@automatalabs/workflows 0.57.1 → 0.58.1

package/dist/mcp-server.js

@@ -30646,9 +30646,9 @@ import {
   buildModelFilter,
   parseWorkflowScript,
   probeHarnessConfig as probeHarnessConfig2,
-  redactText as redactText2,
+  redactText as redactText3,
   validateWorkflowScript,
-  truncateUtf8 as truncateUtf83,
+  truncateUtf8 as truncateUtf84,
   workflowMayUseDefaultModel,
   WorkflowError,
   WorkflowErrorCode,
@@ -30661,6 +30661,15 @@ import {
 
 // ../mcp-server/src/workflow-tool-input.ts
 import { isAbsolute } from "node:path";
+var permissionResponseSchema = external_exports.object({
+  outcome: external_exports.discriminatedUnion("outcome", [
+    external_exports.object({ outcome: external_exports.literal("cancelled") }).strict(),
+    external_exports.object({ outcome: external_exports.literal("selected"), optionId: external_exports.string().min(1).max(512) }).strict()
+  ])
+}).strict();
+var WORKFLOW_RESULT_CHUNK_BYTES_DEFAULT = 16384;
+var WORKFLOW_RESULT_CHUNK_BYTES_MAX = 16384;
+var WORKFLOW_RESULT_CHUNK_BYTES_MIN = 4;
 var checkpointRepliesSchema = external_exports.record(
   external_exports.string().refine(
     (key) => {
@@ -30672,17 +30681,17 @@ var checkpointRepliesSchema = external_exports.record(
   external_exports.unknown()
 );
 var workflowToolInputShape = {
-  action: external_exports.enum(["run", "config", "inspect", "await", "stop"]).optional().describe(
-    "Operation. Omit or use run to validate then execute; config discovers live backend/model/mode/config options without starting a run; inspect reads immediately; await waits for terminal status; stop aborts a live run or cancels one in-flight agent."
+  action: external_exports.enum(["run", "config", "inspect", "await", "result", "stop", "permissions-response"]).optional().describe(
+    "Operation. Omit or use run to validate then execute; config discovers live backend/model/mode/config options; inspect/await expose lifecycle and action requirements; result pages the exact completed JSON result; permissions-response resolves one pending ACP permission; stop aborts a run or one in-flight agent."
   ),
   script: external_exports.string().min(1).optional().describe(
-    "Raw JavaScript workflow script (no Markdown fences). Exactly one of script or scriptPath is required for run; both are forbidden for config/inspect/await/stop. First statement MUST be `export const meta = { name, description, phases? }`. When present, phases MUST be an array of objects shaped `{ title: string, detail?: string, model?: string }`, never an array of strings."
+    "Raw JavaScript workflow script (no Markdown fences). Exactly one of script or scriptPath is required for run; both are forbidden for config/inspect/await/result/stop/permissions-response. First statement MUST be `export const meta = { name, description, phases? }`. When present, phases MUST be an array of objects shaped `{ title: string, detail?: string, model?: string }`, never an array of strings."
   ),
   scriptPath: external_exports.string().min(1).refine((value) => isAbsolute(value), "scriptPath must be an absolute path").optional().describe(
-    "Absolute path, on the server's filesystem, to a workflow script file read once at admission. Exactly one of script or scriptPath is required for run; both are forbidden for config/inspect/await/stop. Relative paths are rejected."
+    "Absolute path, on the server's filesystem, to a workflow script file read once at admission. Exactly one of script or scriptPath is required for run; both are forbidden for config/inspect/await/result/stop/permissions-response. Relative paths are rejected."
   ),
   projectDir: external_exports.string().min(1).refine((value) => isAbsolute(value), "projectDir must be an absolute path").optional().describe(
-    "Absolute project directory used as the cwd for config discovery and, for run, the project-scoped store (where the runId, journal, and resume state live) plus default execution cwd. Required for run and config on the shared workflow daemon; on a single-project (in-process) server it defaults to that server's own project. Forbidden for inspect/await/stop \u2014 a runId locates its project."
+    "Absolute project directory used as the cwd for config discovery and, for run, the project-scoped store (where the runId, journal, and resume state live) plus default execution cwd. Required for run and config on the shared workflow daemon; on a single-project (in-process) server it defaults to that server's own project. Forbidden for inspect/await/result/stop/permissions-response \u2014 a runId locates its project."
   ),
   harnesses: external_exports.array(external_exports.string().regex(/^[a-z][a-z0-9._-]*$/i, "invalid backend name")).min(1).max(16).optional().describe('With action="config", backend names to probe. Omit to probe every backend registered on this server.'),
   modelSpecs: external_exports.array(external_exports.string().min(1).max(256)).min(1).max(16).optional().describe(
@@ -30704,7 +30713,9 @@ var workflowToolInputShape = {
   resumePolicy: external_exports.enum(["auto", "positional"]).optional().describe('Resume matching policy. Default "auto"; requires resumeFromRunId.'),
   checkpointReplies: checkpointRepliesSchema.optional().describe("With resumeFromRunId, durable-checkpoint decisions keyed by checkpointContext.callIndex."),
   background: external_exports.boolean().optional().describe("Default false. True acknowledges after admission and executes in this server process."),
-  runId: external_exports.string().max(128).regex(/^[a-z0-9]+-[a-z0-9]+$/, "runId must be an engine-generated run ID").optional().describe("Project-scoped workflow run ID. Required for inspect/await/stop; forbidden for config/run."),
+  runId: external_exports.string().max(128).regex(/^[a-z0-9]+-[a-z0-9]+$/, "runId must be an engine-generated run ID").optional().describe("Project-scoped workflow run ID. Required for inspect/await/result/stop/permissions-response; forbidden for config/run."),
+  permissionId: external_exports.string().uuid().optional().describe('With action="permissions-response", the opaque pending permission id returned by inspect/await.'),
+  response: permissionResponseSchema.optional().describe('With action="permissions-response", an exact ACP selected optionId or cancelled outcome.'),
   callIndex: external_exports.number().int().nonnegative().safe().optional().describe(
     "With action=stop, cancel exactly this in-flight agent call without aborting the run. Forbidden for every other action."
   ),
@@ -30716,11 +30727,19 @@ var workflowToolInputShape = {
     message: "labelGlob must contain from 1 through 128 Unicode code points"
   }).optional().describe("Case-sensitive whole-label glob using *, ?, and backslash escaping."),
   logLines: external_exports.number().int().min(0).max(50).optional().describe("Latest run-log lines. Default 20; range 0..50."),
-  waitMs: external_exports.number().int().min(0).max(25e3).optional().describe("Await duration in milliseconds. Default 20000; range 0..25000. Zero reads without blocking.")
+  waitMs: external_exports.number().int().min(0).max(25e3).optional().describe("Await duration in milliseconds. Default 20000; range 0..25000. Zero reads without blocking."),
+  offset: external_exports.number().int().nonnegative().safe().optional().describe('With action="result", UTF-8 byte offset into the exact serialized JSON. Default 0; use the previous endOffset.'),
+  maxBytes: external_exports.number().int().min(WORKFLOW_RESULT_CHUNK_BYTES_MIN).max(WORKFLOW_RESULT_CHUNK_BYTES_MAX).optional().describe(`With action="result", maximum UTF-8 bytes returned. Default and maximum ${WORKFLOW_RESULT_CHUNK_BYTES_DEFAULT}.`)
 };
 function hasConfigFields(raw) {
   return raw.harnesses !== void 0 || raw.modelSpecs !== void 0 || raw.modelFilter !== void 0 || raw.probeTimeoutMs !== void 0;
 }
+function hasPermissionFields(raw) {
+  return raw.permissionId !== void 0 || raw.response !== void 0;
+}
+function hasResultFields(raw) {
+  return raw.offset !== void 0 || raw.maxBytes !== void 0;
+}
 function hasExecutionFields(raw) {
   return raw.script !== void 0 || raw.scriptPath !== void 0 || raw.projectDir !== void 0 || raw.args !== void 0 || raw.maxAgents !== void 0 || raw.concurrency !== void 0 || raw.agentRetries !== void 0 || raw.agentTimeoutMs !== void 0 || raw.agentIdleTimeoutMs !== void 0 || raw.resumeFromRunId !== void 0 || raw.resumePolicy !== void 0 || raw.checkpointReplies !== void 0 || raw.background !== void 0;
 }
@@ -30729,7 +30748,7 @@ function invalid(message) {
 }
 function parseWorkflowToolInput(raw, options = {}) {
   if (raw.action === "config") {
-    if (raw.script !== void 0 || raw.scriptPath !== void 0 || raw.args !== void 0 || raw.maxAgents !== void 0 || raw.concurrency !== void 0 || raw.agentRetries !== void 0 || raw.agentTimeoutMs !== void 0 || raw.agentIdleTimeoutMs !== void 0 || raw.resumeFromRunId !== void 0 || raw.resumePolicy !== void 0 || raw.checkpointReplies !== void 0 || raw.background !== void 0 || raw.runId !== void 0 || raw.callIndex !== void 0 || raw.forceOwner !== void 0 || raw.waitMs !== void 0 || raw.lastN !== void 0 || raw.labelGlob !== void 0 || raw.logLines !== void 0) {
+    if (raw.script !== void 0 || raw.scriptPath !== void 0 || raw.args !== void 0 || raw.maxAgents !== void 0 || raw.concurrency !== void 0 || raw.agentRetries !== void 0 || raw.agentTimeoutMs !== void 0 || raw.agentIdleTimeoutMs !== void 0 || raw.resumeFromRunId !== void 0 || raw.resumePolicy !== void 0 || raw.checkpointReplies !== void 0 || raw.background !== void 0 || raw.runId !== void 0 || hasPermissionFields(raw) || raw.callIndex !== void 0 || raw.forceOwner !== void 0 || raw.waitMs !== void 0 || raw.lastN !== void 0 || raw.labelGlob !== void 0 || raw.logLines !== void 0 || hasResultFields(raw)) {
       invalid('action="config" accepts only projectDir, harnesses, modelSpecs, modelFilter, and probeTimeoutMs');
     }
     if (options.requireProjectDir === true && raw.projectDir === void 0) {
@@ -30746,9 +30765,36 @@ function parseWorkflowToolInput(raw, options = {}) {
       probeTimeoutMs: raw.probeTimeoutMs
     };
   }
+  if (raw.action === "result") {
+    if (!raw.runId) invalid('action="result" requires runId');
+    if (hasExecutionFields(raw) || hasConfigFields(raw) || hasPermissionFields(raw) || raw.waitMs !== void 0 || raw.callIndex !== void 0 || raw.forceOwner !== void 0 || raw.lastN !== void 0 || raw.labelGlob !== void 0 || raw.logLines !== void 0) {
+      invalid('action="result" accepts only runId, offset, and maxBytes');
+    }
+    return {
+      action: "result",
+      runId: raw.runId,
+      offset: raw.offset ?? 0,
+      maxBytes: raw.maxBytes ?? WORKFLOW_RESULT_CHUNK_BYTES_DEFAULT
+    };
+  }
+  if (raw.action === "permissions-response") {
+    if (!raw.runId) invalid('action="permissions-response" requires runId');
+    if (!raw.permissionId || raw.response === void 0) {
+      invalid('action="permissions-response" requires permissionId and response');
+    }
+    if (hasExecutionFields(raw) || hasConfigFields(raw) || raw.waitMs !== void 0 || raw.callIndex !== void 0 || raw.forceOwner !== void 0 || raw.lastN !== void 0 || raw.labelGlob !== void 0 || raw.logLines !== void 0 || hasResultFields(raw)) {
+      invalid('action="permissions-response" accepts only runId, permissionId, and response');
+    }
+    return {
+      action: "permissions-response",
+      runId: raw.runId,
+      permissionId: raw.permissionId,
+      response: raw.response
+    };
+  }
   if (raw.action === "inspect") {
     if (!raw.runId) invalid('action="inspect" requires runId');
-    if (hasExecutionFields(raw) || hasConfigFields(raw) || raw.waitMs !== void 0 || raw.callIndex !== void 0 || raw.forceOwner !== void 0) {
+    if (hasExecutionFields(raw) || hasConfigFields(raw) || hasPermissionFields(raw) || hasResultFields(raw) || raw.waitMs !== void 0 || raw.callIndex !== void 0 || raw.forceOwner !== void 0) {
       invalid('action="inspect" cannot include execution fields');
     }
     return {
@@ -30761,7 +30807,7 @@ function parseWorkflowToolInput(raw, options = {}) {
   }
   if (raw.action === "await") {
     if (!raw.runId) invalid('action="await" requires runId');
-    if (hasExecutionFields(raw) || hasConfigFields(raw) || raw.callIndex !== void 0 || raw.forceOwner !== void 0) {
+    if (hasExecutionFields(raw) || hasConfigFields(raw) || hasPermissionFields(raw) || hasResultFields(raw) || raw.callIndex !== void 0 || raw.forceOwner !== void 0) {
       invalid('action="await" cannot include execution fields');
     }
     return {
@@ -30775,7 +30821,7 @@ function parseWorkflowToolInput(raw, options = {}) {
   }
   if (raw.action === "stop") {
     if (!raw.runId) invalid('action="stop" requires runId');
-    if (hasExecutionFields(raw) || hasConfigFields(raw) || raw.waitMs !== void 0) {
+    if (hasExecutionFields(raw) || hasConfigFields(raw) || hasPermissionFields(raw) || hasResultFields(raw) || raw.waitMs !== void 0) {
       invalid('action="stop" cannot include execution fields or waitMs');
     }
     if (raw.callIndex !== void 0 && raw.forceOwner !== void 0) {
@@ -30791,7 +30837,7 @@ function parseWorkflowToolInput(raw, options = {}) {
       logLines: raw.logLines
     };
   }
-  if (raw.runId !== void 0 || raw.callIndex !== void 0 || raw.forceOwner !== void 0 || raw.waitMs !== void 0 || raw.lastN !== void 0 || raw.labelGlob !== void 0 || raw.logLines !== void 0 || hasConfigFields(raw)) {
+  if (raw.runId !== void 0 || hasPermissionFields(raw) || raw.callIndex !== void 0 || raw.forceOwner !== void 0 || raw.waitMs !== void 0 || raw.lastN !== void 0 || raw.labelGlob !== void 0 || raw.logLines !== void 0 || hasConfigFields(raw) || hasResultFields(raw)) {
     invalid("run inputs cannot include inspection fields");
   }
   const hasScript = raw.script !== void 0;
@@ -31667,6 +31713,44 @@ var authContextSchema = external_exports.object({
     external_exports.object({ id: external_exports.string(), type: external_exports.enum(["agent", "terminal"]), name: external_exports.string().optional() })
   )
 });
+var permissionOutcomeSchema = external_exports.discriminatedUnion("outcome", [
+  external_exports.object({ outcome: external_exports.literal("cancelled") }).strict(),
+  external_exports.object({ outcome: external_exports.literal("selected"), optionId: external_exports.string() }).strict()
+]);
+var pendingPermissionSchema = external_exports.object({
+  version: external_exports.literal(1),
+  permissionId: external_exports.string().uuid(),
+  runId: external_exports.string(),
+  callIndex: external_exports.number().int().nonnegative(),
+  backendId: external_exports.string(),
+  label: external_exports.string().optional(),
+  requestedAt: external_exports.string(),
+  request: external_exports.object({
+    toolCall: external_exports.record(external_exports.string(), external_exports.unknown()),
+    options: external_exports.array(external_exports.object({
+      optionId: external_exports.string(),
+      name: external_exports.string(),
+      kind: external_exports.string(),
+      _meta: external_exports.record(external_exports.string(), external_exports.unknown()).nullable().optional()
+    })),
+    _meta: external_exports.record(external_exports.string(), external_exports.unknown()).nullable().optional()
+  }),
+  requestTruncated: external_exports.boolean(),
+  requestRedacted: external_exports.boolean()
+});
+var permissionInteractionSchema = external_exports.object({
+  permissionRequests: external_exports.literal("may-block"),
+  collectWith: external_exports.array(external_exports.enum(["await", "inspect"])),
+  respondWith: external_exports.literal("permissions-response"),
+  elicitation: external_exports.enum(["available", "unavailable"])
+});
+var permissionAcknowledgementSchema = external_exports.object({
+  permissionId: external_exports.string().uuid(),
+  runId: external_exports.string(),
+  callIndex: external_exports.number().int().nonnegative(),
+  outcome: permissionOutcomeSchema,
+  respondedAt: external_exports.string()
+});
 var checkpointContextSchema = external_exports.object({
   callIndex: external_exports.number().int().nonnegative(),
   hash: external_exports.string(),
@@ -31852,6 +31936,7 @@ var scriptLineageEntrySchema = external_exports.object({
 });
 var inspectionScriptResourceShape = {
   scriptUri: external_exports.string(),
+  resultUri: external_exports.string().optional(),
   lineage: external_exports.array(scriptLineageEntrySchema)
 };
 var runStatusShape = {
@@ -31919,12 +32004,28 @@ var executionResultSchema = external_exports.object({
   runId: external_exports.string(),
   status: external_exports.enum(["paused", "completed", "failed", "aborted"]),
   ...executionDetailsShape,
-  scriptUri: external_exports.string()
-}).strict();
+  scriptUri: external_exports.string(),
+  resultUri: external_exports.string().optional()
+}).strict().superRefine((value, context) => {
+  if (value.resultUri !== void 0 && value.status !== "completed") {
+    context.addIssue({
+      code: "custom",
+      path: ["resultUri"],
+      message: "resultUri is available only for completed workflow outcomes"
+    });
+  }
+}).meta({
+  allOf: [
+    {
+      if: { required: ["resultUri"] },
+      then: { required: ["status"], properties: { status: { const: "completed" } } }
+    }
+  ]
+});
 var waitSchema = external_exports.object({
   requestedMs: external_exports.number().int().nonnegative(),
   elapsedMs: external_exports.number().int().nonnegative(),
-  returnedBecause: external_exports.enum(["terminal", "timeout", "immediate"])
+  returnedBecause: external_exports.enum(["terminal", "timeout", "immediate", "action-required", "permission-resolved"])
 });
 var diagnosticRecordSchema = external_exports.record(external_exports.string(), external_exports.unknown());
 var sessionModeStateSchema = external_exports.object({
@@ -31939,6 +32040,9 @@ var sessionModeStateSchema = external_exports.object({
 });
 var harnessDiagnosticSchema = external_exports.object({
   backendId: external_exports.string(),
+  defaultModeId: external_exports.string().optional().describe(
+    "AgentPrism's explicit mode when a call omits mode; absent for no-mode/custom backends."
+  ),
   model: external_exports.string().optional(),
   probed: external_exports.boolean(),
   error: external_exports.string().optional(),
@@ -32000,7 +32104,7 @@ var inspectionRequired = [
 ];
 var terminalStatuses = ["paused", "completed", "failed", "aborted"];
 var nonterminalStatuses = ["pending", "running"];
-var commonOutputFields = ["runId", "status", "scriptUri", "limits", "replayEligibility"];
+var commonOutputFields = ["runId", "status", "scriptUri", "resultUri", "limits", "replayEligibility"];
 var runOutputRequired = ["runId", "status", "scriptUri"];
 var executionDetailFields = [
   "result",
@@ -32027,6 +32131,15 @@ var discoveryOutputFields = [
   "omittedHarnesses",
   "models"
 ];
+var resultRetrievalFields = [
+  "mimeType",
+  "encoding",
+  "totalBytes",
+  "offset",
+  "endOffset",
+  "hasMore",
+  "chunk"
+];
 var stopControlSchema = external_exports.object({
   state: external_exports.literal("pending"),
   operationId: external_exports.string(),
@@ -32049,6 +32162,10 @@ var variantOutputFields = [
   "stopped",
   "alreadyTerminal",
   "control",
+  "pendingPermissions",
+  "interaction",
+  "permissionResponse",
+  ...resultRetrievalFields,
   ...discoveryOutputFields
 ];
 var forbidsRequired = (...fields) => ({
@@ -32067,7 +32184,7 @@ function hasOnlyFields(value, allowed) {
   return Object.entries(value).every(([field, fieldValue]) => fieldValue === void 0 || allowedFields.has(field));
 }
 var workflowToolOutputShape = external_exports.object({
-  action: external_exports.enum(["run", "config"]).optional(),
+  action: external_exports.enum(["run", "config", "result"]).optional(),
   ok: external_exports.boolean().optional(),
   validation: validationSummarySchema.optional(),
   harnessOptions: external_exports.array(harnessDiagnosticSchema).optional(),
@@ -32078,6 +32195,7 @@ var workflowToolOutputShape = external_exports.object({
   ...executionDetailsShape,
   scriptSource: scriptSourceSchema.optional(),
   scriptUri: external_exports.string().optional(),
+  resultUri: external_exports.string().optional(),
   lineage: inspectionScriptResourceShape.lineage.optional(),
   workflowName: runStatusShape.workflowName.optional(),
   phases: runStatusShape.phases.optional(),
@@ -32091,33 +32209,81 @@ var workflowToolOutputShape = external_exports.object({
   outcome: executionResultSchema.optional(),
   stopped: external_exports.boolean().optional(),
   alreadyTerminal: external_exports.boolean().optional(),
-  control: stopControlSchema.optional()
+  control: stopControlSchema.optional(),
+  pendingPermissions: external_exports.array(pendingPermissionSchema).optional(),
+  interaction: permissionInteractionSchema.optional(),
+  permissionResponse: permissionAcknowledgementSchema.optional(),
+  mimeType: external_exports.literal("application/json").optional(),
+  encoding: external_exports.literal("utf-8").optional(),
+  totalBytes: external_exports.number().int().nonnegative().optional(),
+  offset: external_exports.number().int().nonnegative().optional(),
+  endOffset: external_exports.number().int().nonnegative().optional(),
+  hasMore: external_exports.boolean().optional(),
+  chunk: external_exports.string().optional()
 }).superRefine((value, context) => {
   const has = (field) => value[field] !== void 0;
   const inspectionComplete = inspectionRequired.every((field) => has(field));
   const runCommonComplete = has("runId") && has("status") && has("scriptUri");
   const terminal2 = terminalStatuses.includes(value.status);
   let valid;
-  if (value.action === "config") {
+  if (value.action === "result") {
+    valid = value.status === "completed" && has("runId") && has("resultUri") && resultRetrievalFields.every((field) => has(field)) && hasOnlyExactFields(value, ["action", "runId", "status", "resultUri", ...resultRetrievalFields]);
+  } else if (value.action === "config") {
     valid = has("ok") && has("harnessOptions") && has("omittedHarnesses") && has("models") && hasOnlyExactFields(value, ["action", "ok", "harnessOptions", "omittedHarnesses", "models"]);
   } else if (value.action === "run") {
     valid = value.status === "rejected" && has("validation") && hasOnlyExactFields(value, ["action", "status", "validation"]);
   } else if (has("scriptSource")) {
-    valid = runCommonComplete && has("limits") && (value.status === "running" ? hasOnlyFields(value, ["scriptSource"]) : terminal2 && hasOnlyFields(value, ["scriptSource", ...executionDetailFields]));
+    valid = runCommonComplete && has("limits") && (value.status === "running" ? hasOnlyFields(value, ["scriptSource", "pendingPermissions", "interaction"]) : terminal2 && hasOnlyFields(value, ["scriptSource", ...executionDetailFields]));
+  } else if (has("permissionResponse")) {
+    valid = runCommonComplete && inspectionComplete && hasOnlyFields(value, [...inspectionFields, "pendingPermissions", "interaction", "permissionResponse"]);
   } else if (has("control")) {
     valid = runCommonComplete && inspectionComplete && value.stopped === false && value.alreadyTerminal === false && (value.status === "pending" || value.status === "running") && hasOnlyFields(value, [...inspectionFields, "stopped", "alreadyTerminal", "control"]);
   } else if (has("stopped") || has("alreadyTerminal")) {
     valid = runCommonComplete && inspectionComplete && has("stopped") && has("alreadyTerminal") && (value.status === "completed" || value.status === "failed" || value.status === "aborted") && hasOnlyFields(value, [...inspectionFields, "stopped", "alreadyTerminal"]);
   } else if (has("wait")) {
-    valid = runCommonComplete && inspectionComplete && hasOnlyFields(value, [...inspectionFields, "wait", "tokenUsage", "outcome"]) && (terminal2 ? has("outcome") : !has("outcome"));
+    valid = runCommonComplete && inspectionComplete && hasOnlyFields(value, [...inspectionFields, "wait", "tokenUsage", "outcome", "pendingPermissions", "interaction"]) && (terminal2 ? has("outcome") : !has("outcome"));
   } else {
-    valid = runCommonComplete && inspectionComplete && hasOnlyFields(value, inspectionFields);
+    valid = runCommonComplete && inspectionComplete && hasOnlyFields(value, [...inspectionFields, "pendingPermissions", "interaction"]);
   }
+  if (has("resultUri") && value.status !== "completed") valid = false;
   if (!valid) {
     context.addIssue({ code: "custom", message: "output does not match a workflow result variant" });
   }
 }).meta({
+  allOf: [
+    {
+      if: { required: ["resultUri"] },
+      then: { required: ["status"], properties: { status: { const: "completed" } } }
+    }
+  ],
   oneOf: [
+    {
+      title: "Workflow result retrieval",
+      required: ["action", "runId", "status", "resultUri", ...resultRetrievalFields],
+      properties: { action: { const: "result" }, status: { const: "completed" } },
+      ...forbidsRequired(
+        "ok",
+        "validation",
+        "harnessOptions",
+        "omittedHarnesses",
+        "models",
+        "scriptUri",
+        "scriptSource",
+        "limits",
+        "replayEligibility",
+        ...executionDetailFields,
+        ...inspectionFields,
+        "lineage",
+        "wait",
+        "outcome",
+        "stopped",
+        "alreadyTerminal",
+        "control",
+        "pendingPermissions",
+        "interaction",
+        "permissionResponse"
+      )
+    },
     {
       title: "Workflow config discovery",
       required: ["action", "ok", "harnessOptions", "omittedHarnesses", "models"],
@@ -32168,17 +32334,17 @@ var workflowToolOutputShape = external_exports.object({
       title: "Workflow background admission",
       required: [...runOutputRequired, "scriptSource", "limits"],
       properties: { status: { const: "running" } },
-      ...forbidsOutside(["scriptSource"])
+      ...forbidsOutside(["scriptSource", "pendingPermissions", "interaction"])
     },
     {
       title: "Workflow inspection",
       required: [...runOutputRequired, ...inspectionRequired],
-      ...forbidsOutside(inspectionFields)
+      ...forbidsOutside([...inspectionFields, "pendingPermissions", "interaction"])
     },
     {
       title: "Workflow await",
       required: [...runOutputRequired, ...inspectionRequired, "wait"],
-      ...forbidsOutside([...inspectionFields, "wait", "tokenUsage", "outcome"]),
+      ...forbidsOutside([...inspectionFields, "wait", "tokenUsage", "outcome", "pendingPermissions", "interaction"]),
       anyOf: [
         {
           required: ["outcome"],
@@ -32190,6 +32356,11 @@ var workflowToolOutputShape = external_exports.object({
         }
       ]
     },
+    {
+      title: "Workflow permission response acknowledgement",
+      required: [...runOutputRequired, ...inspectionRequired, "permissionResponse"],
+      ...forbidsOutside([...inspectionFields, "pendingPermissions", "interaction", "permissionResponse"])
+    },
     {
       title: "Workflow stop acknowledgement",
       required: [...runOutputRequired, ...inspectionRequired, "stopped", "alreadyTerminal"],
@@ -32239,7 +32410,8 @@ function toWorkflowExecutionOutcome(run, resources) {
     ...run.fallbacks === void 0 ? {} : { fallbacks: run.fallbacks },
     ...run.checkpointsTaken === void 0 ? {} : { checkpointsTaken: run.checkpointsTaken },
     ...run.resumeReport === void 0 ? {} : { resumeReport: run.resumeReport },
-    ...resources
+    scriptUri: resources.scriptUri,
+    ...run.status === "completed" && resources.resultUri !== void 0 ? { resultUri: resources.resultUri } : {}
   };
 }
 function toWorkflowToolResult(run, resources) {
@@ -32413,7 +32585,7 @@ ${trimmed}` : "## Next step\n\nAuthor the workflow script the user asks for, the
     "",
     "Use the connected `docs` tool for version-matched authoring guidance. Read topic `workflow/quickstart` first, then read only the related workflow topics needed for this task; do not load every topic. Workflow scripts and REPL evals have different `agent()` signatures, so use only `workflow/*` topics here.",
     "",
-    'When the script pins a model, mode, or configOptions, call the `workflow` tool with `action:"config"` first; after choosing a model, use `modelSpecs` to read its exact option domain. Set mode only when that selected entry\'s `modes.availableModes` explicitly lists the exact id; `modes:null` means omit it, and never infer a generic `default`. The run action automatically performs static validation, a mocked dry run, and routed no-prompt config checks before admission. Correct any direct rejection diagnostic and re-run.',
