@corbat-tech/coco 2.38.0 → 2.39.0

package/dist/cli/index.js

@@ -5746,12 +5746,12 @@ var init_openai = __esm({
             ...reasoningEffort && { reasoning_effort: reasoningEffort }
           });
           let streamStopReason;
-          for await (const chunk of stream) {
-            const delta = chunk.choices[0]?.delta;
+          for await (const chunk2 of stream) {
+            const delta = chunk2.choices[0]?.delta;
             if (delta?.content) {
               yield { type: "text", text: delta.content };
             }
-            const finishReason = chunk.choices[0]?.finish_reason;
+            const finishReason = chunk2.choices[0]?.finish_reason;
             if (finishReason) {
               streamStopReason = this.mapFinishReason(finishReason);
             }
@@ -5820,8 +5820,8 @@ var init_openai = __esm({
           });
           try {
             let streamStopReason;
-            for await (const chunk of stream) {
-              const delta = chunk.choices[0]?.delta;
+            for await (const chunk2 of stream) {
+              const delta = chunk2.choices[0]?.delta;
               if (delta?.content || delta?.tool_calls) {
                 lastActivityTime = Date.now();
               }
@@ -5859,7 +5859,7 @@ var init_openai = __esm({
                   }
                 }
               }
-              const finishReason = chunk.choices[0]?.finish_reason;
+              const finishReason = chunk2.choices[0]?.finish_reason;
               if (finishReason) {
                 streamStopReason = this.mapFinishReason(finishReason);
               }
@@ -7591,12 +7591,12 @@ var init_gemini = __esm({
             config: this.buildConfig(messages, options)
           });
           let streamStopReason = "end_turn";
-          for await (const chunk of stream) {
-            const text16 = chunk.text;
+          for await (const chunk2 of stream) {
+            const text16 = chunk2.text;
             if (text16) {
               yield { type: "text", text: text16 };
             }
-            const finishReason = chunk.candidates?.[0]?.finishReason;
+            const finishReason = chunk2.candidates?.[0]?.finishReason;
             if (finishReason) {
               streamStopReason = this.mapFinishReason(finishReason);
             }
@@ -7617,12 +7617,12 @@ var init_gemini = __esm({
           let streamStopReason = "end_turn";
           let fallbackToolCounter = 0;
           const emittedToolIds = /* @__PURE__ */ new Set();
-          for await (const chunk of stream) {
-            const text16 = chunk.text;
+          for await (const chunk2 of stream) {
+            const text16 = chunk2.text;
             if (text16) {
               yield { type: "text", text: text16 };
             }
-            const toolCalls = this.extractToolCalls(chunk, { includeLegacyFunctionCalls: true });
+            const toolCalls = this.extractToolCalls(chunk2, { includeLegacyFunctionCalls: true });
             for (const toolCall of toolCalls) {
               const toolCallId = toolCall.id ?? `gemini_call_${++fallbackToolCounter}`;
               if (emittedToolIds.has(toolCallId)) continue;
@@ -7643,7 +7643,7 @@ var init_gemini = __esm({
                 toolCall: normalizedToolCall
               };
             }
-            const finishReason = chunk.candidates?.[0]?.finishReason;
+            const finishReason = chunk2.candidates?.[0]?.finishReason;
             if (toolCalls.length > 0) {
               streamStopReason = "tool_use";
             } else if (finishReason) {
@@ -8000,8 +8000,8 @@ var init_vertex = __esm({
         this.ensureInitialized();
         const stream = await this.streamGenerateContent(messages, options);
         let stopReason = "end_turn";
-        for await (const chunk of stream) {
-          const candidate = chunk.candidates?.[0];
+        for await (const chunk2 of stream) {
+          const candidate = chunk2.candidates?.[0];
           const parts = candidate?.content?.parts ?? [];
           for (const part of parts) {
             if (part.text) {
@@ -8023,8 +8023,8 @@ var init_vertex = __esm({
         let stopReason = "end_turn";
         let streamToolCallCounter = 0;
         const emittedToolFingerprints = /* @__PURE__ */ new Set();
-        for await (const chunk of stream) {
-          const candidate = chunk.candidates?.[0];
+        for await (const chunk2 of stream) {
+          const candidate = chunk2.candidates?.[0];
           const parts = candidate?.content?.parts ?? [];
           for (const part of parts) {
             if (part.text) {
@@ -8711,8 +8711,8 @@ var init_fallback = __esm({
             continue;
           }
           try {
-            for await (const chunk of provider.stream(messages, options)) {
-              yield chunk;
+            for await (const chunk2 of provider.stream(messages, options)) {
+              yield chunk2;
             }
             breaker.recordSuccess();
             return;
@@ -8735,8 +8735,8 @@ var init_fallback = __esm({
             continue;
           }
           try {
-            for await (const chunk of provider.streamWithTools(messages, options)) {
-              yield chunk;
+            for await (const chunk2 of provider.streamWithTools(messages, options)) {
+              yield chunk2;
             }
             breaker.recordSuccess();
             return;
@@ -9005,9 +9005,9 @@ var init_resilient = __esm({
           }
           let emittedChunk = false;
           try {
-            for await (const chunk of createStream()) {
+            for await (const chunk2 of createStream()) {
               emittedChunk = true;
-              yield chunk;
+              yield chunk2;
             }
             this.breaker.recordSuccess();
             return;
@@ -15516,25 +15516,25 @@ var init_complexity = __esm({
             const lines = content.split("\n");
             totalLines += lines.length;
             for (let i = 0; i <= lines.length - this.minLines; i++) {
