@diff-review-system/drs 4.0.0-rc.4 → 4.0.1

package/dist/cli/workflow.js

@@ -1,26 +1,30 @@
 import { mkdir, readFile, writeFile } from 'fs/promises';
-import { dirname } from 'path';
+import { dirname, join } from 'path';
 import simpleGit from 'simple-git';
 import chalk from 'chalk';
-import { getDescriberModelOverride, loadWorkflowSourceInfo, normalizeAgentConfig, resolveAgentRunConfig, } from '../lib/config.js';
+import { getDescriberModelOverride, getReviewAgentIds, loadWorkflowSourceInfo, normalizeAgentConfig, resolveAgentRunConfig, } from '../lib/config.js';
 import { resolveWithinWorkingDir } from '../lib/path-utils.js';
 import { parseDiff, getChangedFiles, getFilesWithDiffs } from '../lib/diff-parser.js';
-import { parseValidLinesFromPatch } from '../lib/diff-lines.js';
+import { parseDiffLineInfo } from '../lib/diff-lines.js';
 import { connectToRuntime, executeReview, filterIgnoredFiles, } from '../lib/review-orchestrator.js';
-import { ExitError, setExitHandler } from '../lib/exit.js';
 import { postReviewComments } from '../lib/comment-poster.js';
-import { findExistingCommentById } from '../lib/comment-manager.js';
+import { findExistingCommentById, createIssueFingerprint } from '../lib/comment-manager.js';
 import { removeErrorComment } from '../lib/error-comment-poster.js';
 import { runDescribeIfEnabled } from '../lib/description-executor.js';
 import { buildBaseInstructions } from '../lib/review-core.js';
 import { resolveCursorFixLinkOptions } from '../lib/cursor-fix-link.js';
-import { enforceRepoBranchMatch, getCanonicalDiffCommand, resolveBaseBranch, } from '../lib/repository-validator.js';
+import { extractHtmlDocument, parseArtifactOutputPointer, readArtifactOutputPointer, validateHtmlArtifact, } from '../lib/html-artifact.js';
+import { getCanonicalDiffCommand, resolveBaseBranch } from '../lib/repository-validator.js';
 import { formatCodeQualityReport, generateCodeQualityReport } from '../lib/code-quality-report.js';
 import { createGitHubClient } from '../github/client.js';
 import { GitHubPlatformAdapter } from '../github/platform-adapter.js';
 import { createGitLabClient } from '../gitlab/client.js';
 import { GitLabPlatformAdapter } from '../gitlab/platform-adapter.js';
+import { loadWorkflowArtifact, saveWorkflowArtifact, updateWorkflowArtifact, workflowArtifactExists, } from '../lib/workflow-artifacts.js';
+import { addReviewArtifactFinding, createReviewArtifactPayload, getReviewArtifactStatus, isReviewArtifactPayload, updateReviewArtifactFindings, } from '../lib/review-artifact.js';
 import { runAgent } from './run-agent.js';
+import { TraceCollector } from '../lib/trace-collector.js';
+import { renderTraceHtml } from '../lib/trace-html.js';
 function createWorkflowLock() {
     return { current: Promise.resolve() };
 }
@@ -85,6 +89,321 @@ function getNodeNeeds(node) {
     }
     return node.needs;
 }
+function getControlTargets(node) {
+    const targets = [];
+    if (node.target)
+        targets.push(node.target);
+    if (node.exit)
+        targets.push(node.exit);
+    if (node.default)
+        targets.push(node.default);
+    if (node.cases)
+        targets.push(...Object.values(node.cases));
+    return targets;
+}
+function validateWorkflowControlTargets(nodes) {
+    for (const [nodeId, node] of Object.entries(nodes)) {
+        for (const target of getControlTargets(node)) {
+            if (!nodes[target]) {
+                throw new Error(`Workflow node "${nodeId}" targets unknown node "${target}".`);
+            }
+        }
+    }
+}
+function validateWorkflowControlRouteDirection(nodes, executionOrder) {
+    const segments = splitWorkflowSegments(nodes, executionOrder);
+    for (let segmentIndex = 0; segmentIndex < segments.length; segmentIndex++) {
+        const segment = segments[segmentIndex];
+        if (segment.type !== 'control') {
+            continue;
+        }
+        const node = nodes[segment.nodeId];
+        if (!node || node.control === 'loop') {
+            continue;
+        }
+        for (const target of getControlTargets(node)) {
+            const targetIndex = findWorkflowSegmentIndex(segments, target);
+            if (targetIndex <= segmentIndex) {
+                throw new Error(`Workflow control node "${segment.nodeId}" cannot jump backward to "${target}". Use control: loop with maxIterations for repeated execution.`);
+            }
+        }
+    }
+}
+function validateWorkflowPassThroughShape(nodeId, node) {
+    if (node.control !== 'passThrough') {
+        return;
+    }
+    if (!node.target) {
+        throw new Error(`Workflow passThrough node "${nodeId}" must define "target".`);
+    }
+    const forbiddenKeys = [
+        'if',
+        'then',
+        'else',
+        'exit',
+        'cases',
+        'default',
+        'maxIterations',
+        'onMaxIterations',
+        'value',
+    ];
+    const extraFields = forbiddenKeys.filter((key) => key in node);
+    if (extraFields.length > 0) {
+        throw new Error(`Workflow passThrough node "${nodeId}" must not define extra control logic: ${extraFields.join(', ')}.`);
+    }
+}
+const WORKFLOW_NODE_FIELDS = new Set([
+    'agent',
+    'agentsFrom',
+    'control',
+    'action',
+    'with',
+    'needs',
+    'if',
+    'target',
+    'exit',
+    'maxIterations',
+    'onMaxIterations',
+    'value',
+    'cases',
+    'default',
+    'input',
+    'output',
+    'writes',
+    'json',
+]);
+const EXECUTABLE_NODE_FIELDS = new Set([
+    'agent',
+    'agentsFrom',
+    'action',
+    'with',
+    'needs',
+    'if',
+    'input',
+    'output',
+    'writes',
+    'json',
+]);
+const CONTROL_NODE_FIELDS = {
+    loop: new Set([
+        'control',
+        'needs',
+        'if',
+        'target',
+        'exit',
+        'maxIterations',
+        'onMaxIterations',
+        'output',
+    ]),
+    switch: new Set(['control', 'needs', 'value', 'cases', 'default', 'output']),
+    end: new Set(['control', 'needs', 'output']),
+    passThrough: new Set(['control', 'needs', 'target', 'output']),
+};
+const ACTION_OPTION_FIELDS = {
+    write: new Set(),
+    'git-diff': new Set(['staged']),
+    'git-add': new Set(['path', 'paths']),
+    'git-branch': new Set(['name', 'from', 'force']),
+    'git-commit': new Set(['message', 'path', 'paths']),
+    'git-push': new Set(['remote', 'branch', 'remoteBranch', 'setUpstream', 'force']),
+    'has-diff': new Set(['path', 'paths']),
+    'stack-guard': new Set(['source', 'allowStackedSource', 'reservedPrefixes']),
+    'review-threshold': new Set(['review', 'severity', 'minIssues']),
+    'save-artifact': new Set([
+        'kind',
+        'source',
+        'artifact',
+        'payload',
+        'platform',
+        'project',
+        'projectId',
+        'owner',
+        'repo',
+        'subject',
+        'changeKind',
+        'changeNumber',
+        'pr',
+        'mr',
+        'branch',
+    ]),
+    'load-artifact': new Set([
+        'kind',
+        'source',
+        'id',
+        'platform',
+        'project',
+        'projectId',
+        'owner',
+        'repo',
+        'subject',
+        'changeKind',
+        'changeNumber',
+        'pr',
+        'mr',
+        'branch',
+    ]),
+    'artifact-exists': new Set([
+        'kind',
+        'source',
+        'id',
+        'platform',
+        'project',
+        'projectId',
+        'owner',
+        'repo',
+        'subject',
+        'changeKind',
+        'changeNumber',
+        'pr',
+        'mr',
+        'branch',
+    ]),
+    'create-review-artifact': new Set(['source', 'review']),
+    'review-artifact-status': new Set(['artifact']),
+    'review-artifact-add-finding': new Set(['artifact', 'issue', 'source']),
+    'review-artifact-update-findings': new Set([
+        'artifact',
+        'state',
+        'disposition',
+        'ids',
+        'fingerprints',
+        'severity',
+    ]),
+    'review-artifact-promote-finding': new Set(['artifact', 'ids', 'fingerprints', 'severity']),
+    'review-artifact-resolve-finding': new Set(['artifact', 'ids', 'fingerprints', 'severity']),
+    'verify-fix': new Set(['artifact', 'review', 'fixChange', 'severity', 'minIssues']),
+    'create-change-request': new Set([
+        'platform',
+        'owner',
+        'repo',
+        'project',
+        'projectId',
+        'sourceBranch',
+        'head',
+        'targetBranch',
+        'base',
+        'title',
+        'body',
+        'draft',
+        'reuseExisting',
+    ]),
+    'create-pr': new Set([
+        'platform',
+        'owner',
+        'repo',
+        'project',
+        'projectId',
+        'sourceBranch',
+        'head',
+        'targetBranch',
+        'base',
+        'title',
+        'body',
+        'draft',
+        'reuseExisting',
+    ]),
+    'create-mr': new Set([
+        'platform',
+        'owner',
+        'repo',
+        'project',
+        'projectId',
+        'sourceBranch',
+        'head',
+        'targetBranch',
+        'base',
+        'title',
+        'body',
+        'draft',
+        'reuseExisting',
+    ]),
+    'change-source': new Set([
+        'type',
+        'staged',
+        'from',
+        'to',
+        'includePrereleaseFrom',
+        'owner',
+        'repo',
+        'pr',
+        'project',
+        'projectId',
+        'mr',
+        'mrIid',
+        'source',
+        'fixChange',
+    ]),
+    review: new Set(['source', 'reviewArtifact', 'severity', 'artifact']),
+    'review-context': new Set(['source', 'file', 'baseBranch']),
+    describe: new Set(['source', 'post', 'postDescription']),
+    'code-quality-report': new Set(['review', 'path']),
+    'post-comment': new Set([
+        'source',
+        'platform',
+        'owner',
+        'repo',
+        'project',
+        'projectId',
+        'pr',
+        'mr',
+        'prNumber',
+        'mrIid',
+        'body',
+        'marker',
+    ]),
+    'post-review-comments': new Set(['source', 'review', 'removeErrorComment']),
+    'post-fix-status': new Set([
+        'platform',
+        'owner',
+        'repo',
+        'project',
+        'projectId',
+        'pr',
+        'mr',
+        'source',
+        'reviewArtifact',
+        'fixReview',
+        'fixChange',
+        'severity',
+        'stackedPrUrl',
+        'marker',
+    ]),
+};
+function validateAllowedFields(nodeId, value, allowed, subject) {
+    const unknownFields = Object.keys(value).filter((key) => !allowed.has(key));
+    if (unknownFields.length > 0) {
+        throw new Error(`Workflow ${subject} "${nodeId}" has unsupported field(s): ${unknownFields.join(', ')}.`);
+    }
+}
+function validateWorkflowNodeShape(nodeId, node) {
+    validateAllowedFields(nodeId, node, WORKFLOW_NODE_FIELDS, 'node');
+    const kind = getNodeKind(node);
+    if (kind === 'control') {
+        const control = node.control;
+        if (!control || !CONTROL_NODE_FIELDS[control]) {
+            throw new Error(`Workflow control node "${nodeId}" has unsupported control "${String(control)}".`);
+        }
+        validateAllowedFields(nodeId, node, CONTROL_NODE_FIELDS[control], 'control node');
+        return;
+    }
+    validateAllowedFields(nodeId, node, EXECUTABLE_NODE_FIELDS, 'node');
+    if (node.action && node.with) {
+        const allowed = ACTION_OPTION_FIELDS[node.action];
+        if (!allowed) {
+            throw new Error(`Workflow action node "${nodeId}" has unsupported action "${node.action}".`);
+        }
+        validateAllowedFields(nodeId, node.with, allowed, `node "${nodeId}" with`);
+    }
+}
+function validateWorkflowNodeKinds(nodes) {
+    for (const [nodeId, node] of Object.entries(nodes)) {
+        validateWorkflowNodeShape(nodeId, node);
+        validateWorkflowPassThroughShape(nodeId, node);
+    }
+}
+function hasWorkflowControlNodes(nodes) {
+    return Object.values(nodes).some((node) => node.control !== undefined);
+}
 function getWorkflowExecutionOrder(nodes) {
     const nodeIds = Object.keys(nodes);
     const visiting = new Set();
@@ -115,7 +434,13 @@ function getWorkflowExecutionOrder(nodes) {
     for (const nodeId of nodeIds) {
         visit(nodeId);
     }
-    return order;
+    validateWorkflowNodeKinds(nodes);
+    validateWorkflowControlTargets(nodes);
+    const standaloneEndNodes = order.filter((nodeId) => nodes[nodeId]?.control === 'end' && getNodeNeeds(nodes[nodeId] ?? {}).length === 0);
+    const nonStandaloneEndNodes = order.filter((nodeId) => !standaloneEndNodes.includes(nodeId));
+    const executionOrder = [...nonStandaloneEndNodes, ...standaloneEndNodes];
+    validateWorkflowControlRouteDirection(nodes, executionOrder);
+    return executionOrder;
 }
 function getWorkflowNodes(workflowName, workflow) {
     const nodes = workflow.nodes;
@@ -174,23 +499,83 @@ function renderTemplate(template, context) {
         return stringifyTemplateValue(value);
     });
 }
+async function flushWorkflowTrace(traceCollector, workflowName, inputs, startedAt, workingDir, options) {
+    const workflowTrace = traceCollector.buildWorkflowTrace(workflowName, inputs, startedAt);
+    const scope = {
+        platform: 'local',
+        projectId: workflowName,
+        subject: 'trace',
+    };