+    'When the script pins a model, mode, or configOptions, call the `workflow` tool with `action:"config"` first; after choosing a model, use `modelSpecs` to read its exact option domain. Read the harness-owned mode names and descriptions before pinning an exact advertised id. Omission uses the reported `defaultModeId` (Claude auto, Codex agent, OpenCode build; none for Pi). The run action automatically performs static validation, a mocked dry run, and routed no-prompt config checks before admission. Correct any direct rejection diagnostic and re-run.',
     "",
     taskSection,
     ""
@@ -32470,9 +32642,9 @@ var AUTHORING_DOC_TOPICS = [
       "workflow/run-lifecycle",
       "workflow/examples"
     ],
-    "bytes": 4233,
-    "sha256": "42ce5da7c5f57960b4cee8e0901c5ae6542a77a17dc5c0e4db8b97cf72544130",
-    "text": '# Workflow scripts: quickstart\n\n**Context:** JavaScript passed to the MCP `workflow` tool. This is not REPL code: workflow scripts use `agent(prompt, options?)`, allow top-level `return`, and start from a required metadata export.\n\nA workflow script is a deterministic orchestrator. Script code owns loops, fan-out, conditionals, aggregation, and checkpoints; `agent()` workers perform repository or research tasks. Workers start fresh sessions and do not share memory, so interpolate every prior result a later worker needs into its prompt.\n\n## Minimal valid script\n\n```js\nexport const meta = {\n  name: "review-target",\n  description: "Review a target and return concrete findings",\n  phases: [{ title: "Review" }],\n};\n\nphase("Review");\nconst report = await agent(\n  `Review ${args.target}. Read the relevant files and report concrete findings.`,\n  { label: "review" },\n);\nreturn { report };\n```\n\nThe metadata export must be the first statement and a pure object literal. `name` and `description` are required non-empty strings. `phases`, when present, is an array of objects shaped `{ title: string, detail?: string, model?: string }`, never strings.\n\nSubmit the source without Markdown fences using the `workflow` tool\'s run form, with an absolute `projectDir` on the shared daemon. `args` is the JSON value supplied by the tool call. Some hosts may carry caller data as a JSON string, so harden scripts that accept external input:\n\n```js\nconst raw = typeof args === "string" ? (() => {\n  try { return JSON.parse(args); } catch { return {}; }\n})() : args;\nconst input = raw && typeof raw === "object" && !Array.isArray(raw) ? raw : {};\n```\n\n## Core rules\n\n- The DSL primitives are injected globals; do not import them.\n- Top-level `await` and top-level `return` are supported.\n- Scripts are JavaScript, not TypeScript.\n- No `require`, imports, filesystem API, network API, timers, `Date.now()`, `Math.random()`, or no-argument `Date` construction. Pass nondeterministic values through `args`.\n- Every `agent()` call should have a stable descriptive `label`.\n- A recoverable worker failure resolves to `null` after retries. Null-check load-bearing results.\n- `parallel()` takes thunks, not already-started promises:\n\n```js\nconst results = (await parallel([\n  () => agent("Review correctness", { label: "review:correctness" }),\n  () => agent("Review test coverage", { label: "review:coverage" }),\n])).filter(Boolean);\n```\n\n- Use a plain JSON Schema object in `schema` when script control flow depends on a worker result.\n- Return a compact JSON-serializable result; do not return a transcript.\n\n## Model selection\n\nOmit `model` for the server default, or use a backend-only value such as `"codex"` to retain that backend\'s configured default model. When `AGENTPRISM_DEFAULT_BACKEND` is truly unset, the MCP server probes backend readiness without prompting, pins one project default before validation/execution, and keeps that backend for the run and resume; an explicit environment default always wins. Before pinning a model id, `mode`, or `configOptions`, call `workflow` with `action:"config"`. After choosing a model, use `modelSpecs` to read that exact model\'s option domain. Set `mode` only when that selected harness entry\'s `modes.availableModes` explicitly lists the exact id; `modes:null` means the backend/model supports no modes, so omit `mode`. Never infer a generic `"default"` and never guess model or option ids.\n\n## Validation and execution\n\nEvery run is statically parsed, mock-executed, and checked against no-prompt backend configuration before admission. A rejection creates no run ID, reserves no background slot, and spends no tokens. Read the diagnostic, correct the script, and submit it again.\n\nUse foreground execution for short work. Use `background:true` for work that may outlive one tool request; retain the returned `runId`, then use bounded `await`, `inspect`, or `stop` calls.\n\n## What to read next\n\n- `workflow/composition-and-failure` \u2014 metadata, fan-out, phases, and null semantics.\n- `workflow/api-agents` \u2014 every `agent()` option and structured output.\n- `workflow/run-lifecycle` \u2014 config, run, await, inspect, stop, and resume.\n- `workflow/examples` \u2014 complete composition patterns.\n'
+    "bytes": 4254,
+    "sha256": "49d4980013555baf3306eee64ae86e26eec2a45cfa352b130cf3862955199ae2",
+    "text": '# Workflow scripts: quickstart\n\n**Context:** JavaScript passed to the MCP `workflow` tool. This is not REPL code: workflow scripts use `agent(prompt, options?)`, allow top-level `return`, and start from a required metadata export.\n\nA workflow script is a deterministic orchestrator. Script code owns loops, fan-out, conditionals, aggregation, and checkpoints; `agent()` workers perform repository or research tasks. Workers start fresh sessions and do not share memory, so interpolate every prior result a later worker needs into its prompt.\n\n## Minimal valid script\n\n```js\nexport const meta = {\n  name: "review-target",\n  description: "Review a target and return concrete findings",\n  phases: [{ title: "Review" }],\n};\n\nphase("Review");\nconst report = await agent(\n  `Review ${args.target}. Read the relevant files and report concrete findings.`,\n  { label: "review" },\n);\nreturn { report };\n```\n\nThe metadata export must be the first statement and a pure object literal. `name` and `description` are required non-empty strings. `phases`, when present, is an array of objects shaped `{ title: string, detail?: string, model?: string }`, never strings.\n\nSubmit the source without Markdown fences using the `workflow` tool\'s run form, with an absolute `projectDir` on the shared daemon. `args` is the JSON value supplied by the tool call. Some hosts may carry caller data as a JSON string, so harden scripts that accept external input:\n\n```js\nconst raw = typeof args === "string" ? (() => {\n  try { return JSON.parse(args); } catch { return {}; }\n})() : args;\nconst input = raw && typeof raw === "object" && !Array.isArray(raw) ? raw : {};\n```\n\n## Core rules\n\n- The DSL primitives are injected globals; do not import them.\n- Top-level `await` and top-level `return` are supported.\n- Scripts are JavaScript, not TypeScript.\n- No `require`, imports, filesystem API, network API, timers, `Date.now()`, `Math.random()`, or no-argument `Date` construction. Pass nondeterministic values through `args`.\n- Every `agent()` call should have a stable descriptive `label`.\n- A recoverable worker failure resolves to `null` after retries. Null-check load-bearing results.\n- `parallel()` takes thunks, not already-started promises:\n\n```js\nconst results = (await parallel([\n  () => agent("Review correctness", { label: "review:correctness" }),\n  () => agent("Review test coverage", { label: "review:coverage" }),\n])).filter(Boolean);\n```\n\n- Use a plain JSON Schema object in `schema` when script control flow depends on a worker result.\n- Return a compact JSON-serializable result; do not return a transcript.\n\n## Model selection\n\nOmit `model` for the server default, or use a backend-only value such as `"codex"` to retain that backend\'s configured default model. When `AGENTPRISM_DEFAULT_BACKEND` is truly unset, the MCP server probes backend readiness without prompting, pins one project default before validation/execution, and keeps that backend for the run and resume; an explicit environment default always wins. Before pinning a model id, `mode`, or `configOptions`, call `workflow` with `action:"config"`. After choosing a model, use `modelSpecs` to read that exact model\'s option domain. Config preserves each advertised mode\'s id, name, description, and `_meta`, plus `defaultModeId`. When mode is omitted, AgentPrism applies Claude `auto`, Codex `agent`, OpenCode `build`, or no Pi mode. Pin only exact advertised ids and never guess model or option ids.\n\n## Validation and execution\n\nEvery run is statically parsed, mock-executed, and checked against no-prompt backend configuration before admission. A rejection creates no run ID, reserves no background slot, and spends no tokens. Read the diagnostic, correct the script, and submit it again.\n\nUse foreground execution for short work. Use `background:true` for work that may outlive one tool request; retain the returned `runId`, then use bounded `await`, `inspect`, or `stop` calls.\n\n## What to read next\n\n- `workflow/composition-and-failure` \u2014 metadata, fan-out, phases, and null semantics.\n- `workflow/api-agents` \u2014 every `agent()` option and structured output.\n- `workflow/run-lifecycle` \u2014 config, run, await, inspect, stop, and resume.\n- `workflow/examples` \u2014 complete composition patterns.\n'
   },
   {
     "id": "workflow/run-lifecycle",
@@ -32485,9 +32657,9 @@ var AUTHORING_DOC_TOPICS = [
       "workflow/determinism-and-resume",
       "workflow/models-and-config"
     ],
-    "bytes": 7983,
-    "sha256": "55bae1f2f722adc7e9fd856f2d673f21ef90805e72473162750ee48dfab83744",
-    "text": '## Running workflows \u2014 the MCP `workflow` tool\n\n**Context:** JavaScript passed to the MCP `workflow` tool. Workflow scripts use `agent(prompt, options?)`; REPL evals use a different API.\n\nUse the connected `workflow` tool for deterministic batch orchestration. The shared server daemon owns execution, so admitted runs survive MCP client session churn and tool-request timeouts. During a version upgrade, the successor becomes the front door while a predecessor may remain the execution owner; signed run-control forwarding keeps later-session stop/cancel operations location-independent. Owner-process exit can still interrupt in-flight work. Any later session can await, inspect, or stop a run. Runs, journals, logs, and outstanding whole-stop intents persist per project namespace.\n\nEvery `config` and `run` call on the shared daemon names its project with the required `projectDir` argument \u2014 an absolute path, normally the workspace root. `inspect`/`await`/`stop` take only a `runId`; the run ID locates its project store automatically. In a single-project server, `projectDir` defaults to that server\'s project.\n\n### The `workflow` tool, by action\n\n- **Config** (`{ action: "config", projectDir, harnesses?, modelSpecs?, modelFilter? }`): discover live model, mode, effort, and `configOptions` values from no-prompt backend sessions. Use `harnesses` plus `modelFilter` to find ids, then `modelSpecs` to select exact models and read their model-specific option domains. Each successful entry reports `modes` explicitly: use only exact ids in `modes.availableModes`; `modes:null` means omit `mode`, never guess a default. It starts no workflow and spends zero tokens. Use it only when pinning those values; an omitted model or backend-only model uses configured defaults without discovery.\n- **Run** (default, no `action`): supply exactly one of `script` (the raw source string, no Markdown fences) or `scriptPath` (an absolute path on the server\'s filesystem), plus `projectDir`. The tool automatically performs static validation, a mocked dry run, and routed config checks before admission. Invalid scripts return bounded `status:"rejected"` diagnostics with no run ID, background slot, or token spend. A path is read once at admission and its content snapshotted; later edits affect only a new run. `args` arrives in the script as the `args` global; the run\'s base directory is the `cwd` global. Some hosts hand `args` through as a JSON **string** \u2014 tolerate both shapes (`typeof args === "string" ? JSON.parse(args) : args`). Foreground streams progress but is bound to the request and its timeout. Pass `background: true` for anything that may outlive one request; it acknowledges after durable admission with a `runId`.\n- **Await** (`{ action: "await", runId, waitMs }`): bounded collection for background runs. A timeout is progress, not failure \u2014 call again (`waitMs: 20000` is typical). At terminal status the response adds `outcome`: the authored result or pause context, plus `replayEligibility`, `resumeReport`, `fallbacks`, and `checkpointsTaken`.\n- **Inspect** (`{ action: "inspect", runId, lastN, labelGlob, logLines }`): a bounded snapshot \u2014 the latest matching calls with compact result previews plus the newest log lines. Use a narrow `labelGlob` to diagnose before deciding whether to resume, edit, or stop. Inspection never executes or resumes a script.\n- **Stop**: `{ action: "stop", runId }` durably aborts the whole run and normally returns its final snapshot; stopping a terminal run is a successful no-op. Across a daemon upgrade, the successor persists an idempotent stop intent and forwards to the predecessor that owns execution. If that owner does not settle within the bounded control wait, the successful response remains nonterminal with `control:{ state:"pending", operationId, requestedAt, owner? }`; retry stop, inspect, or await to observe settlement. `{ action: "stop", runId, callIndex }` synchronously routes to the live owner and cancels exactly that in-flight agent: its slot settles to `null` with `AGENT_CANCELLED` and the run stays live; call cancellation is never reconstructed after owner loss. Whole-run `{ action:"stop", runId, forceOwner:true }` explicitly authorizes terminating a superseded owner daemon when graceful control cannot settle and may interrupt sibling runs in that process; it is forbidden with `callIndex`. `labelGlob` only filters the returned snapshot; it never selects what to cancel.\n- **Resume**: a NEW run with `resumeFromRunId` plus the script content re-sent (the same `script` or `scriptPath`) and the desired `args` (+ `checkpointReplies` when answering a durable checkpoint). Read the returned `replayEligibility` for the predicted and observed replay prefix; never assume a prefix hit. Full semantics: **Determinism and resume**.\n\n### Operating rules\n\n- **Always retain the returned `runId`.** A paused, failed, or aborted response carries a redacted final-20 `logTail`. Read it before you change anything. Every admitted script is also an immutable resource at `workflow://runs/{runId}/script`, so a later session can recover a lost inline script.\n- **Two fingerprints control replay.** The identity hash covers the prompt, the resolved model, `mode` when set, non-empty sorted `configOptions`, `tier`, `phase`, `agentType`, the resolved agent definition, and the schema. The input fingerprint covers the resolved label, per-call `cwd` and isolation, `keepSession`, images, MCP servers, session/prompt metadata, and the approved script-backend digest.\n- **Operational bounds are not replay inputs.** Host `concurrency`, `agentRetries`, `agentTimeoutMs`, and `agentIdleTimeoutMs`, plus per-call `timeoutMs`, `idleTimeoutMs`, and `retries`, enter neither fingerprint. A resume does not inherit them from its source run; pass the values you want on every run. `agentTimeoutMs` caps total wall time and is not an idle timer. The separate opt-in `agentIdleTimeoutMs` fires after that long without real backend activity; ACP `session/update` re-arms it and synthetic progress heartbeats do not. Per-call values can tighten but cannot escape finite host ceilings. Every retry gets fresh clocks.\n- **Old journals stay usable.** Input formats below 2 replay positionally with `fallbackReason: "inputs-format-legacy"`. A current-format crash snapshot uses identity matching even without terminal-environment capture. Ancestor-scoped rows carried from \u22640.23 resume chains replay only while that ancestor run is still persisted. Journals resume across filesystem, environment, engine, Node, and V8 changes; `replayEligibility` reports those differences as diagnostics, never as gates.\n- **A background start returns immediately.** It sends no progress after it returns; collect progress with later bounded awaits. Background runs have no live checkpoint channel, so authored `headless` checkpoint modes apply. When a run\'s owner process dies, a pending whole-stop intent is applied under the reclaimed lease; otherwise cold preflights reconcile stale `pending`/`running` state to `paused` with `pauseReason:"interrupted"`. A live owner lease is never stolen because of a timeout.\n- A run paused with `reason: "auth_required"` resumes as a new run after that backend\'s credentials are configured.\n\n### Execution logs \u2014 the events resource\n\nEvery journaling run publishes an MCP resource at `workflow://runs/{runId}/events`. Subscribe to the canonical URI for advisory `resources/updated` hints, then read and paginate with `after`, `limit`, and `streamId`. Progress is coarse and redacted: `agentTranscript` rows are assistant/tool upserts partitioned by `(scope, callIndex, executionStartSeq)` and reduced by greatest revision per entry index. The durable cursor is authoritative when hints coalesce or a subscriber falls behind.\n\nEmbedding hosts can drive the same contract with `runDynamicWorkflow` / `WorkflowManager` from `@automatalabs/workflows`; the script contract is identical either way.\n'
+    "bytes": 9965,
+    "sha256": "1143d846d50a7c2833ab58d0d88131dde8557770a6f818f2b8747c79f791ace7",
+    "text": '## Running workflows \u2014 the MCP `workflow` tool\n\n**Context:** JavaScript passed to the MCP `workflow` tool. Workflow scripts use `agent(prompt, options?)`; REPL evals use a different API.\n\nUse the connected `workflow` tool for deterministic batch orchestration. The shared server daemon owns execution, so admitted runs survive MCP client session churn and tool-request timeouts. During a version upgrade, the successor becomes the front door while a predecessor may remain the execution owner; signed run-control forwarding keeps later-session stop/cancel operations location-independent. Owner-process exit can still interrupt in-flight work. Any later session can await, inspect, or stop a run. Runs, journals, logs, and outstanding whole-stop intents persist per project namespace.\n\nEvery `config` and `run` call on the shared daemon names its project with the required `projectDir` argument \u2014 an absolute path, normally the workspace root. `inspect`/`await`/`result`/`stop` take only a `runId`; the run ID locates its project store automatically. In a single-project server, `projectDir` defaults to that server\'s project.\n\n### The `workflow` tool, by action\n\n- **Config** (`{ action: "config", projectDir, harnesses?, modelSpecs?, modelFilter? }`): discover live model, mode, effort, and `configOptions` values from no-prompt backend sessions. Use `harnesses` plus `modelFilter` to find ids, then `modelSpecs` to select exact models and read their model-specific option domains. Each successful entry preserves every harness-advertised mode id, name, description, and `_meta`, and reports `defaultModeId`. When a call omits mode, AgentPrism applies Claude `auto`, Codex `agent`, OpenCode `build`, or no mode for Pi; authored and default ids must appear in `modes.availableModes`. It starts no workflow and spends zero tokens. Use it only when pinning those values; an omitted model or backend-only model uses configured defaults without discovery.\n- **Run** (default, no `action`): supply exactly one of `script` (the raw source string, no Markdown fences) or `scriptPath` (an absolute path on the server\'s filesystem), plus `projectDir`. The tool automatically performs static validation, a mocked dry run, and routed config checks before admission. Invalid scripts return bounded `status:"rejected"` diagnostics with no run ID, background slot, or token spend. A path is read once at admission and its content snapshotted; later edits affect only a new run. `args` arrives in the script as the `args` global; the run\'s base directory is the `cwd` global. Some hosts hand `args` through as a JSON **string** \u2014 tolerate both shapes (`typeof args === "string" ? JSON.parse(args) : args`). Foreground streams progress but is bound to the request and its timeout. Pass `background: true` for anything that may outlive one request; it acknowledges after durable admission with a `runId`.\n- **Await** (`{ action: "await", runId, waitMs }`): bounded collection for background runs. A timeout is progress, not failure. Await returns early with `wait.returnedBecause:"action-required"` when an ACP permission is pending. At terminal status the response adds `outcome`: the authored result or pause context, plus replay diagnostics.\n- **Inspect** (`{ action: "inspect", runId, lastN, labelGlob, logLines }`): a bounded snapshot \u2014 the latest matching calls, newest log lines, and any live `pendingPermissions`. A completed run also exposes `resultUri` and an exact-result resource link, without putting a large result into the bounded status projection. Elicitation-capable clients present one request\'s exact backend options during inspect/await. Permission diagnostics omit the private ACP session id, are credential-redacted and bounded, and retain the complete ordered exact option-id list or fail closed.\n- **Result** (`{ action: "result", runId, offset?, maxBytes? }`): bounded exact retrieval for a completed authored result. It returns at most 16,384 UTF-8 bytes plus `totalBytes`, `endOffset`, and `hasMore`; continue at the prior `endOffset`. The default offset is zero. UTF-8 code points are never split, and arbitrary offsets inside one fail closed. Running, paused, failed, aborted, unknown, deleted, and completed-without-value runs have no result page.\n- **Permission response** (`{ action:"permissions-response", runId, permissionId, response }`): for clients without elicitation, resolve one pending request with `{ outcome:{ outcome:"selected", optionId } }` using an exact advertised id, or `{ outcome:{ outcome:"cancelled" } }`. Caller-supplied response `_meta` is forbidden; provider effects come only from the selected advertised option. The request belongs to the live execution owner and cannot be answered after owner loss.\n- **Stop**: `{ action: "stop", runId }` durably aborts the whole run and normally returns its final snapshot; stopping a terminal run is a successful no-op. Across a daemon upgrade, the successor persists an idempotent stop intent and forwards to the predecessor that owns execution. If that owner does not settle within the bounded control wait, the successful response remains nonterminal with `control:{ state:"pending", operationId, requestedAt, owner? }`; retry stop, inspect, or await to observe settlement. `{ action: "stop", runId, callIndex }` synchronously routes to the live owner and cancels exactly that in-flight agent: its slot settles to `null` with `AGENT_CANCELLED` and the run stays live; call cancellation is never reconstructed after owner loss. Whole-run `{ action:"stop", runId, forceOwner:true }` explicitly authorizes terminating a superseded owner daemon when graceful control cannot settle and may interrupt sibling runs in that process; it is forbidden with `callIndex`. `labelGlob` only filters the returned snapshot; it never selects what to cancel.\n- **Resume**: a NEW run with `resumeFromRunId` plus the script content re-sent (the same `script` or `scriptPath`) and the desired `args` (+ `checkpointReplies` when answering a durable checkpoint). Read the returned `replayEligibility` for the predicted and observed replay prefix; never assume a prefix hit. Full semantics: **Determinism and resume**.\n\n### Operating rules\n\n- **Always retain the returned `runId`.** A paused, failed, or aborted response carries a redacted final-20 `logTail`. Read it before you change anything. Every admitted script is an immutable resource at `workflow://runs/{runId}/script`, so a later session can recover a lost inline script. A completed JSON result is independently durable at `workflow://runs/{runId}/result`. Completed foreground/await responses copy exact JSON up to 4,096 UTF-8 bytes into model-visible text; larger results stay out of summary text and point to the resource plus `action:"result"` paging. Script and result links are labelled separately.\n- **Two fingerprints control replay.** The identity hash covers the prompt, the resolved model, `mode` when set, non-empty sorted `configOptions`, `tier`, `phase`, `agentType`, the resolved agent definition, and the schema. The input fingerprint covers the resolved label, per-call `cwd` and isolation, `keepSession`, images, MCP servers, session/prompt metadata, and the approved script-backend digest.\n- **Operational bounds are not replay inputs.** Host `concurrency`, `agentRetries`, `agentTimeoutMs`, and `agentIdleTimeoutMs`, plus per-call `timeoutMs`, `idleTimeoutMs`, and `retries`, enter neither fingerprint. A resume does not inherit them from its source run; pass the values you want on every run. `agentTimeoutMs` caps total wall time and is not an idle timer. The separate opt-in `agentIdleTimeoutMs` fires after that long without real backend activity; ACP `session/update` re-arms it and synthetic progress heartbeats do not. Per-call values can tighten but cannot escape finite host ceilings. Every retry gets fresh clocks.\n- **Old journals stay usable.** Input formats below 2 replay positionally with `fallbackReason: "inputs-format-legacy"`. A current-format crash snapshot uses identity matching even without terminal-environment capture. Ancestor-scoped rows carried from \u22640.23 resume chains replay only while that ancestor run is still persisted. Journals resume across filesystem, environment, engine, Node, and V8 changes; `replayEligibility` reports those differences as diagnostics, never as gates.\n- **A background start returns immediately.** It sends no progress after it returns; collect progress with later bounded awaits. Its `interaction` block explains that ACP permissions may block an agent and names await/inspect plus `permissions-response` as the control path. Background runs have no live checkpoint channel, so authored `headless` checkpoint modes apply. When a run\'s owner process dies, a pending whole-stop intent is applied under the reclaimed lease; otherwise cold preflights reconcile stale `pending`/`running` state to `paused` with `pauseReason:"interrupted"`. A live owner lease is never stolen because of a timeout.\n- A run paused with `reason: "auth_required"` resumes as a new run after that backend\'s credentials are configured.\n\n### Execution logs \u2014 the events resource\n\nEvery journaling run publishes an MCP resource at `workflow://runs/{runId}/events`. Subscribe to the canonical URI for advisory `resources/updated` hints, then read and paginate with `after`, `limit`, and `streamId`. This bounded/redacted stream is observability, not an exact result-reconstruction API; use `/result` or `action:"result"` for authored output. Progress is coarse and redacted: `agentTranscript` rows are assistant/tool upserts partitioned by `(scope, callIndex, executionStartSeq)` and reduced by greatest revision per entry index. The durable cursor is authoritative when hints coalesce or a subscriber falls behind.\n\nEmbedding hosts can drive the same contract with `runDynamicWorkflow` / `WorkflowManager` from `@automatalabs/workflows`; the script contract is identical either way.\n'
   },
   {
     "id": "workflow/models-and-config",
@@ -32500,9 +32672,9 @@ var AUTHORING_DOC_TOPICS = [
       "workflow/environment-and-tools",
       "workflow/run-lifecycle"
     ],
-    "bytes": 9604,
-    "sha256": "21ea6e619a1e0220c60cba74f8323fb5ae00db29b06fe2858d27e750d80c5795",