-              const chunk = lines.slice(i, i + this.minLines).join("\n").trim();
-              if (chunk.length < 20) continue;
-              if (!chunks.has(chunk)) {
-                chunks.set(chunk, []);
+              const chunk2 = lines.slice(i, i + this.minLines).join("\n").trim();
+              if (chunk2.length < 20) continue;
+              if (!chunks.has(chunk2)) {
+                chunks.set(chunk2, []);
               }
-              chunks.get(chunk).push({ file, line: i + 1 });
+              chunks.get(chunk2).push({ file, line: i + 1 });
             }
           } catch {
           }
         }
         const duplicates = [];
         let duplicateLines = 0;
-        for (const [chunk, locations] of chunks.entries()) {
+        for (const [chunk2, locations] of chunks.entries()) {
           if (locations.length > 1) {
             duplicates.push({
-              lines: chunk.split("\n"),
+              lines: chunk2.split("\n"),
               files: locations
             });
-            duplicateLines += chunk.split("\n").length * (locations.length - 1);
+            duplicateLines += chunk2.split("\n").length * (locations.length - 1);
           }
         }
         const percentage = totalLines > 0 ? duplicateLines / totalLines * 100 : 0;
@@ -20749,14 +20749,14 @@ ${message}
           const subprocess = execa(command, options);
           let stdoutBuffer = "";
           let stderrBuffer = "";
-          subprocess.stdout?.on("data", (chunk) => {
-            const text16 = chunk.toString();
+          subprocess.stdout?.on("data", (chunk2) => {
+            const text16 = chunk2.toString();
             stdoutBuffer += text16;
             process.stdout.write(text16);
             heartbeat.activity();
           });
-          subprocess.stderr?.on("data", (chunk) => {
-            const text16 = chunk.toString();
+          subprocess.stderr?.on("data", (chunk2) => {
+            const text16 = chunk2.toString();
             stderrBuffer += text16;
             process.stderr.write(text16);
             heartbeat.activity();
@@ -43226,8 +43226,330 @@ Response format (JSON only, no prose):
   p26.outro("  Spec saved \u2014 starting sprints");
   return spec;
 }
-
-// src/runtime/multi-agent.ts
+var LEGACY_ROLE_MAPPINGS = [
+  { legacy: "explore", role: "researcher", reason: "read-only codebase exploration" },
+  { legacy: "researcher", role: "researcher", reason: "legacy executor role" },
+  { legacy: "plan", role: "planner", reason: "task planning" },
+  { legacy: "planner", role: "planner", reason: "legacy executor role" },
+  { legacy: "architect", role: "architect", reason: "architecture design" },
+  { legacy: "editor", role: "editor", reason: "implementation edits" },
+  { legacy: "debug", role: "coder", reason: "debugging maps to coding capability" },
+  { legacy: "coder", role: "coder", reason: "legacy executor role" },
+  { legacy: "test", role: "tester", reason: "test authoring/execution" },
+  { legacy: "tester", role: "tester", reason: "legacy executor role" },
+  { legacy: "tdd", role: "tester", reason: "test-first implementation" },
+  { legacy: "e2e", role: "tester", reason: "end-to-end testing" },
+  { legacy: "review", role: "reviewer", reason: "code review" },
+  { legacy: "reviewer", role: "reviewer", reason: "legacy executor role" },
+  { legacy: "refactor", role: "optimizer", reason: "structure optimization" },
+  { legacy: "optimizer", role: "optimizer", reason: "legacy executor role" },
+  { legacy: "security", role: "security", reason: "security analysis" },
+  { legacy: "qa", role: "qa", reason: "quality assurance" },
+  { legacy: "integrator", role: "integrator", reason: "integration coordination" },
+  { legacy: "pm", role: "pm", reason: "product/project coordination" },
+  { legacy: "docs", role: "docs", reason: "documentation" },
+  { legacy: "database", role: "database", reason: "database work" }
+];
+var LEGACY_ROLE_MAP = new Map(LEGACY_ROLE_MAPPINGS.map((mapping) => [mapping.legacy, mapping]));
+function mapLegacyAgentRole(legacyRole, fallback = "coder") {
+  return LEGACY_ROLE_MAP.get(legacyRole)?.role ?? fallback;
+}
+function assertProvenance(provenance) {
+  if (!provenance.workflowRunId) {
+    throw new Error("Shared workspace writes require workflowRunId provenance.");
+  }
+}
+function snapshotFromRecords(records, role) {
+  const includeSensitive = role === void 0 || role === "security" || role === "integrator" || role === "pm";
+  const facts = /* @__PURE__ */ new Map();
+  const decisions = /* @__PURE__ */ new Map();
+  const risks = /* @__PURE__ */ new Map();
+  const files = /* @__PURE__ */ new Map();
+  const testResults = /* @__PURE__ */ new Map();
+  const artifacts = [];
+  for (const record of records) {
+    if (!includeSensitive && (record.kind === "risk" || record.provenance.risk === "secrets-sensitive")) {
+      continue;
+    }
+    switch (record.kind) {
+      case "fact":
+        facts.set(record.key, record.value);
+        break;
+      case "decision":
+        decisions.set(record.key, record.value);
+        break;
+      case "risk":
+        risks.set(record.key, record.value);
+        break;
+      case "file":
+        files.set(record.key, record.value);
+        break;
+      case "testResult":
+        testResults.set(record.key, record.value);
+        break;
+      case "artifact":
+        if (isAgentArtifact(record.value)) {
+          if (includeSensitive || record.value.kind !== "riskReport") {
+            artifacts.push(cloneArtifact(record.value));
+          }
+        }
+        break;
+    }
+  }
+  return {
+    facts: Object.fromEntries(facts),
+    decisions: Object.fromEntries(decisions),
+    risks: Object.fromEntries(risks),
+    files: Object.fromEntries(files),
+    testResults: Object.fromEntries(testResults),
+    artifacts
+  };
+}
+var InMemorySharedWorkspaceStore = class {
+  records = [];
+  write(input) {
+    assertProvenance(input.provenance);