+    const savedJson = await saveWorkflowArtifact(workingDir, {
+        kind: 'trace',
+        scope,
+        payload: workflowTrace,
+    });
+    const traceHtmlPath = join(dirname(savedJson.path), 'trace.html');
+    const html = renderTraceHtml(workflowTrace);
+    await writeWorkflowFile(workingDir, traceHtmlPath, html);
+    if (!options.jsonOutput) {
+        console.log(chalk.green(`\n✓ Trace saved to ${savedJson.latestPath}`));
+        console.log(chalk.green(`✓ Trace viewer saved to ${traceHtmlPath}`));
+    }
+}
 async function resolveWorkflowInput(key, input, workingDir) {
     if (typeof input === 'string') {
         return input;
     }
-    const hasValue = input.value !== undefined;
+    const hasValue = input.value !== undefined || input.default !== undefined;
     const hasFile = input.file !== undefined;
     if (hasValue && hasFile) {
-        throw new Error(`Workflow input "${key}" cannot define both value and file.`);
+        throw new Error(`Workflow input "${key}" cannot define both value/default and file.`);
     }
     if (hasValue) {
-        return input.value ?? '';
+        return String(input.value ?? input.default ?? '');
     }
     if (hasFile) {
         const inputPath = resolveWithinWorkingDir(workingDir, input.file ?? '', 'read');
         return readFile(inputPath, 'utf-8');
     }
-    throw new Error(`Workflow input "${key}" must define value or file.`);
+    if (input.required === true) {
+        return '';
+    }
+    return '';
+}
+function getWorkflowInputConfigType(input) {
+    return typeof input === 'string' ? 'string' : (input.type ?? 'string');
+}
+function validateResolvedWorkflowInput(key, input, value) {
+    if (typeof input === 'string') {
+        return;
+    }
+    if (input.required === true && value.trim() === '') {
+        throw new Error(`Workflow input "${key}" is required.`);
+    }
+    const type = getWorkflowInputConfigType(input);
+    if (type === 'boolean') {
+        if (normalizeWorkflowBooleanLike(value) === undefined) {
+            throw new Error(`Workflow input "${key}" must be a boolean value.`);
+        }
+        return;
+    }
+    if (type === 'number') {
+        if (value.trim() === '' || !Number.isFinite(Number(value))) {
+            throw new Error(`Workflow input "${key}" must be a number.`);
+        }
+        return;
+    }
+    if (type === 'enum') {
+        const allowedValues = input.values?.map(String) ?? [];
+        if (allowedValues.length === 0) {
+            throw new Error(`Workflow input "${key}" with type enum must define values.`);
+        }
+        if (!allowedValues.includes(value)) {
+            throw new Error(`Workflow input "${key}" must be one of: ${allowedValues.join(', ')}.`);
+        }
+        return;
+    }
+    if (type !== 'string') {
+        throw new Error(`Workflow input "${key}" has unsupported type "${type}".`);
+    }
 }
 async function resolveWorkflowInputs(workflow, options, workingDir) {
     const values = {};
@@ -204,6 +589,9 @@ async function resolveWorkflowInputs(workflow, options, workingDir) {
         const resolvedPath = resolveWithinWorkingDir(workingDir, filePath, 'read');
         values[key] = await readFile(resolvedPath, 'utf-8');
     }
+    for (const [key, input] of Object.entries(workflow.inputs ?? {})) {
+        validateResolvedWorkflowInput(key, input, values[key] ?? '');
+    }
     return values;
 }
 function resolveAgentsFrom(config, agentsFrom) {
@@ -213,14 +601,16 @@ function resolveAgentsFrom(config, agentsFrom) {
     throw new Error(`Unsupported workflow agentsFrom "${agentsFrom}". ` + 'Currently supported: review.agents.');
 }
 function getNodeKind(node) {
-    const configuredKinds = [node.agent, node.agentsFrom, node.action].filter((value) => value !== undefined).length;
+    const configuredKinds = [node.agent, node.agentsFrom, node.action, node.control].filter((value) => value !== undefined).length;
     if (configuredKinds !== 1) {
-        throw new Error('Workflow node must define exactly one of agent, agentsFrom, or action.');
+        throw new Error('Workflow node must define exactly one of agent, agentsFrom, action, or control.');
     }
     if (node.agent !== undefined)
         return 'agent';
     if (node.agentsFrom !== undefined)
         return 'agents';
+    if (node.control !== undefined)
+        return 'control';
     return 'action';
 }
 function hasConfiguredAgentPrompt(config, agentId) {
@@ -247,6 +637,35 @@ async function writeWorkflowFile(workingDir, relativeOutputPath, content) {
     await mkdir(dirname(outputPath), { recursive: true });
     await writeFile(outputPath, content, 'utf-8');
 }
+async function formatWorkflowNodeWriteContent(workingDir, nodeId, writes, content) {
+    if (!/\.html?$/i.test(writes)) {
+        return content;
+    }
+    const pointer = parseArtifactOutputPointer(content);
+    if (pointer) {
+        if (pointer.outputPath !== writes) {
+            throw new Error(`Workflow node "${nodeId}" artifact pointer wrote "${pointer.outputPath}" but workflow expected "${writes}".`);
+        }
+        return readArtifactOutputPointer(workingDir, pointer);
+    }
+    try {
+        const html = extractHtmlDocument(content);
+        validateHtmlArtifact(html);
+        return html;
+    }
+    catch (error) {
+        try {
+            return await readArtifactOutputPointer(workingDir, {
+                outputType: 'artifact_output',
+                outputPath: writes,
+            });
+        }
+        catch {
+            // If the agent did not write a valid artifact itself, surface the response validation error.
+        }
+        throw new Error(`Workflow node "${nodeId}" produced invalid HTML output: ${error instanceof Error ? error.message : String(error)}`);
+    }
+}
 function renderNodeWritesPath(nodeId, node, context) {
     if (!node.writes) {
         return undefined;
@@ -257,7 +676,7 @@ function renderNodeWritesPath(nodeId, node, context) {
     }
     return writes;
 }
-async function runAgentWorkflowNode(config, nodeId, node, options, workingDir, context) {
+async function runAgentWorkflowNode(config, nodeId, node, options, workingDir, context, executionContext) {
     const agentId = node.agent;
     if (!agentId) {
         throw new Error(`Workflow node "${nodeId}" is missing agent.`);
@@ -267,17 +686,25 @@ async function runAgentWorkflowNode(config, nodeId, node, options, workingDir, c
         throw new Error(`Workflow agent node "${nodeId}" must define input or configure ` +
             `agents.overrides.${agentId}.run.prompt/promptFile.`);
     }
-    const result = await runAgent(config, agentId, createAgentOptions(prompt, options, workingDir));
+    const agentOptions = createAgentOptions(prompt, options, workingDir);
+    if (executionContext?.traceCollector && prompt) {
+        agentOptions.traceCollector = executionContext.traceCollector;
+        executionContext.traceCollector.setContext(nodeId, agentId, prompt);
+    }
+    const result = await runAgent(config, agentId, agentOptions);
     const writes = renderNodeWritesPath(nodeId, node, context);
+    const output = writes
+        ? await formatWorkflowNodeWriteContent(workingDir, nodeId, writes, node.json === true ? JSON.stringify(result, null, 2) : result.response)
+        : result.response;
     if (writes) {
-        await writeWorkflowFile(workingDir, writes, node.json === true ? JSON.stringify(result, null, 2) : result.response);
+        await writeWorkflowFile(workingDir, writes, output);
     }
     return {
         id: nodeId,
         type: 'agent',
         agent: agentId,
         response: result.response,
-        output: result.response,
+        output,
         writes,
     };
 }
@@ -323,9 +750,64 @@ async function runActionWorkflowNode(config, nodeId, node, options, workingDir,
     if (node.action === 'git-add') {
         return runGitAddWorkflowNode(nodeId, node, workingDir, context, executionContext);
     }
+    if (node.action === 'git-branch') {
+        return runGitBranchWorkflowNode(nodeId, node, workingDir, context, executionContext);
+    }
     if (node.action === 'git-commit') {
         return runGitCommitWorkflowNode(nodeId, node, workingDir, context, executionContext);
     }
+    if (node.action === 'git-push') {
+        return runGitPushWorkflowNode(nodeId, node, workingDir, context, executionContext);
+    }
+    if (node.action === 'has-diff') {
+        return runHasDiffWorkflowNode(nodeId, node, workingDir, context, executionContext);
+    }
+    if (node.action === 'stack-guard') {
+        return runStackGuardWorkflowNode(nodeId, node, context);
+    }
+    if (node.action === 'review-threshold') {
+        return runReviewThresholdWorkflowNode(nodeId, node, context);
+    }
+    if (node.action === 'save-artifact') {
+        return runSaveArtifactWorkflowNode(nodeId, node, workingDir, context, executionContext);
+    }
+    if (node.action === 'load-artifact') {
+        return runLoadArtifactWorkflowNode(nodeId, node, workingDir, context, executionContext);
+    }
+    if (node.action === 'artifact-exists') {
+        return runArtifactExistsWorkflowNode(nodeId, node, workingDir, context, executionContext);
+    }
+    if (node.action === 'create-review-artifact') {
+        return runCreateReviewArtifactWorkflowNode(nodeId, node, context);
+    }
+    if (node.action === 'review-artifact-status') {
+        return runReviewArtifactStatusWorkflowNode(nodeId, node, context);
+    }
+    if (node.action === 'review-artifact-add-finding') {
+        return runReviewArtifactAddFindingWorkflowNode(nodeId, node, workingDir, context);
+    }
+    if (node.action === 'review-artifact-update-findings') {
+        return runReviewArtifactUpdateFindingsWorkflowNode(nodeId, node, workingDir, context);
+    }
+    if (node.action === 'verify-fix') {
+        return runVerifyFixWorkflowNode(nodeId, node, workingDir, context);
+    }
+    if (node.action === 'review-artifact-promote-finding') {
+        return runReviewArtifactUpdateFindingsWorkflowNode(nodeId, node, workingDir, context, {
+            disposition: 'confirmed',
+        });
+    }
+    if (node.action === 'review-artifact-resolve-finding') {
+        return runReviewArtifactUpdateFindingsWorkflowNode(nodeId, node, workingDir, context, {
+            state: 'resolved',
+            disposition: 'resolved',
+        });
+    }
+    if (node.action === 'create-change-request' ||
+        node.action === 'create-pr' ||
+        node.action === 'create-mr') {
+        return runCreateChangeRequestWorkflowNode(nodeId, node, context, executionContext);
+    }
     if (node.action === 'change-source') {
         return runChangeSourceWorkflowNode(nodeId, node, workingDir, context, executionContext);
     }
@@ -347,6 +829,9 @@ async function runActionWorkflowNode(config, nodeId, node, options, workingDir,
     if (node.action === 'post-review-comments') {
         return runPostReviewCommentsWorkflowNode(config, nodeId, node, options, workingDir, context, executionContext);
     }
+    if (node.action === 'post-fix-status') {
+        return runPostFixStatusWorkflowNode(nodeId, node, options, workingDir, context, executionContext);
+    }
     throw new Error(`Unsupported workflow action "${node.action}" in node "${nodeId}".`);
 }
 async function runWriteWorkflowNode(nodeId, node, workingDir, context) {
@@ -371,9 +856,13 @@ async function runWriteWorkflowNode(nodeId, node, workingDir, context) {
         writes: relativeOutputPath,
     };
 }
-function getBooleanActionOption(node, key) {
+function getBooleanActionOption(node, key, context) {
     const value = node.with?.[key];
-    return value === true || value === 'true';
+    if (typeof value === 'string' && context) {
+        const rendered = renderTemplate(value, context).trim().toLowerCase();
+        return rendered === 'true' || rendered === '1' || rendered === 'yes';
+    }
+    return value === true || value === 'true' || value === 1;
 }
 function getStringActionOption(node, key, context) {
     const value = node.with?.[key];
@@ -419,6 +908,12 @@ function getPathActionOption(nodeId, node, context, workingDir) {
     }
     return paths;
 }
+function getOptionalPathActionOption(nodeId, node, context, workingDir) {
+    if (!hasActionOption(node, 'paths') && !hasActionOption(node, 'path')) {
+        return undefined;
+    }
+    return getPathActionOption(nodeId, node, context, workingDir);
+}
 async function requireWorkflowGitRepo(nodeId, workingDir, executionContext) {
     const git = getWorkflowGitClient(executionContext, workingDir);
     const isRepo = await git.checkIsRepo();
@@ -433,7 +928,7 @@ async function runGitDiffWorkflowNode(nodeId, node, workingDir, context, executi
     if (!isRepo) {
         throw new Error(`Workflow git-diff node "${nodeId}" must run from a git repository.`);
     }
-    const staged = getBooleanActionOption(node, 'staged');
+    const staged = getBooleanActionOption(node, 'staged', context);
     const diff = staged ? await git.diff(['--cached']) : await git.diff();
     const writes = renderNodeWritesPath(nodeId, node, context);
     if (writes) {
@@ -460,6 +955,24 @@ async function runGitAddWorkflowNode(nodeId, node, workingDir, context, executio