-    "text": '## Choosing the agent for each call\n\n**Context:** JavaScript passed to the MCP `workflow` tool. Workflow scripts use `agent(prompt, options?)`; REPL evals use a different API.\n\nThe backend is selected **per `agent()` call** from its effective `model` string. One script can plan on one vendor\'s agent, implement on another\'s, and review on a third\'s, handing structured results between them.\n\nThe built-in names (`claude`, `codex`, `opencode`, `pi`) come from the runtime backend registry. Registered custom names extend that set.\n\n- **Omit `model` entirely** for maximum portability. In the MCP server, an explicitly present `AGENTPRISM_DEFAULT_BACKEND` wins; when it is truly unset, the first model-less run for a project performs zero-token backend readiness probes, pins one effective backend before validation/execution, and reuses that pin for the run and resume. The SDK runner itself retains its configured default (`AGENTPRISM_DEFAULT_BACKEND`, historical fallback Claude). A script with no model specs remains backend-portable.\n- **Route by one registered first segment.** Split on the first `/`; ASCII-case-insensitive `claude`, `codex`, `opencode`, `pi`, or a registered custom backend name selects that harness and is stripped exactly once. A custom registration wins on a built-in-name collision.\n- **Use a backend name alone** (`claude`, `codex`, `opencode`, `pi`, or a custom name) to preserve the harness\'s configured default model. No model config call is made.\n- **Everything else goes intact to the default backend.** `anthropic/\u2026`, `openai/\u2026`, bare `opus`, and bare `gpt-\u2026` are not routing aliases. When an id remains after routing, it is sent byte-for-byte: no catalog matching, case folding, bracket parsing, effort/Fast option driving, retry, or fallback. Harness rejection is an agent error.\n- **`tier`** (`"small" | "medium" | "big"`) is a coarse alternative resolved from the host\'s tier config \u2014 use it for "a cheap model" without naming a vendor.\n\nThe published examples use ids verified against live harness catalogs: `claude/opus[1m]`, `codex/gpt-5.6-sol`, and `opencode/zai/glm-5.2`. For Pi, `pi/openrouter/vendor/model-id` strips only `pi/`; Pi then splits provider `openrouter` from model id `vendor/model-id`. Prefer backend-only forms when the desired model is configured inside the harness.\n\nNever guess model ids, mode ids, effort values, or option names from memory. With MCP, call the `workflow` tool using `action:"config"` and optional `harnesses` / `modelFilter`; it returns the live catalog without starting a workflow.\n\nOne no-prompt session per harness, zero tokens: each successful harness entry contains `modes` plus its config-option catalog. A non-null `modes` object carries `currentModeId` and `availableModes`; only those exact advertised ids are valid. `modes:null` explicitly means that backend/model supports no ACP session modes, so omit `mode`\u2014absence never licenses an invented generic `"default"`. Config options list model ids (including bracket variants like `opus[1m]`), effort levels, and every other negotiable option exactly as the installed harness advertises them. `probed:true` means session/config discovery succeeded, **not** that every backend has proven it can authenticate a first prompt: ACP has no universal zero-token auth-status method, and some agents defer that check. Automatic MCP default selection treats failed probes and explicitly empty built-in model catalogs as unavailable, prefers stronger session-open evidence (Codex authorization; Pi\'s credential-filtered catalog), then falls back to the first session-ready backend whose prompt readiness is unknown. One additional caveat: the bare `config` probe reads each harness with its **default model** selected, and option domains are **model-specific**. An option can appear only after a particular model is selected. Ceilings differ per model. Provider-served variants of the same model can advertise different domains. The authoritative per-model probe is the validator run on your real script: it selects each authored model spec first and echoes that pair\'s advertised modes and options. Confirm every pinned value against its own echoed entry; do not read package internals to discover options.\n\n```js\nconst plan   = await agent(PLAN_PROMPT,          { label: "plan",      model: "opencode/zai/glm-5.2", schema: PLAN });\nconst impl   = await agent(implPrompt(plan),     { label: "implement", model: "codex/gpt-5.6-sol" });\nconst review = await agent(reviewPrompt(impl),   { label: "review",    model: "claude/opus[1m]", schema: REVIEW });\n```\n\nUse `configOptions` only for exact ACP session options advertised by that routed harness. With MCP, read the selected harness\'s `action:"config"` result before choosing ids or select values; catalogs vary by harness version, login, and machine.\n\n```js\nconst impl = await agent(implPrompt(plan), {\n  label: "implement",\n  model: "codex",\n  configOptions: { "fast-mode": true, reasoning_effort: "high" },\n});\n```\n\nIds and string/boolean values pass through verbatim in ascending id order, after model selection and before the prompt. There are no aliases, coercion, client-side vocabulary, defaults, or cached catalogs. Copy option ids character-for-character from the catalog, punctuation included \u2014 `"fast-mode"`, not `fast_mode` \u2014 and quote ids that are not valid identifiers. Never put `"model"` in `configOptions`; use the dedicated `model` field. A harness rejection follows the ordinary agent-error path.\n\nPi\'s thought-level option is named `thinkingLevel`, and its choices depend on the exact model in the same call:\n\n```js\nconst review = await agent(REVIEW_PROMPT, {\n  label: "pi-review",\n  model: "pi/openrouter/vendor/model-id",\n  configOptions: { thinkingLevel: "high" },\n});\n```\n\nValidation selects `openrouter/vendor/model-id` before reading Pi\'s choices. A listed value passes unchanged. A recognized value above an ordered model\'s ceiling, or in a model-specific gap, passes with a warning that names the effective clamp target. Pi advertises its SDK-derived domain directly. Claude and Codex are also ordered: when their options omit domain metadata, validation enumerates the advertised models and merges their per-model effort orders. A Claude model without an `effort` option does not support effort, and `default` never becomes a ceiling target. OpenCode and custom backends have no declared value order, so validation is exact-set. An unrecognized or unadvertised value fails with exit code `2`. Enumeration stops at 32 advertised models; a larger or inconsistently ordered catalog warns and falls back to exact advertised-value validation.\n\n**The harness is authoritative.** The client never substitutes a nearby model or silently falls back. A rejected id follows the existing agent-error path; a harness that accepts or ignores it determines the outcome. The public `fallbacks`/`onModelFallback` fields remain for compatibility but model resolution does not emit them.\n\n## Structured output\n\nPass `schema` \u2014 a **plain JSON Schema object literal** (no schema builders exist inside the realm) \u2014 and the call resolves to a **validated object** instead of text:\n\n```js\nconst FINDINGS = {\n  type: "object",\n  additionalProperties: false,\n  required: ["findings"],\n  properties: {\n    findings: {\n      type: "array",\n      items: {\n        type: "object",\n        additionalProperties: false,\n        required: ["file", "line", "summary"],\n        properties: {\n          file:    { type: "string", description: "Repo-relative path \u2014 copy it exactly, never invent one" },\n          line:    { type: "number", description: "1-indexed line the finding anchors to" },\n          summary: { type: "string", description: "One sentence stating the defect, grounded in code you actually read" },\n        },\n      },\n    },\n  },\n};\n\nconst report = await agent("Review the diff on this branch for correctness bugs.", {\n  label: "review", schema: FINDINGS,\n});\nreport.findings.forEach((f) => log(`${f.file}:${f.line} ${f.summary}`));\n```\n\nThe same schema works on **every** backend; only the fulfillment channel differs, and the runner picks it for you: Claude uses its `outputFormat`, Codex its strict `outputSchema`, while Pi, OpenCode, and eligible custom ACP agents receive a client-hosted `StructuredOutput` MCP tool when they advertise HTTP MCP support. Pi accepts stdio, Streamable HTTP, and SSE MCP servers. If no valid tool capture exists, Pi retains the runner\'s common prompt-embedded schema and validated final-text JSON fallback. In every channel the runner validates the value client-side (with type coercion) and re-prompts a bounded number of times before failing the call with non-recoverable `SCHEMA_NONCOMPLIANCE`.\n\nSchema authoring rules that keep all channels healthy:\n\n- Root must be an object; set `additionalProperties: false` and list every property in `required`.\n- Put a `description` on every field \u2014 descriptions are the per-field prompt.\n- Keep schemas structurally simple. Exotic keywords (`oneOf`, `patternProperties`, unusual `format`s, backreference regexes) are normalized or stripped on the wire for some backends \u2014 validation still enforces them client-side, which shows up as re-prompt churn. Prefer `anyOf`, `enum`, and plain types.\n- Keep free-text fields small (tens of lines). An oversized structured output can exhaust schema repair and fail the call.\n- Validation checks structure, not truth. Check load-bearing values in script code (for example, reject findings whose `file` is not in a known file list) before spending more agents on them.\n'
+    "bytes": 9653,
+    "sha256": "2c5279f1c2968e4f9fd24393b7c1107e48dbf773ec7462e4502896a3202a3403",
+    "text": '## Choosing the agent for each call\n\n**Context:** JavaScript passed to the MCP `workflow` tool. Workflow scripts use `agent(prompt, options?)`; REPL evals use a different API.\n\nThe backend is selected **per `agent()` call** from its effective `model` string. One script can plan on one vendor\'s agent, implement on another\'s, and review on a third\'s, handing structured results between them.\n\nThe built-in names (`claude`, `codex`, `opencode`, `pi`) come from the runtime backend registry. Registered custom names extend that set.\n\n- **Omit `model` entirely** for maximum portability. In the MCP server, an explicitly present `AGENTPRISM_DEFAULT_BACKEND` wins; when it is truly unset, the first model-less run for a project performs zero-token backend readiness probes, pins one effective backend before validation/execution, and reuses that pin for the run and resume. The SDK runner itself retains its configured default (`AGENTPRISM_DEFAULT_BACKEND`, historical fallback Claude). A script with no model specs remains backend-portable.\n- **Route by one registered first segment.** Split on the first `/`; ASCII-case-insensitive `claude`, `codex`, `opencode`, `pi`, or a registered custom backend name selects that harness and is stripped exactly once. A custom registration wins on a built-in-name collision.\n- **Use a backend name alone** (`claude`, `codex`, `opencode`, `pi`, or a custom name) to preserve the harness\'s configured default model. No model config call is made.\n- **Everything else goes intact to the default backend.** `anthropic/\u2026`, `openai/\u2026`, bare `opus`, and bare `gpt-\u2026` are not routing aliases. When an id remains after routing, it is sent byte-for-byte: no catalog matching, case folding, bracket parsing, effort/Fast option driving, retry, or fallback. Harness rejection is an agent error.\n- **`tier`** (`"small" | "medium" | "big"`) is a coarse alternative resolved from the host\'s tier config \u2014 use it for "a cheap model" without naming a vendor.\n\nThe published examples use ids verified against live harness catalogs: `claude/opus[1m]`, `codex/gpt-5.6-sol`, and `opencode/zai/glm-5.2`. For Pi, `pi/openrouter/vendor/model-id` strips only `pi/`; Pi then splits provider `openrouter` from model id `vendor/model-id`. Prefer backend-only forms when the desired model is configured inside the harness.\n\nNever guess model ids, mode ids, effort values, or option names from memory. With MCP, call the `workflow` tool using `action:"config"` and optional `harnesses` / `modelFilter`; it returns the live catalog without starting a workflow.\n\nOne no-prompt session per harness, zero tokens: each successful harness entry contains `modes`, `defaultModeId`, and its config-option catalog. A non-null `modes` object carries `currentModeId` plus every available mode\'s raw id, name, description, and `_meta`; only exact advertised ids are valid. When omitted, AgentPrism applies Claude `auto`, Codex `agent`, OpenCode `build`, or no Pi mode. `modes:null` means the backend supports no mode. Config options list model ids (including bracket variants like `opus[1m]`), effort levels, and every other negotiable option exactly as the installed harness advertises them. `probed:true` means session/config discovery succeeded, **not** that every backend has proven it can authenticate a first prompt: ACP has no universal zero-token auth-status method, and some agents defer that check. Automatic MCP default selection treats failed probes and explicitly empty built-in model catalogs as unavailable, prefers stronger session-open evidence (Codex authorization; Pi\'s credential-filtered catalog), then falls back to the first session-ready backend whose prompt readiness is unknown. One additional caveat: the bare `config` probe reads each harness with its **default model** selected, and option domains are **model-specific**. An option can appear only after a particular model is selected. Ceilings differ per model. Provider-served variants of the same model can advertise different domains. The authoritative per-model probe is the validator run on your real script: it selects each authored model spec first and echoes that pair\'s advertised modes and options. Confirm every pinned value against its own echoed entry; do not read package internals to discover options.\n\n```js\nconst plan   = await agent(PLAN_PROMPT,          { label: "plan",      model: "opencode/zai/glm-5.2", schema: PLAN });\nconst impl   = await agent(implPrompt(plan),     { label: "implement", model: "codex/gpt-5.6-sol" });\nconst review = await agent(reviewPrompt(impl),   { label: "review",    model: "claude/opus[1m]", schema: REVIEW });\n```\n\nUse `configOptions` only for exact ACP session options advertised by that routed harness. With MCP, read the selected harness\'s `action:"config"` result before choosing ids or select values; catalogs vary by harness version, login, and machine.\n\n```js\nconst impl = await agent(implPrompt(plan), {\n  label: "implement",\n  model: "codex",\n  configOptions: { "fast-mode": true, reasoning_effort: "high" },\n});\n```\n\nIds and string/boolean values pass through verbatim in ascending id order, after model selection and before the prompt. There are no aliases, coercion, client-side vocabulary, defaults, or cached catalogs. Copy option ids character-for-character from the catalog, punctuation included \u2014 `"fast-mode"`, not `fast_mode` \u2014 and quote ids that are not valid identifiers. Never put `"model"` in `configOptions`; use the dedicated `model` field. A harness rejection follows the ordinary agent-error path.\n\nPi\'s thought-level option is named `thinkingLevel`, and its choices depend on the exact model in the same call:\n\n```js\nconst review = await agent(REVIEW_PROMPT, {\n  label: "pi-review",\n  model: "pi/openrouter/vendor/model-id",\n  configOptions: { thinkingLevel: "high" },\n});\n```\n\nValidation selects `openrouter/vendor/model-id` before reading Pi\'s choices. A listed value passes unchanged. A recognized value above an ordered model\'s ceiling, or in a model-specific gap, passes with a warning that names the effective clamp target. Pi advertises its SDK-derived domain directly. Claude and Codex are also ordered: when their options omit domain metadata, validation enumerates the advertised models and merges their per-model effort orders. A Claude model without an `effort` option does not support effort, and `default` never becomes a ceiling target. OpenCode and custom backends have no declared value order, so validation is exact-set. An unrecognized or unadvertised value fails with exit code `2`. Enumeration stops at 32 advertised models; a larger or inconsistently ordered catalog warns and falls back to exact advertised-value validation.\n\n**The harness is authoritative.** The client never substitutes a nearby model or silently falls back. A rejected id follows the existing agent-error path; a harness that accepts or ignores it determines the outcome. The public `fallbacks`/`onModelFallback` fields remain for compatibility but model resolution does not emit them.\n\n## Structured output\n\nPass `schema` \u2014 a **plain JSON Schema object literal** (no schema builders exist inside the realm) \u2014 and the call resolves to a **validated object** instead of text:\n\n```js\nconst FINDINGS = {\n  type: "object",\n  additionalProperties: false,\n  required: ["findings"],\n  properties: {\n    findings: {\n      type: "array",\n      items: {\n        type: "object",\n        additionalProperties: false,\n        required: ["file", "line", "summary"],\n        properties: {\n          file:    { type: "string", description: "Repo-relative path \u2014 copy it exactly, never invent one" },\n          line:    { type: "number", description: "1-indexed line the finding anchors to" },\n          summary: { type: "string", description: "One sentence stating the defect, grounded in code you actually read" },\n        },\n      },\n    },\n  },\n};\n\nconst report = await agent("Review the diff on this branch for correctness bugs.", {\n  label: "review", schema: FINDINGS,\n});\nreport.findings.forEach((f) => log(`${f.file}:${f.line} ${f.summary}`));\n```\n\nThe same schema works on **every** backend; only the fulfillment channel differs, and the runner picks it for you: Claude uses its `outputFormat`, Codex its strict `outputSchema`, while Pi, OpenCode, and eligible custom ACP agents receive a client-hosted `StructuredOutput` MCP tool when they advertise HTTP MCP support. Pi accepts stdio, Streamable HTTP, and SSE MCP servers. If no valid tool capture exists, Pi retains the runner\'s common prompt-embedded schema and validated final-text JSON fallback. In every channel the runner validates the value client-side (with type coercion) and re-prompts a bounded number of times before failing the call with non-recoverable `SCHEMA_NONCOMPLIANCE`.\n\nSchema authoring rules that keep all channels healthy:\n\n- Root must be an object; set `additionalProperties: false` and list every property in `required`.\n- Put a `description` on every field \u2014 descriptions are the per-field prompt.\n- Keep schemas structurally simple. Exotic keywords (`oneOf`, `patternProperties`, unusual `format`s, backreference regexes) are normalized or stripped on the wire for some backends \u2014 validation still enforces them client-side, which shows up as re-prompt churn. Prefer `anyOf`, `enum`, and plain types.\n- Keep free-text fields small (tens of lines). An oversized structured output can exhaust schema repair and fail the call.\n- Validation checks structure, not truth. Check load-bearing values in script code (for example, reject findings whose `file` is not in a known file list) before spending more agents on them.\n'
   },
   {
     "id": "workflow/composition-and-failure",
@@ -32545,9 +32717,9 @@ var AUTHORING_DOC_TOPICS = [
       "workflow/api-resume-and-backends",
       "workflow/models-and-config"
     ],
-    "bytes": 5786,
-    "sha256": "d8354d57084a8d3bfef2614058f5d6b595c1cc6d377e4483ee22c9c414ebb23b",
-    "text": '## Working directory, isolation, confinement\n\n**Context:** JavaScript passed to the MCP `workflow` tool. Workflow scripts use `agent(prompt, options?)`; REPL evals use a different API.\n\n- Every agent session runs in the run\'s base `cwd` unless the call narrows it: `agent({ cwd: "packages/api" })` (relative resolves against the base).\n- `isolation: "worktree"` runs the agent in a **throwaway git worktree** (`<repoRoot>/.agentprism/worktrees/\u2026`) so parallel agents can edit without colliding. The worktree and its branch are **always deleted when the call ends \u2014 an isolated agent\'s file edits are discarded**. Have isolated agents *return their work as data* (a unified diff, a file map, a report) and apply it in a later non-isolated step; use worktrees for experiments, builds, and verification, not for persistent edits. Outside a git repo, isolation degrades to the shared tree with a logged notice.\n- `resume: { filesystem: "read-only" }` is a deprecated compatibility annotation. It is not a runner mode and has no effect on replay; completed calls replay by journal correspondence whether they read or write. Use `mode`, tool policy, prompts, and worktrees when you actually need confinement.\n- `mode` requests an agent-advertised ACP session mode and is **strict** \u2014 an unsupported mode fails the call rather than running unconfined. Mode ids are backend/model-specific and drift with harness versions. Read the selected entry\'s `modes.availableModes` from `workflow` `action:"config"`; only copy an exact listed id. `modes:null` means no mode support, so omit `mode`; never infer `"default"` from a backend\'s ordinary behavior or from an absent mode value. Automatic preflight rejects unadvertised ids before admission. Only set `mode` on calls whose `model` you also pin. Use an explicitly advertised read-only/plan mode for reviewers and auditors that must not write.\n- `agentType: "<name>"` binds a reusable subagent definition \u2014 a Markdown file at `<cwd>/.agentprism/agents/<name>.md` (project) or `~/.agentprism/agents/<name>.md` (user; project wins) whose frontmatter sets tool allow/deny lists, a model, and isolation, and whose body is the role prompt. An unknown name logs a warning and degrades to defaults.\n\n## Where a mutating workflow runs\n\nThe run\'s base `cwd` is the USER\'S checkout \u2014 the working copy they launched the host from. Treat it as borrowed: committing onto whatever branch is checked out, switching branches, or resetting it are defects unless the user asked for exactly that. A script that commits should verify its target workspace in a preflight step, or create its own workspace idempotently, and refuse on a mismatch rather than adapt. `isolation: "worktree"` is NOT such a workspace \u2014 it is per-call and throwaway. Note also that a throwaway worktree branches from the run cwd\'s repository: an isolated agent sees another agent\'s commits only when they are reachable there.\n\n## Wiring tools and inputs into a call\n\n- `mcpServers: [{ name, command, args: [], env: [] }]` attaches MCP servers to that agent\'s session \u2014 the portable way to hand any backend a capability (image generation, a browser, a ticket system). The agent sees the server\'s tools natively. Note `env` is a list of `{ name, value }` pairs (ACP shape), not an object map; HTTP/SSE servers use `{ type: "http", name, url, headers: [] }`.\n- `images: [...]` appends base64 image blocks to the prompt (backends without image support receive a bracketed text note instead).\n- `meta` / `promptMeta` pass generic ACP `_meta` through to `session/new` / `session/prompt` \u2014 the escape hatch for driving a custom agent\'s extension surface.\n- `keepSession: true` keeps a successful agent\'s ACP session re-openable after the run: the re-attach record (sessionId, backend, effective pool identity, cwd, reopen capabilities) lands in `WorkflowRunResult.agentSessions`, and the HOST can continue that conversation later via `runner.loadSession()`. Usage/auth pause failures are kept open automatically so managed resume can continue the interrupted occurrence. Scripts themselves never request reattach.\n\n### Custom ACP backends\n\nAny process that speaks ACP over stdio can serve `agent()` calls \u2014 an in-house browser-QA agent, an image generator, a domain-specific executor. Two ways in:\n\n1. **Host-registered** (preferred): the embedder passes `createAcpRunner({ backends: { browser: { command: "/abs/browser-acp" } } })`; the script just routes with `model: "browser"`.\n2. **Script-declared**: the script itself declares the backend in `meta.backends` \u2014 but declarations are **inert until the host approves them** (an elicitation in the MCP server; `allowScriptBackends` in the SDK), because they spawn commands on the host machine. Don\'t rely on them silently working.\n\n```js\nexport const meta = {\n  name: "checkout-qa",\n  description: "Implement, then QA the checkout flow in a real browser",\n  backends: {\n    browser: { command: "browser-acp", args: ["--headless"] },  // requires host approval\n  },\n};\n\nconst change = await agent("Implement the coupon-code field per the spec in docs/coupon.md.",\n                           { label: "implement" });              // default backend\nconst verdict = await agent(\n  `Open the app, walk through checkout with coupon SAVE20, and verify the discount line. Change summary:\\n${change}`,\n  { label: "qa", model: "browser",                               // the custom agent\n    schema: { type: "object", additionalProperties: false, required: ["passed"],\n              properties: { passed: { type: "boolean" }, notes: { type: "string" } } } },\n);\nreturn { change, qa: verdict };\n```\n\nStructured output works on custom backends through the same injected-tool/fallback ladder as OpenCode \u2014 no special-casing in the script.\n'
+    "bytes": 5648,
+    "sha256": "562a2372283f5a26c7ed0247ddf7eb972e51b1ede17a4d6b42758b7756256dfa",
+    "text": '## Working directory, isolation, confinement\n\n**Context:** JavaScript passed to the MCP `workflow` tool. Workflow scripts use `agent(prompt, options?)`; REPL evals use a different API.\n\n- Every agent session runs in the run\'s base `cwd` unless the call narrows it: `agent({ cwd: "packages/api" })` (relative resolves against the base).\n- `isolation: "worktree"` runs the agent in a **throwaway git worktree** (`<repoRoot>/.agentprism/worktrees/\u2026`) so parallel agents can edit without colliding. The worktree and its branch are **always deleted when the call ends \u2014 an isolated agent\'s file edits are discarded**. Have isolated agents *return their work as data* (a unified diff, a file map, a report) and apply it in a later non-isolated step; use worktrees for experiments, builds, and verification, not for persistent edits. Outside a git repo, isolation degrades to the shared tree with a logged notice.\n- `resume: { filesystem: "read-only" }` is a deprecated compatibility annotation. It is not a runner mode and has no effect on replay; completed calls replay by journal correspondence whether they read or write. Use `mode`, tool policy, prompts, and worktrees when you actually need confinement.\n- `mode` requests an exact agent-advertised ACP session mode. Config returns raw names, descriptions, and `_meta`; use those backend-owned explanations instead of inferring from an id. When omitted, AgentPrism applies Claude `auto`, Codex `agent`, OpenCode `build`, or no Pi mode. Automatic preflight rejects an authored or built-in default that the selected backend/model does not advertise. Only set `mode` on calls whose `model` you also pin. Use an explicitly advertised read-only/plan mode for reviewers and auditors that must not write.\n- `agentType: "<name>"` binds a reusable subagent definition \u2014 a Markdown file at `<cwd>/.agentprism/agents/<name>.md` (project) or `~/.agentprism/agents/<name>.md` (user; project wins) whose frontmatter sets tool allow/deny lists, a model, and isolation, and whose body is the role prompt. An unknown name logs a warning and degrades to defaults.\n\n## Where a mutating workflow runs\n\nThe run\'s base `cwd` is the USER\'S checkout \u2014 the working copy they launched the host from. Treat it as borrowed: committing onto whatever branch is checked out, switching branches, or resetting it are defects unless the user asked for exactly that. A script that commits should verify its target workspace in a preflight step, or create its own workspace idempotently, and refuse on a mismatch rather than adapt. `isolation: "worktree"` is NOT such a workspace \u2014 it is per-call and throwaway. Note also that a throwaway worktree branches from the run cwd\'s repository: an isolated agent sees another agent\'s commits only when they are reachable there.\n\n## Wiring tools and inputs into a call\n\n- `mcpServers: [{ name, command, args: [], env: [] }]` attaches MCP servers to that agent\'s session \u2014 the portable way to hand any backend a capability (image generation, a browser, a ticket system). The agent sees the server\'s tools natively. Note `env` is a list of `{ name, value }` pairs (ACP shape), not an object map; HTTP/SSE servers use `{ type: "http", name, url, headers: [] }`.\n- `images: [...]` appends base64 image blocks to the prompt (backends without image support receive a bracketed text note instead).\n- `meta` / `promptMeta` pass generic ACP `_meta` through to `session/new` / `session/prompt` \u2014 the escape hatch for driving a custom agent\'s extension surface.\n- `keepSession: true` keeps a successful agent\'s ACP session re-openable after the run: the re-attach record (sessionId, backend, effective pool identity, cwd, reopen capabilities) lands in `WorkflowRunResult.agentSessions`, and the HOST can continue that conversation later via `runner.loadSession()`. Usage/auth pause failures are kept open automatically so managed resume can continue the interrupted occurrence. Scripts themselves never request reattach.\n\n### Custom ACP backends\n\nAny process that speaks ACP over stdio can serve `agent()` calls \u2014 an in-house browser-QA agent, an image generator, a domain-specific executor. Two ways in:\n\n1. **Host-registered** (preferred): the embedder passes `createAcpRunner({ backends: { browser: { command: "/abs/browser-acp" } } })`; the script just routes with `model: "browser"`.\n2. **Script-declared**: the script itself declares the backend in `meta.backends` \u2014 but declarations are **inert until the host approves them** (an elicitation in the MCP server; `allowScriptBackends` in the SDK), because they spawn commands on the host machine. Don\'t rely on them silently working.\n\n```js\nexport const meta = {\n  name: "checkout-qa",\n  description: "Implement, then QA the checkout flow in a real browser",\n  backends: {\n    browser: { command: "browser-acp", args: ["--headless"] },  // requires host approval\n  },\n};\n\nconst change = await agent("Implement the coupon-code field per the spec in docs/coupon.md.",\n                           { label: "implement" });              // default backend\nconst verdict = await agent(\n  `Open the app, walk through checkout with coupon SAVE20, and verify the discount line. Change summary:\\n${change}`,\n  { label: "qa", model: "browser",                               // the custom agent\n    schema: { type: "object", additionalProperties: false, required: ["passed"],\n              properties: { passed: { type: "boolean" }, notes: { type: "string" } } } },\n);\nreturn { change, qa: verdict };\n```\n\nStructured output works on custom backends through the same injected-tool/fallback ladder as OpenCode \u2014 no special-casing in the script.\n'