+    const record = {
+      id: `state-${randomUUID()}`,
+      kind: input.kind,
+      key: input.key,
+      value: cloneUnknown(input.value),
+      provenance: { ...input.provenance },
+      createdAt: input.createdAt ?? (/* @__PURE__ */ new Date()).toISOString()
+    };
+    this.records.push(record);
+    return cloneRecord(record);
+  }
+  list() {
+    return this.records.map(cloneRecord);
+  }
+  snapshot() {
+    return snapshotFromRecords(this.records);
+  }
+  readForRole(role) {
+    return snapshotFromRecords(this.records, role);
+  }
+  clear() {
+    this.records = [];
+  }
+};
+function createAgentTraceContext(input = {}) {
+  return {
+    traceId: input.traceId ?? `trace-${randomUUID()}`,
+    spanId: input.spanId ?? `span-${randomUUID()}`,
+    parentSpanId: input.parentSpanId,
+    workflowRunId: input.workflowRunId,
+    agentRunId: input.agentRunId,
+    taskId: input.taskId,
+    toolCallId: input.toolCallId
+  };
+}
+var AgentGraphEngine = class {
+  eventLog;
+  sharedState;
+  nodeExecutor;
+  gateEvaluator;
+  trace;
+  constructor(options = {}) {
+    this.eventLog = options.eventLog;
+    this.sharedState = options.sharedState ?? new InMemorySharedWorkspaceStore();
+    this.nodeExecutor = options.nodeExecutor ?? defaultAgentGraphNodeExecutor;
+    this.gateEvaluator = options.gateEvaluator ?? defaultAgentGateEvaluator;
+    this.trace = options.trace ?? createAgentTraceContext();
+  }
+  async run(input) {
+    const validation = validateAgentGraph(input.graph);
+    if (!validation.valid) {
+      throw new Error(
+        `Invalid agent graph: ${validation.issues.map((issue) => issue.message).join("; ")}`
+      );
+    }
+    const startedAt = (/* @__PURE__ */ new Date()).toISOString();
+    const nodeResults = /* @__PURE__ */ new Map();
+    const artifacts = [];
+    const graphTrace = createAgentTraceContext({
+      ...this.trace,
+      workflowRunId: input.workflowRunId
+    });
+    this.eventLog?.record("agent.graph.started", {
+      workflowRunId: input.workflowRunId,
+      trace: graphTrace,
+      levels: validation.levels
+    });
+    try {
+      for (const level of validation.levels) {
+        const batches = chunk(level, input.graph.parallelism ?? level.length);
+        for (const batch of batches) {
+          const levelResults = await Promise.all(
+            batch.map(
+              (nodeId) => this.executeNode({
+                node: input.graph.nodes.find((candidate) => candidate.id === nodeId),
+                graph: input.graph,
+                workflowRunId: input.workflowRunId,
+                input: input.input,
+                graphTrace,
+                nodeResults
+              })
+            )
+          );
+          for (const result2 of levelResults) {
+            nodeResults.set(result2.taskId, result2);
+            artifacts.push(...result2.artifacts.map(cloneArtifact));
+          }
+        }
+      }
+      const completedAt = (/* @__PURE__ */ new Date()).toISOString();
+      const result = {
+        id: input.workflowRunId,
+        status: "completed",
+        nodeResults: Object.fromEntries(nodeResults),
+        artifacts,
+        stateSnapshot: this.sharedState.snapshot(),
+        trace: graphTrace,
+        startedAt,
+        completedAt
+      };
+      this.eventLog?.record("agent.graph.completed", {
+        workflowRunId: input.workflowRunId,
+        trace: graphTrace,
+        nodeCount: nodeResults.size
+      });
+      return result;
+    } catch (error) {
+      const completedAt = (/* @__PURE__ */ new Date()).toISOString();
+      const message = error instanceof Error ? error.message : String(error);
+      this.eventLog?.record("agent.graph.failed", {
+        workflowRunId: input.workflowRunId,
+        trace: graphTrace,
+        error: message
+      });
+      return {
+        id: input.workflowRunId,
+        status: "failed",
+        nodeResults: Object.fromEntries(nodeResults),
+        artifacts,
+        stateSnapshot: this.sharedState.snapshot(),
+        trace: graphTrace,
+        startedAt,
+        completedAt,
+        error: message
+      };
+    }
+  }
+  async executeNode(input) {
+    const attempts = input.node.retryPolicy?.maxAttempts ?? 1;
+    let lastResult;
+    for (let attempt = 1; attempt <= attempts; attempt++) {
+      const task = graphNodeToTask(input.node, input.input);
+      const trace = createAgentTraceContext({
+        traceId: input.graphTrace.traceId,
+        parentSpanId: input.graphTrace.spanId,
+        workflowRunId: input.workflowRunId,
+        taskId: task.id
+      });
+      this.eventLog?.record("agent.started", {
+        workflowRunId: input.workflowRunId,
+        nodeId: input.node.id,
+        taskId: task.id,
+        role: task.role,
+        attempt,
+        trace
+      });
+      const result = await this.nodeExecutor({
+        node: input.node,
+        task,
+        attempt,
+        workflowRunId: input.workflowRunId,
+        trace,
+        dependencyResults: input.nodeResults,
+        sharedState: this.sharedState,
+        eventLog: this.eventLog ?? NULL_EVENT_LOG
+      });
+      lastResult = result;
+      for (const artifact of result.artifacts) {
+        this.sharedState.write({
+          kind: "artifact",
+          key: artifact.id,
+          value: artifact,
+          provenance: {
+            workflowRunId: input.workflowRunId,
+            agentRunId: result.id,
+            nodeId: input.node.id,
+            taskId: task.id,
+            risk: input.node.risk
+          }
+        });
+        this.eventLog?.record("agent.artifact.created", {
+          workflowRunId: input.workflowRunId,
+          nodeId: input.node.id,
+          agentRunId: result.id,
+          artifactId: artifact.id,
+          kind: artifact.kind,
+          trace
+        });
+      }
+      if (result.success) {
+        await this.evaluateNodeGates(input.graph, input.node, result, input.workflowRunId, trace);