         output: paths,
     };
 }
+async function runGitBranchWorkflowNode(nodeId, node, workingDir, context, executionContext) {
+    const git = await requireWorkflowGitRepo(nodeId, workingDir, executionContext);
+    const name = requireStringActionOption(nodeId, node, 'name', context);
+    const from = getStringActionOption(node, 'from', context)?.trim();
+    const force = getBooleanActionOption(node, 'force', context);
+    const args = ['checkout', force ? '-B' : '-b', name];
+    if (from) {
+        args.push(from);
+    }
+    await git.raw(args);
+    return {
+        id: nodeId,
+        type: 'action',
+        action: node.action,
+        response: `checked out branch ${name}`,
+        output: { branch: name, from, force },
+    };
+}
 async function runGitCommitWorkflowNode(nodeId, node, workingDir, context, executionContext) {
     const git = await requireWorkflowGitRepo(nodeId, workingDir, executionContext);
     const message = requireStringActionOption(nodeId, node, 'message', context);
@@ -484,13 +997,464 @@ async function runGitCommitWorkflowNode(nodeId, node, workingDir, context, execu
         output,
     };
 }
-async function loadLocalChangeSource(nodeId, node, workingDir) {
+async function runGitPushWorkflowNode(nodeId, node, workingDir, context, executionContext) {
+    const git = await requireWorkflowGitRepo(nodeId, workingDir, executionContext);
+    const configuredRemote = getStringActionOption(node, 'remote', context)?.trim();
+    const remote = configuredRemote && configuredRemote.length > 0 ? configuredRemote : 'origin';
+    const branch = requireStringActionOption(nodeId, node, 'branch', context);
+    const configuredRemoteBranch = getStringActionOption(node, 'remoteBranch', context)?.trim();
+    const remoteBranch = configuredRemoteBranch && configuredRemoteBranch.length > 0 ? configuredRemoteBranch : branch;
+    const setUpstream = !hasActionOption(node, 'setUpstream') || getBooleanActionOption(node, 'setUpstream', context);
+    const force = getBooleanActionOption(node, 'force', context);
+    const args = ['push'];
+    if (setUpstream) {
+        args.push('-u');
+    }
+    if (force) {
+        args.push('--force-with-lease');
+    }
+    args.push(remote, `${branch}:${remoteBranch}`);
+    await git.raw(args);
+    return {
+        id: nodeId,
+        type: 'action',
+        action: node.action,
+        response: `pushed ${branch} to ${remote}/${remoteBranch}`,
+        output: { remote, branch, remoteBranch, setUpstream, force },
+    };
+}
+async function runHasDiffWorkflowNode(nodeId, node, workingDir, context, executionContext) {
+    const git = await requireWorkflowGitRepo(nodeId, workingDir, executionContext);
+    const paths = getOptionalPathActionOption(nodeId, node, context, workingDir);
+    const diff = paths ? await git.diff(['--', ...paths]) : await git.diff();
+    const files = paths ?? [];
+    const changed = diff.trim().length > 0;
+    return {
+        id: nodeId,
+        type: 'action',
+        action: node.action,
+        response: changed ? 'changes found' : 'no changes found',
+        output: { changed, files, bytes: Buffer.byteLength(diff, 'utf8') },
+    };
+}
+function runStackGuardWorkflowNode(nodeId, node, context) {
+    const sourceArtifact = getStringActionOption(node, 'source', context) ?? 'change';
+    const source = context.artifacts[sourceArtifact];
+    if (!isReviewSource(source)) {
+        throw new Error(`Workflow stack-guard node "${nodeId}" needs a ReviewSource artifact.`);
+    }
+    const pullRequest = isPullRequest(source.context.pullRequest)
+        ? source.context.pullRequest
+        : undefined;
+    const sourceBranch = pullRequest?.sourceBranch ?? '';
+    const allowStackedSource = getBooleanActionOption(node, 'allowStackedSource', context);
+    const rawPrefixes = getStringActionOption(node, 'reservedPrefixes', context) ?? 'drs-fix/,drs-guidance/,drs-stack/';
+    const reservedPrefixes = rawPrefixes
+        .split(/[,\n]/)
+        .map((prefix) => prefix.trim())
+        .filter(Boolean);
+    const matchingPrefix = reservedPrefixes.find((prefix) => sourceBranch.startsWith(prefix));
+    const allowed = allowStackedSource || !matchingPrefix;
+    const reason = allowed ? 'allowed' : `source branch uses reserved DRS prefix "${matchingPrefix}"`;
+    return {
+        id: nodeId,
+        type: 'action',
+        action: node.action,
+        response: reason,
+        output: { allowed, reason, sourceBranch, reservedPrefixes },
+    };
+}
+function severityRank(severity) {
+    const normalized = severity.trim().toUpperCase();
+    if (normalized === 'CRITICAL')
+        return 4;
+    if (normalized === 'HIGH')
+        return 3;
+    if (normalized === 'MEDIUM')
+        return 2;
+    if (normalized === 'LOW')
+        return 1;
+    return 0;
+}
+function runReviewThresholdWorkflowNode(nodeId, node, context) {
+    const reviewArtifact = getStringActionOption(node, 'review', context) ?? 'review';
+    const reviewResult = context.artifacts[reviewArtifact];
+    if (!isReviewResult(reviewResult)) {
+        throw new Error(`Workflow review-threshold node "${nodeId}" needs a ReviewResult artifact.`);
+    }
+    const severity = (getStringActionOption(node, 'severity', context) ?? 'high').toUpperCase();
+    const minIssues = hasActionOption(node, 'minIssues')
+        ? requireNumberActionOption(nodeId, node, 'minIssues', context)
+        : 1;
+    const thresholdRank = severityRank(severity);
+    if (thresholdRank === 0) {
+        throw new Error(`Workflow review-threshold node "${nodeId}" has unsupported severity "${severity}".`);
+    }
+    const matchingIssues = reviewResult.issues.filter((issue) => severityRank(issue.severity) >= thresholdRank);
+    const matched = matchingIssues.length >= minIssues;
+    return {
+        id: nodeId,
+        type: 'action',
+        action: node.action,
+        response: matched ? `${matchingIssues.length} matching issue(s)` : 'threshold not met',
+        output: { matched, count: matchingIssues.length, severity, minIssues },
+    };
+}
+async function getCurrentBranch(workingDir, executionContext) {
+    const git = await requireWorkflowGitRepo('artifact-scope', workingDir, executionContext);
+    const branch = await git.branch();
+    return branch.current ?? 'unknown';
+}
+async function resolveArtifactScope(nodeId, node, workingDir, context, executionContext) {
+    const sourceArtifact = getStringActionOption(node, 'source', context);
+    const source = sourceArtifact ? context.artifacts[sourceArtifact] : undefined;
+    const reviewSource = isReviewSource(source) ? source : undefined;
+    const sourceTarget = readSourcePostTarget(reviewSource);
+    const explicitPlatform = getStringActionOption(node, 'platform', context);
+    const platform = explicitPlatform ?? sourceTarget.platform ?? 'local';
+    const projectId = getStringActionOption(node, 'project', context) ??
+        getStringActionOption(node, 'projectId', context) ??
+        (hasActionOption(node, 'owner') || hasActionOption(node, 'repo')
+            ? `${requireStringActionOption(nodeId, node, 'owner', context)}/${requireStringActionOption(nodeId, node, 'repo', context)}`
+            : undefined) ??
+        sourceTarget.projectId ??
+        'local';
+    const explicitSubject = getStringActionOption(node, 'subject', context)?.trim();
+    if (explicitSubject) {
+        return { platform, projectId, subject: explicitSubject };
+    }
+    const explicitChangeKind = getStringActionOption(node, 'changeKind', context)?.trim();
+    const explicitChangeNumber = getStringActionOption(node, 'changeNumber', context)?.trim() ??
+        getStringActionOption(node, 'pr', context)?.trim() ??
+        getStringActionOption(node, 'mr', context)?.trim();
+    const sourceChangeKind = sourceTarget.platform === 'gitlab' ? 'mr' : sourceTarget.platform ? 'pr' : undefined;
+    const sourceChangeNumber = sourceTarget.prNumber;
+    const changeKind = explicitChangeKind && explicitChangeKind.length > 0 ? explicitChangeKind : sourceChangeKind;
+    const changeNumber = explicitChangeNumber ?? sourceChangeNumber;
+    if (changeKind && changeNumber !== undefined) {
+        return { platform, projectId, changeKind, changeNumber };
+    }
+    const configuredBranch = getStringActionOption(node, 'branch', context)?.trim();
+    const branch = configuredBranch && configuredBranch.length > 0
+        ? configuredBranch
+        : await getCurrentBranch(workingDir, executionContext);
+    return { platform, projectId, branch };
+}
+function getArtifactPayloadFromNode(nodeId, node, context) {
+    const artifactName = getStringActionOption(node, 'artifact', context);
+    if (artifactName) {
+        if (!Object.prototype.hasOwnProperty.call(context.artifacts, artifactName)) {
+            throw new Error(`Workflow node "${nodeId}" references unknown artifact "${artifactName}".`);
+        }
+        return context.artifacts[artifactName];
+    }
+    const payloadName = getStringActionOption(node, 'payload', context);
+    if (payloadName && Object.prototype.hasOwnProperty.call(context.artifacts, payloadName)) {
+        return context.artifacts[payloadName];
+    }
+    if (payloadName) {
+        try {
+            return JSON.parse(payloadName);
+        }
+        catch {
+            return payloadName;
+        }
+    }
+    throw new Error(`Workflow node "${nodeId}" must define with.artifact or with.payload.`);
+}
+async function runSaveArtifactWorkflowNode(nodeId, node, workingDir, context, executionContext) {
+    const kind = requireStringActionOption(nodeId, node, 'kind', context);
+    const payload = getArtifactPayloadFromNode(nodeId, node, context);
+    const scope = await resolveArtifactScope(nodeId, node, workingDir, context, executionContext);
+    const saved = await saveWorkflowArtifact(workingDir, { kind, scope, payload });
+    return {
+        id: nodeId,
+        type: 'action',
+        action: node.action,
+        response: `saved ${kind} artifact ${saved.artifact.id}`,
+        output: { ...saved.artifact, path: saved.path, latestPath: saved.latestPath },
+    };
+}
+async function runLoadArtifactWorkflowNode(nodeId, node, workingDir, context, executionContext) {
+    const kind = requireStringActionOption(nodeId, node, 'kind', context);
+    const rawId = getStringActionOption(node, 'id', context)?.trim();
+    const id = rawId && rawId.length > 0 ? rawId : undefined;
+    const scope = await resolveArtifactScope(nodeId, node, workingDir, context, executionContext);
+    const loaded = await loadWorkflowArtifact(workingDir, kind, scope, id);
+    return {
+        id: nodeId,
+        type: 'action',
+        action: node.action,
+        response: `loaded ${kind} artifact ${loaded.artifact.id}`,
+        output: { ...loaded.artifact, path: loaded.path },
+    };
+}
+async function runArtifactExistsWorkflowNode(nodeId, node, workingDir, context, executionContext) {
+    const kind = requireStringActionOption(nodeId, node, 'kind', context);
+    const rawId = getStringActionOption(node, 'id', context)?.trim();
+    const id = rawId && rawId.length > 0 ? rawId : undefined;
+    const scope = await resolveArtifactScope(nodeId, node, workingDir, context, executionContext);
+    const exists = await workflowArtifactExists(workingDir, kind, scope, id);
+    return {
+        id: nodeId,
+        type: 'action',
+        action: node.action,
+        response: exists ? 'artifact exists' : 'artifact missing',
+        output: { exists, kind, scope, id },
+    };
+}
+function runCreateReviewArtifactWorkflowNode(nodeId, node, context) {
+    const reviewArtifact = getStringActionOption(node, 'review', context) ?? 'review';
+    const review = context.artifacts[reviewArtifact];
+    if (!isReviewResult(review)) {
+        throw new Error(`Workflow create-review-artifact node "${nodeId}" needs a ReviewResult artifact.`);
+    }
+    const sourceArtifact = getStringActionOption(node, 'source', context);
+    const source = sourceArtifact ? context.artifacts[sourceArtifact] : undefined;
+    const reviewSource = isReviewSource(source) ? source : undefined;
+    const artifact = createReviewArtifactPayload(review, reviewSource);
+    return {
+        id: nodeId,
+        type: 'action',
+        action: node.action,
+        response: `created review artifact ${artifact.reviewId}`,
+        output: artifact,
+    };
+}
+function getReviewArtifactPayloadFromValue(nodeId, value) {
+    const envelope = value;
+    const payload = envelope && typeof envelope === 'object' && 'payload' in envelope ? envelope.payload : value;
+    if (!isReviewArtifactPayload(payload)) {
+        throw new Error(`Workflow review-artifact-status node "${nodeId}" needs a review artifact payload.`);
+    }
+    return payload;
+}
+function getReviewArtifactEnvelopeFromValue(value) {
+    if (!value || typeof value !== 'object') {
+        return undefined;
+    }
+    const envelope = value;
+    if (envelope.schemaVersion === 1 &&
+        envelope.kind === 'review' &&
+        typeof envelope.id === 'string' &&
+        typeof envelope.createdAt === 'string' &&
+        typeof envelope.updatedAt === 'string' &&