   },
   {
     "id": "workflow/determinism-and-resume",
@@ -32575,9 +32747,9 @@ var AUTHORING_DOC_TOPICS = [
       "workflow/environment-and-tools",
       "workflow/api-control-flow"
     ],
-    "bytes": 8866,
-    "sha256": "cce59fffcb8a5e58e8a127220bf303a1d362d66b1216ecde0712b38d6e8eae47",
-    "text": '# Workflow agent API reference\n\n**Context:** JavaScript passed to the MCP `workflow` tool. Workflow scripts use `agent(prompt, options?)`; REPL evals use a different API.\n\n## `agent(prompt, options?)` \u2014 full option table\n\nReturns the agent\'s final assistant text, or the schema-validated object when `schema` is set. Resolves to `null` when a *recoverable* failure survives all retries.\n\n| option | type | meaning |\n|---|---|---|\n| `label` | `string` | Display/telemetry name; also stamped on every live ACP event for this call. Always set it. Not part of the resume hash. |\n| `phase` | `string` | Assign this call to a phase explicitly (needed inside concurrent stages where the global `phase()` state would race). |\n| `schema` | JSON Schema object | Structured output. Plain object literal only \u2014 no schema builders exist in the realm. Part of the resume hash. |\n| `model` | `string` | Model spec: optional registered harness prefix plus a verbatim id, or a backend-only name. See [Model specs & routing](#model-specs--routing). Part of the resume hash. |\n| `tier` | `"small" \\| "medium" \\| "big"` | Coarse tier resolved from host config; beats phase/meta model, loses to explicit `model`. Part of the resume hash. |\n| `mode` | `string` | ACP session mode id advertised by the selected backend/model. **Strict**: unsupported/unadvertised ids fail before prompting (and automatic workflow preflight rejects them before admission). Read the selected `action:"config"` entry\'s `modes.availableModes` and copy only an exact id; `modes:null` means omit this field. Never infer a generic `"default"`. Part of the resume hash when set. |\n| `configOptions` | `Record<string, string \\| boolean>` | Exact ACP session option ids and authored values. Applied in ascending id order after model and before the prompt, with no aliases or coercion. `"model"` is reserved for the dedicated `model` field. Part of the resume hash only when non-empty, with sorted keys. With MCP, read the advertised-options table from `workflow` action `config` before choosing values. |\n| `agentType` | `string` | Bind a named subagent definition (tools allow/deny, model, isolation, role prompt). See [agentType definitions](#agenttype-definitions). Part of the resume hash. |\n| `isolation` | `"worktree"` | Run in a throwaway git worktree branched from the run cwd. **Always removed (worktree + branch) when the call ends** \u2014 edits are discarded; return work as data. Degrades to the shared tree outside a git repo (logged). |\n| `resume` | `{ filesystem: "read-only" }` | Deprecated compatibility annotation. It is recorded as legacy diagnostic provenance, is not sent to the runner or hashed, and has no effect on replay. New scripts should omit it. |\n| `cwd` | `string` | Per-session working directory; relative resolves against the run\'s base cwd. Overridden by worktree isolation. Not hashed. |\n| `timeoutMs` | `number \\| null` | Total wall-clock cap for each attempt. A finite value may tighten a finite host `agentTimeoutMs` ceiling but cannot raise or disable it. With no host ceiling, a finite value applies and `null`/omitted is uncapped. |\n| `idleTimeoutMs` | `number \\| null` | No-backend-activity cap for each attempt. It may tighten a finite host `agentIdleTimeoutMs` ceiling but cannot raise or disable it. |\n| `retries` | `number` | Retries after *recoverable* failures (default 0, host-overridable). Exhausted retries \u21D2 the call resolves `null`. |\n| `mcpServers` | `McpServerConfig[]` | MCP servers attached to this session. Stdio shape: `{ name, command, args: [], env: [{ name, value }] }` (`args`/`env` required, `env` is name/value pairs, not a map); `{ type: "http" \\| "sse", name, url, headers: [] }` also accepted. Not hashed. |\n| `images` | `PromptImage[]` | Base64 image blocks appended to the prompt; backends without image support get a bracketed text note. Not hashed. |\n| `meta` | `object` | ACP `_meta` merged into `session/new` \u2014 session-scoped extension passthrough (pairs with custom backends). Not hashed. |\n| `promptMeta` | `object` | ACP `_meta` merged into `session/prompt` \u2014 turn-scoped passthrough. Backend-computed keys win on conflict. Not hashed. |\n| `keepSession` | `boolean` | Skip release-time best-effort `session/close`; the non-secret re-attach record lands in `WorkflowRunResult.agentSessions` for host-side `loadSession()` / `resumeSession()`. Usage/auth pause failures are kept open automatically for managed continuation. Not identity-hashed; included in the input fingerprint. |\n\nThe total-wall clock measures the whole attempt, including backend startup, model/config setup,\ntool work, and streamed output; it is not an idle timer. The separate idle clock is opt-in and\nre-arms on real backend activity (every ACP `session/update`), never synthetic progress heartbeats.\nSize it above the longest expected backend-silent local tool call. Each retry starts fresh clocks.\nExhaustion is recoverable `AGENT_TIMEOUT` or `AGENT_IDLE_TIMEOUT`: the call resolves to `null`,\nreleases its concurrency slot, and asks the ACP session to cancel. A session that keeps running\nafter the cancellation grace is closed where supported and its pooled child is recycled.\n\nEvery new run, including one admitted with `resumeFromRunId`, resolves host limits from that run\'s\nrequest. It does not inherit `agentTimeoutMs`, `agentIdleTimeoutMs`, retries, concurrency, or\nagent-count values from its source, so pass every operational bound the resumed execution should use.\n\n## Model specs & routing\n\nA `model` string is resolved solely from its first segment, then delegated to the harness:\n\n| spec shape | routes to | notes |\n|---|---|---|\n| *(omitted)* | host-pinned/default backend | MCP: explicit `AGENTPRISM_DEFAULT_BACKEND` wins; when truly unset, zero-token readiness discovery pins one project default before validation/execution and preserves it across resume. SDK runner: configured default, historical fallback `claude`. The selected harness keeps its session default model. Most portable. |\n| `claude`, `codex`, `opencode`, `pi`, or `<custom-name>` | that registered harness | Backend-only: no model config call; the harness default remains active. |\n| `claude/<id>`, `codex/<id>`, `opencode/<id>`, `pi/<id>`, or `<custom-name>/<id>` | that registered harness | Match the first segment ASCII-case-insensitively and strip exactly one segment. Custom names take priority on collision. The remaining `<id>` is sent verbatim, including further `/` characters. For Pi, that remainder is its `<provider>/<model-id>` and Pi preserves any further slashes in the model id. |\n| any other string, including `anthropic/\u2026`, `openai/\u2026`, bare `opus`, or bare `gpt-\u2026` | host default backend | The **entire** authored string is sent verbatim; these are not routing aliases. |\n\nSelection is a single `session/set_config_option` with `configId: "model"` and the exact remaining string. There is no catalog matching, case folding, normalization, bracket parsing, nearest-neighbor selection, sibling effort/Fast option driving, retry, or echo verification. Brackets, dots, and provider-style prefixes are ordinary model-id characters.\n\nWhatever the harness returns is the outcome. A rejection follows the existing agent-error path with no resolution-specific code or model fallback event. `onModelFallback` and `WorkflowRunResult.fallbacks` remain public compatibility surfaces; model resolution does not emit entries, while pause recovery emits `kind: "continuation"` reattach/skip notices.\n\n## Structured output channels\n\nOne author API (`schema`), four fulfillment paths \u2014 chosen automatically per backend:\n\n| backend | channel |\n|---|---|\n| Claude | native `outputFormat`, schema normalized to Anthropic\'s structured-outputs subset (e.g. `oneOf` \u2192 `anyOf`; unsupported keywords/formats stripped on the wire) |\n| Codex | native strict `outputSchema` (OpenAI strict subset normalization) |\n| Pi | a client-hosted `StructuredOutput` MCP tool injected when the agent advertises HTTP MCP support; common prompt-embedded schema and validated final-text JSON fallback |\n| OpenCode / custom ACP | a client-hosted **`StructuredOutput` MCP tool** injected into the session when the agent advertises HTTP MCP support (an agent may show it as `structured_output_StructuredOutput`); otherwise prompt-embedded schema + JSON parse of the final message. Custom backends can opt out of tool injection with `structuredOutputTool: false`. |\n\nPi accepts stdio, Streamable HTTP, and SSE MCP servers; ACP-transport MCP hosting remains client-side.\n\nIn every channel the runner coerces + validates client-side and re-prompts a bounded number of times; the final miss fails the call with non-recoverable `SCHEMA_NONCOMPLIANCE`. Constraints stripped from the wire are still enforced client-side \u2014 an exotic schema keyword shows up as re-prompt churn, so keep schemas simple.\n'
+    "bytes": 8842,
+    "sha256": "aeda144cdea50062a1d2c42d11e3cb26b058777f50c3285318a8ad1a53319eb4",
+    "text": '# Workflow agent API reference\n\n**Context:** JavaScript passed to the MCP `workflow` tool. Workflow scripts use `agent(prompt, options?)`; REPL evals use a different API.\n\n## `agent(prompt, options?)` \u2014 full option table\n\nReturns the agent\'s final assistant text, or the schema-validated object when `schema` is set. Resolves to `null` when a *recoverable* failure survives all retries.\n\n| option | type | meaning |\n|---|---|---|\n| `label` | `string` | Display/telemetry name; also stamped on every live ACP event for this call. Always set it. Not part of the resume hash. |\n| `phase` | `string` | Assign this call to a phase explicitly (needed inside concurrent stages where the global `phase()` state would race). |\n| `schema` | JSON Schema object | Structured output. Plain object literal only \u2014 no schema builders exist in the realm. Part of the resume hash. |\n| `model` | `string` | Model spec: optional registered harness prefix plus a verbatim id, or a backend-only name. See [Model specs & routing](#model-specs--routing). Part of the resume hash. |\n| `tier` | `"small" \\| "medium" \\| "big"` | Coarse tier resolved from host config; beats phase/meta model, loses to explicit `model`. Part of the resume hash. |\n| `mode` | `string` | Exact ACP session mode id advertised by the selected backend/model. Config preserves each raw name, description, and `_meta`. When omitted, AgentPrism applies Claude `auto`, Codex `agent`, OpenCode `build`, or no Pi mode; `defaultModeId` reports that choice. Authored and built-in defaults are validated before prompting. Part of the resume hash only when authored. |\n| `configOptions` | `Record<string, string \\| boolean>` | Exact ACP session option ids and authored values. Applied in ascending id order after model and before the prompt, with no aliases or coercion. `"model"` is reserved for the dedicated `model` field. Part of the resume hash only when non-empty, with sorted keys. With MCP, read the advertised-options table from `workflow` action `config` before choosing values. |\n| `agentType` | `string` | Bind a named subagent definition (tools allow/deny, model, isolation, role prompt). See [agentType definitions](#agenttype-definitions). Part of the resume hash. |\n| `isolation` | `"worktree"` | Run in a throwaway git worktree branched from the run cwd. **Always removed (worktree + branch) when the call ends** \u2014 edits are discarded; return work as data. Degrades to the shared tree outside a git repo (logged). |\n| `resume` | `{ filesystem: "read-only" }` | Deprecated compatibility annotation. It is recorded as legacy diagnostic provenance, is not sent to the runner or hashed, and has no effect on replay. New scripts should omit it. |\n| `cwd` | `string` | Per-session working directory; relative resolves against the run\'s base cwd. Overridden by worktree isolation. Not hashed. |\n| `timeoutMs` | `number \\| null` | Total wall-clock cap for each attempt. A finite value may tighten a finite host `agentTimeoutMs` ceiling but cannot raise or disable it. With no host ceiling, a finite value applies and `null`/omitted is uncapped. |\n| `idleTimeoutMs` | `number \\| null` | No-backend-activity cap for each attempt. It may tighten a finite host `agentIdleTimeoutMs` ceiling but cannot raise or disable it. |\n| `retries` | `number` | Retries after *recoverable* failures (default 0, host-overridable). Exhausted retries \u21D2 the call resolves `null`. |\n| `mcpServers` | `McpServerConfig[]` | MCP servers attached to this session. Stdio shape: `{ name, command, args: [], env: [{ name, value }] }` (`args`/`env` required, `env` is name/value pairs, not a map); `{ type: "http" \\| "sse", name, url, headers: [] }` also accepted. Not hashed. |\n| `images` | `PromptImage[]` | Base64 image blocks appended to the prompt; backends without image support get a bracketed text note. Not hashed. |\n| `meta` | `object` | ACP `_meta` merged into `session/new` \u2014 session-scoped extension passthrough (pairs with custom backends). Not hashed. |\n| `promptMeta` | `object` | ACP `_meta` merged into `session/prompt` \u2014 turn-scoped passthrough. Backend-computed keys win on conflict. Not hashed. |\n| `keepSession` | `boolean` | Skip release-time best-effort `session/close`; the non-secret re-attach record lands in `WorkflowRunResult.agentSessions` for host-side `loadSession()` / `resumeSession()`. Usage/auth pause failures are kept open automatically for managed continuation. Not identity-hashed; included in the input fingerprint. |\n\nThe total-wall clock measures the whole attempt, including backend startup, model/config setup,\ntool work, and streamed output; it is not an idle timer. The separate idle clock is opt-in and\nre-arms on real backend activity (every ACP `session/update`), never synthetic progress heartbeats.\nSize it above the longest expected backend-silent local tool call. Each retry starts fresh clocks.\nExhaustion is recoverable `AGENT_TIMEOUT` or `AGENT_IDLE_TIMEOUT`: the call resolves to `null`,\nreleases its concurrency slot, and asks the ACP session to cancel. A session that keeps running\nafter the cancellation grace is closed where supported and its pooled child is recycled.\n\nEvery new run, including one admitted with `resumeFromRunId`, resolves host limits from that run\'s\nrequest. It does not inherit `agentTimeoutMs`, `agentIdleTimeoutMs`, retries, concurrency, or\nagent-count values from its source, so pass every operational bound the resumed execution should use.\n\n## Model specs & routing\n\nA `model` string is resolved solely from its first segment, then delegated to the harness:\n\n| spec shape | routes to | notes |\n|---|---|---|\n| *(omitted)* | host-pinned/default backend | MCP: explicit `AGENTPRISM_DEFAULT_BACKEND` wins; when truly unset, zero-token readiness discovery pins one project default before validation/execution and preserves it across resume. SDK runner: configured default, historical fallback `claude`. The selected harness keeps its session default model. Most portable. |\n| `claude`, `codex`, `opencode`, `pi`, or `<custom-name>` | that registered harness | Backend-only: no model config call; the harness default remains active. |\n| `claude/<id>`, `codex/<id>`, `opencode/<id>`, `pi/<id>`, or `<custom-name>/<id>` | that registered harness | Match the first segment ASCII-case-insensitively and strip exactly one segment. Custom names take priority on collision. The remaining `<id>` is sent verbatim, including further `/` characters. For Pi, that remainder is its `<provider>/<model-id>` and Pi preserves any further slashes in the model id. |\n| any other string, including `anthropic/\u2026`, `openai/\u2026`, bare `opus`, or bare `gpt-\u2026` | host default backend | The **entire** authored string is sent verbatim; these are not routing aliases. |\n\nSelection is a single `session/set_config_option` with `configId: "model"` and the exact remaining string. There is no catalog matching, case folding, normalization, bracket parsing, nearest-neighbor selection, sibling effort/Fast option driving, retry, or echo verification. Brackets, dots, and provider-style prefixes are ordinary model-id characters.\n\nWhatever the harness returns is the outcome. A rejection follows the existing agent-error path with no resolution-specific code or model fallback event. `onModelFallback` and `WorkflowRunResult.fallbacks` remain public compatibility surfaces; model resolution does not emit entries, while pause recovery emits `kind: "continuation"` reattach/skip notices.\n\n## Structured output channels\n\nOne author API (`schema`), four fulfillment paths \u2014 chosen automatically per backend:\n\n| backend | channel |\n|---|---|\n| Claude | native `outputFormat`, schema normalized to Anthropic\'s structured-outputs subset (e.g. `oneOf` \u2192 `anyOf`; unsupported keywords/formats stripped on the wire) |\n| Codex | native strict `outputSchema` (OpenAI strict subset normalization) |\n| Pi | a client-hosted `StructuredOutput` MCP tool injected when the agent advertises HTTP MCP support; common prompt-embedded schema and validated final-text JSON fallback |\n| OpenCode / custom ACP | a client-hosted **`StructuredOutput` MCP tool** injected into the session when the agent advertises HTTP MCP support (an agent may show it as `structured_output_StructuredOutput`); otherwise prompt-embedded schema + JSON parse of the final message. Custom backends can opt out of tool injection with `structuredOutputTool: false`. |\n\nPi accepts stdio, Streamable HTTP, and SSE MCP servers; ACP-transport MCP hosting remains client-side.\n\nIn every channel the runner coerces + validates client-side and re-prompts a bounded number of times; the final miss fails the call with non-recoverable `SCHEMA_NONCOMPLIANCE`. Constraints stripped from the wire are still enforced client-side \u2014 an exotic schema keyword shows up as re-prompt churn, so keep schemas simple.\n'
   },
   {
     "id": "workflow/api-control-flow",
@@ -32620,9 +32792,9 @@ var AUTHORING_DOC_TOPICS = [
       "workflow/composition-and-failure",
       "workflow/checkpoints-and-quality"
     ],
-    "bytes": 6181,
-    "sha256": "281d047d5def4a8a17660c5009e6b8fbf76197da768561e138418a3ba533b8c8",
-    "text": '## Worked example \u2014 cross-vendor build with every major primitive\n\n**Context:** JavaScript passed to the MCP `workflow` tool. Workflow scripts use `agent(prompt, options?)`; REPL evals use a different API.\n\n```js\nexport const meta = {\n  name: "feature-build",\n  description: "Plan, gate on approval, implement, cross-vendor review, fix until green",\n  phases: [{ title: "Plan" }, { title: "Implement" }, { title: "Review" }],\n};\n\nconst PLAN = { type: "object", additionalProperties: false, required: ["steps", "risks"],\n  properties: {\n    steps: { type: "array", items: { type: "string", description: "One concrete implementation step" } },\n    risks: { type: "array", items: { type: "string" } } } };\nconst VERDICT = { type: "object", additionalProperties: false, required: ["ok"],\n  properties: { ok: { type: "boolean" },\n                feedback: { type: "string", description: "Required when ok=false: concretely what to change" } } };\n\nphase("Plan");\nconst plan = await agent(\n  `Study this repo, then write an implementation plan for: ${args.feature}. Keep steps concrete.`,\n  { label: "plan", model: "opencode/zai/glm-5.2", schema: PLAN },\n);\n\nconst approved = await checkpoint(\n  `Implement "${args.feature}" with this plan?\\n- ${plan.steps.join("\\n- ")}\\nRisks: ${plan.risks.join("; ")}`,\n  { kind: "confirm", default: true },\n);\nif (!approved) return { implemented: false, plan };\n\nphase("Implement");\nconst outcome = await gate(\n  (feedback, attempt) => agent(\n    `Implement: ${args.feature}\\nPlan:\\n- ${plan.steps.join("\\n- ")}\\n` +\n    `Run the project\'s tests before finishing and report results.` +\n    (feedback ? `\\n\\nReviewer feedback on attempt ${attempt}:\\n${feedback}\\nAddress every point.` : ""),\n    { label: `implement:${attempt + 1}`, model: "codex/gpt-5.6-sol", retries: 1 },\n  ),\n  async (report) => {\n    if (!report) return { ok: false, feedback: "implementation agent produced no result" };\n    phase("Review");\n    const reviews = (await parallel([   // two reviewers on different vendors\n      () => agent(`Review the working-tree diff for correctness. Implementer\'s report:\\n${report}`,\n                  { label: "review:correctness", model: "claude/opus[1m]", schema: VERDICT }),\n      () => agent(`Review the working-tree diff for regressions and missing tests. Report:\\n${report}`,\n                  { label: "review:coverage", model: "opencode/zai/glm-5.2", schema: VERDICT }),\n    ])).filter(Boolean);\n    const rejections = reviews.filter((r) => !r.ok);\n    return rejections.length\n      ? { ok: false, feedback: rejections.map((r) => r.feedback).join("\\n"), reviews }\n      : { ok: true, reviews };\n  },\n  { attempts: 3 },\n);\n\nreturn { implemented: outcome.ok, attempts: outcome.attempts, reviewVerdict: outcome.verdict, plan };\n```\n\n(The planner would ideally run read-only, but mode ids are backend/model-specific, so this call leaves `mode` unset rather than guessing. Add one only after `action:"config"` explicitly lists the exact id in `modes.availableModes`; `modes:null` means keep it omitted.)\n\n## Worked example \u2014 fully backend-agnostic audit\n\nNo `model` anywhere: this script runs unchanged on whatever backend the host defaults to.\n\n```js\nexport const meta = {\n  name: "edge-case-audit",\n  description: "Exhaustively hunt edge-case bugs in a target dir, verify each, report gaps",\n  phases: [{ title: "Hunt" }, { title: "Verify" }],\n};\n\nconst BUGS = { type: "object", additionalProperties: false, required: ["bugs"],\n  properties: { bugs: { type: "array", items: { type: "object", additionalProperties: false,\n    required: ["file", "scenario"], properties: {\n      file: { type: "string", description: "Repo-relative path you actually opened" },\n      scenario: { type: "string", description: "Concrete input/state \u2192 wrong behavior" } } } } } };\n\nphase("Hunt");\nconst seen = [];   // what earlier rounds reported, threaded into each new prompt\nconst candidates = await loopUntilDry({\n  round: async (i) => {\n    const r = await agent(\n      `Round ${i + 1}: find edge-case bugs in ${args.target} not already in this list:\\n` +\n      JSON.stringify(seen) + `\\nOnly report what you can ground in code you read.`,\n      { label: `hunt:${i + 1}`, schema: BUGS },\n    );\n    const bugs = r ? r.bugs : [];\n    seen.push(...bugs);\n    return bugs;      // loopUntilDry dedups these by `key` across rounds\n  },\n  key: (b) => `${b.file}:${b.scenario}`,\n  consecutiveEmpty: 2,\n  maxRounds: 8,\n});\n\nphase("Verify");\nconst confirmed = (await pipeline(\n  candidates,\n  (bug) => verify(bug, { reviewers: 3, threshold: 0.66, lens: ["correctness", "reproducibility"] }),\n  (v, bug) => (v.real ? bug : null),\n)).filter(Boolean);\n\nconst gaps = await completenessCheck(args, confirmed);\nlog(`${confirmed.length}/${candidates.length} confirmed; complete=${gaps.complete}`);\nreturn { confirmed, missing: gaps.missing ?? [] };\n```\n\n## Automatic validation before admission\n\nThe MCP `workflow` tool validates every run automatically before admission: static parse, mocked dry run, then routed no-prompt config checks. Invalid scripts return `status:"rejected"` diagnostics without creating a run ID, reserving a background slot, or spending tokens. When pinning model, mode, or `configOptions`, use `action:"config"` first.\n\nThe mocked pass executes reachable script control flow with schema-conforming fabricated agent results. It can prove that syntax, metadata, helper calls, and reachable branches are structurally executable, but it cannot prove prompt quality, real-world judgment, or convergence through every branch. Keep loops bounded in script code and inspect validation warnings for declared phases that the default fabricated path did not reach.\n\nThe routed config pass probes each distinct backend/model pair without prompting. Unknown option ids, invalid select values, wrong value types, and the reserved `"model"` config key reject the script with direct alternatives. A backend that cannot be probed produces an explicit warning and leaves only that backend\'s option domain unverified.\n\nFor model/config details, read `workflow/models-and-config`. For edited-script replay patterns, read `workflow/determinism-and-resume`.\n'
+    "bytes": 6133,
+    "sha256": "267c9831a93a8cb4c6f64fa951782803f4a990b3ed8c69ba3ad75e367a60fb8f",