+        this.eventLog?.record("agent.completed", {
+          workflowRunId: input.workflowRunId,
+          nodeId: input.node.id,
+          agentRunId: result.id,
+          taskId: task.id,
+          role: result.role,
+          attempt,
+          trace
+        });
+        return result;
+      }
+      this.eventLog?.record("agent.failed", {
+        workflowRunId: input.workflowRunId,
+        nodeId: input.node.id,
+        agentRunId: result.id,
+        taskId: task.id,
+        role: result.role,
+        attempt,
+        error: result.error,
+        trace
+      });
+      if (attempt < attempts && input.node.retryPolicy?.backoffMs) {
+        await new Promise((resolve4) => setTimeout(resolve4, input.node.retryPolicy.backoffMs));
+      }
+    }
+    throw new Error(
+      `Node '${input.node.id}' failed after ${attempts} attempt(s): ${lastResult?.error ?? "unknown error"}`
+    );
+  }
+  async evaluateNodeGates(graph, node, result, workflowRunId, trace) {
+    for (const gateId of node.gates ?? []) {
+      const gate = graph.gates?.find((candidate) => candidate.id === gateId);
+      if (!gate) continue;
+      const evaluation = await this.gateEvaluator({
+        gate,
+        node,
+        result,
+        workflowRunId,
+        trace,
+        sharedState: this.sharedState,
+        eventLog: this.eventLog ?? NULL_EVENT_LOG
+      });
+      const eventType = evaluation.passed ? "workflow.gate.passed" : "workflow.gate.failed";
+      this.eventLog?.record(eventType, {
+        workflowRunId,
+        nodeId: node.id,
+        gateId: gate.id,
+        kind: gate.kind,
+        required: gate.required,
+        reason: evaluation.reason,
+        trace
+      });
+      if (!evaluation.passed && gate.required) {
+        throw new Error(
+          `Required gate '${gate.id}' failed for node '${node.id}': ${evaluation.reason ?? "no reason"}`
+        );
+      }
+    }
+  }
+};
 function createAgentArtifact(input) {
   return {
     ...input,
@@ -43359,6 +43681,101 @@ function buildExecutionLevels(graph, issues) {
   }
   return levels;
 }
+var NULL_EVENT_LOG = {
+  record(type, data = {}) {
+    return {
+      id: `event-${randomUUID()}`,
+      type,
+      timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+      data
+    };
+  },
+  list() {
+    return [];
+  },
+  count() {
+    return 0;
+  },
+  clear() {
+  }
+};
+function graphNodeToTask(node, workflowInput) {
+  return {
+    id: node.id,
+    role: node.agentRole ?? "coder",
+    objective: node.description,
+    context: {
+      workflowInput,
+      condition: node.condition
+    },
+    dependencies: node.dependsOn,
+    constraints: node.requiredTools?.map((tool) => `Requires tool: ${tool}`)
+  };
+}
+async function defaultAgentGraphNodeExecutor(execution) {
+  const startedAt = (/* @__PURE__ */ new Date()).toISOString();
+  const dependencyOutputs = Object.fromEntries(
+    [...execution.dependencyResults.entries()].map(([id, result]) => [
+      id,
+      { success: result.success, output: result.output }
+    ])
+  );
+  const output = [
+    `Node '${execution.node.id}' executed by ${execution.task.role}.`,
+    `Objective: ${execution.task.objective}`,
+    Object.keys(dependencyOutputs).length > 0 ? `Dependencies: ${JSON.stringify(dependencyOutputs)}` : "Dependencies: none"
+  ].join("\n");
+  return normalizeAgentRunResult({
+    id: `${execution.workflowRunId}-${execution.node.id}-attempt-${execution.attempt}`,
+    taskId: execution.task.id,
+    role: execution.task.role,
+    success: true,
+    output,
+    startedAt,
+    completedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    turns: 0,
+    toolsUsed: [],
+    durationMs: 0,
+    metadata: {
+      workflowRunId: execution.workflowRunId,
+      nodeId: execution.node.id,
+      trace: execution.trace,
+      simulated: true
+    }
+  });
+}
+async function defaultAgentGateEvaluator(input) {
+  if (!input.result.success) {
+    return { passed: false, reason: "Agent result was not successful." };
+  }
+  return { passed: true };
+}
+function chunk(items, size) {
+  const safeSize = Math.max(1, size);
+  const result = [];
+  for (let index = 0; index < items.length; index += safeSize) {
+    result.push(items.slice(index, index + safeSize));
+  }
+  return result;
+}
+function cloneUnknown(value) {
+  if (value === void 0 || value === null) return value;
+  try {
+    return JSON.parse(JSON.stringify(value));
+  } catch {
+    return value;
+  }
+}
+function cloneRecord(record) {
+  return {
+    ...record,
+    value: cloneUnknown(record.value),
+    provenance: { ...record.provenance }
+  };
+}
+function isAgentArtifact(value) {
+  return typeof value === "object" && value !== null && "id" in value && "kind" in value && "content" in value && "createdAt" in value;
+}
 function cloneArtifact(artifact) {
   return {
     ...artifact,
@@ -43547,7 +43964,7 @@ Complete this task autonomously using the available tools. When done, provide a
   }
 };
 function normalizeRole(role) {
-  return role === "researcher" || role === "architect" || role === "editor" || role === "coder" || role === "tester" || role === "reviewer" || role === "optimizer" || role === "planner" ? role : "coder";
+  return mapLegacyAgentRole(role);
 }
 var AGENT_ROLES = {
   researcher: {
@@ -46366,29 +46783,7 @@ var AgentManager = class extends EventEmitter {
   }
 };
 function agentTypeToRuntimeRole(type) {
-  switch (type) {
-    case "explore":
-      return "researcher";
-    case "plan":
-      return "planner";
-    case "test":
-    case "e2e":
-    case "tdd":
-      return "tester";
-    case "debug":
-    case "refactor":
-      return "coder";
-    case "review":
-      return "reviewer";
-    case "architect":
-      return "architect";
-    case "security":
-      return "security";
-    case "docs":
-      return "docs";
-    case "database":
-      return "database";
-  }
+  return mapLegacyAgentRole(type);
 }
 
 // src/agents/provider-bridge.ts
@@ -46434,7 +46829,7 @@ var AGENT_TYPES = [