+        envelope.scope &&
+        typeof envelope.scope === 'object' &&
+        isReviewArtifactPayload(envelope.payload)) {
+        return envelope;
+    }
+    return undefined;
+}
+function getReviewArtifactInput(nodeId, node, context) {
+    const artifactName = getStringActionOption(node, 'artifact', context) ?? 'reviewArtifact';
+    const artifactValue = context.artifacts[artifactName];
+    const artifact = getReviewArtifactPayloadFromValue(nodeId, artifactValue);
+    return { artifact, envelope: getReviewArtifactEnvelopeFromValue(artifactValue) };
+}
+async function persistMutatedReviewArtifact(workingDir, payload, envelope) {
+    if (!envelope) {
+        return { output: payload, responseSuffix: '' };
+    }
+    const saved = await updateWorkflowArtifact(workingDir, { artifact: envelope, payload });
+    return {
+        output: { ...saved.artifact, path: saved.path, latestPath: saved.latestPath },
+        responseSuffix: ` and saved ${saved.artifact.id}`,
+    };
+}
+function parseListActionOption(node, key, context) {
+    const value = getStringActionOption(node, key, context)?.trim();
+    if (!value) {
+        return undefined;
+    }
+    return value
+        .split(/[,\n]/)
+        .map((item) => item.trim())
+        .filter(Boolean);
+}
+function parseReviewFindingState(nodeId, value) {
+    if (!value) {
+        return undefined;
+    }
+    if (value === 'open' || value === 'attempted' || value === 'resolved') {
+        return value;
+    }
+    throw new Error(`Workflow node "${nodeId}" has invalid review finding state "${value}".`);
+}
+function parseReviewFindingDisposition(nodeId, value) {
+    if (!value) {
+        return undefined;
+    }
+    if (value === 'confirmed' ||
+        value === 'uncertain' ||
+        value === 'pre_existing' ||
+        value === 'partial' ||
+        value === 'still_open' ||
+        value === 'regression' ||
+        value === 'resolved') {
+        return value;
+    }
+    throw new Error(`Workflow node "${nodeId}" has invalid review finding disposition "${value}".`);
+}
+function parseReviewFindingSource(nodeId, value) {
+    if (!value) {
+        return 'manual';
+    }
+    if (value === 'agent' || value === 'manual' || value === 'external') {
+        return value;
+    }
+    throw new Error(`Workflow node "${nodeId}" has invalid review finding source "${value}".`);
+}
+function isReviewIssue(value) {
+    if (!value || typeof value !== 'object') {
+        return false;
+    }
+    const issue = value;
+    return (typeof issue.severity === 'string' &&
+        typeof issue.category === 'string' &&
+        typeof issue.title === 'string' &&
+        typeof issue.file === 'string' &&
+        typeof issue.problem === 'string' &&
+        typeof issue.solution === 'string');
+}
+function getReviewIssueFromNode(nodeId, node, context) {
+    const issueName = requireStringActionOption(nodeId, node, 'issue', context);
+    const issue = Object.prototype.hasOwnProperty.call(context.artifacts, issueName)
+        ? context.artifacts[issueName]
+        : JSON.parse(issueName);
+    if (!isReviewIssue(issue)) {
+        throw new Error(`Workflow review-artifact-add-finding node "${nodeId}" needs a ReviewIssue.`);
+    }
+    return issue;
+}
+function runReviewArtifactStatusWorkflowNode(nodeId, node, context) {
+    const artifactName = getStringActionOption(node, 'artifact', context) ?? 'reviewArtifact';
+    const artifactValue = context.artifacts[artifactName];
+    const artifact = getReviewArtifactPayloadFromValue(nodeId, artifactValue);
+    const status = getReviewArtifactStatus(artifact);
+    return {
+        id: nodeId,
+        type: 'action',
+        action: node.action,
+        response: `${status.totalFindings} finding(s), ${status.openFindings} open`,
+        output: status,
+    };
+}
+async function runReviewArtifactAddFindingWorkflowNode(nodeId, node, workingDir, context) {
+    const { artifact, envelope } = getReviewArtifactInput(nodeId, node, context);
+    const issue = getReviewIssueFromNode(nodeId, node, context);
+    const source = parseReviewFindingSource(nodeId, getStringActionOption(node, 'source', context));
+    const updated = addReviewArtifactFinding(artifact, issue, source);
+    const persisted = await persistMutatedReviewArtifact(workingDir, updated, envelope);
+    const addedFinding = updated.findings[updated.findings.length - 1];
+    return {
+        id: nodeId,
+        type: 'action',
+        action: node.action,
+        response: `added review finding ${addedFinding?.id ?? 'unknown'}${persisted.responseSuffix}`,
+        output: persisted.output,
+    };
+}
+async function runReviewArtifactUpdateFindingsWorkflowNode(nodeId, node, workingDir, context, defaults = {}) {
+    const { artifact, envelope } = getReviewArtifactInput(nodeId, node, context);
+    const state = parseReviewFindingState(nodeId, getStringActionOption(node, 'state', context) ?? defaults.state);
+    const disposition = parseReviewFindingDisposition(nodeId, getStringActionOption(node, 'disposition', context) ?? defaults.disposition);
+    if (!state && !disposition) {
+        throw new Error(`Workflow node "${nodeId}" must define with.state or with.disposition.`);
+    }
+    const { artifact: updated, updatedIds } = updateReviewArtifactFindings(artifact, {
+        ids: parseListActionOption(node, 'ids', context),
+        fingerprints: parseListActionOption(node, 'fingerprints', context),
+        severity: getStringActionOption(node, 'severity', context)?.trim().toUpperCase(),
+        state,
+        disposition,
+    });
+    const persisted = await persistMutatedReviewArtifact(workingDir, updated, envelope);
+    return {
+        id: nodeId,
+        type: 'action',
+        action: node.action,
+        response: `updated ${updatedIds.length} review finding(s)${persisted.responseSuffix}`,
+        output: {
+            ...(typeof persisted.output === 'object' && persisted.output !== null
+                ? persisted.output
+                : {}),
+            updatedIds,
+        },
+    };
+}
+async function runVerifyFixWorkflowNode(nodeId, node, workingDir, context) {
+    const { artifact, envelope } = getReviewArtifactInput(nodeId, node, context);
+    const reviewArtifact = getStringActionOption(node, 'review', context) ?? 'reReview';
+    const review = context.artifacts[reviewArtifact];
+    if (!isReviewResult(review)) {
+        throw new Error(`Workflow verify-fix node "${nodeId}" needs a ReviewResult.`);
+    }
+    const severity = (getStringActionOption(node, 'severity', context) ?? 'high').toUpperCase();
+    if (severityRank(severity) === 0) {
+        throw new Error(`Workflow verify-fix node "${nodeId}" has unsupported severity "${severity}".`);
+    }
+    const minIssues = hasActionOption(node, 'minIssues')
+        ? requireNumberActionOption(nodeId, node, 'minIssues', context)
+        : 1;
+    const fixChangeName = getStringActionOption(node, 'fixChange', context);
+    const fixChange = fixChangeName ? context.artifacts[fixChangeName] : undefined;
+    const fixSource = isReviewSource(fixChange) ? fixChange : undefined;
+    const reconciliation = reconcileReviewArtifactFindings(artifact, review, {
+        severity,
+        minIssues,
+        fixSource,
+    });
+    const persisted = await persistMutatedReviewArtifact(workingDir, reconciliation.artifact, envelope);
+    const status = getReviewArtifactStatus(reconciliation.artifact);
+    const output = {
+        ...(typeof persisted.output === 'object' && persisted.output !== null ? persisted.output : {}),
+        payload: reconciliation.artifact,
+        verification: {
+            severity,
+            minIssues,
+            shouldContinue: reconciliation.shouldContinue,
+            actionableOpen: reconciliation.actionableOpen,
+            fixFiles: fixSource?.files.length ?? 0,
+            resolved: reconciliation.resolved,
+            partial: reconciliation.partial,
+            stillOpen: reconciliation.stillOpen,
+            regression: reconciliation.regression,
+            statuses: reconciliation.statuses.map((statusItem) => ({
+                id: statusItem.finding.id,
+                fingerprint: statusItem.finding.fingerprint,
+                disposition: statusItem.disposition,
+                severity: statusItem.finding.issue.severity,
+                file: statusItem.finding.issue.file,
+                line: statusItem.finding.issue.line,
+                title: statusItem.finding.issue.title,
+                verificationMissing: statusItem.verificationMissing === true,
+                verificationRationale: statusItem.finding.verification?.rationale,
+            })),
+        },
+        shouldContinue: reconciliation.shouldContinue,
+        actionableOpen: reconciliation.actionableOpen,
+        fixFiles: fixSource?.files.length ?? 0,
+        updatedIds: reconciliation.statuses.map((statusItem) => statusItem.finding.id),
+        status,
+    };
+    return {
+        id: nodeId,
+        type: 'action',
+        action: node.action,
+        response: reconciliation.shouldContinue
+            ? `${reconciliation.actionableOpen} actionable finding(s) remain${persisted.responseSuffix}`
+            : `fix verification converged${persisted.responseSuffix}`,
+        output,
+    };
+}
+async function loadLocalChangeSource(nodeId, node, workingDir, context) {
     const git = simpleGit({ baseDir: workingDir });
     const isRepo = await git.checkIsRepo();
     if (!isRepo) {
         throw new Error(`Workflow change-source node "${nodeId}" must run from a git repository.`);
     }
-    const staged = getBooleanActionOption(node, 'staged');
+    const staged = getBooleanActionOption(node, 'staged', context);
     const diffText = staged ? await git.diff(['--cached']) : await git.diff();
     const diffs = parseDiff(diffText);
     const changedFiles = getChangedFiles(diffs);
@@ -528,8 +1492,8 @@ async function resolveGitRangeToRef(git) {
 function isStableSemverTag(tag) {
     return /^v?\d+\.\d+\.\d+$/.test(tag);
 }
-async function resolvePreviousGitRangeTag(nodeId, node, git, toRef) {
-    const includePrerelease = getBooleanActionOption(node, 'includePrereleaseFrom');
+async function resolvePreviousGitRangeTag(nodeId, node, git, toRef, context) {
+    const includePrerelease = getBooleanActionOption(node, 'includePrereleaseFrom', context);
     const tagOutput = await git.raw(['tag', '--merged', toRef, '--sort=-v:refname']);
     const tags = tagOutput
         .split('\n')
@@ -544,11 +1508,9 @@ async function resolvePreviousGitRangeTag(nodeId, node, git, toRef) {
 }
 async function resolveGitRangeRefs(nodeId, node, context, git) {
     const configuredToRef = getStringActionOption(node, 'to', context)?.trim();
-    const toRef = configuredToRef ? configuredToRef : await resolveGitRangeToRef(git);
+    const toRef = configuredToRef ?? (await resolveGitRangeToRef(git));
     const configuredFromRef = getStringActionOption(node, 'from', context)?.trim();
-    const fromRef = configuredFromRef
-        ? configuredFromRef
-        : await resolvePreviousGitRangeTag(nodeId, node, git, toRef);
+    const fromRef = configuredFromRef ?? (await resolvePreviousGitRangeTag(nodeId, node, git, toRef, context));
     if (!fromRef) {
         throw new Error(`Workflow node "${nodeId}" could not infer the previous tag for ${toRef}. ` +
             'Provide with.from explicitly.');
@@ -619,11 +1581,68 @@ async function loadGitLabChangeSource(nodeId, node, workingDir, context, executi
     ]);
     return createPlatformChangeSource('gitlab', `GitLab MR ${projectId}!${mrIid}`, projectId, pullRequest, changedFiles, workingDir);
 }
+function combineVerificationPatch(originalPatch, fixPatch) {
+    const sections = [];
+    if (originalPatch) {
+        sections.push(`# Original PR/MR diff\n${originalPatch}`);
+    }
+    if (fixPatch) {
+        sections.push(`# Local fix diff\n${fixPatch}`);
+    }
+    return sections.join('\n\n');
+}
+async function loadFixVerificationChangeSource(nodeId, node, workingDir, context) {
+    const sourceName = getStringActionOption(node, 'source', context) ?? 'change';
+    const source = context.artifacts[sourceName];
+    if (!isReviewSource(source)) {
+        throw new Error(`Workflow fix-verification change-source node "${nodeId}" needs a source ReviewSource artifact.`);
+    }
+    const fixChangeName = getStringActionOption(node, 'fixChange', context) ?? 'fixChange';
+    const fixChange = context.artifacts[fixChangeName];
+    if (!isReviewSource(fixChange)) {
+        throw new Error(`Workflow fix-verification change-source node "${nodeId}" needs a fixChange ReviewSource artifact.`);
+    }
+    const files = [...new Set([...source.files, ...fixChange.files])];
+    const pullRequest = isPullRequest(source.context.pullRequest) ? source.context.pullRequest : null;
+    const baseRef = pullRequest?.targetBranch ?? source.context.baseBranch ?? 'HEAD~1';
+    const realDiffs = await tryGetRealPostFixDiff(workingDir, files, baseRef);
+    return {
+        ...source,
+        name: `${source.name} with local fixes`,
+        files,
+        filesWithDiffs: realDiffs ??