+    "text": '## Worked example \u2014 cross-vendor build with every major primitive\n\n**Context:** JavaScript passed to the MCP `workflow` tool. Workflow scripts use `agent(prompt, options?)`; REPL evals use a different API.\n\n```js\nexport const meta = {\n  name: "feature-build",\n  description: "Plan, gate on approval, implement, cross-vendor review, fix until green",\n  phases: [{ title: "Plan" }, { title: "Implement" }, { title: "Review" }],\n};\n\nconst PLAN = { type: "object", additionalProperties: false, required: ["steps", "risks"],\n  properties: {\n    steps: { type: "array", items: { type: "string", description: "One concrete implementation step" } },\n    risks: { type: "array", items: { type: "string" } } } };\nconst VERDICT = { type: "object", additionalProperties: false, required: ["ok"],\n  properties: { ok: { type: "boolean" },\n                feedback: { type: "string", description: "Required when ok=false: concretely what to change" } } };\n\nphase("Plan");\nconst plan = await agent(\n  `Study this repo, then write an implementation plan for: ${args.feature}. Keep steps concrete.`,\n  { label: "plan", model: "opencode/zai/glm-5.2", schema: PLAN },\n);\n\nconst approved = await checkpoint(\n  `Implement "${args.feature}" with this plan?\\n- ${plan.steps.join("\\n- ")}\\nRisks: ${plan.risks.join("; ")}`,\n  { kind: "confirm", default: true },\n);\nif (!approved) return { implemented: false, plan };\n\nphase("Implement");\nconst outcome = await gate(\n  (feedback, attempt) => agent(\n    `Implement: ${args.feature}\\nPlan:\\n- ${plan.steps.join("\\n- ")}\\n` +\n    `Run the project\'s tests before finishing and report results.` +\n    (feedback ? `\\n\\nReviewer feedback on attempt ${attempt}:\\n${feedback}\\nAddress every point.` : ""),\n    { label: `implement:${attempt + 1}`, model: "codex/gpt-5.6-sol", retries: 1 },\n  ),\n  async (report) => {\n    if (!report) return { ok: false, feedback: "implementation agent produced no result" };\n    phase("Review");\n    const reviews = (await parallel([   // two reviewers on different vendors\n      () => agent(`Review the working-tree diff for correctness. Implementer\'s report:\\n${report}`,\n                  { label: "review:correctness", model: "claude/opus[1m]", schema: VERDICT }),\n      () => agent(`Review the working-tree diff for regressions and missing tests. Report:\\n${report}`,\n                  { label: "review:coverage", model: "opencode/zai/glm-5.2", schema: VERDICT }),\n    ])).filter(Boolean);\n    const rejections = reviews.filter((r) => !r.ok);\n    return rejections.length\n      ? { ok: false, feedback: rejections.map((r) => r.feedback).join("\\n"), reviews }\n      : { ok: true, reviews };\n  },\n  { attempts: 3 },\n);\n\nreturn { implemented: outcome.ok, attempts: outcome.attempts, reviewVerdict: outcome.verdict, plan };\n```\n\n(An omitted mode uses AgentPrism\'s autonomous built-in default. For a genuinely read-only planner, inspect the backend-owned mode names/descriptions from `action:"config"` and pin the exact advertised read-only/plan id.)\n\n## Worked example \u2014 fully backend-agnostic audit\n\nNo `model` anywhere: this script runs unchanged on whatever backend the host defaults to.\n\n```js\nexport const meta = {\n  name: "edge-case-audit",\n  description: "Exhaustively hunt edge-case bugs in a target dir, verify each, report gaps",\n  phases: [{ title: "Hunt" }, { title: "Verify" }],\n};\n\nconst BUGS = { type: "object", additionalProperties: false, required: ["bugs"],\n  properties: { bugs: { type: "array", items: { type: "object", additionalProperties: false,\n    required: ["file", "scenario"], properties: {\n      file: { type: "string", description: "Repo-relative path you actually opened" },\n      scenario: { type: "string", description: "Concrete input/state \u2192 wrong behavior" } } } } } };\n\nphase("Hunt");\nconst seen = [];   // what earlier rounds reported, threaded into each new prompt\nconst candidates = await loopUntilDry({\n  round: async (i) => {\n    const r = await agent(\n      `Round ${i + 1}: find edge-case bugs in ${args.target} not already in this list:\\n` +\n      JSON.stringify(seen) + `\\nOnly report what you can ground in code you read.`,\n      { label: `hunt:${i + 1}`, schema: BUGS },\n    );\n    const bugs = r ? r.bugs : [];\n    seen.push(...bugs);\n    return bugs;      // loopUntilDry dedups these by `key` across rounds\n  },\n  key: (b) => `${b.file}:${b.scenario}`,\n  consecutiveEmpty: 2,\n  maxRounds: 8,\n});\n\nphase("Verify");\nconst confirmed = (await pipeline(\n  candidates,\n  (bug) => verify(bug, { reviewers: 3, threshold: 0.66, lens: ["correctness", "reproducibility"] }),\n  (v, bug) => (v.real ? bug : null),\n)).filter(Boolean);\n\nconst gaps = await completenessCheck(args, confirmed);\nlog(`${confirmed.length}/${candidates.length} confirmed; complete=${gaps.complete}`);\nreturn { confirmed, missing: gaps.missing ?? [] };\n```\n\n## Automatic validation before admission\n\nThe MCP `workflow` tool validates every run automatically before admission: static parse, mocked dry run, then routed no-prompt config checks. Invalid scripts return `status:"rejected"` diagnostics without creating a run ID, reserving a background slot, or spending tokens. When pinning model, mode, or `configOptions`, use `action:"config"` first.\n\nThe mocked pass executes reachable script control flow with schema-conforming fabricated agent results. It can prove that syntax, metadata, helper calls, and reachable branches are structurally executable, but it cannot prove prompt quality, real-world judgment, or convergence through every branch. Keep loops bounded in script code and inspect validation warnings for declared phases that the default fabricated path did not reach.\n\nThe routed config pass probes each distinct backend/model pair without prompting. Unknown option ids, invalid select values, wrong value types, and the reserved `"model"` config key reject the script with direct alternatives. A backend that cannot be probed produces an explicit warning and leaves only that backend\'s option domain unverified.\n\nFor model/config details, read `workflow/models-and-config`. For edited-script replay patterns, read `workflow/determinism-and-resume`.\n'
   },
   {
     "id": "repl/quickstart",
@@ -32666,9 +32838,9 @@ var AUTHORING_DOC_TOPICS = [
       "repl/steering-queueing-and-cancellation",
       "repl/api-reference"
     ],
-    "bytes": 3550,
-    "sha256": "93acec40f5758f8f5317242ba2e9a871defc4b1a4f6c72285252d5a88999f4cd",
-    "text": '# REPL agent calls and persistent handles\n\nREPL delegation uses:\n\n```js\nagent(modelSpec, task, options?) -> PromiseHandle\n```\n\nThis differs from workflow scripts, whose signature is `agent(prompt, options?)`.\n\n## Model routing\n\n`modelSpec` is required. Use a registered backend name alone to preserve its configured default model:\n\n```js\nconst worker = agent("codex", "Investigate the failing parser test");\n```\n\nUse `backend/model-id` only after model discovery:\n\n```js\nconst worker = agent("claude/verified-model-id", "Review the implementation");\n```\n\nThe known built-ins are Claude, Codex, OpenCode, and pi, plus host-registered custom backends. Unknown backend names reject and enumerate known backends. Use the `workflow` tool\'s `action:"config"` with `harnesses`/`modelFilter`, then `modelSpecs`, before pinning model, mode, or config-option values. Set `mode` only when the selected entry\'s `modes.availableModes` explicitly lists that exact id; `modes:null` means omit it, and a generic `"default"` must never be inferred.\n\n## Exact option vocabulary\n\n```js\nconst worker = agent("codex", "Inspect the parser", {\n  schema: {\n    type: "object",\n    additionalProperties: false,\n    required: ["summary"],\n    properties: { summary: { type: "string" } },\n  },\n  cwd: "/absolute/path",\n  mode: "advertised-mode-id",\n  configOptions: { advertisedOptionId: "advertised-value" },\n});\n```\n\nOptions are exactly:\n\n- `schema`: plain JSON Schema object; the promise resolves to its validated object.\n- `cwd`: absolute worker session working directory.\n- `mode`: exact ACP mode explicitly listed in the selected backend/model\'s discovered `modes.availableModes`.\n- `configOptions`: exact string/boolean ACP option ids and values.\n\nUnknown option keys reject. Options must be JSON-serializable.\n\n## Preserve the handle\n\nThe returned promise is also the live handle:\n\n```js\nconst worker = agent("pi", "Research the issue");\nconst id = worker.id;\nconst answer = await worker;\n```\n\nDo not write this if you intend to reuse the session:\n\n```js\nconst worker = await agent("pi", "Research the issue");\n```\n\nThat variable stores only the answer and loses access to handle methods.\n\nThe founding handle exposes non-enumerable, immutable members:\n\n- `id`: stable call id such as `"c1"`.\n- `queue(prompt, options?)`: create a distinct durable FIFO future turn.\n- `steer(prompt, options?)`: attempt strict control of only the currently active turn.\n- `cancel()`: cancel the session\'s current public turn.\n\nA queued-turn handle exposes its own `id` and `cancel()`.\n\n## Settlement and failures\n\nWithout `schema`, the founding promise resolves to final assistant text. With `schema`, it resolves to the validated object.\n\nA rejected call carries an error with call/backend attribution where available. Errors whose `recoverable` field is not `false` are treated as recoverable by `parallel()` and `pipeline()` and become `null` slots. A non-recoverable error rejects the surrounding combinator/eval.\n\nDirect `await worker` propagates rejection; catch only errors you can handle meaningfully:\n\n```js\nlet answer;\ntry {\n  answer = await worker;\n} catch (error) {\n  console.error(error);\n  answer = null;\n}\n```\n\n## Session continuity\n\nThe founding answer settling does not erase the handle binding. Queue later prompts on the founding handle to continue the same ACP session. Session continuity depends on the backend\'s continuation capability and the workspace\'s durable lane state. Never fabricate a new handle from a saved id; retain the actual promise-handle binding.\n'
+    "bytes": 3565,
+    "sha256": "26f9868ba7d70fac2465cdb8fc0d22726585b61608d852aeca26b12a762dff96",
+    "text": '# REPL agent calls and persistent handles\n\nREPL delegation uses:\n\n```js\nagent(modelSpec, task, options?) -> PromiseHandle\n```\n\nThis differs from workflow scripts, whose signature is `agent(prompt, options?)`.\n\n## Model routing\n\n`modelSpec` is required. Use a registered backend name alone to preserve its configured default model:\n\n```js\nconst worker = agent("codex", "Investigate the failing parser test");\n```\n\nUse `backend/model-id` only after model discovery:\n\n```js\nconst worker = agent("claude/verified-model-id", "Review the implementation");\n```\n\nThe known built-ins are Claude, Codex, OpenCode, and pi, plus host-registered custom backends. Unknown backend names reject and enumerate known backends. Use the `workflow` tool\'s `action:"config"` with `harnesses`/`modelFilter`, then `modelSpecs`, before pinning model, mode, or config-option values. Read the selected entry\'s harness-owned mode names/descriptions before pinning an exact advertised id. Omission uses `defaultModeId` (Claude auto, Codex agent, OpenCode build; none for Pi).\n\n## Exact option vocabulary\n\n```js\nconst worker = agent("codex", "Inspect the parser", {\n  schema: {\n    type: "object",\n    additionalProperties: false,\n    required: ["summary"],\n    properties: { summary: { type: "string" } },\n  },\n  cwd: "/absolute/path",\n  mode: "advertised-mode-id",\n  configOptions: { advertisedOptionId: "advertised-value" },\n});\n```\n\nOptions are exactly:\n\n- `schema`: plain JSON Schema object; the promise resolves to its validated object.\n- `cwd`: absolute worker session working directory.\n- `mode`: exact ACP mode explicitly listed in the selected backend/model\'s discovered `modes.availableModes`.\n- `configOptions`: exact string/boolean ACP option ids and values.\n\nUnknown option keys reject. Options must be JSON-serializable.\n\n## Preserve the handle\n\nThe returned promise is also the live handle:\n\n```js\nconst worker = agent("pi", "Research the issue");\nconst id = worker.id;\nconst answer = await worker;\n```\n\nDo not write this if you intend to reuse the session:\n\n```js\nconst worker = await agent("pi", "Research the issue");\n```\n\nThat variable stores only the answer and loses access to handle methods.\n\nThe founding handle exposes non-enumerable, immutable members:\n\n- `id`: stable call id such as `"c1"`.\n- `queue(prompt, options?)`: create a distinct durable FIFO future turn.\n- `steer(prompt, options?)`: attempt strict control of only the currently active turn.\n- `cancel()`: cancel the session\'s current public turn.\n\nA queued-turn handle exposes its own `id` and `cancel()`.\n\n## Settlement and failures\n\nWithout `schema`, the founding promise resolves to final assistant text. With `schema`, it resolves to the validated object.\n\nA rejected call carries an error with call/backend attribution where available. Errors whose `recoverable` field is not `false` are treated as recoverable by `parallel()` and `pipeline()` and become `null` slots. A non-recoverable error rejects the surrounding combinator/eval.\n\nDirect `await worker` propagates rejection; catch only errors you can handle meaningfully:\n\n```js\nlet answer;\ntry {\n  answer = await worker;\n} catch (error) {\n  console.error(error);\n  answer = null;\n}\n```\n\n## Session continuity\n\nThe founding answer settling does not erase the handle binding. Queue later prompts on the founding handle to continue the same ACP session. Session continuity depends on the backend\'s continuation capability and the workspace\'s durable lane state. Never fabricate a new handle from a saved id; retain the actual promise-handle binding.\n'
   },
   {
     "id": "repl/steering-queueing-and-cancellation",
@@ -33020,7 +33192,7 @@ function registerReplTool(mcp, options) {
   mcp.registerTool(
     "repl",
     {
-      description: 'A persistent QuickJS-in-WASM JavaScript VM you drive interactively to orchestrate subagents \u2014 one VM per projectDir, addressed by the same project model as the workflow tool. Two actions: eval runs code and holds the call open pumping settlements; interrupt cancels one subagent call (by id) or breaks the running eval (no id). Named bindings, pending subagent calls, raised checkpoints, and `_` (the previous eval\'s completion value) PERSIST in the VM between calls \u2014 a later eval sees the same variables and awaits the same promises. Console logging produces output text only and creates no persistent value; nothing lives in the transcript. For deeper syntax and examples, read docs topic repl/quickstart and then one related repl/* topic. Inside code (JavaScript; top-level await is allowed, top-level return is a syntax error; console output is captured) the host bridge provides agent(modelSpec, task, opts?) \u2192 Promise: spawn an ACP subagent on a registry built-in (currently Claude, Codex, OpenCode, and pi) or a registered custom agent. The spec is "backend/model" (a bare "backend" runs its default model); an unknown backend rejects the call immediately, naming the known backends. The opts keys are schema (a structured-output JSON schema, validated per call), cwd, configOptions (backend-specific knobs, validated at admission), and mode. Before setting mode, use workflow action:"config" for that exact modelSpec and copy only an id explicitly listed in modes.availableModes; modes:null means omit mode, never infer "default". Unknown option keys reject synchronously. agent() returns a persistent promise-handle. Assign the handle before awaiting it: `const a = agent("codex", "inspect the failure"); const first = await a`. a.steer(text) targets only the currently running turn. It never starts or queues another turn and resolves "injected", "idle", or "unsupported"; transport and protocol failures reject. Steering while idle returns "idle" and loses the instruction by design. `const q = a.queue(text)` creates a distinct FIFO turn on the same session. q.id is available immediately, await q returns that turn\'s answer, and q.cancel() or an out-of-band interrupt of q.id cancels that exact turn. Queueing works on every backend that can continue the session; steering requires the ACP server\'s raw steering advertisement. Do not write `const a = await agent(...)` when you intend to reuse the handle, because that stores only the answer. Persistent-workspace example \u2014 first eval: `const a = agent("codex", "Investigate the parser failure")`; a later eval, only while agents() reports a\'s turn as running: `const steering = await a.steer("Focus on the parser state machine")`; after the founding answer settles: `const first = await a; const q1 = a.queue("Implement the fix"); const q2 = a.queue("Run the focused tests"); console.log(q1.id, q2.id, steering); const fixed = await q1; const tested = await q2`. checkpoint(question) parks a promise for a human answer, resolved by checkpoint.answer(id, value) in a later eval. parallel, pipeline, verify, judgePanel, gate, retry, loopUntilDry, and sleep(ms) round out the guest library. Introspection is in-band: workspace() returns { bindings, inFlight, checkpoints, diagnostics }; agents() lists live agents with their call ids and states; reset() tears the workspace down. `_` holds the previous eval\'s completion value. No fs, no net, no timers beyond sleep. Subagents (6 concurrent per workspace) take stable ids c1, c2, \u2026 used by interrupt and reported by agents(). eval { code } runs the code, then HOLDS THE CALL OPEN pumping settlements up to a soft bound (default 60 000 ms; per-call timeoutMs override; hard cap 120 000 ms). If everything the code waits on settles within the bound the result is the finished shape { output, result? } \u2014 output is ONE newline-joined string (console lines, checkpoint lines like "checkpoint c9: <question>", error renderings), result the completion value\'s repr. If the bound elapses first the result is the still-running shape { output, running: [call ids] } and the eval continues server-side \u2014 any later eval drains what settled, and eval with "" (the empty script) is the documented idempotent poll: it re-executes nothing, only reports. State survives MCP-session churn and daemon restarts: every eval and every settlement drain that changed state persists the workspace to the daemon\'s per-project repl store, and the first touch of a stored workspace restores it and reconciles every outstanding call. A stored snapshot that refuses (corrupt, a format upgrade, a wasm-binary mismatch) AUTO-RESETS \u2014 the file is renamed aside, never deleted, and the next eval\'s output leads with a notice naming the file and reason. Reconcile reports and drain errors live in workspace().diagnostics. On last-client disconnect the workspace drains in-flight subagent turns to completion and closes idle children; the next eligible queued turn re-attaches its founding session lazily. Subagent output passes through UNFILTERED \u2014 backend harness noise (e.g. codex\'s "Warning: Skill descriptions were shortened\u2026") is forwarded verbatim, never curated away. Every result carries the machine-readable shape (see the output schema) as structuredContent alongside the human text.',
+      description: 'A persistent QuickJS-in-WASM JavaScript VM you drive interactively to orchestrate subagents \u2014 one VM per projectDir, addressed by the same project model as the workflow tool. Two actions: eval runs code and holds the call open pumping settlements; interrupt cancels one subagent call (by id) or breaks the running eval (no id). Named bindings, pending subagent calls, raised checkpoints, and `_` (the previous eval\'s completion value) PERSIST in the VM between calls \u2014 a later eval sees the same variables and awaits the same promises. Console logging produces output text only and creates no persistent value; nothing lives in the transcript. For deeper syntax and examples, read docs topic repl/quickstart and then one related repl/* topic. Inside code (JavaScript; top-level await is allowed, top-level return is a syntax error; console output is captured) the host bridge provides agent(modelSpec, task, opts?) \u2192 Promise: spawn an ACP subagent on a registry built-in (currently Claude, Codex, OpenCode, and pi) or a registered custom agent. The spec is "backend/model" (a bare "backend" runs its default model); an unknown backend rejects the call immediately, naming the known backends. The opts keys are schema (a structured-output JSON schema, validated per call), cwd, configOptions (backend-specific knobs, validated at admission), and mode. Before setting mode, use workflow action:"config" for that exact modelSpec and read the harness-owned mode descriptions. Omission uses defaultModeId (Claude auto, Codex agent, OpenCode build; none for Pi); pin only an exact advertised id. Unknown option keys reject synchronously. agent() returns a persistent promise-handle. Assign the handle before awaiting it: `const a = agent("codex", "inspect the failure"); const first = await a`. a.steer(text) targets only the currently running turn. It never starts or queues another turn and resolves "injected", "idle", or "unsupported"; transport and protocol failures reject. Steering while idle returns "idle" and loses the instruction by design. `const q = a.queue(text)` creates a distinct FIFO turn on the same session. q.id is available immediately, await q returns that turn\'s answer, and q.cancel() or an out-of-band interrupt of q.id cancels that exact turn. Queueing works on every backend that can continue the session; steering requires the ACP server\'s raw steering advertisement. Do not write `const a = await agent(...)` when you intend to reuse the handle, because that stores only the answer. Persistent-workspace example \u2014 first eval: `const a = agent("codex", "Investigate the parser failure")`; a later eval, only while agents() reports a\'s turn as running: `const steering = await a.steer("Focus on the parser state machine")`; after the founding answer settles: `const first = await a; const q1 = a.queue("Implement the fix"); const q2 = a.queue("Run the focused tests"); console.log(q1.id, q2.id, steering); const fixed = await q1; const tested = await q2`. checkpoint(question) parks a promise for a human answer, resolved by checkpoint.answer(id, value) in a later eval. parallel, pipeline, verify, judgePanel, gate, retry, loopUntilDry, and sleep(ms) round out the guest library. Introspection is in-band: workspace() returns { bindings, inFlight, checkpoints, diagnostics }; agents() lists live agents with their call ids and states; reset() tears the workspace down. `_` holds the previous eval\'s completion value. No fs, no net, no timers beyond sleep. Subagents (6 concurrent per workspace) take stable ids c1, c2, \u2026 used by interrupt and reported by agents(). eval { code } runs the code, then HOLDS THE CALL OPEN pumping settlements up to a soft bound (default 60 000 ms; per-call timeoutMs override; hard cap 120 000 ms). If everything the code waits on settles within the bound the result is the finished shape { output, result? } \u2014 output is ONE newline-joined string (console lines, checkpoint lines like "checkpoint c9: <question>", error renderings), result the completion value\'s repr. If the bound elapses first the result is the still-running shape { output, running: [call ids] } and the eval continues server-side \u2014 any later eval drains what settled, and eval with "" (the empty script) is the documented idempotent poll: it re-executes nothing, only reports. State survives MCP-session churn and daemon restarts: every eval and every settlement drain that changed state persists the workspace to the daemon\'s per-project repl store, and the first touch of a stored workspace restores it and reconciles every outstanding call. A stored snapshot that refuses (corrupt, a format upgrade, a wasm-binary mismatch) AUTO-RESETS \u2014 the file is renamed aside, never deleted, and the next eval\'s output leads with a notice naming the file and reason. Reconcile reports and drain errors live in workspace().diagnostics. On last-client disconnect the workspace drains in-flight subagent turns to completion and closes idle children; the next eligible queued turn re-attaches its founding session lazily. Subagent output passes through UNFILTERED \u2014 backend harness noise (e.g. codex\'s "Warning: Skill descriptions were shortened\u2026") is forwarded verbatim, never curated away. Every result carries the machine-readable shape (see the output schema) as structuredContent alongside the human text.',
       // STRICT at the wire too: the MCP SDK strips unknown keys from a
       // non-strict object schema before the handler runs, so a deleted
       // surface like `refs` would be silently discarded instead of
@@ -33628,6 +33800,7 @@ function projectHarnessOptions(harnesses) {
     const options = harness.options ?? [];
     return boundValue({
       backendId: harness.backendId,
+      defaultModeId: harness.defaultModeId,
       model: harness.model,
       probed: harness.probed,
       error: harness.error,
@@ -33674,14 +33847,16 @@ import {
   WorkflowManager as WorkflowManager2
 } from "@automatalabs/workflows";
 var SCRIPT_RESOURCE_MIME_TYPE = "text/javascript";
+var RESULT_RESOURCE_MIME_TYPE = "application/json";
 var SCRIPT_RESOURCE_LIST_LIMIT = 50;
 var EVENTS_RESOURCE_MIME_TYPE = "application/json";
 var WORKFLOW_RUN_EVENTS_SCHEMA_VERSION = 1;
 var SCRIPT_URI_PATTERN = /^workflow:\/\/runs\/([a-z0-9]+-[a-z0-9]+)\/script$/;
+var RESULT_URI_PATTERN = /^workflow:\/\/runs\/([a-z0-9]+-[a-z0-9]+)\/result$/;
 var EVENTS_URI_PATTERN = /^workflow:\/\/runs\/([a-z0-9]+-[a-z0-9]+)\/events(?:\?([^#]*))?$/;
 var STREAM_ID_PATTERN = /^[0-9a-f]{32}$/;
 function resourceNotFound(uri) {
-  throw new ProtocolError(ProtocolErrorCode.InvalidParams, `Workflow script resource not found: ${uri}`);
+  throw new ProtocolError(ProtocolErrorCode.InvalidParams, `Workflow resource not found: ${uri}`);
 }
 function workflowScriptUri(runId) {
   return `workflow://runs/${runId}/script`;
@@ -33689,9 +33864,18 @@ function workflowScriptUri(runId) {
 function workflowRunIdFromScriptUri(uri) {
   return SCRIPT_URI_PATTERN.exec(uri)?.[1];
 }
+function workflowResultUri(runId) {
+  return `workflow://runs/${runId}/result`;
+}
+function workflowRunIdFromResultUri(uri) {
+  return RESULT_URI_PATTERN.exec(uri)?.[1];
+}
 function workflowRunEventsUri(runId) {
   return `workflow://runs/${runId}/events`;
 }
+function hasExactResult(state) {
+  return state.status === "completed" && state.result !== void 0;
+}
 function parseDecimal(value, max = Number.MAX_SAFE_INTEGER) {
   if (!/^(?:0|[1-9][0-9]*)$/.test(value)) return void 0;
   const parsed = Number(value);
@@ -33758,6 +33942,15 @@ var WorkflowScriptResources = class {
     this.modernNotifier = modernNotifier;
     this.router = source instanceof WorkflowManager2 ? singleStoreRouter(source) : source.router;
     this.detachRunDeleted = this.router.onRunDeleted(this.onRunDeleted);
+    this.detachRunEventPersisted = this.modernNotifier ? () => void 0 : this.router.onRunEventPersisted((record2) => {
+      if (record2.event.type !== "complete") return;
+      queueMicrotask(() => {
+        try {
+          if (this.availableResultUri(record2.runId)) void this.mcp.sendResourceListChanged();
+        } catch {
+        }
+      });
+    });
     this.detachRunStopped = this.router.onRunStopped(({ runId }) => this.cancelPendingElicitation(runId));
     const previousOnClose = this.mcp.server.onclose;
     this.mcp.server.onclose = () => {
@@ -33765,6 +33958,7 @@ var WorkflowScriptResources = class {
       this.elicitationControllers.clear();
       for (const uri of [...this.eventSubscriptions.keys()]) this.closeEventSubscription(uri);
       this.detachRunStopped();
+      this.detachRunEventPersisted();
       this.detachRunDeleted();
       previousOnClose?.();
     };
@@ -33774,6 +33968,7 @@ var WorkflowScriptResources = class {
   modernNotifier;
   router;
   detachRunDeleted;
+  detachRunEventPersisted;
   detachRunStopped;
   subscriptions = /* @__PURE__ */ new Set();
   externalReaders = /* @__PURE__ */ new Map();
@@ -33782,16 +33977,13 @@ var WorkflowScriptResources = class {
   silentDeletionRunIds = /* @__PURE__ */ new Set();
   elicitationControllers = /* @__PURE__ */ new Map();
   onRunDeleted = ({ runId }) => {
-    const uri = workflowScriptUri(runId);
-    this.subscriptions.delete(uri);
+    this.subscriptions.delete(workflowScriptUri(runId));
+    this.subscriptions.delete(workflowResultUri(runId));
     this.closeEventSubscription(workflowRunEventsUri(runId));
     this.cancelPendingElicitation(runId);
     this.deletedRunIds.add(runId);
     const notify = !this.silentDeletionRunIds.delete(runId);
-    if (notify) {
-      if (this.modernNotifier) this.modernNotifier.resourcesChanged();
-      else void this.mcp.sendResourceListChanged();
-    }
+    if (notify && !this.modernNotifier) void this.mcp.sendResourceListChanged();
   };
   /** The persistence store containing runId, if any known project store holds it. */