   "docs",
   "database"
 ];
-var LEGACY_ROLE_MAP = {
+var LEGACY_ROLE_MAP2 = {
   researcher: "explore",
   coder: "debug",
   // "debug" has write + bash + read — closest to general coding
@@ -46454,7 +46849,7 @@ var SpawnSimpleAgentSchema = z.object({
 });
 function resolveAgentType(input) {
   if (input.type) return input.type;
-  if (input.role && input.role in LEGACY_ROLE_MAP) return LEGACY_ROLE_MAP[input.role];
+  if (input.role && input.role in LEGACY_ROLE_MAP2) return LEGACY_ROLE_MAP2[input.role];
   return "explore";
 }
 var spawnSimpleAgentTool = defineTool({
@@ -46996,14 +47391,14 @@ ${message}
       const subprocess = execa(pm, cmdArgs, options);
       let stdoutBuffer = "";
       let stderrBuffer = "";
-      subprocess.stdout?.on("data", (chunk) => {
-        const text16 = chunk.toString();
+      subprocess.stdout?.on("data", (chunk2) => {
+        const text16 = chunk2.toString();
         stdoutBuffer += text16;
         process.stdout.write(text16);
         heartbeat.activity();
       });
-      subprocess.stderr?.on("data", (chunk) => {
-        const text16 = chunk.toString();
+      subprocess.stderr?.on("data", (chunk2) => {
+        const text16 = chunk2.toString();
         stderrBuffer += text16;
         process.stderr.write(text16);
         heartbeat.activity();
@@ -47121,14 +47516,14 @@ ${message}
       const subprocess = execa(pm, cmdArgs, options);
       let stdoutBuffer = "";
       let stderrBuffer = "";
-      subprocess.stdout?.on("data", (chunk) => {
-        const text16 = chunk.toString();
+      subprocess.stdout?.on("data", (chunk2) => {
+        const text16 = chunk2.toString();
         stdoutBuffer += text16;
         process.stdout.write(text16);
         heartbeat.activity();
       });
-      subprocess.stderr?.on("data", (chunk) => {
-        const text16 = chunk.toString();
+      subprocess.stderr?.on("data", (chunk2) => {
+        const text16 = chunk2.toString();
         stderrBuffer += text16;
         process.stderr.write(text16);
         heartbeat.activity();
@@ -47223,14 +47618,14 @@ ${message}
       const subprocess = execa("make", cmdArgs, options);
       let stdoutBuffer = "";
       let stderrBuffer = "";
-      subprocess.stdout?.on("data", (chunk) => {
-        const text16 = chunk.toString();
+      subprocess.stdout?.on("data", (chunk2) => {
+        const text16 = chunk2.toString();
         stdoutBuffer += text16;
         process.stdout.write(text16);
         heartbeat.activity();
       });
-      subprocess.stderr?.on("data", (chunk) => {
-        const text16 = chunk.toString();
+      subprocess.stderr?.on("data", (chunk2) => {
+        const text16 = chunk2.toString();
         stderrBuffer += text16;
         process.stderr.write(text16);
         heartbeat.activity();
@@ -47326,14 +47721,14 @@ ${message}
       const subprocess = execa("npx", ["tsc", ...cmdArgs], options);
       let stdoutBuffer = "";
       let stderrBuffer = "";
-      subprocess.stdout?.on("data", (chunk) => {
-        const text16 = chunk.toString();
+      subprocess.stdout?.on("data", (chunk2) => {
+        const text16 = chunk2.toString();
         stdoutBuffer += text16;
         process.stdout.write(text16);
         heartbeat.activity();
       });
-      subprocess.stderr?.on("data", (chunk) => {
-        const text16 = chunk.toString();
+      subprocess.stderr?.on("data", (chunk2) => {
+        const text16 = chunk2.toString();
         stderrBuffer += text16;
         process.stderr.write(text16);
         heartbeat.activity();
@@ -47430,14 +47825,14 @@ ${message}
       });
       let stdoutBuffer = "";
       let stderrBuffer = "";
-      subprocess.stdout?.on("data", (chunk) => {
-        const text16 = chunk.toString();
+      subprocess.stdout?.on("data", (chunk2) => {
+        const text16 = chunk2.toString();
         stdoutBuffer += text16;
         process.stdout.write(text16);
         heartbeat.activity();
       });
-      subprocess.stderr?.on("data", (chunk) => {
-        const text16 = chunk.toString();
+      subprocess.stderr?.on("data", (chunk2) => {
+        const text16 = chunk2.toString();
         stderrBuffer += text16;
         process.stderr.write(text16);
         heartbeat.activity();
@@ -47517,14 +47912,14 @@ ${message}
       });
       let stdoutBuffer = "";
       let stderrBuffer = "";
-      subprocess.stdout?.on("data", (chunk) => {
-        const text16 = chunk.toString();
+      subprocess.stdout?.on("data", (chunk2) => {
+        const text16 = chunk2.toString();
         stdoutBuffer += text16;
         process.stdout.write(text16);
         heartbeat.activity();
       });
-      subprocess.stderr?.on("data", (chunk) => {
-        const text16 = chunk.toString();
+      subprocess.stderr?.on("data", (chunk2) => {
+        const text16 = chunk2.toString();
         stderrBuffer += text16;
         process.stderr.write(text16);
         heartbeat.activity();
@@ -49346,13 +49741,13 @@ Examples:
           const content = await fs41.readFile(fullPath, "utf-8");
           if (content.length > 1e5) continue;
           const fileChunks = chunkContent(content, DEFAULT_CHUNK_SIZE);
-          for (const chunk of fileChunks) {
-            const vector = await getEmbedding(chunk.text);
+          for (const chunk2 of fileChunks) {
+            const vector = await getEmbedding(chunk2.text);
             chunks.push({
               file,
-              startLine: chunk.startLine,
-              endLine: chunk.endLine,
-              text: chunk.text,
+              startLine: chunk2.startLine,
+              endLine: chunk2.endLine,
+              text: chunk2.text,
               vector,
               mtime: stat2.mtimeMs
             });
@@ -49386,9 +49781,9 @@ Examples:
       }
     }
     const queryVector = await getEmbedding(query);
-    const scored = index.chunks.map((chunk) => ({
-      chunk,
-      score: cosineSimilarity(queryVector, chunk.vector)
+    const scored = index.chunks.map((chunk2) => ({