+            files.map((filename) => ({
+                filename,
+                patch: combineVerificationPatch((source.filesWithDiffs ?? []).find((f) => f.filename === filename)?.patch, (fixChange.filesWithDiffs ?? []).find((f) => f.filename === filename)?.patch),
+            })),
+        context: {
+            ...source.context,
+            sourceType: 'fix-verification',
+            fixFiles: fixChange.files,
+        },
+        staged: fixChange.staged,
+    };
+}
+async function tryGetRealPostFixDiff(workingDir, files, baseRef) {
+    try {
+        const git = simpleGit({ baseDir: workingDir });
+        const isRepo = await git.checkIsRepo();
+        if (!isRepo)
+            return undefined;
+        const diffText = await git.diff(['--no-ext-diff', '-M', baseRef, '--', ...files]);
+        if (!diffText.trim())
+            return undefined;
+        return getFilesWithDiffs(parseDiff(diffText));
+    }
+    catch {
+        return undefined;
+    }
+}
 async function runChangeSourceWorkflowNode(nodeId, node, workingDir, context, executionContext) {
     const type = getStringActionOption(node, 'type', context) ?? 'local';
     let source;
     if (type === 'local') {
-        source = await loadLocalChangeSource(nodeId, node, workingDir);
+        source = await loadLocalChangeSource(nodeId, node, workingDir, context);
     }
     else if (type === 'git-range') {
         source = await loadGitRangeChangeSource(nodeId, node, workingDir, context, executionContext);
@@ -634,9 +1653,12 @@ async function runChangeSourceWorkflowNode(nodeId, node, workingDir, context, ex
     else if (type === 'gitlab-mr') {
         source = await loadGitLabChangeSource(nodeId, node, workingDir, context, executionContext);
     }
+    else if (type === 'fix-verification') {
+        source = await loadFixVerificationChangeSource(nodeId, node, workingDir, context);
+    }
     else {
         throw new Error(`Unsupported workflow change-source type "${type}" in node "${nodeId}". ` +
-            'Currently supported: local, git-range, github-pr, gitlab-mr.');
+            'Currently supported: local, git-range, github-pr, gitlab-mr, fix-verification.');
     }
     const writes = renderNodeWritesPath(nodeId, node, context);
     if (writes) {
@@ -724,9 +1746,84 @@ function resolvePostTarget(nodeId, node, context, executionContext, source) {
         changedFiles: sourceTarget.changedFiles,
     };
 }
-function isPullRequest(value) {
-    if (!value || typeof value !== 'object') {
-        return false;
+async function runCreateChangeRequestWorkflowNode(nodeId, node, context, executionContext) {
+    const sourceArtifact = getStringActionOption(node, 'source', context) ?? 'change';
+    const source = isReviewSource(context.artifacts[sourceArtifact])
+        ? context.artifacts[sourceArtifact]
+        : undefined;
+    const sourceTarget = readSourcePostTarget(source);
+    const aliasPlatform = node.action === 'create-pr' ? 'github' : node.action === 'create-mr' ? 'gitlab' : undefined;
+    const explicitPlatform = getStringActionOption(node, 'platform', context);
+    const platform = aliasPlatform ?? explicitPlatform ?? sourceTarget.platform;
+    if (!isWorkflowPlatform(platform)) {
+        throw new Error(`Workflow change-request node "${nodeId}" must resolve with.platform to github or gitlab.`);
+    }
+    const projectId = resolvePostProjectId(nodeId, node, context, sourceTarget);
+    const configuredSourceBranch = getStringActionOption(node, 'sourceBranch', context)?.trim();
+    const configuredHead = getStringActionOption(node, 'head', context)?.trim();
+    const sourceBranch = configuredSourceBranch && configuredSourceBranch.length > 0
+        ? configuredSourceBranch
+        : configuredHead;
+    const configuredTargetBranch = getStringActionOption(node, 'targetBranch', context)?.trim();
+    const configuredBase = getStringActionOption(node, 'base', context)?.trim();
+    const targetBranch = configuredTargetBranch && configuredTargetBranch.length > 0
+        ? configuredTargetBranch
+        : configuredBase;
+    if (!sourceBranch) {
+        throw new Error(`Workflow change-request node "${nodeId}" must define with.sourceBranch.`);
+    }
+    if (!targetBranch) {
+        throw new Error(`Workflow change-request node "${nodeId}" must define with.targetBranch.`);
+    }
+    const title = requireStringActionOption(nodeId, node, 'title', context);
+    const body = getStringActionOption(node, 'body', context);
+    const draft = getBooleanActionOption(node, 'draft', context);
+    const reuseExisting = !hasActionOption(node, 'reuseExisting') ||
+        getBooleanActionOption(node, 'reuseExisting', context);
+    const platformClient = getWorkflowPlatformClient(executionContext, platform);
+    const input = {
+        sourceBranch,
+        targetBranch,
+        title,
+        body,
+        draft,
+    };
+    const existing = reuseExisting
+        ? await platformClient.findChangeRequest?.(projectId, sourceBranch, targetBranch)
+        : undefined;
+    let operation = existing ? 'reused' : 'created';
+    const changeRequest = existing ??
+        (await platformClient.createChangeRequest(projectId, input).catch(async (error) => {
+            if (reuseExisting) {
+                try {
+                    const retryExisting = await platformClient.findChangeRequest?.(projectId, sourceBranch, targetBranch);
+                    if (retryExisting) {
+                        operation = 'reused';
+                        return retryExisting;
+                    }
+                }
+                catch {
+                    // ignore retry failure; fall through to throw original error
+                }
+            }
+            throw error;
+        }));
+    return {
+        id: nodeId,
+        type: 'action',
+        action: node.action,
+        response: `${operation} ${platform} change request #${changeRequest.number}`,
+        output: {
+            platform,
+            projectId,
+            operation,
+            ...changeRequest,
+        },
+    };
+}
+function isPullRequest(value) {
+    if (!value || typeof value !== 'object') {
+        return false;
     }
     const candidate = value;
     return (typeof candidate.number === 'number' &&
@@ -755,19 +1852,24 @@ function createWorkflowLineValidator(platform, source) {
         : [];
     const patchSources = fileChanges.length > 0 ? fileChanges : (source.filesWithDiffs ?? []);
     const validLinesMap = new Map();
+    const changedLinesMap = new Map();
     for (const file of patchSources) {
         if ('status' in file && file.status === 'removed') {
             continue;
         }
         const patch = file.patch;
         if (patch) {
-            validLinesMap.set(file.filename, parseValidLinesFromPatch(patch));
+            const lineInfo = parseDiffLineInfo(patch);
+            validLinesMap.set(file.filename, lineInfo.commentableLines);
+            changedLinesMap.set(file.filename, lineInfo.addedLines);
         }
     }
     return {
         isValidLine(file, line) {
-            const validLines = validLinesMap.get(file);
-            return validLines !== undefined && validLines.has(line);
+            return validLinesMap.get(file)?.has(line) ?? false;
+        },
+        isChangedLine(file, line) {
+            return changedLinesMap.get(file)?.has(line) ?? false;
         },
     };
 }
@@ -896,7 +1998,8 @@ async function runDescribeWorkflowNode(config, nodeId, node, options, workingDir
     if (!target.pullRequest) {
         throw new Error(`Workflow describe node "${nodeId}" needs a platform change-source target.`);
     }
-    const shouldPostDescription = getBooleanActionOption(node, 'post') || getBooleanActionOption(node, 'postDescription');
+    const shouldPostDescription = getBooleanActionOption(node, 'post', context) ||
+        getBooleanActionOption(node, 'postDescription', context);
     const runtimeClient = await connectToRuntime(config, source.workingDir ?? workingDir, {
         debug: options.debug,
         modelOverrides: getDescriberModelOverride(config),
@@ -988,7 +2091,7 @@ async function runPostReviewCommentsWorkflowNode(config, nodeId, node, options,
         ? createWorkflowInlinePosition(target.platform, source)
         : undefined;
     const shouldRemoveErrorComment = !hasActionOption(node, 'removeErrorComment') ||
-        getBooleanActionOption(node, 'removeErrorComment');
+        getBooleanActionOption(node, 'removeErrorComment', context);
     await withWorkflowConsoleSuppressed(executionContext, options.jsonOutput === true, async () => {
         if (shouldRemoveErrorComment) {
             await removeErrorComment(target.platformClient, target.projectId, target.prNumber);
@@ -1015,6 +2118,256 @@ async function runPostReviewCommentsWorkflowNode(config, nodeId, node, options,
         },
     };
 }
+function getFixStatusDisposition(finding) {
+    const disposition = finding.disposition;
+    if (disposition === 'resolved')
+        return 'resolved';
+    if (disposition === 'partial')
+        return 'partial';
+    if (disposition === 'regression')
+        return 'regression';
+    return 'still-open';
+}
+function getVerificationDisposition(finding, verdict, thresholdRank) {
+    if (severityRank(finding.issue.severity) < thresholdRank) {
+        return finding.disposition;
+    }
+    if (!verdict) {
+        if (finding.disposition === 'regression') {
+            return 'regression';
+        }
+        return 'still_open';
+    }
+    return verdict.disposition === 'still_open' ? 'still_open' : verdict.disposition;
+}
+function reconcileReviewArtifactFindings(artifact, reReview, options) {
+    const now = new Date().toISOString();
+    const thresholdRank = severityRank(options.severity);
+    const verdicts = new Map((reReview.verification?.findings ?? []).map((finding) => [finding.id, finding]));
+    const existingFingerprints = new Set(artifact.findings.map((finding) => finding.fingerprint));
+    const reconciledFindings = artifact.findings.map((finding) => {
+        const verdict = verdicts.get(finding.id);
+        const disposition = getVerificationDisposition(finding, verdict, thresholdRank);
+        const issue = isReviewIssue(verdict?.issue) ? verdict.issue : finding.issue;
+        const fingerprint = issue === finding.issue ? finding.fingerprint : createIssueFingerprint(issue);
+        const shouldVerify = severityRank(finding.issue.severity) >= thresholdRank;
+        const verification = shouldVerify
+            ? {
+                disposition: verdict?.disposition ?? 'missing',
+                rationale: verdict?.rationale,
+                verifiedAt: now,
+            }
+            : finding.verification;
+        return {
+            ...finding,
+            issue,
+            fingerprint,
+            state: disposition === 'resolved' ? 'resolved' : 'open',
+            disposition,
+            verification,
+            updatedAt: now,
+        };
+    });
+    for (const issue of reReview.issues) {
+        const fingerprint = createIssueFingerprint(issue);
+        if (existingFingerprints.has(fingerprint)) {
+            continue;
+        }
+        existingFingerprints.add(fingerprint);
+        reconciledFindings.push({
+            id: `R${reconciledFindings.length + 1}`,
+            fingerprint,
+            issue,
+            state: 'open',
+            disposition: 'regression',
+            verification: undefined,
+            source: 'agent',
+            createdAt: now,
+            updatedAt: now,
+        });
+    }
+    const updatedArtifact = { ...artifact, findings: reconciledFindings };
+    const statuses = updatedArtifact.findings.map((finding) => {
+        const disposition = getFixStatusDisposition(finding);
+        const verificationMissing = severityRank(finding.issue.severity) >= thresholdRank && !verdicts.has(finding.id);
+        const diffSnippet = disposition === 'resolved' || disposition === 'regression'
+            ? extractDiffSnippet(options.fixSource, finding.issue.file, finding.issue.line)
+            : undefined;
+        return { finding, disposition, diffSnippet, verificationMissing };
+    });
+    const actionableOpen = updatedArtifact.findings.filter((finding) => finding.state === 'open' &&
+        severityRank(finding.issue.severity) >= thresholdRank &&
+        (finding.disposition === 'still_open' ||
+            finding.disposition === 'partial' ||
+            finding.disposition === 'regression')).length;
+    return {
+        artifact: updatedArtifact,
+        statuses,
+        shouldContinue: actionableOpen >= options.minIssues,
+        actionableOpen,
+        resolved: updatedArtifact.findings.filter((finding) => finding.state === 'resolved').length,
+        partial: updatedArtifact.findings.filter((finding) => finding.disposition === 'partial').length,
+        stillOpen: updatedArtifact.findings.filter((finding) => finding.disposition === 'still_open')
+            .length,
+        regression: updatedArtifact.findings.filter((finding) => finding.disposition === 'regression')
+            .length,
+    };
+}
+function extractDiffSnippet(fixChange, filePath, line) {
+    if (!fixChange?.filesWithDiffs) {
+        return undefined;
+    }
+    const fileWithDiff = fixChange.filesWithDiffs.find((f) => f.filename === filePath);
+    if (!fileWithDiff?.patch) {
+        return undefined;
+    }
+    const lines = fileWithDiff.patch.split('\n');
+    if (!line) {
+        return lines.slice(0, 15).join('\n');
+    }
+    for (let i = 0; i < lines.length; i++) {
+        const hunkMatch = lines[i]?.match(/^@@ -\d+(?:,\d+)? \+(\d+)(?:,(\d+))? @@/);
+        if (!hunkMatch) {
+            continue;
+        }
+        const newStart = Number.parseInt(hunkMatch[1], 10);
+        const newLineCount = hunkMatch[2] ? Number.parseInt(hunkMatch[2], 10) : 1;
+        if (line < newStart || line >= newStart + newLineCount) {
+            continue;
+        }
+        let end = i + 1;
+        while (end < lines.length && !lines[end]?.startsWith('@@')) {
+            end++;
+        }
+        return lines.slice(i, end).join('\n');
+    }
+    return lines.slice(0, 15).join('\n');
+}
+function formatFixStatusComment(statuses, stackedPrUrl) {
+    const lines = ['## Fix Status', ''];
+    if (statuses.length === 0) {
+        lines.push('No findings to report.');
+        return lines.join('\n');
+    }
+    lines.push('| # | Severity | File | Issue | Status |');
+    lines.push('|---|----------|------|-------|--------|');