   persistenceFor(runId) {
@@ -33878,6 +34070,57 @@ var WorkflowScriptResources = class {
     }
     return newestToOldest.reverse();
   }
+  /** Exact persisted result metadata, available only for completed runs with a JSON value. */
+  serializedResult(runId) {
+    const state = this.loadState(runId);
+    if (!state) {
+      throw new ProtocolError(
+        ProtocolErrorCode.InvalidParams,
+        `No workflow run found for runId "${runId}" in this server's project-scoped run store.`
+      );
+    }
+    if (!hasExactResult(state)) {
+      throw new ProtocolError(
+        ProtocolErrorCode.InvalidParams,
+        state.status === "completed" ? `Workflow run "${runId}" completed without a JSON result.` : `Workflow result for runId "${runId}" is unavailable while the run is ${state.status}.`
+      );
+    }
+    let text;
+    try {
+      text = JSON.stringify(state.result);
+    } catch {
+      throw new ProtocolError(
+        ProtocolErrorCode.InternalError,
+        `Workflow result for runId "${runId}" could not be serialized.`
+      );
+    }
+    if (text === void 0) {
+      throw new ProtocolError(
+        ProtocolErrorCode.InternalError,
+        `Workflow result for runId "${runId}" could not be serialized.`
+      );
+    }
+    return {
+      uri: workflowResultUri(runId),
+      text,
+      bytes: Buffer.byteLength(text, "utf8")
+    };
+  }
+  availableResultUri(runId) {
+    const state = this.loadState(runId);
+    return state && hasExactResult(state) ? workflowResultUri(runId) : void 0;
+  }
+  resultLink(runId) {
+    const state = this.loadState(runId);
+    if (!state || !hasExactResult(state)) return void 0;
+    return {
+      type: "resource_link",
+      uri: workflowResultUri(runId),
+      name: `${state.workflowName} result (${state.runId})`,
+      description: `exact workflow result \xB7 completed ${state.completedAt ?? state.updatedAt}`,
+      mimeType: RESULT_RESOURCE_MIME_TYPE
+    };
+  }
   links(lineage) {
     const links = [];
     for (const entry of lineage) {
@@ -33887,8 +34130,8 @@ var WorkflowScriptResources = class {
       links.push({
         type: "resource_link",
         uri: entry.uri,
-        name: `${state.workflowName} (${state.runId})`,
-        description: `${state.status} \xB7 started ${state.startedAt}`,
+        name: `${state.workflowName} script (${state.runId})`,
+        description: `workflow script \xB7 ${state.status} \xB7 started ${state.startedAt}`,
         mimeType: SCRIPT_RESOURCE_MIME_TYPE
       });
     }
@@ -33904,8 +34147,8 @@ var WorkflowScriptResources = class {
         list: () => ({
           resources: this.recentRuns().map((state) => ({
             uri: workflowScriptUri(state.runId),
-            name: `${state.workflowName} (${state.runId})`,
-            description: `${state.status} \xB7 started ${state.startedAt}`,
+            name: `${state.workflowName} script (${state.runId})`,
+            description: `workflow script \xB7 ${state.status} \xB7 started ${state.startedAt}`,
             mimeType: SCRIPT_RESOURCE_MIME_TYPE
           }))
         }),
@@ -33920,6 +34163,28 @@ var WorkflowScriptResources = class {
       },
       (uri) => this.readResource(uri.toString())
     );
+    this.mcp.registerResource(
+      "workflow-run-result",
+      new ResourceTemplate("workflow://runs/{runId}/result", {
+        list: () => ({
+          resources: this.recentRuns().filter(hasExactResult).map((state) => ({
+            uri: workflowResultUri(state.runId),
+            name: `${state.workflowName} result (${state.runId})`,
+            description: `exact workflow result \xB7 completed ${state.completedAt ?? state.updatedAt}`,
+            mimeType: RESULT_RESOURCE_MIME_TYPE
+          }))
+        }),
+        complete: {
+          runId: (partial2) => this.recentRuns().filter(hasExactResult).map((state) => state.runId).filter((runId) => runId.startsWith(partial2))
+        }
+      }),
+      {
+        title: "Workflow run results",
+        description: "Exact JSON results for completed workflow runs. Listing is discovery-only and contains at most the 50 newest runs; direct workflow://runs/{runId}/result reads remain available until run deletion.",
+        mimeType: RESULT_RESOURCE_MIME_TYPE
+      },
+      (uri) => this.readResultResource(uri.toString())
+    );
     this.mcp.registerResource(
       "workflow-run-events",
       new ResourceTemplate("workflow://runs/{runId}/events", {
@@ -33949,7 +34214,9 @@ var WorkflowScriptResources = class {
         if (external.available !== void 0 && !external.available(ctx)) resourceNotFound(uri);
         return external.read();
       }
-      return uri.includes("/events") ? this.readEventsResource(uri) : this.readResource(uri);
+      if (uri.includes("/events")) return this.readEventsResource(uri);
+      if (workflowRunIdFromResultUri(uri)) return this.readResultResource(uri);
+      return this.readResource(uri);
     });
     this.mcp.server.setRequestHandler("resources/subscribe", (request, ctx) => {
       const uri = request.params.uri;
@@ -33964,6 +34231,12 @@ var WorkflowScriptResources = class {
         this.subscriptions.add(uri);
         return {};
       }
+      const resultRunId = workflowRunIdFromResultUri(uri);
+      if (resultRunId) {
+        if (!this.availableResultUri(resultRunId)) resourceNotFound(uri);
+        this.subscriptions.add(uri);
+        return {};
+      }
       if (!uri.includes("/events")) resourceNotFound(uri);
       const parsed = parseWorkflowRunEventsUri(uri);
       if (!parsed) malformedEventsUri();
@@ -33977,7 +34250,7 @@ var WorkflowScriptResources = class {
         if (external.available !== void 0 && !external.available(ctx)) resourceNotFound(uri);
         return {};
       }
-      const runId = workflowRunIdFromScriptUri(uri);
+      const runId = workflowRunIdFromScriptUri(uri) ?? workflowRunIdFromResultUri(uri);
       if (runId) {
         if (!this.loadState(runId) && !this.loadTombstone(runId) && !this.deletedRunIds.has(runId) && !this.subscriptions.has(uri)) resourceNotFound(uri);
         this.subscriptions.delete(uri);
@@ -34146,6 +34419,20 @@ var WorkflowScriptResources = class {
       mapEventError(error51, parsed);
     }
   }
+  readResultResource(uri) {
+    const runId = workflowRunIdFromResultUri(uri);
+    if (!runId) resourceNotFound(uri);
+    const result = this.serializedResult(runId);
+    return {
+      contents: [
+        {
+          uri: result.uri,
+          mimeType: RESULT_RESOURCE_MIME_TYPE,
+          text: result.text
+        }
+      ]
+    };
+  }
   readResource(uri) {
     const runId = workflowRunIdFromScriptUri(uri);
     if (!runId) resourceNotFound(uri);
@@ -34200,6 +34487,275 @@ function requireDurableStoppedRun(manager, runId) {
   }
 }
 
+// ../mcp-server/src/workflow-permissions.ts
+import { EventEmitter } from "node:events";
+import { randomUUID as randomUUID2 } from "node:crypto";
+import {
+  decidePermission,
+  redactText as redactText2,
+  truncateUtf8 as truncateUtf83
+} from "@automatalabs/workflows";
+var RUN_ID2 = /^[a-z0-9]+-[a-z0-9]+$/;
+var PERMISSION_ID = /^[0-9a-f-]{36}$/i;
+var MAX_PUBLIC_REQUEST_BYTES = 64 * 1024;
+var MAX_PUBLIC_SCALAR_BYTES = 512;
+var MAX_PERMISSION_OPTIONS = 16;
+var MAX_OPTION_ID_CODE_UNITS = 512;
+var MAX_OPTION_ID_BYTES = 2048;
+var MAX_PUBLIC_ARRAY_ITEMS = 16;
+var MAX_PUBLIC_OBJECT_KEYS = 20;
+var MAX_PUBLIC_DEPTH = 4;
+var SENSITIVE_KEY_PARTS = [
+  "password",
+  "passwd",
+  "secret",
+  "token",
+  "apikey",
+  "credential",
+  "authorization",
+  "cookie",
+  "privatekey"
+];
+var PERMISSION_OPTION_KINDS = /* @__PURE__ */ new Set([
+  "allow_once",
+  "allow_always",
+  "reject_once",
+  "reject_always"
+]);
+function cloneRequest(request) {
+  return structuredClone(request);
+}
+function sensitiveKey(key) {
+  const normalized = key.toLowerCase().replace(/[^a-z0-9]/g, "");
+  return SENSITIVE_KEY_PARTS.some((part) => normalized.includes(part));
+}
+function sanitizeString(value, state) {
+  const redacted = redactText2(value);
+  const bounded = truncateUtf83(redacted.value, MAX_PUBLIC_SCALAR_BYTES);
+  state.redacted ||= redacted.redacted;
+  state.truncated ||= bounded !== redacted.value;
+  return bounded;
+}
+function sanitizeValue(value, state, depth = 0, ancestors = /* @__PURE__ */ new Set()) {
+  if (value === null || typeof value === "boolean" || typeof value === "number") return value;
+  if (typeof value === "string") return sanitizeString(value, state);
+  if (typeof value !== "object") {
+    state.truncated = true;
+    return null;
+  }
+  if (depth >= MAX_PUBLIC_DEPTH || ancestors.has(value)) {
+    state.truncated = true;
+    return depth >= MAX_PUBLIC_DEPTH ? "[max depth]" : "[cycle]";
+  }
+  const nextAncestors = new Set(ancestors);
+  nextAncestors.add(value);
+  if (Array.isArray(value)) {
+    const kept = value.slice(0, MAX_PUBLIC_ARRAY_ITEMS).map(
+      (entry) => sanitizeValue(entry, state, depth + 1, nextAncestors)
+    );
+    if (value.length > MAX_PUBLIC_ARRAY_ITEMS) state.truncated = true;
+    return kept;
+  }
+  const entries = Object.entries(value);
+  const output = {};
+  for (const [key, child] of entries.slice(0, MAX_PUBLIC_OBJECT_KEYS)) {
+    const outwardKey = sanitizeString(key, state);
+    if (Object.hasOwn(output, outwardKey)) {
+      state.truncated = true;
+      continue;
+    }
+    if (sensitiveKey(key)) {
+      output[outwardKey] = "[REDACTED]";
+      state.redacted = true;
+    } else {
+      output[outwardKey] = sanitizeValue(child, state, depth + 1, nextAncestors);
+    }
+  }
+  if (entries.length > MAX_PUBLIC_OBJECT_KEYS) state.truncated = true;
+  return output;
+}
+function validMeta(value) {
+  return value === void 0 || value === null || typeof value === "object" && !Array.isArray(value);
+}
+function validOption(option) {
+  return typeof option.optionId === "string" && option.optionId.length > 0 && option.optionId.length <= MAX_OPTION_ID_CODE_UNITS && Buffer.byteLength(option.optionId, "utf8") <= MAX_OPTION_ID_BYTES && typeof option.name === "string" && PERMISSION_OPTION_KINDS.has(option.kind) && validMeta(option._meta);
+}
+function sanitizeOption(option, state) {
+  return {
+    optionId: option.optionId,
+    name: sanitizeString(option.name, state),
+    kind: option.kind,
+    ...option._meta === void 0 ? {} : { _meta: sanitizeValue(option._meta, state) }
+  };
+}
+function safeToolCall(toolCall, state) {
+  if (typeof toolCall.toolCallId !== "string" || toolCall.toolCallId.length === 0) return void 0;
+  const sanitized = sanitizeValue(toolCall, state);
+  if (sanitized === null || typeof sanitized !== "object" || Array.isArray(sanitized)) return void 0;
+  return {
+    ...sanitized,
+    toolCallId: sanitizeString(toolCall.toolCallId, state)
+  };
+}
+function publicRequest(request) {
+  if (!Array.isArray(request.options) || request.options.length === 0 || request.options.length > MAX_PERMISSION_OPTIONS || !request.options.every(validOption) || !validMeta(request._meta)) return void 0;
+  const optionIds = request.options.map((option) => option.optionId);
+  if (new Set(optionIds).size !== optionIds.length) return void 0;
+  const state = { redacted: false, truncated: false };
+  const toolCall = safeToolCall(request.toolCall, state);
+  if (!toolCall) return void 0;
+  const options = request.options.map((option) => sanitizeOption(option, state));
+  const projected = {
+    toolCall,
+    options,
+    ...request._meta === void 0 ? {} : { _meta: sanitizeValue(request._meta, state) }
+  };
+  if (Buffer.byteLength(JSON.stringify(projected), "utf8") <= MAX_PUBLIC_REQUEST_BYTES) {
+    return { request: projected, truncated: state.truncated, redacted: state.redacted };
+  }
+  const minimal = {
+    toolCall: {
+      toolCallId: projected.toolCall.toolCallId,
+      ...projected.toolCall.title === void 0 ? {} : { title: projected.toolCall.title },
+      ...projected.toolCall.name === void 0 ? {} : { name: projected.toolCall.name },
+      ...projected.toolCall.kind === void 0 ? {} : { kind: projected.toolCall.kind },
+      ...projected.toolCall.status === void 0 ? {} : { status: projected.toolCall.status }
+    },
+    options: projected.options.map(({ optionId, name, kind }) => ({ optionId, name, kind }))
+  };
+  if (Buffer.byteLength(JSON.stringify(minimal), "utf8") > MAX_PUBLIC_REQUEST_BYTES) return void 0;
+  return { request: minimal, truncated: true, redacted: state.redacted };
+}
+function validResponse(response) {
+  if ("_meta" in response) return false;
+  if (response.outcome.outcome === "cancelled") return true;
+  return typeof response.outcome.optionId === "string" && response.outcome.optionId.length > 0 && response.outcome.optionId.length <= MAX_OPTION_ID_CODE_UNITS && Buffer.byteLength(response.outcome.optionId, "utf8") <= MAX_OPTION_ID_BYTES;
+}
+var WorkflowPermissionBroker = class {
+  byId = /* @__PURE__ */ new Map();
+  idsByRun = /* @__PURE__ */ new Map();
+  changed = new EventEmitter();
+  detachEvents;
+  resolver = (request, context) => {
+    if (context.backendId === "pi" || context.runId === void 0 || !RUN_ID2.test(context.runId) || context.callIndex === void 0 || !Number.isSafeInteger(context.callIndex) || context.callIndex < 0) {
+      return decidePermission(request, {});
+    }
+    return this.park(request, context);
+  };
+  attach(source) {
+    this.detachEvents?.();
+    this.detachEvents = source.on("permission_request", (event) => this.observeFinalOutcome(event));
+  }
+  dispose() {
+    this.detachEvents?.();
+    this.detachEvents = void 0;
+    for (const entry of [...this.byId.values()]) {
+      this.finish(entry, { outcome: { outcome: "cancelled" } });
+    }
+    this.changed.removeAllListeners();
+  }
+  list(runId) {
+    const ids = this.idsByRun.get(runId);
+    if (!ids) return [];
+    return [...ids].map((id) => this.byId.get(id)?.public).filter((entry) => entry !== void 0).sort(
+      (left, right) => left.callIndex - right.callIndex || left.requestedAt.localeCompare(right.requestedAt) || left.permissionId.localeCompare(right.permissionId)
+    ).map((entry) => structuredClone(entry));
+  }
+  has(runId, permissionId) {
+    if (permissionId !== void 0) return this.byId.get(permissionId)?.public.runId === runId;
+    return (this.idsByRun.get(runId)?.size ?? 0) > 0;
+  }
+  async waitForPending(runId) {
+    if (this.has(runId)) return;
+    await new Promise((resolve) => {
+      const eventName = `pending:${runId}`;
+      const done = () => {
+        this.changed.off(eventName, done);
+        resolve();
+      };
+      this.changed.on(eventName, done);
+      if (this.has(runId)) done();
+    });
+  }
+  respond(runId, permissionId, response) {
+    if (!RUN_ID2.test(runId) || !PERMISSION_ID.test(permissionId)) {
+      throw new TypeError("Invalid workflow permission identity");
+    }
+    if (!validResponse(response)) throw new TypeError("Invalid workflow permission response");
+    const entry = this.byId.get(permissionId);
+    if (!entry || entry.public.runId !== runId) {
+      throw new TypeError(`Permission request "${permissionId}" is not pending for run "${runId}"`);
+    }
+    if (response.outcome.outcome === "selected") {
+      const selectedOptionId = response.outcome.optionId;
+      if (!entry.request.options.some((option) => option.optionId === selectedOptionId)) {
+        throw new TypeError(
+          `Permission option ${JSON.stringify(selectedOptionId)} was not advertised by request "${permissionId}"`
+        );
+      }
+    }
+    const accepted = structuredClone(response);
+    const acknowledgement = {
+      permissionId,
+      runId,
+      callIndex: entry.public.callIndex,
+      outcome: structuredClone(accepted.outcome),
+      respondedAt: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    this.finish(entry, accepted);
+    return acknowledgement;
+  }
+  park(request, context) {
+    const projection = publicRequest(request);
+    if (!projection) return Promise.resolve({ outcome: { outcome: "cancelled" } });
+    const permissionId = randomUUID2();
+    return new Promise((resolve) => {
+      const entry = {
+        request: cloneRequest(request),
+        public: {
+          version: 1,
+          permissionId,
+          runId: context.runId,
+          callIndex: context.callIndex,
+          backendId: context.backendId,
+          ...context.label === void 0 ? {} : { label: context.label },
+          requestedAt: (/* @__PURE__ */ new Date()).toISOString(),
+          request: projection.request,
+          requestTruncated: projection.truncated,
+          requestRedacted: projection.redacted
+        },
+        settle: resolve
+      };
+      this.byId.set(permissionId, entry);
+      const runIds = this.idsByRun.get(context.runId) ?? /* @__PURE__ */ new Set();
+      runIds.add(permissionId);
+      this.idsByRun.set(context.runId, runIds);
+      this.changed.emit(`run:${context.runId}`);
+      this.changed.emit(`pending:${context.runId}`);
+    });
+  }
+  observeFinalOutcome(event) {
+    for (const entry of this.byId.values()) {
+      if (entry.public.backendId === event.backendId && entry.request.sessionId === event.sessionId && entry.request.toolCall.toolCallId === event.request.toolCall.toolCallId) {
+        this.finish(entry, event.outcome);
+        return;
+      }
+    }
+  }
+  finish(entry, response) {
+    this.remove(entry);
+    entry.settle(response);
+  }
+  remove(entry) {
+    const { permissionId, runId } = entry.public;
+    if (!this.byId.delete(permissionId)) return;
+    const ids = this.idsByRun.get(runId);
+    ids?.delete(permissionId);
+    if (ids?.size === 0) this.idsByRun.delete(runId);
+    this.changed.emit(`run:${runId}`);
+  }
+};
+
 // ../mcp-server/src/server.ts
 var SERVER_NAME = "agentprism-workflow";
 var DEFAULT_REQUEST_STATE_CODEC = createRequestStateCodec({
@@ -34207,11 +34763,11 @@ var DEFAULT_REQUEST_STATE_CODEC = createRequestStateCodec({
   bind: (ctx) => ctx.mcpReq.method
 });
 var require2 = createRequire(import.meta.url);
-var SERVER_VERSION = true ? "0.37.1" : require2("../package.json").version;
+var SERVER_VERSION = true ? "0.38.2" : require2("../package.json").version;
 var SERVER_INSTRUCTIONS = [
   "This server exposes three model-facing tools for authoring and orchestrating multi-agent work. workflow and repl spawn subagents over the same ACP backends \u2014 the registry built-ins Claude, Codex, OpenCode, and pi, plus any registered custom agents \u2014 and key their durable state by an absolute projectDir (required on the shared daemon; defaults to the server's own project in single-project mode). Backend credentials come from each agent's own login (claude, codex, opencode, pi), so there is nothing auth-shaped to configure here.",
   '\u2022 docs \u2014 SELECTIVE VERSION-MATCHED REFERENCE. Omit topic or use topic:"index" for the bounded catalog, then read exactly one workflow/* or repl/* topic. It embeds the selected text/markdown resource, runs no code, opens no backend, and needs no projectDir. Use it when the compact tool descriptions do not contain enough syntax or lifecycle detail.',
-  '\u2022 workflow \u2014 DETERMINISTIC BATCH orchestration. Supply a JavaScript workflow script (inline or by absolute scriptPath) that fans out agent() subagents and optional checkpoint() gates; it runs to completion in the foreground, or background:true returns a durable runId for bounded action:"await"/"inspect"/"stop" calls, with journaling, replay, and resumeFromRunId. Reach for it when the orchestration is known up front and you want it repeatable and resumable. action:"config" discovers the live backend/model option catalog without starting a run, and every run is statically checked, mock-executed, and config-probed before admission. Read docs topic workflow/quickstart first when authoring is unfamiliar.',
+  '\u2022 workflow \u2014 DETERMINISTIC BATCH orchestration. Supply a JavaScript workflow script (inline or by absolute scriptPath) that fans out agent() subagents and optional checkpoint() gates; it runs to completion in the foreground, or background:true returns a durable runId for bounded action:"await"/"inspect"/"permissions-response"/"stop" calls, with journaling, replay, and resumeFromRunId. Await/inspect surface exact live ACP permission options when an agent needs external action. Reach for it when the orchestration is known up front and you want it repeatable and resumable. action:"config" discovers the live backend/model option catalog without starting a run, and every run is statically checked, mock-executed, and config-probed before admission. Read docs topic workflow/quickstart first when authoring is unfamiliar.',
   '\u2022 repl \u2014 INTERACTIVE STATEFUL orchestration. A persistent per-project JavaScript VM you drive incrementally with action:"eval"; named bindings, pending subagent calls, raised checkpoints, and `_` (the previous eval\'s completion value) persist between calls and survive daemon restarts. Console logging produces output text only and creates no persistent value. Reach for it when you want to inspect intermediate results and decide the next step adaptively, or keep a human in the loop via checkpoint(). Read docs topic repl/quickstart first when the persistent handle API is unfamiliar.',
   "Rule of thumb: use workflow when you can script the whole plan ahead of time; use repl when you want a live, stateful session that evolves call by call."
 ].join("\n\n");
@@ -34239,6 +34795,30 @@ function isTerminalStatus(status) {
 function isAlreadyTerminalForStop(status) {
   return status === "completed" || status === "failed" || status === "aborted";
 }
+function permissionInteraction(canElicit) {
+  return {
+    permissionRequests: "may-block",
+    collectWith: ["await", "inspect"],
+    respondWith: "permissions-response",
+    elicitation: canElicit ? "available" : "unavailable"
+  };
+}
+async function pendingPermissionsForRun(manager, runId, broker, router) {
+  if (manager.getRun(runId)) return broker.list(runId);
+  return router ? await router.listPermissions(manager, runId) : [];
+}
+async function respondToPermission(manager, input, broker, router) {
+  if (manager.getRun(input.runId) && broker.has(input.runId, input.permissionId)) {
+    return broker.respond(input.runId, input.permissionId, input.response);
+  }
+  if (!router) {
+    throw new ProtocolError(
+      ProtocolErrorCode.InvalidParams,
+      `Permission request "${input.permissionId}" is not pending in this server process.`
+    );
+  }
+  return await router.respondPermission(manager, input);
+}
 function readCheckpointDefault(options) {
   if (options && typeof options === "object" && "default" in options) {
     return options.default;
@@ -34324,6 +34904,55 @@ function createCheckpointElicitation(prompt, options) {
     }
   };
 }
+function createPermissionElicitation(permission) {
+  const tool = permission.request.toolCall;
+  const title = typeof tool.title === "string" && tool.title.trim() !== "" ? tool.title : `${tool.kind ?? "tool"} request`;
+  const optionLines = permission.request.options.map(
+    (option) => `- ${option.optionId}: ${option.name} (${option.kind})`
+  );
+  return {
+    mode: "form",
+    message: `Workflow agent ${permission.label ? JSON.stringify(permission.label) : `call ${permission.callIndex}`} on ${permission.backendId} requests permission for: ${title}
+
+${optionLines.join("\n")}
+
+Select one exact advertised option.`,
+    requestedSchema: {
+      type: "object",
+      properties: {
+        optionId: {
+          type: "string",
+          title: "Permission decision",
+          description: "Exact option advertised by the ACP backend.",
+          enum: permission.request.options.map((option) => option.optionId)
+        }
+      },
+      required: ["optionId"]
+    }
+  };
+}
+function formatPendingPermissions(permissions) {
+  if (permissions.length === 0) return "";
+  const lines = [
+    `${permissions.length} workflow permission request(s) require a response:`,
+    ...permissions.map((permission) => {
+      const title = permission.request.toolCall.title ?? permission.request.toolCall.kind ?? "tool request";
+      const options = permission.request.options.map((option) => option.optionId).join(", ");
+      return `- ${permission.permissionId} call ${permission.callIndex} (${permission.backendId}) ${title}; options: ${options}`;
+    }),
+    `Use action="permissions-response" with runId, permissionId, and an exact selected optionId or cancelled outcome.`
+  ];
+  return truncateUtf84(`
+${lines.join("\n")}`, 8192, "\u2026[permission summary truncated]");
+}
+function permissionResponseFromElicitation(permission, response) {
+  if (response.action !== "accept") return { outcome: { outcome: "cancelled" } };
+  const optionId = response.content?.optionId;
+  if (typeof optionId !== "string" || !permission.request.options.some((option) => option.optionId === optionId)) {
+    return { outcome: { outcome: "cancelled" } };
+  }
+  return { outcome: { outcome: "selected", optionId } };
+}
 function acceptedCheckpointReply(content, options, headlessReply) {
   const kind = readCheckpointKind(options);
   if (kind === "input") {
@@ -34445,6 +35074,19 @@ function parseWorkflowRequestState(value, inputHash) {
       pendingKey: state.pendingKey
     };
   }
+  if (state.flow === "permission") {
+    if (typeof state.runId !== "string" || !/^[a-z0-9]+-[a-z0-9]+$/.test(state.runId) || typeof state.permissionId !== "string" || !/^[0-9a-f-]{36}$/i.test(state.permissionId)) {
+      throw new ProtocolError(ProtocolErrorCode.InvalidParams, "Invalid workflow permission requestState");
+    }
+    return {
+      version: 1,
+      flow: "permission",
+      inputHash,
+      scriptHash: state.scriptHash,
+      runId: state.runId,
+      permissionId: state.permissionId
+    };
+  }
   if (state.flow === "checkpoint") {
     if (typeof state.runId !== "string" || !Number.isSafeInteger(state.callIndex) || state.callIndex < 0 || typeof state.checkpointHash !== "string" || !/^[0-9a-f]{64}$/.test(state.checkpointHash) || !Array.isArray(state.approvedKeys) || state.approvedKeys.length > 64 || !state.approvedKeys.every((key) => typeof key === "string" && /^[0-9a-f]{64}$/.test(key)) || state.expiresAt !== void 0 && (typeof state.expiresAt !== "number" || !Number.isFinite(state.expiresAt))) {
       throw new ProtocolError(ProtocolErrorCode.InvalidParams, "Invalid workflow checkpoint requestState");
@@ -34617,10 +35259,10 @@ function formatResumeSummary(eligibility, report) {
 function formatTerminalSummary(run) {
   const lines = [`Workflow run ${run.status}.`, `runId: ${run.runId}`];
   if (run.reason) {
-    lines.push(`reason: ${truncateUtf83(redactText2(run.reason).value, 512)}`);
+    lines.push(`reason: ${truncateUtf84(redactText3(run.reason).value, 512)}`);
   }
   if (run.resetHint) {
-    lines.push(`reset hint: ${truncateUtf83(redactText2(run.resetHint).value, 512)}`);
+    lines.push(`reset hint: ${truncateUtf84(redactText3(run.resetHint).value, 512)}`);
   }
   if (run.logTail) {
     lines.push(`recent run log (last ${run.logTail.lines.length} of ${run.logTail.totalLines}):`);
@@ -34652,7 +35294,7 @@ function formatTerminalSummary(run) {
       );
     }
   }
-  return truncateUtf83(lines.join("\n"), 12288, "\u2026[text truncated]");
+  return truncateUtf84(lines.join("\n"), 12288, "\u2026[text truncated]");
 }
 function formatRunSummary(run) {
   return run.status === "completed" ? formatCompletedSummary(run) : formatTerminalSummary(run);
@@ -34678,15 +35320,15 @@ function inspectionSummaryLines(status, options = {}) {
   return lines;
 }
 function formatInspectionSummary(status) {
-  return truncateUtf83(inspectionSummaryLines(status).join("\n"), 8192, "\u2026[text truncated]");
+  return truncateUtf84(inspectionSummaryLines(status).join("\n"), 8192, "\u2026[text truncated]");
 }
 var MAX_INSPECTION_STRUCTURED_BYTES = 24576;
 var MAX_INSPECTION_SCALAR_BYTES = 512;
 var MAX_INSPECTION_PHASES = 64;
 function retainedInspectionText(value) {
-  const redacted = redactText2(value);
+  const redacted = redactText3(value);
   return {
-    shortened: truncateUtf83(redacted.value, MAX_INSPECTION_SCALAR_BYTES) !== redacted.value,
+    shortened: truncateUtf84(redacted.value, MAX_INSPECTION_SCALAR_BYTES) !== redacted.value,
     redacted: redacted.redacted
   };
 }
@@ -34792,7 +35434,7 @@ function formatStopSummary(result) {
       "Agent-session cancellation may still be winding down; inspect the per-agent states only if backend cleanup appears hung."