+      chunk: chunk2,
+      score: cosineSimilarity(queryVector, chunk2.vector)
     }));
     const filtered = scored.filter((s) => s.score >= effectiveThreshold).sort((a, b) => b.score - a.score).slice(0, effectiveMaxResults);
     const results = filtered.map((s) => {
@@ -54367,17 +54762,17 @@ function resetLineBuffer() {
   stopStreamingIndicator();
   resetBlockStore();
 }
-function renderStreamChunk(chunk) {
-  if (chunk.type === "text" && chunk.text) {
-    lineBuffer += chunk.text;
-    rawMarkdownBuffer += chunk.text;
+function renderStreamChunk(chunk2) {
+  if (chunk2.type === "text" && chunk2.text) {
+    lineBuffer += chunk2.text;
+    rawMarkdownBuffer += chunk2.text;
     let newlineIndex;
     while ((newlineIndex = lineBuffer.indexOf("\n")) !== -1) {
       const line = lineBuffer.slice(0, newlineIndex);
       lineBuffer = lineBuffer.slice(newlineIndex + 1);
       processAndOutputLine(line);
     }
-  } else if (chunk.type === "done") {
+  } else if (chunk2.type === "done") {
     flushLineBuffer();
   }
 }
@@ -55571,22 +55966,22 @@ ${tail}`;
           content: `[System: ${reason} Do not call tools. Either explain the exact blocker and ask the user for the smallest missing input, or, if the task is already complete, summarize it briefly. Do not return an empty response.]`
         }
       ];
-      for await (const chunk of provider.streamWithTools(finalMessages, {
+      for await (const chunk2 of provider.streamWithTools(finalMessages, {
         tools: [],
         maxTokens: session.config.provider.maxTokens,
         signal: options.signal
         // Omit thinking for the final explanation turn to avoid unnecessary cost
       })) {
         if (options.signal?.aborted) break;
-        if (chunk.type === "text" && chunk.text) {
+        if (chunk2.type === "text" && chunk2.text) {
           if (!explanationThinkingEnded) {
             options.onThinkingEnd?.();
             explanationThinkingEnded = true;
           }
-          explanation += chunk.text;
-          options.onStream?.(chunk);
+          explanation += chunk2.text;
+          options.onStream?.(chunk2);
         }
-        if (chunk.type === "done") break;
+        if (chunk2.type === "done") break;
       }
     } catch {
     } finally {
@@ -55627,7 +56022,7 @@ ${tail}`;
         lastStopReason = void 0;
         const toolCallBuilders = /* @__PURE__ */ new Map();
         try {
-          for await (const chunk of provider.streamWithTools(messages, {
+          for await (const chunk2 of provider.streamWithTools(messages, {
             tools,
             maxTokens: session.config.provider.maxTokens,
             signal: options.signal,
@@ -55637,56 +56032,56 @@ ${tail}`;
               break;
             }
             try {
-              if (chunk.type === "text" && chunk.text) {
+              if (chunk2.type === "text" && chunk2.text) {
                 if (!thinkingEnded) {
                   options.onThinkingEnd?.();
                   thinkingEnded = true;
                 }
-                responseContent += chunk.text;
-                finalContent += chunk.text;
-                iterationTextChunks.push(chunk);
+                responseContent += chunk2.text;
+                finalContent += chunk2.text;
+                iterationTextChunks.push(chunk2);
               }
-              if (chunk.type === "tool_use_start" && chunk.toolCall) {
+              if (chunk2.type === "tool_use_start" && chunk2.toolCall) {
                 flushLineBuffer();
                 if (!thinkingEnded) {
                   options.onThinkingEnd?.();
                   thinkingEnded = true;
                 }
-                const id = chunk.toolCall.id ?? `tool_${toolCallBuilders.size}`;
-                const toolName = chunk.toolCall.name ?? "";
+                const id = chunk2.toolCall.id ?? `tool_${toolCallBuilders.size}`;
+                const toolName = chunk2.toolCall.name ?? "";
                 toolCallBuilders.set(id, {
                   id,
                   name: toolName,
                   input: {},
-                  geminiThoughtSignature: chunk.toolCall.geminiThoughtSignature
+                  geminiThoughtSignature: chunk2.toolCall.geminiThoughtSignature
                 });
                 if (toolName) {
                   options.onToolPreparing?.(toolName);
                 }
               }
-              if (chunk.type === "tool_use_end" && chunk.toolCall) {
-                const id = chunk.toolCall.id ?? "";
+              if (chunk2.type === "tool_use_end" && chunk2.toolCall) {
+                const id = chunk2.toolCall.id ?? "";
                 const builder = toolCallBuilders.get(id);
                 if (builder) {
                   const finalToolCall = {
                     id: builder.id,
-                    name: chunk.toolCall.name ?? builder.name,
-                    input: chunk.toolCall.input ?? builder.input,
-                    geminiThoughtSignature: chunk.toolCall.geminiThoughtSignature ?? builder.geminiThoughtSignature
+                    name: chunk2.toolCall.name ?? builder.name,
+                    input: chunk2.toolCall.input ?? builder.input,
+                    geminiThoughtSignature: chunk2.toolCall.geminiThoughtSignature ?? builder.geminiThoughtSignature
                   };
                   collectedToolCalls.push(finalToolCall);
-                } else if (chunk.toolCall.id && chunk.toolCall.name) {
+                } else if (chunk2.toolCall.id && chunk2.toolCall.name) {
                   collectedToolCalls.push({
-                    id: chunk.toolCall.id,
-                    name: chunk.toolCall.name,
-                    input: chunk.toolCall.input ?? {},
-                    geminiThoughtSignature: chunk.toolCall.geminiThoughtSignature
+                    id: chunk2.toolCall.id,
+                    name: chunk2.toolCall.name,
+                    input: chunk2.toolCall.input ?? {},