+    for (let i = 0; i < statuses.length; i++) {
+        const s = statuses[i];
+        const statusIcon = s.disposition === 'resolved'
+            ? '✅ Resolved'
+            : s.disposition === 'partial'
+                ? '🟡 Partial'
+                : s.disposition === 'regression'
+                    ? '🔴 Regression'
+                    : s.disposition === 'attempted'
+                        ? '🔧 Attempted'
+                        : s.verificationMissing
+                            ? '⚠️ Verification Missing'
+                            : '⚪ Still Open';
+        const file = `${s.finding.issue.file}${s.finding.issue.line ? `:${s.finding.issue.line}` : ''}`;
+        lines.push(`| ${i + 1} | ${s.finding.issue.severity} | ${file} | ${s.finding.issue.title} | ${statusIcon} |`);
+    }
+    const resolved = statuses.filter((s) => s.disposition === 'resolved' && s.diffSnippet);
+    if (resolved.length > 0) {
+        lines.push('');
+        lines.push('### Fix Details');
+        for (let i = 0; i < statuses.length; i++) {
+            const s = statuses[i];
+            if (s.disposition === 'resolved' && s.diffSnippet) {
+                lines.push('');
+                lines.push(`**#${i + 1} — ${s.finding.issue.title} (${s.disposition})**`);
+                lines.push('```diff');
+                lines.push(s.diffSnippet);
+                lines.push('```');
+            }
+        }
+    }
+    if (stackedPrUrl) {
+        lines.push('');
+        lines.push(`Stacked fix PR: ${stackedPrUrl}`);
+    }
+    return lines.join('\n');
+}
+async function runPostFixStatusWorkflowNode(nodeId, node, options, workingDir, context, executionContext) {
+    const sourceArtifact = getStringActionOption(node, 'source', context) ?? 'change';
+    const source = isReviewSource(context.artifacts[sourceArtifact])
+        ? context.artifacts[sourceArtifact]
+        : undefined;
+    const target = resolvePostTarget(nodeId, node, context, executionContext, source);
+    const reviewArtifactName = getStringActionOption(node, 'reviewArtifact', context) ?? 'reviewArtifact';
+    const reviewArtifactValue = context.artifacts[reviewArtifactName];
+    let artifactPayload;
+    if (isReviewArtifactPayload(reviewArtifactValue)) {
+        artifactPayload = reviewArtifactValue;
+    }
+    else if (reviewArtifactValue &&
+        typeof reviewArtifactValue === 'object' &&
+        'payload' in reviewArtifactValue) {
+        const payload = reviewArtifactValue.payload;
+        if (isReviewArtifactPayload(payload)) {
+            artifactPayload = payload;
+        }
+    }
+    if (!artifactPayload) {
+        throw new Error(`Workflow post-fix-status node "${nodeId}" needs a review artifact (with.reviewArtifact).`);
+    }
+    const fixReviewName = getStringActionOption(node, 'fixReview', context);
+    const fixReviewResult = fixReviewName ? context.artifacts[fixReviewName] : undefined;
+    const hasReReview = isReviewResult(fixReviewResult);
+    const fixChangeName = getStringActionOption(node, 'fixChange', context);
+    const fixChange = fixChangeName ? context.artifacts[fixChangeName] : undefined;
+    const fixSource = isReviewSource(fixChange) ? fixChange : undefined;
+    const stackedPrUrl = getStringActionOption(node, 'stackedPrUrl', context);
+    const marker = getStringActionOption(node, 'marker', context)?.trim() ?? 'drs-fix-status';
+    const severity = (getStringActionOption(node, 'severity', context) ?? 'high').toUpperCase();
+    const thresholdRank = severityRank(severity);
+    const originalFindings = artifactPayload.findings.filter((finding) => severityRank(finding.issue.severity) >= thresholdRank);
+    const statuses = originalFindings.map((finding) => {
+        if (hasReReview) {
+            const disposition = getFixStatusDisposition(finding);
+            const diffSnippet = disposition === 'resolved' || disposition === 'regression'
+                ? extractDiffSnippet(fixSource, finding.issue.file, finding.issue.line)
+                : undefined;
+            return { finding, disposition, diffSnippet };
+        }
+        const diffSnippet = extractDiffSnippet(fixSource, finding.issue.file, finding.issue.line);
+        return { finding, disposition: 'attempted', diffSnippet };
+    });
+    const body = formatFixStatusComment(statuses, stackedPrUrl);
+    const markedBody = formatMarkedComment(body, marker);
+    let operation = 'created';
+    try {
+        const comments = await target.platformClient.getComments(target.projectId, target.prNumber);
+        const existingComment = findExistingCommentById(comments, marker);
+        if (existingComment) {
+            await withWorkflowConsoleSuppressed(executionContext, options.jsonOutput === true, () => target.platformClient.updateComment(target.projectId, target.prNumber, existingComment.id, markedBody));
+            operation = 'updated';
+        }
+        else {
+            await withWorkflowConsoleSuppressed(executionContext, options.jsonOutput === true, () => target.platformClient.createComment(target.projectId, target.prNumber, markedBody));
+        }
+    }
+    catch (error) {
+        throw new Error(`Workflow post-fix-status node "${nodeId}" failed to post comment: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    return {
+        id: nodeId,
+        type: 'action',
+        action: node.action,
+        response: `${operation} fix-status comment on ${target.platform} ${target.projectId}#${target.prNumber}`,
+        output: {
+            platform: target.platform,
+            projectId: target.projectId,
+            prNumber: target.prNumber,
+            operation,
+            resolved: statuses.filter((s) => s.disposition === 'resolved').length,
+            partial: statuses.filter((s) => s.disposition === 'partial').length,
+            stillOpen: statuses.filter((s) => s.disposition === 'still-open').length,
+            regression: statuses.filter((s) => s.disposition === 'regression').length,
+            attempted: statuses.filter((s) => s.disposition === 'attempted').length,
+        },
+    };
+}
 function isReviewSource(value) {
     if (!value || typeof value !== 'object') {
         return false;
@@ -1025,23 +2378,6 @@ function isReviewSource(value) {
         typeof candidate.context === 'object' &&
         candidate.context !== null);
 }
-async function enforceWorkflowReviewTarget(config, source, workingDir) {
-    const platform = typeof source.context.platform === 'string' ? source.context.platform : undefined;
-    if (!isWorkflowPlatform(platform)) {
-        return;
-    }
-    const projectId = typeof source.context.projectId === 'string' ? source.context.projectId : undefined;
-    const pullRequest = isPullRequest(source.context.pullRequest)
-        ? source.context.pullRequest
-        : undefined;
-    if (!projectId || !pullRequest) {
-        throw new Error('Workflow platform review source is missing project or PR/MR metadata.');
-    }
-    await enforceRepoBranchMatch(workingDir, projectId, pullRequest, {
-        skipRepoCheck: config.review.skipRepoCheck,
-        skipBranchCheck: config.review.skipBranchCheck,
-    });
-}
 async function runReviewWorkflowNode(config, nodeId, node, options, workingDir, context, executionContext) {
     const sourceArtifact = getStringActionOption(node, 'source', context) ?? 'change';
     const source = context.artifacts[sourceArtifact];
@@ -1049,10 +2385,46 @@ async function runReviewWorkflowNode(config, nodeId, node, options, workingDir,
         throw new Error(`Workflow review node "${nodeId}" needs a ReviewSource artifact. ` +
             'Set with.source to a change-source output.');
     }
+    const reviewArtifactName = getStringActionOption(node, 'reviewArtifact', context);
+    const reviewArtifactEnvelope = reviewArtifactName
+        ? context.artifacts[reviewArtifactName]
+        : undefined;
+    const reviewArtifact = reviewArtifactName
+        ? getReviewArtifactPayloadFromValue(nodeId, reviewArtifactEnvelope)
+        : undefined;
+    const reviewArtifactPath = reviewArtifactEnvelope && typeof reviewArtifactEnvelope === 'object'
+        ? reviewArtifactEnvelope.path
+        : undefined;
+    const severity = getStringActionOption(node, 'severity', context)?.toUpperCase();
+    const traceCollector = executionContext.traceCollector;
+    const sourceForReview = reviewArtifact
+        ? {
+            ...source,
+            context: {
+                ...source.context,
+                verification: {
+                    artifact: {
+                        reviewId: reviewArtifact.reviewId,
+                        findings: reviewArtifact.findings,
+                    },
+                    artifactPath: reviewArtifactPath,
+                    severity,
+                },
+                traceCollector,
+            },
+        }
+        : {
+            ...source,
+            context: {
+                ...source.context,
+                traceCollector,
+            },
+        };
+    if (traceCollector) {
+        const agentIds = getReviewAgentIds(config);
+        traceCollector.setContext(nodeId, agentIds[0] ?? 'review/unified-reviewer', '');
+    }
     const reviewResult = await withWorkflowLock(executionContext.locks.exit, async () => {
-        const restoreExit = setExitHandler((code) => {
-            throw new ExitError(code);
-        });
         const originalLog = console.log;
         const originalWarn = console.warn;
         if (options.jsonOutput) {
@@ -1060,38 +2432,45 @@ async function runReviewWorkflowNode(config, nodeId, node, options, workingDir,
             console.warn = () => undefined;
         }
         try {
-            await enforceWorkflowReviewTarget(config, source, source.workingDir ?? workingDir);
             return await executeReview(config, {
-                ...source,
-                workingDir: source.workingDir ?? workingDir,
+                ...sourceForReview,
+                workingDir: sourceForReview.workingDir ?? workingDir,
                 debug: options.debug,
                 thinkingLevel: options.thinkingLevel,
             });
         }
-        catch (error) {
-            if (error instanceof ExitError) {
-                throw new Error(`Workflow review node "${nodeId}" failed: all review agents failed.`);
-            }
-            throw error;
-        }
         finally {
             if (options.jsonOutput) {
                 console.log = originalLog;
                 console.warn = originalWarn;
             }
-            restoreExit();
         }
     });
     const writes = renderNodeWritesPath(nodeId, node, context);
     if (writes) {
         await writeWorkflowFile(workingDir, writes, JSON.stringify(reviewResult, null, 2));
     }
+    const artifactOutput = getStringActionOption(node, 'artifact', context)?.trim();
+    const outputs = {};
+    let artifactResponse = '';
+    if (artifactOutput) {
+        const reviewArtifact = createReviewArtifactPayload(reviewResult, source);
+        const scope = await resolveArtifactScope(nodeId, node, workingDir, context, executionContext);
+        const saved = await saveWorkflowArtifact(workingDir, {
+            kind: 'review',
+            scope,
+            payload: reviewArtifact,
+        });
+        outputs[artifactOutput] = { ...saved.artifact, path: saved.path, latestPath: saved.latestPath };
+        artifactResponse = `\nSaved review artifact ${saved.artifact.id}.`;
+    }
     return {
         id: nodeId,
         type: 'action',
         action: node.action,
-        response: JSON.stringify(reviewResult.summary, null, 2),
+        response: `${JSON.stringify(reviewResult.summary, null, 2)}${artifactResponse}`,
         output: reviewResult,
+        outputs,
         writes,
     };
 }
@@ -1101,18 +2480,522 @@ function recordNodeArtifact(nodeId, node, result, artifacts) {
     if (node.output) {
         artifacts[node.output] = artifactValue;
     }
+    if (result.outputs) {
+        for (const [name, value] of Object.entries(result.outputs)) {
+            artifacts[name] = value;
+        }
+    }
+}
+function parseWorkflowExpressionValue(value, context) {
+    const trimmed = value.trim();
+    if (!trimmed)
+        return '';
+    const templateReference = trimmed.match(/^\{\{\s*([^}]+?)\s*\}\}$/);
+    if (templateReference && context) {
+        const path = templateReference[1]?.trim() ?? '';
+        const resolved = getPathValue(context, path);
+        if (resolved === undefined) {
+            throw new Error(`Unknown workflow template value "{{${path}}}".`);
+        }
+        return resolved;
+    }
+    if (trimmed === 'true')
+        return true;
+    if (trimmed === 'false')
+        return false;
+    if (trimmed === 'null')
+        return null;
+    if (/^-?\d+(\.\d+)?$/.test(trimmed))
+        return Number(trimmed);
+    if ((trimmed.startsWith('"') && trimmed.endsWith('"')) ||
+        (trimmed.startsWith("'") && trimmed.endsWith("'"))) {
+        const inner = trimmed.slice(1, -1);
+        return context ? renderTemplate(inner, context) : inner;
+    }
+    if (context && /^(inputs|nodes|artifacts|loop)\.[A-Za-z0-9_.-]+$/.test(trimmed)) {
+        const resolved = getPathValue(context, trimmed);
+        if (resolved === undefined) {
+            throw new Error(`Unknown workflow expression value "${trimmed}".`);
+        }
+        return resolved;
+    }
+    try {
+        return JSON.parse(trimmed);
+    }
+    catch {
+        return trimmed;
+    }
+}
+function isWorkflowTruthy(value) {
+    if (value === undefined || value === null)
+        return false;
+    if (typeof value === 'boolean')
+        return value;
+    if (typeof value === 'number')
+        return value !== 0;
+    if (typeof value === 'string') {
+        const normalized = value.trim().toLowerCase();
+        return (normalized.length > 0 && normalized !== 'false' && normalized !== '0' && normalized !== 'no');
+    }
+    if (Array.isArray(value))
+        return value.length > 0;
+    if (typeof value === 'object')
+        return Object.keys(value).length > 0;
+    return true;
+}
+function normalizeWorkflowBooleanLike(value) {
+    if (typeof value === 'boolean')
+        return value;
+    if (typeof value === 'number') {
+        if (value === 1)
+            return true;
+        if (value === 0)
+            return false;
+    }
+    if (typeof value === 'string') {
+        const normalized = value.trim().toLowerCase();