     );
   }
-  return truncateUtf83(lines.join("\n"), 8192, "\u2026[text truncated]");
+  return truncateUtf84(lines.join("\n"), 8192, "\u2026[text truncated]");
 }
 function formatPendingStopSummary(result) {
   const lines = inspectionSummaryLines(result);
@@ -34803,7 +35445,7 @@ function formatPendingStopSummary(result) {
     `Stop request ${result.control.operationId} is durably pending; retry stop, inspect, or await to observe settlement.`,
     owner === void 0 ? "No live execution owner is currently discoverable; a later lease holder will apply the intent." : `Execution owner: daemon pid ${owner.pid}${owner.version ? ` v${owner.version}` : ""}${owner.lameDuck ? " (draining)" : ""}.`
   );
-  return truncateUtf83(lines.join("\n"), 8192, "\u2026[text truncated]");
+  return truncateUtf84(lines.join("\n"), 8192, "\u2026[text truncated]");
 }
 function formatAgentCancellationSummary(status, cancellation) {
   const lines = inspectionSummaryLines(status);
@@ -34812,7 +35454,7 @@ function formatAgentCancellationSummary(status, cancellation) {
     0,
     `Agent call ${cancellation.callIndex} ("${cancellation.label}") settled with AGENT_CANCELLED; the workflow run remains live.`
   );
-  return truncateUtf83(lines.join("\n"), 8192, "\u2026[text truncated]");
+  return truncateUtf84(lines.join("\n"), 8192, "\u2026[text truncated]");
 }
 function readScriptAtAdmission(scriptPath) {
   try {
@@ -34861,6 +35503,13 @@ async function settleForegroundRun(manager, started) {
     throw error51;
   }
 }
+async function settleForegroundRunOrPermission(manager, started, broker) {
+  if (broker.has(started.runId)) return { kind: "permission" };
+  return await Promise.race([
+    settleForegroundRun(manager, started).then((run) => ({ kind: "terminal", run })),
+    broker.waitForPending(started.runId).then(() => ({ kind: "permission" }))
+  ]);
+}
 function normalizeTokenUsage(usage) {
   if (!usage) return void 0;
   return {
@@ -34895,17 +35544,98 @@ function persistedOutcome(persisted, status) {
     ...persisted.checkpointsTaken === void 0 ? {} : { checkpointsTaken: persisted.checkpointsTaken },
     ...persisted.resumeReport === void 0 ? {} : { resumeReport: persisted.resumeReport },
     ...persisted.replayEligibility === void 0 ? {} : { replayEligibility: persisted.replayEligibility },
-    scriptUri: workflowScriptUri(persisted.runId)
+    scriptUri: workflowScriptUri(persisted.runId),
+    ...status.status === "completed" && persisted.result !== void 0 ? { resultUri: workflowResultUri(persisted.runId) } : {}
   };
 }
 function terminalOutcome(manager, runId, status) {
+  const persisted = manager.getPersistence().load(runId);
+  const resultUri = persisted?.status === "completed" && persisted.result !== void 0 ? workflowResultUri(runId) : void 0;
   const live = manager.getRun(runId)?.result;
   if (live) {
-    return toWorkflowExecutionOutcome(live, { scriptUri: workflowScriptUri(runId) });
+    return toWorkflowExecutionOutcome(live, {
+      scriptUri: workflowScriptUri(runId),
+      ...resultUri === void 0 ? {} : { resultUri }
+    });
   }
-  const persisted = manager.getPersistence().load(runId);
   return persisted ? persistedOutcome(persisted, status) : void 0;
 }
+var INLINE_WORKFLOW_RESULT_MAX_BYTES = 4096;
+function resultResourceFields(resources, runId) {
+  const resultUri = resources.availableResultUri(runId);
+  return resultUri === void 0 ? {} : { resultUri };
+}
+function resultContentBlocks(resources, runId, inline) {
+  const link = resources.resultLink(runId);
+  if (!link) return [];
+  const resultUri = link.uri;
+  if (inline) {
+    const result = resources.serializedResult(runId);
+    if (result.bytes <= INLINE_WORKFLOW_RESULT_MAX_BYTES) {
+      return [
+        {
+          type: "text",
+          text: `Workflow result (exact JSON):
+${result.text}`,
+          annotations: { audience: ["assistant"] }
+        },
+        link
+      ];
+    }
+    return [
+      {
+        type: "text",
+        text: `Exact workflow result: ${result.bytes} UTF-8 bytes at ${resultUri}. Read that resource directly, or call workflow with action="result", runId="${runId}", offset=0 and follow endOffset while hasMore is true for bounded exact chunks.`,
+        annotations: { audience: ["assistant"] }
+      },
+      link
+    ];
+  }
+  return [
+    {
+      type: "text",
+      text: `Exact workflow result: ${resultUri}. Read that resource directly, or call workflow with action="result", runId="${runId}", offset=0 and follow endOffset while hasMore is true for bounded exact chunks.`,
+      annotations: { audience: ["assistant"] }
+    },
+    link
+  ];
+}
+function isUtf8ContinuationByte(byte) {
+  return byte !== void 0 && (byte & 192) === 128;
+}
+function resultRetrievalPage(resources, runId, offset, maxBytes) {
+  const result = resources.serializedResult(runId);
+  const buffer = Buffer.from(result.text, "utf8");
+  if (offset > buffer.length) {
+    throw new ProtocolError(
+      ProtocolErrorCode.InvalidParams,
+      `Workflow result offset ${offset} exceeds totalBytes ${buffer.length} for runId "${runId}".`
+    );
+  }
+  if (offset < buffer.length && isUtf8ContinuationByte(buffer[offset])) {
+    throw new ProtocolError(
+      ProtocolErrorCode.InvalidParams,
+      `Workflow result offset ${offset} is not a UTF-8 boundary for runId "${runId}"; use the previous endOffset.`
+    );
+  }
+  let endOffset = Math.min(buffer.length, offset + maxBytes);
+  while (endOffset > offset && endOffset < buffer.length && isUtf8ContinuationByte(buffer[endOffset])) {
+    endOffset--;
+  }
+  return {
+    action: "result",
+    runId,
+    status: "completed",
+    resultUri: result.uri,
+    mimeType: RESULT_RESOURCE_MIME_TYPE,
+    encoding: "utf-8",
+    totalBytes: buffer.length,
+    offset,
+    endOffset,
+    hasMore: endOffset < buffer.length,
+    chunk: buffer.subarray(offset, endOffset).toString("utf8")
+  };
+}
 var AWAIT_CANCELLED = /* @__PURE__ */ Symbol("await-cancelled");
 var AWAIT_UNKNOWN_RUN = /* @__PURE__ */ Symbol("await-unknown-run");
 var EVENT_LOG_POLL_FALLBACK_CODES = /* @__PURE__ */ new Set([
@@ -34923,15 +35653,18 @@ var EVENT_LOG_POLL_FALLBACK_CODES = /* @__PURE__ */ new Set([
 ]);
 var EVENT_LOG_UNKNOWN_RUN_CODES = /* @__PURE__ */ new Set(["RUN_NOT_FOUND", "ORPHANED_LOG"]);
 var TERMINAL_RUN_EVENT_TYPES = /* @__PURE__ */ new Set(["complete", "paused", "error", "stopped"]);
-async function waitForTerminal(manager, runId, waitMs, signal, localPromise, progress) {
+async function waitForTerminal(manager, runId, waitMs, signal, localPromise, progress, permissionWait, permissionProbe) {
   return await new Promise((resolve, reject) => {
     let timer;
     let poller;
+    let permissionPoller;
+    let permissionProbeActive = false;
     let stream;
     let done = false;
     const cleanup = () => {
       if (timer) clearTimeout(timer);
       if (poller) clearInterval(poller);
+      if (permissionPoller) clearInterval(permissionPoller);
       stream?.close();
       signal.removeEventListener("abort", cancelled);
     };
@@ -34984,6 +35717,23 @@ async function waitForTerminal(manager, runId, waitMs, signal, localPromise, pro
         () => finish("settled")
       );
     }
+    if (permissionWait) {
+      void permissionWait.then(() => finish("action-required"), () => void 0);
+    }
+    if (permissionProbe) {
+      const probe = async () => {
+        if (done || permissionProbeActive) return;
+        permissionProbeActive = true;
+        try {
+          if (await permissionProbe()) finish("action-required");
+        } catch {
+        } finally {
+          permissionProbeActive = false;
+        }
+      };
+      permissionPoller = setInterval(() => void probe(), 1e3);
+      void probe();
+    }
     try {
       const persistence = manager.getPersistence();
       const snapshot = persistence.load(runId);
@@ -35060,7 +35810,7 @@ function formatAwaitSummary(result) {
     }
   }
   lines.push(...diagnostics);
-  return truncateUtf83(lines.join("\n"), 8192, "\u2026[text truncated]");
+  return truncateUtf84(lines.join("\n"), 8192, "\u2026[text truncated]");
 }
 function replEvalTimeoutMs() {
   const env = process.env.AGENTPRISM_REPL_EVAL_TIMEOUT_MS;
@@ -35072,6 +35822,7 @@ function replEvalTimeoutMs() {
 }
 function createWorkflowServer(runner, options = {}) {
   const requestStateCodec = options.requestStateCodec ?? DEFAULT_REQUEST_STATE_CODEC;
+  const permissionBroker = options.permissionBroker ?? new WorkflowPermissionBroker();
   const mcp = new McpServer(
     { name: SERVER_NAME, version: SERVER_VERSION },
     {
@@ -35112,7 +35863,7 @@ function createWorkflowServer(runner, options = {}) {
   const backendApprovals = /* @__PURE__ */ new Set();
   const replPresence = options.replPresence ?? new ReplPresenceLedger(options.replDrainBoundMs ?? REPL_DRAIN_BOUND_MS);
   const resolveContext2 = (input) => {
-    if (input.action === "inspect" || input.action === "await" || input.action === "stop") {
+    if (input.action === "inspect" || input.action === "await" || input.action === "stop" || input.action === "permissions-response") {
       return projects.storeFor(input.runId) ?? defaultContext;
     }
     if (input.projectDir !== void 0) {
@@ -35140,8 +35891,8 @@ function createWorkflowServer(runner, options = {}) {
   const workflowToolInputSchema = external_exports.object(workflowToolInputShape);
   const workflowToolOutputSchema = workflowToolOutputShape;
   const workflowToolConfig = {
-    title: "Discover, validate, run, inspect, await, stop, or narrow-cancel an agent workflow",
-    description: 'Author and operate JavaScript agent workflows through one project-scoped tool. A script\'s first statement must be `export const meta = { name, description, phases? }`. When present, phases must be an array of objects shaped `{ title: string, detail?: string, model?: string }`, never an array of strings. Inside the deterministic script realm use agent(prompt, options?) for one subagent; parallel([thunks]) for a barrier; pipeline(items, ...stages) for streaming stages; checkpoint(prompt, options?) for a human gate; phase(title) and log(message) for progress; and return the final JSON-serializable value. Top-level await is supported. Imports, require, network APIs, Date.now(), and Math.random() are unavailable. Always label agent calls; schema is a plain JSON Schema object for structured results. The only agent option keys are label, phase, model, tier, mode, configOptions, schema, cwd, timeoutMs, idleTimeoutMs, retries, isolation:"worktree", resume, agentType, mcpServers, images, meta, promptMeta, and keepSession; unknown keys reject before admission. Every parallel entry must be a thunk: parallel([() => agent(...), () => agent(...)]). For deeper syntax, read docs topic workflow/quickstart and then one related workflow/* topic. Minimal script: `export const meta = { name: "review", description: "Review a target", phases: [{ title: "Review" }] }; phase("Review"); const report = await agent("Review " + args.target, { label: "review" }); return { report };`. Omit model for the server default (explicit AGENTPRISM_DEFAULT_BACKEND, else a zero-token auto-selected project pin), or use a backend name alone to preserve that backend\'s configured default. Before choosing a pinned model, mode, or configOptions, call action:"config" with projectDir and optional harnesses/modelFilter; after choosing a model, pass modelSpecs to read its model-specific options. Set mode only when that selected harness entry\'s modes.availableModes explicitly lists the exact id; modes:null means unsupported, so omit mode\u2014never infer a default from an absent value. Config opens no-prompt sessions, spends zero tokens, and starts no workflow. action:"run" automatically performs static validation, a mocked dry run, and routed config checks before admission. Invalid scripts return bounded diagnostics with status:"rejected" and create no run ID, reserve no background slot, and spend no tokens. Run, resume, inspect, await, or stop an admitted workflow through the same tool. The script orchestrates agent() subagents (and optional checkpoint() gates) over registry built-ins\u2014currently Claude, Codex, OpenCode, and pi\u2014ACP backends, plus registered custom agents. Supply exactly one of inline script or absolute scriptPath; path content is read once and snapshotted at admission. ' + (requireProjectDir ? "config and run REQUIRE projectDir (absolute): it is the discovery cwd and selects the project-scoped run store/default execution cwd. " : "run optionally takes projectDir (absolute) to select the project-scoped run store; default is this server's own project. ") + `inspect/await/stop locate the project store from runId and never accept projectDir. Foreground is the default and streams progress; background:true returns a durable runId for bounded action:"await" calls. run and await honor _meta.progressToken with notifications/progress while they block. Pass resumeFromRunId to execute a new run from a prior journal prefix. In hosts that render MCP Apps, every call of this tool shows a live self-updating run-monitor panel and the panel reports phase starts, pauses, and terminal outcomes on its own \u2014 do NOT poll action:"inspect" to check on a run there; prefer a single bounded action:"await". Use action:"inspect" with a runId when you need machine-readable status data: a safe bounded status, log tail, and attributed call previews. Use action:"stop" to durably abort through the run's execution owner; cross-generation control may return a durable pending operationId before final settlement. Add callIndex to cancel only that live agent and keep the run live. forceOwner explicitly authorizes terminating a superseded owner and is forbidden with callIndex. labelGlob remains an output filter. A final whole-run stop makes resume safe immediately; pending control must be retried or observed with inspect/await. Every admitted script is readable at workflow://runs/{runId}/script and results include resource links. Background runs are tracked per project, capped at four active/starting runs, and use headless checkpoint semantics; checkpointReplies continue a checkpoint pause in a new run.`,
+    title: "Discover, validate, run, inspect, await, answer permissions, stop, or narrow-cancel a workflow",
+    description: 'Author and operate JavaScript agent workflows through one project-scoped tool. A script\'s first statement must be `export const meta = { name, description, phases? }`. When present, phases must be an array of objects shaped `{ title: string, detail?: string, model?: string }`, never an array of strings. Inside the deterministic script realm use agent(prompt, options?) for one subagent; parallel([thunks]) for a barrier; pipeline(items, ...stages) for streaming stages; checkpoint(prompt, options?) for a human gate; phase(title) and log(message) for progress; and return the final JSON-serializable value. Top-level await is supported. Imports, require, network APIs, Date.now(), and Math.random() are unavailable. Always label agent calls; schema is a plain JSON Schema object for structured results. The only agent option keys are label, phase, model, tier, mode, configOptions, schema, cwd, timeoutMs, idleTimeoutMs, retries, isolation:"worktree", resume, agentType, mcpServers, images, meta, promptMeta, and keepSession; unknown keys reject before admission. Every parallel entry must be a thunk: parallel([() => agent(...), () => agent(...)]). For deeper syntax, read docs topic workflow/quickstart and then one related workflow/* topic. Minimal script: `export const meta = { name: "review", description: "Review a target", phases: [{ title: "Review" }] }; phase("Review"); const report = await agent("Review " + args.target, { label: "review" }); return { report };`. Omit model for the server default (explicit AGENTPRISM_DEFAULT_BACKEND, else a zero-token auto-selected project pin), or use a backend name alone to preserve that backend\'s configured default. Before choosing a pinned model, mode, or configOptions, call action:"config" with projectDir and optional harnesses/modelFilter; after choosing a model, pass modelSpecs to read its model-specific options. Config returns every harness-advertised mode name, description, and metadata plus AgentPrism\'s omitted-mode default: Claude auto, Codex agent, OpenCode build, and no Pi mode. Pin only exact advertised ids. Config opens no-prompt sessions, spends zero tokens, and starts no workflow. action:"run" automatically performs static validation, a mocked dry run, and routed config checks before admission. Invalid scripts return bounded diagnostics with status:"rejected" and create no run ID, reserve no background slot, and spend no tokens. Run, resume, inspect, await, retrieve an exact completed result, answer a live ACP permission, or stop an admitted workflow through the same tool. The script orchestrates agent() subagents (and optional checkpoint() gates) over registry built-ins\u2014currently Claude, Codex, OpenCode, and pi\u2014ACP backends, plus registered custom agents. Supply exactly one of inline script or absolute scriptPath; path content is read once and snapshotted at admission. ' + (requireProjectDir ? "config and run REQUIRE projectDir (absolute): it is the discovery cwd and selects the project-scoped run store/default execution cwd. " : "run optionally takes projectDir (absolute) to select the project-scoped run store; default is this server's own project. ") + `inspect/await/result/stop/permissions-response locate the project store from runId and never accept projectDir. Foreground is the default and streams progress; background:true returns a durable runId for bounded action:"await" calls. run and await honor _meta.progressToken with notifications/progress while they block. Pass resumeFromRunId to execute a new run from a prior journal prefix. In hosts that render MCP Apps, every call of this tool shows a live self-updating run-monitor panel and the panel reports phase starts, pauses, and terminal outcomes on its own \u2014 do NOT poll action:"inspect" to check on a run there; prefer a single bounded action:"await". Use action:"inspect" with a runId when you need machine-readable status data: a safe bounded status, log tail, attributed call previews, and pending ACP permissions. Await returns early with action-required when one appears. Elicitation-capable hosts can present the exact backend options; otherwise use action:"permissions-response" with the returned permissionId and an exact advertised optionId or cancelled outcome. Use action:"stop" to durably abort through the run's execution owner; cross-generation control may return a durable pending operationId before final settlement. Add callIndex to cancel only that live agent and keep the run live. forceOwner explicitly authorizes terminating a superseded owner and is forbidden with callIndex. labelGlob remains an output filter. A final whole-run stop makes resume safe immediately; pending control must be retried or observed with inspect/await. Every admitted script is readable at workflow://runs/{runId}/script. Completed JSON results are readable at workflow://runs/{runId}/result; small results are also copied into text for content-first hosts, while large results can be paged exactly with action:"result", offset, and maxBytes. Result and script resource links are labelled separately. Background runs are tracked per project, capped at four active/starting runs, and use headless checkpoint semantics; checkpointReplies continue a checkpoint pause in a new run.`,
     inputSchema: workflowToolInputSchema,
     outputSchema: workflowToolOutputSchema,
     annotations: void 0
@@ -35158,7 +35909,7 @@ function createWorkflowServer(runner, options = {}) {
     let parsedInput = parseWorkflowToolInput(args, { requireProjectDir });
     const approvedBackendKeys = /* @__PURE__ */ new Set();
     let declinedBackendKey;
-    if (requestState !== void 0) {
+    if (requestState !== void 0 && "approvedKeys" in requestState) {
       for (const key of requestState.approvedKeys) approvedBackendKeys.add(key);
     }
     if (requestState?.flow === "backend-approval") {
@@ -35231,6 +35982,86 @@ function createWorkflowServer(runner, options = {}) {
     replPresence.touch(context.repl, options.replClientId?.() ?? "unknown");
     const manager = context.manager;
     const backgroundRuns = context.backgroundRuns;
+    if (requestState?.flow === "permission") {
+      if (parsedInput.action !== "inspect" && parsedInput.action !== "await" || parsedInput.runId !== requestState.runId) {
+        throw new ProtocolError(
+          ProtocolErrorCode.InvalidParams,
+          "Invalid workflow permission retry: the original inspect/await arguments must be replayed unchanged"
+        );
+      }
+      const pending = await pendingPermissionsForRun(
+        manager,
+        requestState.runId,
+        permissionBroker,
+        options.runControl
+      );
+      const permission = pending.find((entry) => entry.permissionId === requestState.permissionId);
+      if (!permission) {
+        throw new ProtocolError(
+          ProtocolErrorCode.InvalidParams,
+          `Permission request "${requestState.permissionId}" is no longer pending for run "${requestState.runId}"`
+        );
+      }
+      const input2 = inputResponse(ctx.mcpReq.inputResponses, "permission");
+      if (input2.kind !== "elicit") {
+        return inputRequired({
+          inputRequests: { permission: inputRequired.elicit(createPermissionElicitation(permission)) },
+          requestState: await requestStateCodec.mint(requestState, ctx)
+        });
+      }
+      const response = permissionResponseFromElicitation(permission, input2);
+      const acknowledgement = await respondToPermission(
+        manager,
+        { runId: requestState.runId, permissionId: requestState.permissionId, response },
+        permissionBroker,
+        options.runControl
+      );
+      const status = manager.inspectRun(requestState.runId, {
+        lastN: parsedInput.lastN,
+        labelGlob: parsedInput.labelGlob,
+        logLines: parsedInput.logLines
+      });
+      if (!status) {
+        throw new ProtocolError(
+          ProtocolErrorCode.InvalidParams,
+          `No workflow run found for runId "${requestState.runId}" after its permission response.`
+        );
+      }
+      const lineage = scriptResources.lineage(requestState.runId);
+      const remaining = await pendingPermissionsForRun(
+        manager,
+        requestState.runId,
+        permissionBroker,
+        options.runControl
+      );
+      const projected = addInspectionResourceFields(
+        status,
+        {
+          scriptUri: workflowScriptUri(requestState.runId),
+          ...resultResourceFields(scriptResources, requestState.runId),
+          lineage,
+          pendingPermissions: remaining
+        },
+        inspectionRetentionMetadata(manager, requestState.runId, status)
+      );
+      return {
+        structuredContent: {
+          ...projected,
+          permissionResponse: acknowledgement
+        },
+        content: [
+          {
+            type: "text",
+            text: `Permission ${acknowledgement.permissionId} resolved for workflow run ${requestState.runId}.
+${formatInspectionSummary(projected)}`,
+            annotations: { audience: ["assistant"] }
+          },
+          ...resultContentBlocks(scriptResources, requestState.runId, false),
+          ...scriptResources.links(lineage)
+        ],
+        isError: false
+      };
+    }
     if (requestState?.flow === "checkpoint") {
       if (parsedInput.action !== void 0 && parsedInput.action !== "run" || parsedInput.background || parsedInput.resumeFromRunId !== void 0 || parsedInput.checkpointReplies !== void 0) {
         throw new ProtocolError(
@@ -35301,7 +36132,137 @@ function createWorkflowServer(runner, options = {}) {
         }
       }
     }
+    if (parsedInput.action === "result") {
+      try {
+        const page = resultRetrievalPage(
+          scriptResources,
+          parsedInput.runId,
+          parsedInput.offset ?? 0,
+          parsedInput.maxBytes ?? WORKFLOW_RESULT_CHUNK_BYTES_DEFAULT
+        );
+        const resultLink = scriptResources.resultLink(parsedInput.runId);
+        return {
+          structuredContent: { ...page },
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify(page),
+              annotations: { audience: ["assistant"] }
+            },
+            ...resultLink === void 0 ? [] : [resultLink]
+          ],
+          isError: false
+        };
+      } catch (error51) {
+        if (!(error51 instanceof ProtocolError)) throw error51;
+        return {
+          content: [{ type: "text", text: error51.message }],
+          isError: true
+        };
+      }
+    }
+    if (parsedInput.action === "permissions-response") {
+      const acknowledgement = await respondToPermission(
+        manager,
+        {
+          runId: parsedInput.runId,
+          permissionId: parsedInput.permissionId,
+          response: parsedInput.response
+        },
+        permissionBroker,
+        options.runControl
+      );
+      const status = manager.inspectRun(parsedInput.runId, { lastN: 20, logLines: 20 });
+      if (!status) {
+        throw new ProtocolError(
+          ProtocolErrorCode.InvalidParams,
+          `No workflow run found for runId "${parsedInput.runId}" after its permission response.`
+        );
+      }
+      const lineage = scriptResources.lineage(parsedInput.runId);
+      const pendingPermissions = await pendingPermissionsForRun(
+        manager,
+        parsedInput.runId,
+        permissionBroker,
+        options.runControl
+      );
+      const projected = addInspectionResourceFields(
+        status,
+        {
+          scriptUri: workflowScriptUri(parsedInput.runId),
+          ...resultResourceFields(scriptResources, parsedInput.runId),
+          lineage,
+          pendingPermissions
+        },
+        inspectionRetentionMetadata(manager, parsedInput.runId, status)
+      );
+      return {
+        structuredContent: {
+          ...projected,
+          permissionResponse: acknowledgement
+        },
+        content: [
+          {
+            type: "text",
+            text: `Permission ${acknowledgement.permissionId} resolved for workflow run ${parsedInput.runId}.
+` + formatInspectionSummary(projected) + formatPendingPermissions(pendingPermissions),
+            annotations: { audience: ["assistant"] }
+          },
+          ...resultContentBlocks(scriptResources, parsedInput.runId, false),
+          ...scriptResources.links(lineage)
+        ],
+        isError: false
+      };
+    }
     if (parsedInput.action === "inspect") {
+      let pendingPermissions = await pendingPermissionsForRun(
+        manager,
+        parsedInput.runId,
+        permissionBroker,
+        options.runControl
+      );
+      let acknowledgement;
+      const canElicitPermission = Boolean(toolCatalog.clientCapabilities(ctx)?.elicitation);
+      if (pendingPermissions.length > 0 && canElicitPermission) {
+        const permission = pendingPermissions[0];
+        if (options.protocolEra === "modern") {
+          const state = {
+            version: 1,
+            flow: "permission",
+            inputHash,
+            scriptHash: workflowScriptHash(parsedInput.runId),
+            runId: parsedInput.runId,
+            permissionId: permission.permissionId
+          };
+          return inputRequired({
+            inputRequests: { permission: inputRequired.elicit(createPermissionElicitation(permission)) },
+            requestState: await requestStateCodec.mint(state, ctx)
+          });
+        }
+        try {
+          await primeCancellableServerRequestId(mcp.server);
+          const elicited = await mcp.server.elicitInput(createPermissionElicitation(permission), {
+            signal: ctx.mcpReq.signal
+          });
+          acknowledgement = await respondToPermission(
+            manager,
+            {
+              runId: parsedInput.runId,
+              permissionId: permission.permissionId,
+              response: permissionResponseFromElicitation(permission, elicited)
+            },
+            permissionBroker,
+            options.runControl
+          );
+          pendingPermissions = await pendingPermissionsForRun(
+            manager,
+            parsedInput.runId,
+            permissionBroker,
+            options.runControl
+          );
+        } catch {
+        }
+      }
       const status = manager.inspectRun(parsedInput.runId, {
         lastN: parsedInput.lastN,
         labelGlob: parsedInput.labelGlob,
@@ -35323,20 +36284,28 @@ function createWorkflowServer(runner, options = {}) {
         status,
         {
           scriptUri: workflowScriptUri(parsedInput.runId),
-          lineage
+          ...resultResourceFields(scriptResources, parsedInput.runId),
+          lineage,
+          pendingPermissions,
+          interaction: permissionInteraction(canElicitPermission)
         },
         inspectionRetentionMetadata(manager, parsedInput.runId, status)
       );
       return {
-        structuredContent: { ...projected },
+        structuredContent: {
+          ...projected,
+          ...acknowledgement === void 0 ? {} : { permissionResponse: acknowledgement }
+        },
         content: [
           // Status summaries are model input, not user-facing chat content (the run-monitor
           // panel is the user's live view) — the audience annotation says so per MCP core.