+                    geminiThoughtSignature: chunk2.toolCall.geminiThoughtSignature
                   });
                 }
               }
-              if (chunk.type === "done") {
-                if (chunk.stopReason) {
-                  lastStopReason = chunk.stopReason;
+              if (chunk2.type === "done") {
+                if (chunk2.stopReason) {
+                  lastStopReason = chunk2.stopReason;
                 }
                 if (!thinkingEnded) {
                   options.onThinkingEnd?.();
@@ -56169,17 +56564,17 @@ ${ITERATION_LIMIT_SUMMARY_PROMPT}` : ITERATION_LIMIT_SUMMARY_PROMPT
     if (stuckInErrorLoop) {
       try {
         const finalMessages = getConversationContext(session, toolRegistry);
-        for await (const chunk of provider.streamWithTools(finalMessages, {
+        for await (const chunk2 of provider.streamWithTools(finalMessages, {
           tools: [],
           maxTokens: session.config.provider.maxTokens,
           signal: options.signal
         })) {
           if (options.signal?.aborted) break;
-          if (chunk.type === "text" && chunk.text) {
-            finalContent += chunk.text;
-            options.onStream?.(chunk);
+          if (chunk2.type === "text" && chunk2.text) {
+            finalContent += chunk2.text;
+            options.onStream?.(chunk2);
           }
-          if (chunk.type === "done") break;
+          if (chunk2.type === "done") break;
         }
       } catch {
       }
@@ -56200,21 +56595,21 @@ ${ITERATION_LIMIT_SUMMARY_PROMPT}` : ITERATION_LIMIT_SUMMARY_PROMPT
       options.onThinkingStart?.();
       try {
         const finalMessages = getConversationContext(session, toolRegistry);
-        for await (const chunk of provider.streamWithTools(finalMessages, {
+        for await (const chunk2 of provider.streamWithTools(finalMessages, {
           tools: [],
           maxTokens: session.config.provider.maxTokens,
           signal: options.signal
         })) {
           if (options.signal?.aborted) break;
-          if (chunk.type === "text" && chunk.text) {
+          if (chunk2.type === "text" && chunk2.text) {
             if (!summaryThinkingEnded) {
               options.onThinkingEnd?.();
               summaryThinkingEnded = true;
             }
-            finalContent += chunk.text;
-            options.onStream?.(chunk);
+            finalContent += chunk2.text;
+            options.onStream?.(chunk2);
           }
-          if (chunk.type === "done") break;
+          if (chunk2.type === "done") break;
         }
       } catch {
         const notice = `
@@ -56365,15 +56760,15 @@ function createReplayProvider(turns) {
     async *stream() {
       const chunks = turns[Math.min(callIndex, turns.length - 1)] ?? [{ type: "done" }];
       callIndex++;
-      for (const chunk of chunks) {
-        yield chunk;
+      for (const chunk2 of chunks) {
+        yield chunk2;
       }
     },
     async *streamWithTools() {
       const chunks = turns[Math.min(callIndex, turns.length - 1)] ?? [{ type: "done" }];
       callIndex++;
-      for (const chunk of chunks) {
-        yield chunk;
+      for (const chunk2 of chunks) {
+        yield chunk2;
       }
     },
     countTokens(text16) {
@@ -56389,9 +56784,9 @@ function createReplayProvider(turns) {
 }
 function collectToolNames(stream) {
   const names = /* @__PURE__ */ new Set();
-  for (const chunk of stream) {
-    if ((chunk.type === "tool_use_start" || chunk.type === "tool_use_end") && chunk.toolCall?.name) {
-      names.add(chunk.toolCall.name);
+  for (const chunk2 of stream) {
+    if ((chunk2.type === "tool_use_start" || chunk2.type === "tool_use_end") && chunk2.toolCall?.name) {
+      names.add(chunk2.toolCall.name);
     }
   }
   return Array.from(names);
@@ -57775,7 +58170,6 @@ var READ_ONLY_TOOL_NAMES = /* @__PURE__ */ new Set([
   "recall_memory",
   "list_memories",
   "list_checkpoints",
-  "spawnSimpleAgent",
   "checkAgentCapability"
 ]);
 var WRITE_CAPABLE_TOOL_NAMES = /* @__PURE__ */ new Set(["run_linter"]);
@@ -57821,6 +58215,22 @@ var DefaultPermissionPolicy = class {
     return { allowed: true, risk };
   }
   canExecuteToolInput(mode, tool, input) {
+    if (tool.name === "spawnSimpleAgent") {
+      const risk = riskForSpawnedAgent(input);
+      const definition2 = getAgentMode(mode);
+      if (definition2.readOnly && risk !== "read-only" && risk !== "network") {
+        return {
+          allowed: false,
+          reason: `${definition2.label} mode is read-only; spawnSimpleAgent with this role can perform ${risk} work.`,
+          risk
+        };
+      }
+      return {
+        allowed: true,
+        requiresConfirmation: risk === "destructive" || risk === "secrets-sensitive",
+        risk
+      };
+    }
     if (tool.name !== "run_linter") {
       return this.canExecuteTool(mode, tool);
     }
@@ -57840,6 +58250,37 @@ var DefaultPermissionPolicy = class {
 function createPermissionPolicy() {
   return new DefaultPermissionPolicy();
 }
+function riskForSpawnedAgent(input) {
+  const type = typeof input["type"] === "string" ? input["type"] : void 0;
+  const role = typeof input["role"] === "string" ? input["role"] : void 0;
+  const resolved = type ?? role;
+  switch (resolved) {
+    case "explore":
+    case "plan":
+    case "review":
+    case "architect":
+    case "security":
+    case "docs":
+    case "researcher":
+    case "reviewer":
+    case "planner":
+      return "read-only";
+    case "database":
+      return "secrets-sensitive";
+    case "test":
+    case "tdd":
+    case "e2e":
+    case "tester":
+      return "destructive";
+    case "debug":
+    case "refactor":
+    case "coder":
+    case "optimizer":
+      return "write";
+    default:
+      return "read-only";
+  }
+}
 
 // src/runtime/provider-registry.ts
 init_providers();
@@ -58146,19 +58587,26 @@ function createWorkflowCatalog(workflows) {
 
 // src/runtime/workflow-engine.ts
 var WorkflowEngine = class {