+        if (normalized === 'true' || normalized === '1' || normalized === 'yes')
+            return true;
+        if (normalized === 'false' || normalized === '0' || normalized === 'no')
+            return false;
+    }
+    return undefined;
+}
+function compareWorkflowValues(left, operator, right) {
+    if (operator === '==' || operator === '!=') {
+        const leftBoolean = normalizeWorkflowBooleanLike(left);
+        const rightBoolean = normalizeWorkflowBooleanLike(right);
+        const matches = leftBoolean !== undefined || rightBoolean !== undefined
+            ? leftBoolean === rightBoolean
+            : String(left) === String(right);
+        return operator === '==' ? matches : !matches;
+    }
+    const leftNumber = Number(left);
+    const rightNumber = Number(right);
+    if (!Number.isFinite(leftNumber) || !Number.isFinite(rightNumber)) {
+        throw new Error(`Workflow expression operator "${operator}" requires numeric values.`);
+    }
+    if (operator === '>')
+        return leftNumber > rightNumber;
+    if (operator === '>=')
+        return leftNumber >= rightNumber;
+    if (operator === '<')
+        return leftNumber < rightNumber;
+    if (operator === '<=')
+        return leftNumber <= rightNumber;
+    throw new Error(`Unsupported workflow expression operator "${operator}".`);
+}
+function splitWorkflowExpressionOperator(expression, operator) {
+    const parts = [];
+    let current = '';
+    let quote;
+    let depth = 0;
+    for (let i = 0; i < expression.length; i++) {
+        const char = expression[i] ?? '';
+        if ((char === '"' || char === "'") && expression[i - 1] !== '\\') {
+            quote = quote === char ? undefined : (quote ?? char);
+            current += char;
+            continue;
+        }
+        if (!quote && char === '(') {
+            depth += 1;
+            current += char;
+            continue;
+        }
+        if (!quote && char === ')' && depth > 0) {
+            depth -= 1;
+            current += char;
+            continue;
+        }
+        if (!quote && depth === 0 && expression.slice(i, i + operator.length) === operator) {
+            parts.push(current.trim());
+            current = '';
+            i += operator.length - 1;
+            continue;
+        }
+        current += char;
+    }
+    parts.push(current.trim());
+    return parts;
+}
+function stripWorkflowExpressionParens(expression) {
+    const trimmed = expression.trim();
+    if (!trimmed.startsWith('(') || !trimmed.endsWith(')')) {
+        return trimmed;
+    }
+    let quote;
+    let depth = 0;
+    for (let i = 0; i < trimmed.length; i++) {
+        const char = trimmed[i] ?? '';
+        if ((char === '"' || char === "'") && trimmed[i - 1] !== '\\') {
+            quote = quote === char ? undefined : (quote ?? char);
+            continue;
+        }
+        if (quote)
+            continue;
+        if (char === '(')
+            depth += 1;
+        if (char === ')')
+            depth -= 1;
+        if (depth === 0 && i < trimmed.length - 1) {
+            return trimmed;
+        }
+    }
+    return trimmed.slice(1, -1).trim();
+}
+function evaluateWorkflowExpressionText(rendered, context) {
+    rendered = stripWorkflowExpressionParens(rendered);
+    const orParts = splitWorkflowExpressionOperator(rendered, '||');
+    if (orParts.length > 1) {
+        return orParts.some((part) => evaluateWorkflowExpressionText(part, context));
+    }
+    const andParts = splitWorkflowExpressionOperator(rendered, '&&');
+    if (andParts.length > 1) {
+        return andParts.every((part) => evaluateWorkflowExpressionText(part, context));
+    }
+    const match = rendered.match(/^(.+?)\s*(==|!=|>=|<=|>|<)\s*(.+)$/);
+    if (!match) {
+        return isWorkflowTruthy(parseWorkflowExpressionValue(rendered, context));
+    }
+    return compareWorkflowValues(parseWorkflowExpressionValue(match[1] ?? '', context), match[2] ?? '', parseWorkflowExpressionValue(match[3] ?? '', context));
+}
+function evaluateWorkflowExpression(expression, context) {
+    return evaluateWorkflowExpressionText(expression.trim(), context);
+}
+function splitWorkflowSegments(workflowNodes, executionOrder) {
+    const segments = [];
+    let currentDag = [];
+    for (const nodeId of executionOrder) {
+        const node = workflowNodes[nodeId];
+        if (!node) {
+            throw new Error(`Workflow references unknown node "${nodeId}".`);
+        }
+        if (node.control !== undefined) {
+            if (currentDag.length > 0) {
+                segments.push({ type: 'dag', nodeIds: currentDag });
+                currentDag = [];
+            }
+            segments.push({ type: 'control', nodeId });
+        }
+        else {
+            currentDag.push(nodeId);
+        }
+    }
+    if (currentDag.length > 0) {
+        segments.push({ type: 'dag', nodeIds: currentDag });
+    }
+    return segments;
+}
+function findWorkflowSegmentIndex(segments, targetNodeId) {
+    return segments.findIndex((segment) => segment.type === 'control'
+        ? segment.nodeId === targetNodeId
+        : segment.nodeIds.includes(targetNodeId));
+}
+function computeActiveWorkflowNodes(workflowNodes, nodeIds, rootNodeId, includeRootDependencies = true) {
+    const segmentNodeIds = new Set(nodeIds);
+    const downstream = new Set([rootNodeId]);
+    let changed = true;
+    while (changed) {
+        changed = false;
+        for (const nodeId of nodeIds) {
+            if (downstream.has(nodeId))
+                continue;
+            const needs = getNodeNeeds(workflowNodes[nodeId] ?? {});
+            if (needs.some((dependency) => downstream.has(dependency))) {
+                downstream.add(nodeId);
+                changed = true;
+            }
+        }
+    }
+    const active = new Set(downstream);
+    const includeDependencies = (nodeId) => {
+        const node = workflowNodes[nodeId];
+        if (!node)
+            return;
+        for (const dependency of getNodeNeeds(node)) {
+            if (!segmentNodeIds.has(dependency) || active.has(dependency))
+                continue;
+            active.add(dependency);
+            includeDependencies(dependency);
+        }
+    };
+    if (includeRootDependencies) {
+        for (const nodeId of downstream) {
+            includeDependencies(nodeId);
+        }
+    }
+    return active;
+}
+function createSkippedWorkflowNodeResult(nodeId) {
+    return {
+        id: nodeId,
+        type: 'skipped',
+        status: 'skipped',
+        response: '',
+        output: undefined,
+    };
+}
+function getWorkflowNodeRunCondition(node) {
+    return node.if;
+}
+function getSkippedWorkflowDependencies(node, nodes) {
+    return getNodeNeeds(node).filter((dependency) => nodes[dependency]?.status === 'skipped');
+}
+function getWorkflowNodeSkipReason(node, context) {
+    const skippedDependencies = getSkippedWorkflowDependencies(node, context.nodes);
+    if (skippedDependencies.length > 0) {
+        return `dependency skipped: ${skippedDependencies.join(', ')}`;
+    }
+    const ifExpression = getWorkflowNodeRunCondition(node);
+    if (ifExpression !== undefined && !evaluateWorkflowExpression(ifExpression, context)) {
+        return `if false: ${ifExpression}`;
+    }
+    return undefined;
+}
+function logWorkflowNodeRunning(nodeId, options) {
+    if (!options.jsonOutput) {
+        console.log(chalk.gray(`Running node ${nodeId}...`));
+    }
+}
+function logWorkflowNodeSkipped(nodeId, reason, options) {
+    if (!options.jsonOutput) {
+        console.log(chalk.gray(`Skipping node ${nodeId} (${reason})`));
+    }
+}
+function recordWorkflowNodeResult(nodeId, node, result, nodes, artifacts) {
+    result.status ??= 'success';
+    nodes[nodeId] = result;
+    if (result.status !== 'skipped') {
+        recordNodeArtifact(nodeId, node, result, artifacts);
+    }
+}
+async function runWorkflowDagSegment(config, workflowNodes, nodeIds, activeNodeIds, options, workingDir, context, executionContext) {
+    const completed = new Set();
+    const segmentNodeIds = new Set(nodeIds);
+    if (activeNodeIds) {
+        for (const nodeId of nodeIds) {
+            if (!activeNodeIds.has(nodeId)) {
+                completed.add(nodeId);
+                if (context.nodes[nodeId] === undefined) {
+                    logWorkflowNodeSkipped(nodeId, 'inactive branch', options);
+                    context.nodes[nodeId] = createSkippedWorkflowNodeResult(nodeId);
+                }
+            }
+        }
+    }
+    while (completed.size < nodeIds.length) {
+        const runnable = nodeIds.filter((nodeId) => {
+            if (completed.has(nodeId))
+                return false;
+            const node = workflowNodes[nodeId];
+            if (!node)
+                return false;
+            return getNodeNeeds(node).every((dependency) => completed.has(dependency) || !segmentNodeIds.has(dependency));
+        });
+        if (runnable.length === 0) {
+            throw new Error('Workflow control runner could not make progress in a DAG segment.');
+        }
+        const settled = await Promise.allSettled(runnable.map(async (nodeId) => {
+            const node = workflowNodes[nodeId];
+            if (!node) {
+                throw new Error(`Workflow references unknown node "${nodeId}".`);
+            }
+            const skipReason = getWorkflowNodeSkipReason(node, context);
+            if (skipReason) {
+                logWorkflowNodeSkipped(nodeId, skipReason, options);
+                return { nodeId, node, result: createSkippedWorkflowNodeResult(nodeId) };
+            }
+            logWorkflowNodeRunning(nodeId, options);
+            const result = await runSingleWorkflowNode(config, nodeId, node, options, workingDir, context, executionContext);
+            return { nodeId, node, result };
+        }));
+        const firstRejection = settled.find((outcome) => outcome.status === 'rejected');
+        if (firstRejection) {
+            throw firstRejection.reason instanceof Error
+                ? firstRejection.reason
+                : new Error(String(firstRejection.reason));
+        }
+        for (const outcome of settled) {
+            const { nodeId, node, result } = outcome.value;
+            completed.add(nodeId);
+            recordWorkflowNodeResult(nodeId, node, result, context.nodes, context.artifacts);
+        }
+    }
+}
+function runControlWorkflowNode(nodeId, node, context) {
+    if (node.control === 'loop') {
+        const expression = node.if;
+        if (!expression) {
+            throw new Error(`Workflow loop node "${nodeId}" must define if.`);
+        }
+        if (!node.target || !node.exit) {
+            throw new Error(`Workflow loop node "${nodeId}" must define target and exit.`);
+        }
+        const rawMaxIterations = node.maxIterations;
+        const renderedMaxIterations = typeof rawMaxIterations === 'string'
+            ? renderTemplate(rawMaxIterations, context).trim()
+            : String(rawMaxIterations ?? '');
+        const configuredMaxIterations = Number.parseInt(renderedMaxIterations, 10);
+        if (renderedMaxIterations === '' ||
+            !Number.isInteger(configuredMaxIterations) ||
+            configuredMaxIterations <= 0) {
+            throw new Error(`Workflow loop node "${nodeId}" must define a positive maxIterations.`);
+        }
+        const maxIterations = configuredMaxIterations;
+        const shouldLoop = evaluateWorkflowExpression(expression, context);
+        const current = context.loop[nodeId] ?? { iteration: 1, maxIterations };
+        let nextNodeId = node.exit;
+        let decision = 'exit';
+        if (shouldLoop) {
+            if (current.iteration >= maxIterations) {
+                if (node.onMaxIterations === 'exit') {
+                    nextNodeId = node.exit;
+                }
+                else {
+                    throw new Error(`Workflow loop node "${nodeId}" reached maxIterations (${maxIterations}).`);
+                }
+            }
+            else {
+                decision = 'loop';
+                nextNodeId = node.target;
+                current.iteration += 1;
+            }
+        }
+        current.maxIterations = maxIterations;
+        current.lastDecision = decision;
+        context.loop[nodeId] = current;
+        return {
+            nextNodeId,
+            result: {
+                id: nodeId,
+                type: 'control',
+                status: 'success',
+                control: node.control,
+                decision,
+                target: nextNodeId,
+                response: decision,
+                output: {
+                    matched: shouldLoop,
+                    target: nextNodeId,
+                    iteration: current.iteration,
+                    maxIterations,
+                },
+            },
+        };
+    }
+    if (node.control === 'switch') {
+        if (!node.value || !node.cases) {
+            throw new Error(`Workflow switch node "${nodeId}" must define value and cases.`);
+        }
+        const value = renderTemplate(node.value, context).trim();
+        const nextNodeId = node.cases[value] ?? node.default;
+        if (!nextNodeId) {
+            throw new Error(`Workflow switch node "${nodeId}" has no case for "${value}" or default.`);
+        }
+        return {
+            nextNodeId,
+            result: {
+                id: nodeId,
+                type: 'control',
+                status: 'success',
+                control: node.control,
+                decision: value,
+                target: nextNodeId,
+                response: value,
+                output: { value, target: nextNodeId },
+            },
+        };
+    }
+    if (node.control === 'end') {
+        return {
+            ended: true,
+            result: {
+                id: nodeId,
+                type: 'control',
+                status: 'success',
+                control: node.control,
+                decision: 'end',
+                response: 'end',
+                output: { ended: true },
+            },
+        };
+    }
+    if (node.control === 'passThrough') {
+        const result = {
+            id: nodeId,
+            type: 'control',
+            control: 'passThrough',
+            target: node.target,
+            decision: 'pass',
+            response: `passed through to ${node.target}`,
+        };
+        return { result, nextNodeId: node.target };
+    }
+    throw new Error(`Unsupported workflow control "${node.control}" in node "${nodeId}".`);
+}