           {
             type: "text",
-            text: formatInspectionSummary(projected),
+            text: formatInspectionSummary(projected) + (acknowledgement ? `
+Permission ${acknowledgement.permissionId} resolved.` : "") + formatPendingPermissions(pendingPermissions),
             annotations: { audience: ["assistant"] }
           },
+          ...resultContentBlocks(scriptResources, parsedInput.runId, false),
           ...scriptResources.links(lineage)
         ],
         isError: false
@@ -35538,6 +36507,7 @@ function createWorkflowServer(runner, options = {}) {
         status,
         {
           scriptUri: workflowScriptUri(parsedInput.runId),
+          ...resultResourceFields(scriptResources, parsedInput.runId),
           lineage,
           stopped,
           alreadyTerminal
@@ -35548,7 +36518,11 @@ function createWorkflowServer(runner, options = {}) {
       const currentLink = scriptResources.links(lineage).filter((link) => link.uri === workflowScriptUri(parsedInput.runId));
       return {
         structuredContent: { ...result },
-        content: [{ type: "text", text: formatStopSummary(result) }, ...currentLink],
+        content: [
+          { type: "text", text: formatStopSummary(result) },
+          ...resultContentBlocks(scriptResources, parsedInput.runId, false),
+          ...currentLink
+        ],
         isError: false
       };
     }
@@ -35585,19 +36559,30 @@ function createWorkflowServer(runner, options = {}) {
           isError: true
         };
       }
+      let pendingPermissions = manager.getRun(parsedInput.runId) ? permissionBroker.list(parsedInput.runId) : await pendingPermissionsForRun(
+        manager,
+        parsedInput.runId,
+        permissionBroker,
+        options.runControl
+      );
       let returnedBecause;
       if (isTerminalStatus(status.status)) {
         returnedBecause = "terminal";
+      } else if (pendingPermissions.length > 0) {
+        returnedBecause = "action-required";
       } else if (parsedInput.waitMs === 0) {
         returnedBecause = "immediate";
       } else {
+        const local = manager.getRun(parsedInput.runId) !== void 0;
         const waited = await waitForTerminal(
           manager,
           parsedInput.runId,
           parsedInput.waitMs ?? 2e4,
           ctx.mcpReq.signal,
           backgroundRuns.get(parsedInput.runId),
-          createAwaitProgressReporter(ctx)
+          createAwaitProgressReporter(ctx),
+          local ? permissionBroker.waitForPending(parsedInput.runId) : void 0,
+          !local && options.runControl ? async () => (await options.runControl.listPermissions(manager, parsedInput.runId)).length > 0 : void 0
         );
         if (waited === AWAIT_CANCELLED) {
           return {
@@ -35621,6 +36606,12 @@ function createWorkflowServer(runner, options = {}) {
             isError: true
           };
         }
+        pendingPermissions = await pendingPermissionsForRun(
+          manager,
+          parsedInput.runId,
+          permissionBroker,
+          options.runControl
+        );
         status = manager.inspectRun(parsedInput.runId, inspectionOptions);
         if (!status) {
           return {
@@ -35633,7 +36624,49 @@ function createWorkflowServer(runner, options = {}) {
             isError: true
           };
         }
-        returnedBecause = isTerminalStatus(status.status) ? "terminal" : "timeout";
+        returnedBecause = isTerminalStatus(status.status) ? "terminal" : waited === "action-required" || pendingPermissions.length > 0 ? "action-required" : "timeout";
+      }
+      const canElicitPermission = Boolean(toolCatalog.clientCapabilities(ctx)?.elicitation);
+      if (pendingPermissions.length > 0 && canElicitPermission) {
+        const permission = pendingPermissions[0];
+        if (options.protocolEra === "modern") {
+          const state = {
+            version: 1,
+            flow: "permission",
+            inputHash,
+            scriptHash: workflowScriptHash(parsedInput.runId),
+            runId: parsedInput.runId,
+            permissionId: permission.permissionId
+          };
+          return inputRequired({
+            inputRequests: { permission: inputRequired.elicit(createPermissionElicitation(permission)) },
+            requestState: await requestStateCodec.mint(state, ctx)
+          });
+        }
+        try {
+          await primeCancellableServerRequestId(mcp.server);
+          const elicited = await mcp.server.elicitInput(createPermissionElicitation(permission), {
+            signal: ctx.mcpReq.signal
+          });
+          await respondToPermission(
+            manager,
+            {
+              runId: parsedInput.runId,
+              permissionId: permission.permissionId,
+              response: permissionResponseFromElicitation(permission, elicited)
+            },
+            permissionBroker,
+            options.runControl
+          );
+          pendingPermissions = await pendingPermissionsForRun(
+            manager,
+            parsedInput.runId,
+            permissionBroker,
+            options.runControl
+          );
+          returnedBecause = "permission-resolved";
+        } catch {
+        }
       }
       const tokenUsage = currentTokenUsage(manager, parsedInput.runId);
       const baseOutcome = isTerminalStatus(status.status) ? terminalOutcome(manager, parsedInput.runId, status) : void 0;
@@ -35649,7 +36682,10 @@ function createWorkflowServer(runner, options = {}) {
         {
           wait,
           ...tokenUsage === void 0 ? {} : { tokenUsage },
+          pendingPermissions,
+          interaction: permissionInteraction(canElicitPermission),
           scriptUri: workflowScriptUri(parsedInput.runId),
+          ...resultResourceFields(scriptResources, parsedInput.runId),
           lineage
         },
         inspectionRetentionMetadata(manager, parsedInput.runId, status)
@@ -35664,9 +36700,10 @@ function createWorkflowServer(runner, options = {}) {
           // Same audience hint as inspect: the await summary is for the model.
           {
             type: "text",
-            text: formatAwaitSummary(result),
+            text: formatAwaitSummary(result) + formatPendingPermissions(pendingPermissions),
             annotations: { audience: ["assistant"] }
           },
+          ...resultContentBlocks(scriptResources, parsedInput.runId, true),
           ...scriptResources.links(lineage)
         ],
         isError: false
@@ -35766,7 +36803,7 @@ function createWorkflowServer(runner, options = {}) {
             } catch (error51) {
               if (error51 instanceof NoAutoDefaultBackendError) {
                 return {
-                  content: [{ type: "text", text: truncateUtf83(error51.message, 8192, "\u2026[backend diagnostics truncated]") }],
+                  content: [{ type: "text", text: truncateUtf84(error51.message, 8192, "\u2026[backend diagnostics truncated]") }],
                   isError: true
                 };
               }
@@ -35802,7 +36839,7 @@ function createWorkflowServer(runner, options = {}) {
         if (admissionWarnings.length > lines.length) {
           lines.push(`- \u2026 ${admissionWarnings.length - lines.length} more warning(s) omitted`);
         }
-        preflightWarningText = truncateUtf83(
+        preflightWarningText = truncateUtf84(
           `
 Preflight warnings (the run was admitted):
 ${lines.join("\n")}`,
@@ -35843,15 +36880,15 @@ ${lines.join("\n")}`,
         let lastActivitySeq = 0;
         exec.signal = ctx.mcpReq.signal;
         exec.onProgress = (snapshot) => {
-          const settled = snapshot.agents.filter(
+          const settled2 = snapshot.agents.filter(
             (a) => a.status === "done" || a.status === "error" || a.status === "skipped"
           ).length;
           const activity = snapshot.latestActivity;
           if (activity && activity.seq > lastActivitySeq) {
             lastActivitySeq = activity.seq;
-            reporter(settled, snapshot.agents.length || void 0, formatAgentProgressMessage(activity.progress));
+            reporter(settled2, snapshot.agents.length || void 0, formatAgentProgressMessage(activity.progress));
           } else {
-            reporter(settled, snapshot.agents.length || void 0, snapshot.currentPhase);
+            reporter(settled2, snapshot.agents.length || void 0, snapshot.currentPhase);
           }
         };
         const canElicit = Boolean(toolCatalog.clientCapabilities(ctx)?.elicitation);
@@ -35895,7 +36932,9 @@ ${lines.join("\n")}`,
             scriptSource,
             scriptUri: scriptUri2,
             limits: admittedRun.limits,
-            ...admittedRun.replayEligibility === void 0 ? {} : { replayEligibility: admittedRun.replayEligibility }
+            ...admittedRun.replayEligibility === void 0 ? {} : { replayEligibility: admittedRun.replayEligibility },
+            pendingPermissions: permissionBroker.list(started2.runId),
+            interaction: permissionInteraction(Boolean(toolCatalog.clientCapabilities(ctx)?.elicitation))
           },
           content: [
             {
@@ -35904,7 +36943,7 @@ ${lines.join("\n")}`,
 runId: ${started2.runId}
 ` + (preflightWarningText ? `${preflightWarningText.trimStart()}
 ` : "") + (admittedRun.replayEligibility ? `${formatResumeSummary(admittedRun.replayEligibility)}
-` : "") + `Call workflow with action="await" and this runId to wait for its result, or action="inspect" for an immediate status snapshot. If a live run-monitor panel is shown for this run, it self-updates and reports phase starts, pauses, and terminal outcomes \u2014 do not poll inspect for status.`
+` : "") + `Call workflow with action="await" and this runId to wait for its result, or action="inspect" for an immediate status snapshot. Either action returns early when an ACP permission needs a response; use the elicitation shown by capable clients or action="permissions-response" with an exact advertised option. If a live run-monitor panel is shown for this run, it self-updates and reports phase starts, pauses, and terminal outcomes \u2014 do not poll inspect for status.`
             },
             ...links
           ],
@@ -35925,7 +36964,41 @@ runId: ${started2.runId}
         }
       );
       executionLatch.admit();
-      const run = await settleForegroundRun(manager, started);
+      const settled = await settleForegroundRunOrPermission(manager, started, permissionBroker);
+      if (settled.kind === "permission") {
+        const admittedRun = manager.getRun(started.runId);
+        if (!admittedRun?.limits) {
+          throw new ProtocolError(ProtocolErrorCode.InternalError, "Workflow permission wait lost its live run limits");
+        }
+        backgroundRuns.track(started.runId, started.promise);
+        const pendingPermissions = permissionBroker.list(started.runId);
+        const scriptUri2 = workflowScriptUri(started.runId);
+        const canElicitPermission = Boolean(toolCatalog.clientCapabilities(ctx)?.elicitation);
+        return {
+          structuredContent: {
+            runId: started.runId,
+            status: "running",
+            scriptSource,
+            scriptUri: scriptUri2,
+            limits: admittedRun.limits,
+            pendingPermissions,
+            interaction: permissionInteraction(canElicitPermission),
+            ...admittedRun.replayEligibility === void 0 ? {} : { replayEligibility: admittedRun.replayEligibility }
+          },
+          content: [
+            {
+              type: "text",
+              text: `Workflow "${admittedRun.snapshot.name}" is still running but requires a permission response.
+runId: ${started.runId}
+` + formatPendingPermissions(pendingPermissions).trimStart() + `
+Call workflow with action="await" or action="inspect"; elicitation-capable clients will present the pending choice, and other clients can use action="permissions-response".`
+            },
+            ...scriptResources.links([{ runId: started.runId, uri: scriptUri2, available: true }])
+          ],
+          isError: false
+        };
+      }
+      const run = settled.run;
       if (options.protocolEra === "modern" && toolCatalog.clientCapabilities(ctx)?.elicitation && run.status === "paused" && run.reason === "checkpoint_required" && run.checkpointContext !== void 0) {
         const checkpoint = run.checkpointContext;
         const elicitation = createCheckpointElicitation(checkpoint.prompt, checkpoint);
@@ -35950,14 +37023,16 @@ runId: ${started2.runId}
         });
       }
       const scriptUri = workflowScriptUri(run.runId);
+      const resultFields = resultResourceFields(scriptResources, run.runId);
       const structuredContent = {
-        ...toWorkflowToolResult(run, { scriptSource, scriptUri })
+        ...toWorkflowToolResult(run, { scriptSource, scriptUri, ...resultFields })
       };
       const isError = run.status === "failed" || run.status === "aborted";
       return {
         structuredContent: { ...structuredContent },
         content: [
           { type: "text", text: `${formatRunSummary(run)}${preflightWarningText}` },
+          ...resultContentBlocks(scriptResources, run.runId, true),
           ...scriptResources.links([{ runId: run.runId, uri: scriptUri, available: true }])
         ],
         isError
@@ -36010,7 +37085,7 @@ import { dirname as dirname2 } from "node:path";
 import { spawn } from "node:child_process";
 
 // ../mcp-server/src/daemon/daemon-info.ts
-import { randomUUID as randomUUID2 } from "node:crypto";
+import { randomUUID as randomUUID3 } from "node:crypto";
 import { createHash as createHash2 } from "node:crypto";
 import {
   chmodSync as chmodSync2,
@@ -36083,7 +37158,7 @@ function readDaemonInstance(pid) {
 }
 function writeInfoFile(path, info) {
   mkdirSync2(dirname(path), { recursive: true });
-  const tmp = `${path}.${info.pid}.${randomUUID2().slice(0, 8)}.tmp`;
+  const tmp = `${path}.${info.pid}.${randomUUID3().slice(0, 8)}.tmp`;
   writeFileSync2(tmp, `${JSON.stringify(info, null, 2)}
 `, { mode: 384 });
   chmodSync2(tmp, 384);
@@ -36170,7 +37245,7 @@ function compareVersions(a, b) {
 function claimSpawnLock(fingerprint = envFingerprint()) {
   const path = daemonLockPath(fingerprint);
   mkdirSync2(dirname(path), { recursive: true });
-  const lock = { pid: process.pid, startedAt: (/* @__PURE__ */ new Date()).toISOString(), token: randomUUID2() };
+  const lock = { pid: process.pid, startedAt: (/* @__PURE__ */ new Date()).toISOString(), token: randomUUID3() };
   for (let attempt = 0; attempt < 2; attempt++) {
     try {
       writeFileSync2(path, JSON.stringify(lock), { flag: "wx", mode: 384 });
@@ -36320,7 +37395,7 @@ async function ensureDaemonRunning(options) {
 }
 
 // ../mcp-server/src/daemon/run-daemon.ts
-import { randomUUID as randomUUID5 } from "node:crypto";
+import { randomUUID as randomUUID6 } from "node:crypto";
 import { createAcpRunner } from "@automatalabs/workflows";
 
 // ../mcp-server/src/daemon/daemon-lifecycle.ts
@@ -36402,7 +37477,7 @@ function installDaemonLifecycle(options) {
 
 // ../mcp-server/src/daemon/http-daemon.ts
 import http from "node:http";
-import { randomUUID as randomUUID4 } from "node:crypto";
+import { randomUUID as randomUUID5 } from "node:crypto";
 
 // ../../node_modules/.pnpm/@hono+node-server@1.19.14_hono@4.12.27/node_modules/@hono/node-server/dist/index.mjs
 import { Http2ServerRequest as Http2ServerRequest2, constants as h2constants } from "http2";
@@ -37472,7 +38547,7 @@ function verifyRunControlRequest(key, input) {
 }
 
 // ../mcp-server/src/daemon/run-control.ts
-import { randomUUID as randomUUID3 } from "node:crypto";
+import { randomUUID as randomUUID4 } from "node:crypto";
 var FORWARD_TIMEOUT_MS = 5e3;
 var FORCE_TERM_WAIT_MS = 5e3;
 var FORCE_KILL_WAIT_MS = 2e3;
@@ -37512,12 +38587,14 @@ var DaemonRunControl = class {
     this.fetchImpl = options.fetch ?? fetch;
     this.killProcess = options.kill ?? ((pid, signal) => process.kill(pid, signal));
     this.isPidAlive = options.isPidAlive ?? pidIsAlive;
+    this.permissionBroker = options.permissionBroker ?? new WorkflowPermissionBroker();
   }
   options;
   log;
   fetchImpl;
   killProcess;
   isPidAlive;
+  permissionBroker;
   processingPending;
   async resolveOwner(manager, runId) {
     const lease = manager.getPersistence().inspectRunLease?.(runId);
@@ -37600,6 +38677,24 @@ var DaemonRunControl = class {
       return { ok: false, code: "NOT_OWNER", message: `Daemon has no live run ${request.runId}` };
     }
     try {
+      if (request.action === "list-permissions") {
+        return {
+          ok: true,
+          outcome: "permissions-listed",
+          permissions: this.permissionBroker.list(request.runId)
+        };
+      }
+      if (request.action === "respond-permission") {
+        return {
+          ok: true,
+          outcome: "permission-responded",
+          acknowledgement: this.permissionBroker.respond(
+            request.runId,
+            request.permissionId,
+            request.response
+          )
+        };
+      }
       const cancellation = await manager.cancelAgentCall(request.runId, request.callIndex);
       return { ok: true, outcome: "agent-cancelled", cancellation };
     } catch (error51) {
@@ -37664,6 +38759,71 @@ var DaemonRunControl = class {
       }
     }
   }
+  async listPermissions(manager, runId) {
+    if (manager.getRun(runId)) return this.permissionBroker.list(runId);
+    const owner = await this.resolveOwner(manager, runId);
+    if (!owner) return [];
+    if (!this.controlCapable(owner)) {
+      throw new ProtocolError(
+        ProtocolErrorCode.InvalidParams,
+        `${actionableOwnerMessage(runId, owner, "permission inspection")} Pending permissions are live execution state and require a control-capable owner.`
+      );
+    }
+    let response;
+    try {
+      response = await this.post(owner, {
+        operationId: randomUUID4(),
+        runId,
+        action: "list-permissions"
+      });
+    } catch (error51) {
+      throw new ProtocolError(
+        ProtocolErrorCode.InternalError,
+        `${actionableOwnerMessage(runId, owner, "permission inspection")} ${String(error51)}`
+      );
+    }
+    if (!response.ok || response.outcome !== "permissions-listed") {
+      throw new ProtocolError(
+        response.ok || response.code === "INTERNAL_ERROR" ? ProtocolErrorCode.InternalError : ProtocolErrorCode.InvalidParams,
+        response.ok ? "Owner returned an invalid permission-list response." : response.message
+      );
+    }
+    return response.permissions;
+  }
+  async respondPermission(manager, input) {
+    if (manager.getRun(input.runId) && this.permissionBroker.has(input.runId, input.permissionId)) {
+      return this.permissionBroker.respond(input.runId, input.permissionId, input.response);
+    }
+    const owner = await this.resolveOwner(manager, input.runId);
+    if (!owner || !this.controlCapable(owner)) {
+      throw new ProtocolError(
+        ProtocolErrorCode.InvalidParams,
+        `${actionableOwnerMessage(input.runId, owner, "permission response")} A permission response cannot be reconstructed after owner loss.`
+      );
+    }
+    let response;
+    try {
+      response = await this.post(owner, {
+        operationId: randomUUID4(),
+        runId: input.runId,
+        action: "respond-permission",
+        permissionId: input.permissionId,
+        response: input.response
+      });
+    } catch (error51) {
+      throw new ProtocolError(
+        ProtocolErrorCode.InternalError,
+        `${actionableOwnerMessage(input.runId, owner, "permission response")} ${String(error51)}`
+      );
+    }
+    if (!response.ok || response.outcome !== "permission-responded") {
+      throw new ProtocolError(
+        response.ok || response.code === "INTERNAL_ERROR" ? ProtocolErrorCode.InternalError : ProtocolErrorCode.InvalidParams,
+        response.ok ? "Owner returned an invalid permission-response acknowledgement." : response.message
+      );
+    }
+    return response.acknowledgement;
+  }
   async control(manager, input) {
     let owner = await this.resolveOwner(manager, input.runId);
     if (input.callIndex !== void 0) {
@@ -37676,7 +38836,7 @@ var DaemonRunControl = class {
       let response;
       try {
         response = await this.post(owner, {
-          operationId: randomUUID3(),
+          operationId: randomUUID4(),
           runId: input.runId,
           action: "cancel-agent",
           callIndex: input.callIndex
@@ -37906,14 +39066,29 @@ function writeControlResponse(res, status, body) {
   res.writeHead(status, { "Content-Type": "application/json" });
   res.end(JSON.stringify(body));
 }
+function isPermissionResponse(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
+  const row = value;
+  const keys = Object.keys(row).sort();
+  if (keys.join(",") !== "outcome") return false;
+  const outcome = row.outcome;
+  if (outcome === null || typeof outcome !== "object" || Array.isArray(outcome)) return false;
+  const decision = outcome;
+  const decisionKeys = Object.keys(decision).sort().join(",");
+  if (decision.outcome === "cancelled") return decisionKeys === "outcome";
+  return decision.outcome === "selected" && typeof decision.optionId === "string" && decision.optionId.length > 0 && decisionKeys === "optionId,outcome";
+}
 function isInternalRunControlRequest(value) {
   if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
   const row = value;
   const keys = Object.keys(row).sort();
   if (typeof row.operationId !== "string" || !/^[0-9a-f-]{36}$/i.test(row.operationId) || typeof row.runId !== "string" || !/^[a-z0-9]+-[a-z0-9]+$/.test(row.runId)) return false;
-  if (row.action === "stop") {
+  if (row.action === "stop" || row.action === "list-permissions") {
     return keys.join(",") === "action,operationId,runId";
   }
+  if (row.action === "respond-permission") {
+    return typeof row.permissionId === "string" && /^[0-9a-f-]{36}$/i.test(row.permissionId) && isPermissionResponse(row.response) && keys.join(",") === "action,operationId,permissionId,response,runId";
+  }
   return row.action === "cancel-agent" && Number.isSafeInteger(row.callIndex) && row.callIndex >= 0 && keys.join(",") === "action,callIndex,operationId,runId";
 }
 async function handleRunControlRequest(req, res, key, runControl) {
@@ -37981,11 +39156,12 @@ async function createDaemon(options) {
   const log = options.log ?? ((line) => console.error(line));
   const startedAt = (/* @__PURE__ */ new Date()).toISOString();
   const ownPid = options.ownPid ?? process.pid;
-  const ownInstanceId = options.ownInstanceId ?? randomUUID4();
+  const ownInstanceId = options.ownInstanceId ?? randomUUID5();
   const version2 = options.version ?? SERVER_VERSION;
   const isSuperseded = options.isSuperseded ?? (() => isSupersededBy(ownPid));
   const familyFingerprint = envFingerprint(env);
   const sessions = new SessionRegistry();
+  const permissionBroker = options.permissionBroker ?? new WorkflowPermissionBroker();
   const projects = new WorkflowProjectRegistry(options.runner, { leaseOwnerId: ownInstanceId });
   const runControlKey = loadOrCreateRunControlKey();
   const runControl = new DaemonRunControl({
@@ -37993,6 +39169,7 @@ async function createDaemon(options) {
     ownPid,
     ownInstanceId,
     key: runControlKey,
+    permissionBroker,
     log
   });
   const replDrainBoundMs = options.replDrainBoundMs ?? options.sessionTtlMs ?? REPL_DRAIN_BOUND_MS;
@@ -38015,7 +39192,7 @@ async function createDaemon(options) {
   };
   modernHandler = createMcpHandler(
     () => {
-      const clientId = `modern:${randomUUID4()}`;
+      const clientId = `modern:${randomUUID5()}`;
       return createWorkflowServer(options.runner, {
         projects,
         requireProjectDir: true,
@@ -38028,7 +39205,8 @@ async function createDaemon(options) {
         requestStateCodec,
         disconnectReplClientOnClose: true,
         modernNotifier,
-        runControl
+        runControl,
+        permissionBroker
       });
     },
     {
@@ -38042,6 +39220,16 @@ async function createDaemon(options) {
   const detachModernRunDeleted = projects.onRunDeleted(() => modernNotifier.resourcesChanged());
   const detachModernRunEvent = projects.onRunEventPersisted((record2) => {
     modernNotifier.resourceUpdated(workflowRunEventsUri(record2.runId));
+    if (record2.event.type !== "complete") return;
+    queueMicrotask(() => {
+      try {
+        const state = projects.storeFor(record2.runId)?.manager.getPersistence().load(record2.runId);
+        if (state?.status === "completed" && state.result !== void 0) {
+          modernNotifier.resourcesChanged();
+        }
+      } catch {
+      }
+    });
   });
   const handleMcpRequest = async (req, res) => {
     const sessionHeader = req.headers["mcp-session-id"];
@@ -38084,7 +39272,7 @@ async function createDaemon(options) {
       return;
     }
     const transport = new NodeStreamableHTTPServerTransport({
-      sessionIdGenerator: () => randomUUID4(),
+      sessionIdGenerator: () => randomUUID5(),
       eventStore: new BoundedEventStore(),
       onsessioninitialized: (sid) => {
         sessions.add({
@@ -38107,7 +39295,8 @@ async function createDaemon(options) {
       replClientId: () => transport.sessionId,
       replDrainBoundMs,
       replEvalBreakChannel: options.evalBreakChannel,
-      runControl
+      runControl,
+      permissionBroker
     });
     await server.connect(transport);
     const protocolOnClose = transport.onclose;
@@ -38205,6 +39394,7 @@ async function createDaemon(options) {
       detachModernRunEvent();
       detachModernRunDeleted();
       await modernHandler.close();
+      permissionBroker.dispose();
       httpServer.closeAllConnections();
       await closed;
     }
@@ -38230,9 +39420,14 @@ async function ownDaemonAlreadyRunning() {
 }
 async function runDaemon(options = {}) {
   const log = (line) => console.error(line);
-  const runner = createAcpRunner();
+  const permissionBroker = new WorkflowPermissionBroker();
+  const runner = createAcpRunner({
+    onPermissionRequest: permissionBroker.resolver,
+    enforceToolPolicyBeforePermissionResolver: true
+  });
+  permissionBroker.attach(runner);
   const supersede = options.supersede ?? false;
-  const instanceId = randomUUID5();
+  const instanceId = randomUUID6();
   let daemon;
   const sessionTtlMs = envInt(SESSION_IDLE_TTL_ENV, SESSION_IDLE_TTL_MS);
   const replDrainBoundMs = envInt(REPL_DRAIN_BOUND_ENV, REPL_DRAIN_BOUND_MS);
@@ -38242,7 +39437,7 @@ async function runDaemon(options = {}) {
     return `port ${port} is still held by ${holder.legacy ? "a legacy " : ""}daemon pid ${holder.info.pid} (v${holder.info.version}, started ${holder.info.startedAt})`;
   };
   const evalBreakChannel = createEvalBreakChannel2();
-  const daemonOptions = { runner, log, replDrainBoundMs, evalBreakChannel, ownInstanceId: instanceId };
+  const daemonOptions = { runner, permissionBroker, log, replDrainBoundMs, evalBreakChannel, ownInstanceId: instanceId };
   if (supersede) {
     let port = options.port ?? 0;
     try {
@@ -52269,7 +53464,12 @@ var ReplRelayStdioTransport = class {
 
 // ../mcp-server/src/index.ts
 async function main() {
-  const runner = createAcpRunner2();
+  const permissionBroker = new WorkflowPermissionBroker();
+  const runner = createAcpRunner2({
+    onPermissionRequest: permissionBroker.resolver,
+    enforceToolPolicyBeforePermissionResolver: true
+  });
+  permissionBroker.attach(runner);
   const projects = new WorkflowProjectRegistry(runner);
   const defaultContext = projects.getOrCreate(process.cwd());
   const replPresence = new ReplPresenceLedger(REPL_DRAIN_BOUND_MS);
@@ -52295,7 +53495,8 @@ async function main() {
         replDrainBoundMs: REPL_DRAIN_BOUND_MS,
         replEvalBreakChannel: evalBreakChannel,
         protocolEra: era,
-        disconnectReplClientOnClose: true
+        disconnectReplClientOnClose: true,
+        permissionBroker
       });
       activeServer = server;
       activeEra = era;
@@ -52312,6 +53513,7 @@ async function main() {
       replDefaultProjectDir: () => defaultContext.projectDir,
       async disposeReplEvalBreakChannel() {
         detachModernEvents();
+        permissionBroker.dispose();
         await projects.disposeReplStates();
         replPresence.disconnectAll();
         await evalBreakChannel.dispose();
@@ -52409,13 +53611,18 @@ export {
   MCP_ENDPOINT_PATH,
   RESOURCE_MIME_TYPE,
   RESOURCE_URI_META_KEY,
+  RESULT_RESOURCE_MIME_TYPE,
   RUN_MONITOR_RESOURCE_URI,
   ReplPresenceLedger,
   SCRIPT_RESOURCE_LIST_LIMIT,
   SCRIPT_RESOURCE_MIME_TYPE,
   SHUTDOWN_DEADLINE_MS,
   WORKFLOW_EVENTS_TOOL_NAME,
+  WORKFLOW_RESULT_CHUNK_BYTES_DEFAULT,
+  WORKFLOW_RESULT_CHUNK_BYTES_MAX,
+  WORKFLOW_RESULT_CHUNK_BYTES_MIN,
   WORKFLOW_RUN_EVENTS_SCHEMA_VERSION,
+  WorkflowPermissionBroker,
   WorkflowProjectRegistry,
   appResourceToolMeta,
   authoringDocResource,
@@ -52456,7 +53663,9 @@ export {
   toWorkflowExecutionOutcome,
   toWorkflowToolResult,
   validateRequest,
+  workflowResultUri,
   workflowRunEventsUri,
+  workflowRunIdFromResultUri,
   workflowRunIdFromScriptUri,
   workflowScriptUri,
   workflowToolInputShape,