-  constructor(catalog = createWorkflowCatalog(), eventLog = createEventLog()) {
+  constructor(catalog = createWorkflowCatalog(), eventLog = createEventLog(), options = {}) {
     this.catalog = catalog;
     this.eventLog = eventLog;
+    this.sharedState = options.sharedState ?? new InMemorySharedWorkspaceStore();
+    this.nodeExecutor = options.nodeExecutor;
   }
   catalog;
   eventLog;
   handlers = /* @__PURE__ */ new Map();
+  sharedState;
+  nodeExecutor;
   registerHandler(workflowId, handler) {
     if (!this.catalog.get(workflowId)) {
       throw new Error(`Unknown workflow: ${workflowId}`);
     }
     this.handlers.set(workflowId, handler);
   }
+  registerNodeExecutor(executor) {
+    this.nodeExecutor = executor;
+  }
   createPlan(workflowId, input) {
     return this.catalog.createPlan(workflowId, input, this.eventLog);
   }
@@ -58168,23 +58616,35 @@ var WorkflowEngine = class {
       throw new Error(`Unknown workflow: ${request.workflowId}`);
     }
     const handler = this.handlers.get(request.workflowId);
-    if (!handler) {
-      throw new Error(`No handler registered for workflow: ${request.workflowId}`);
-    }
     const plan = request.plan ?? this.createPlan(request.workflowId, request.input);
     const startedAt = (/* @__PURE__ */ new Date()).toISOString();
     const runId = `${request.workflowId}-run-${Date.now().toString(36)}`;
+    const trace = createAgentTraceContext({ workflowRunId: runId });
     this.eventLog.record("workflow.started", {
       workflowId: request.workflowId,
       planId: plan.id,
-      runId
+      runId,
+      trace
     });
     try {
-      const output = await handler(request.input, {
+      const graphResult = handler ? void 0 : await new AgentGraphEngine({
+        eventLog: this.eventLog,
+        sharedState: this.sharedState,
+        nodeExecutor: this.nodeExecutor,
+        trace
+      }).run({
+        workflowRunId: runId,
+        graph: workflowToAgentGraph(workflow),
+        input: request.input
+      });
+      const output = graphResult ?? await handler(request.input, {
         workflow,
         plan,
         eventLog: this.eventLog
       });
+      if (graphResult?.status === "failed") {
+        throw new Error(graphResult.error ?? "Workflow graph failed");
+      }
       const completedAt = (/* @__PURE__ */ new Date()).toISOString();
       const result = {
         id: runId,
@@ -58192,12 +58652,15 @@ var WorkflowEngine = class {
         status: "completed",
         output,
         startedAt,
-        completedAt
+        completedAt,
+        graphResult,
+        trace
       };
       this.eventLog.record("workflow.completed", {
         workflowId: request.workflowId,
         planId: plan.id,
-        runId
+        runId,
+        trace
       });
       return result;
     } catch (error) {
@@ -58207,7 +58670,8 @@ var WorkflowEngine = class {
         workflowId: request.workflowId,
         planId: plan.id,
         runId,
-        error: message
+        error: message,
+        trace
       });
       return {
         id: runId,
@@ -58216,13 +58680,14 @@ var WorkflowEngine = class {
         output: null,
         startedAt,
         completedAt,
-        error: message
+        error: message,
+        trace
       };
     }
   }
 };
-function createWorkflowEngine(catalog, eventLog) {
-  return new WorkflowEngine(catalog, eventLog);
+function createWorkflowEngine(catalog, eventLog, options) {
+  return new WorkflowEngine(catalog, eventLog, options);
 }
 
 // src/runtime/agent-runtime.ts
@@ -58400,7 +58865,7 @@ var AgentRuntime = class {
     let completed = false;
     let failed = false;
     try {
-      for await (const chunk of provider.stream(messages, {
+      for await (const chunk2 of provider.stream(messages, {
         model: input.options?.model,
         maxTokens: input.options?.maxTokens,
         temperature: input.options?.temperature,
@@ -58410,12 +58875,12 @@ var AgentRuntime = class {
         signal: input.options?.signal,
         thinking: input.options?.thinking
       })) {
-        if (chunk.type === "text" && chunk.text) {
-          content += chunk.text;
+        if (chunk2.type === "text" && chunk2.text) {
+          content += chunk2.text;
           yield {
             type: "text",
             sessionId: effectiveSession.id,
-            text: chunk.text
+            text: chunk2.text
           };
         }
       }
@@ -59853,12 +60318,12 @@ ${imagePrompts}`.trim() : imagePrompts;
       let lastToolGroup = null;
       await ensureRequestedMcpConnections(extractMessageText(effectiveMessage));
       const result = await executeAgentTurn(session, effectiveMessage, provider, toolRegistry, {
-        onStream: (chunk) => {
+        onStream: (chunk2) => {
           if (!streamStarted) {
             streamStarted = true;
             clearSpinner();
           }
-          renderStreamChunk(chunk);
+          renderStreamChunk(chunk2);
         },
         onToolStart: (tc, index, total) => {
           const desc = getToolRunningDescription(
@@ -60489,9 +60954,9 @@ async function readStdin() {
     const timeout = setTimeout(() => {
       resolve4("");
     }, 5e3);
-    process.stdin.on("data", (chunk) => {
+    process.stdin.on("data", (chunk2) => {
       clearTimeout(timeout);
-      chunks.push(Buffer.from(chunk));
+      chunks.push(Buffer.from(chunk2));
     });
     process.stdin.on("end", () => {
       clearTimeout(timeout);
@@ -60581,9 +61046,9 @@ ${stdinContent}
     const result = await executeAgentTurn(session, task, provider, toolRegistry, {
       skipConfirmation: true,
       // No interactive confirmations in headless mode
-      onStream: (chunk) => {
-        if (options.outputFormat === "text" && chunk.type === "text" && chunk.text) {
-          process.stdout.write(chunk.text);
+      onStream: (chunk2) => {
+        if (options.outputFormat === "text" && chunk2.type === "text" && chunk2.text) {
+          process.stdout.write(chunk2.text);
         }
       }
     });