+async function runControlWorkflow(config, workflowNodes, executionOrder, options, workingDir, context, executionContext) {
+    const segments = splitWorkflowSegments(workflowNodes, executionOrder);
+    let segmentIndex = 0;
+    while (segmentIndex < segments.length) {
+        const segment = segments[segmentIndex];
+        if (segment.type === 'dag') {
+            await runWorkflowDagSegment(config, workflowNodes, segment.nodeIds, segment.activeNodeIds, options, workingDir, context, executionContext);
+            segmentIndex += 1;
+            continue;
+        }
+        const node = workflowNodes[segment.nodeId];
+        if (!node) {
+            throw new Error(`Workflow references unknown node "${segment.nodeId}".`);
+        }
+        const skipReason = getWorkflowNodeSkipReason(node, context);
+        if (skipReason) {
+            logWorkflowNodeSkipped(segment.nodeId, skipReason, options);
+        }
+        else {
+            logWorkflowNodeRunning(segment.nodeId, options);
+        }
+        const { result, nextNodeId, ended } = skipReason
+            ? { result: createSkippedWorkflowNodeResult(segment.nodeId) }
+            : runControlWorkflowNode(segment.nodeId, node, context);
+        recordWorkflowNodeResult(segment.nodeId, node, result, context.nodes, context.artifacts);
+        if (ended) {
+            return;
+        }
+        if (!nextNodeId) {
+            segmentIndex += 1;
+            continue;
+        }
+        const targetIndex = findWorkflowSegmentIndex(segments, nextNodeId);
+        if (targetIndex < 0) {
+            throw new Error(`Workflow control node "${segment.nodeId}" targets unknown node "${nextNodeId}".`);
+        }
+        if (node.control !== 'loop' && targetIndex <= segmentIndex) {
+            throw new Error(`Workflow control node "${segment.nodeId}" cannot jump backward to "${nextNodeId}". Use control: loop with maxIterations for repeated execution.`);
+        }
+        const targetSegment = segments[targetIndex];
+        if (targetSegment.type === 'dag') {
+            targetSegment.activeNodeIds = computeActiveWorkflowNodes(workflowNodes, targetSegment.nodeIds, nextNodeId, !(node.control === 'loop' && nextNodeId === node.target));
+        }
+        segmentIndex = targetIndex;
+    }
 }
 function formatWorkflowJson(result) {
     return JSON.stringify(result, null, 2);
 }
 async function runSingleWorkflowNode(config, nodeId, node, options, workingDir, context, executionContext) {
     const kind = getNodeKind(node);
+    if (getWorkflowNodeSkipReason(node, context)) {
+        return createSkippedWorkflowNodeResult(nodeId);
+    }
     if (kind === 'agent') {
-        return runAgentWorkflowNode(config, nodeId, node, options, workingDir, context);
+        return runAgentWorkflowNode(config, nodeId, node, options, workingDir, context, executionContext);
     }
     if (kind === 'agents') {
         return runAgentsWorkflowNode(config, nodeId, node, options, workingDir, context);
     }
+    if (kind === 'control') {
+        throw new Error(`Workflow control node "${nodeId}" cannot run in the static DAG executor.`);
+    }
     return runActionWorkflowNode(config, nodeId, node, options, workingDir, context, executionContext);
 }
 export async function runWorkflow(config, workflowName, options = {}) {
@@ -1125,10 +3008,12 @@ export async function runWorkflow(config, workflowName, options = {}) {
     const inputs = await resolveWorkflowInputs(workflow, options, workingDir);
     const nodes = {};
     const artifacts = {};
-    const context = { inputs, nodes, artifacts };
+    const loop = {};
+    const context = { inputs, nodes, artifacts, loop };
     const executionContext = {
         gitClients: new Map(),
         platformClients: {},
+        traceCollector: options.trace ? new TraceCollector() : undefined,
         locks: {
             exit: createWorkflowLock(),
             console: createWorkflowLock(),
@@ -1139,32 +3024,60 @@ export async function runWorkflow(config, workflowName, options = {}) {
     if (!options.jsonOutput) {
         console.log(chalk.gray(`Running workflow ${workflowName}...\n`));
     }
-    for (const wave of executionWaves) {
-        const results = await Promise.all(wave.map(async (nodeId) => {
-            const node = workflowNodes[nodeId];
-            if (!node) {
-                throw new Error(`Workflow references unknown node "${nodeId}".`);
+    try {
+        if (hasWorkflowControlNodes(workflowNodes)) {
+            await runControlWorkflow(config, workflowNodes, executionOrder, options, workingDir, context, executionContext);
+        }
+        else {
+            for (const wave of executionWaves) {
+                const settled = await Promise.allSettled(wave.map(async (nodeId) => {
+                    const node = workflowNodes[nodeId];
+                    if (!node) {
+                        throw new Error(`Workflow references unknown node "${nodeId}".`);
+                    }
+                    const skipReason = getWorkflowNodeSkipReason(node, context);
+                    if (skipReason) {
+                        logWorkflowNodeSkipped(nodeId, skipReason, options);
+                        return { nodeId, node, result: createSkippedWorkflowNodeResult(nodeId) };
+                    }
+                    logWorkflowNodeRunning(nodeId, options);
+                    const result = await runSingleWorkflowNode(config, nodeId, node, options, workingDir, context, executionContext);
+                    return { nodeId, node, result };
+                }));
+                const firstRejection = settled.find((outcome) => outcome.status === 'rejected');
+                if (firstRejection) {
+                    throw firstRejection.reason instanceof Error
+                        ? firstRejection.reason
+                        : new Error(String(firstRejection.reason));
+                }
+                for (const outcome of settled) {
+                    const { nodeId, node, result } = outcome.value;
+                    recordWorkflowNodeResult(nodeId, node, result, nodes, artifacts);
+                }
+            }
+        }
+    }
+    catch (error) {
+        if (executionContext.traceCollector && executionContext.traceCollector.getTraces().length > 0) {
+            try {
+                await flushWorkflowTrace(executionContext.traceCollector, workflowName, inputs, new Date().toISOString(), workingDir, options);
             }
-            if (!options.jsonOutput) {
-                console.log(chalk.gray(`Running node ${nodeId}...`));
+            catch (flushError) {
+                console.error(chalk.yellow('Warning:'), 'Failed to persist workflow trace on failure:', flushError instanceof Error ? flushError.message : String(flushError));
             }
-            const result = await runSingleWorkflowNode(config, nodeId, node, options, workingDir, context, executionContext);
-            return { nodeId, node, result };
-        }));
-        for (const { nodeId, node, result } of results) {
-            nodes[nodeId] = result;
-            recordNodeArtifact(nodeId, node, result, artifacts);
         }
+        throw error;
     }
     const lastNodeId = executionOrder[executionOrder.length - 1];
     const lastNode = workflowNodes[lastNodeId];
-    const outputKey = lastNode.output ?? lastNodeId;
+    const outputKey = workflow.output ?? lastNode.output ?? lastNodeId;
     const result = {
         timestamp: new Date().toISOString(),
         workflow: workflowName,
         inputs,
         nodes,
         artifacts,
+        loop,
         output: artifacts[outputKey],
     };
     if (options.outputPath) {
@@ -1173,6 +3086,9 @@ export async function runWorkflow(config, workflowName, options = {}) {
             console.log(chalk.green(`\n✓ Workflow output saved to ${options.outputPath}`));
         }
     }
+    if (executionContext.traceCollector && executionContext.traceCollector.getTraces().length > 0) {
+        await flushWorkflowTrace(executionContext.traceCollector, workflowName, inputs, result.timestamp, workingDir, options);
+    }
     if (options.jsonOutput) {
         console.log(formatWorkflowJson(result));
     }
@@ -1226,4 +3142,168 @@ export function listWorkflows(config, options = {}) {
     }
     return entries;
 }
+function getWorkflowNodeRoutes(node) {
+    if (node.control === 'loop') {
+        return { target: node.target, exit: node.exit };
+    }
+    if (node.control === 'switch') {
+        return { cases: node.cases, default: node.default };
+    }
+    if (node.control === 'passThrough') {
+        return { target: node.target };
+    }
+    return undefined;
+}
+function formatWorkflowInput(input) {
+    if (typeof input === 'string') {
+        return JSON.stringify(input);
+    }
+    if (input.file !== undefined) {
+        return `file:${input.file}`;
+    }
+    return JSON.stringify(input.value ?? '');
+}
+function buildWorkflowDetail(name, workflow, workingDir) {
+    const sourceInfo = loadWorkflowSourceInfo(workingDir);
+    const info = sourceInfo[name] ?? {
+        source: 'packaged',
+        overridesPackaged: false,
+    };
+    const workflowNodes = getWorkflowNodes(name, workflow);
+    getWorkflowExecutionOrder(workflowNodes);
+    return {
+        name,
+        source: info.source,
+        overridden: info.overridesPackaged,
+        description: workflow.description,
+        inputs: workflow.inputs ?? {},
+        output: workflow.output,
+        nodes: Object.entries(workflowNodes).map(([nodeId, node]) => ({
+            id: nodeId,
+            kind: getNodeKind(node),
+            needs: getNodeNeeds(node),
+            agent: node.agent,
+            agentsFrom: node.agentsFrom,
+            action: node.action,
+            control: node.control,
+            if: node.if,
+            input: node.input,
+            with: node.with,
+            output: node.output,
+            writes: node.writes,
+            json: node.json,
+            routes: getWorkflowNodeRoutes(node),
+        })),
+    };
+}
+export function showWorkflow(config, workflowName, options = {}) {
+    const workflow = config.workflows?.[workflowName];
+    if (!workflow) {
+        throw new Error(`Unknown workflow "${workflowName}".`);
+    }
+    const detail = buildWorkflowDetail(workflowName, workflow, options.workingDir ?? process.cwd());
+    if (options.json) {
+        console.log(JSON.stringify(detail, null, 2));
+        return detail;
+    }
+    const sourceLabel = detail.source === 'packaged' ? chalk.gray('packaged') : chalk.cyan('project');
+    const overridden = detail.overridden ? ` ${chalk.yellow('(overrides packaged)')}` : '';
+    console.log(chalk.bold(`\nWorkflow: ${detail.name}\n`));
+    console.log(`  Source: ${sourceLabel}${overridden}`);
+    if (detail.description) {
+        console.log(`  Description: ${detail.description}`);
+    }
+    if (detail.output) {
+        console.log(`  Output: ${detail.output}`);
+    }
+    console.log(chalk.bold('\nInputs:'));
+    const inputEntries = Object.entries(detail.inputs);
+    if (inputEntries.length === 0) {
+        console.log(chalk.gray('  (none)'));
+    }
+    else {
+        for (const [key, input] of inputEntries) {
+            console.log(`  ${key}: ${formatWorkflowInput(input)}`);
+        }
+    }
+    console.log(chalk.bold('\nNodes:'));
+    for (const node of detail.nodes) {
+        console.log(`  ${node.id} (${node.kind})`);
+        if (node.needs.length > 0) {
+            console.log(`    needs: ${node.needs.join(', ')}`);
+        }
+        if (node.agent)
+            console.log(`    agent: ${node.agent}`);
+        if (node.agentsFrom)
+            console.log(`    agentsFrom: ${node.agentsFrom}`);
+        if (node.action)
+            console.log(`    action: ${node.action}`);
+        if (node.control)
+            console.log(`    control: ${node.control}`);
+        if (node.if)
+            console.log(`    if: ${node.if}`);
+        if (node.output)
+            console.log(`    output: ${node.output}`);
+        if (node.writes)
+            console.log(`    writes: ${node.writes}`);
+        if (node.input)
+            console.log(`    input: ${node.input.split('\n')[0]}`);
+        if (node.with && Object.keys(node.with).length > 0) {
+            console.log(`    with: ${JSON.stringify(node.with)}`);
+        }
+        if (node.routes && Object.keys(node.routes).length > 0) {
+            console.log(`    routes: ${JSON.stringify(node.routes)}`);
+        }
+    }
+    console.log('');
+    return detail;
+}
+function validateSingleWorkflow(config, workflowName, workingDir) {
+    const workflow = config.workflows?.[workflowName];
+    if (!workflow) {
+        return { name: workflowName, valid: false, error: `Unknown workflow "${workflowName}".` };
+    }
+    try {
+        const sourceInfo = loadWorkflowSourceInfo(workingDir);
+        const workflowNodes = getWorkflowNodes(workflowName, workflow);
+        const executionOrder = getWorkflowExecutionOrder(workflowNodes);
+        return {
+            name: workflowName,
+            valid: true,
+            source: sourceInfo[workflowName]?.source ?? 'packaged',
+            waves: getWorkflowExecutionWaves(workflowNodes, executionOrder),
+        };
+    }
+    catch (error) {
+        return {
+            name: workflowName,
+            valid: false,
+            error: error instanceof Error ? error.message : String(error),
+        };
+    }
+}
+export function validateWorkflows(config, workflowName, options = {}) {
+    const workingDir = options.workingDir ?? process.cwd();
+    const names = workflowName ? [workflowName] : Object.keys(config.workflows ?? {}).sort();
+    const results = names.map((name) => validateSingleWorkflow(config, name, workingDir));
+    if (options.json) {
+        console.log(JSON.stringify(results, null, 2));
+        return results;
+    }
+    console.log(chalk.bold('\nWorkflow Validation:\n'));
+    for (const result of results) {
+        if (result.valid) {
+            console.log(`  ${chalk.green('✓')} ${result.name}`);
+            if (result.waves) {
+                console.log(`    waves: ${result.waves.map((wave) => `[${wave.join(', ')}]`).join(' -> ')}`);
+            }
+        }
+        else {
+            console.log(`  ${chalk.red('✗')} ${result.name}`);
+            console.log(`    ${chalk.red(result.error ?? 'invalid workflow')}`);
+        }
+    }
+    console.log('');
+    return results;
+}
 //# sourceMappingURL=workflow.js.map