true,
 	get: function() {
@@ -11359,12 +11056,6 @@ Object.defineProperty(exports, "diagnoseWorkflows", {
 		return diagnoseWorkflows;
 	}
 });
-Object.defineProperty(exports, "formatArtifactWarning", {
-	enumerable: true,
-	get: function() {
-		return formatArtifactWarning;
-	}
-});
 Object.defineProperty(exports, "gateStepDecision", {
 	enumerable: true,
 	get: function() {
@@ -11456,4 +11147,4 @@ Object.defineProperty(exports, "workflowShellOutput", {
 	}
 });
 
-//# sourceMappingURL=RecoverWorkflowService-BLehH1qi.cjs.map
+//# sourceMappingURL=RecoverWorkflowService-CEYR10KF.cjs.map