@diff-review-system/drs 4.1.0 → 5.0.0-rc.1

package/dist/cli/workflow.js

@@ -16,17 +16,21 @@ import { resolveCursorFixLinkOptions } from '../lib/cursor-fix-link.js';
 import { extractHtmlDocument, parseArtifactOutputPointer, readArtifactOutputPointer, validateHtmlArtifact, } from '../lib/html-artifact.js';
 import { getCanonicalDiffCommand, resolveBaseBranch } from '../lib/repository-validator.js';
 import { formatCodeQualityReport, generateCodeQualityReport } from '../lib/code-quality-report.js';
+import { formatOkfValidationErrors, synchronizeOkfIndexes, validateOkfBundle, } from '../lib/okf-wiki.js';
+import { checkWikiClean, planWikiUpdate, recordWikiState, } from '../lib/wiki-delta.js';
+import { createWikiRunSummary, formatWikiRunSummaryHuman, formatWikiRunSummaryMarkdown, getWikiRunSummary, } from '../lib/wiki-run-summary.js';
 import { createGitHubClient } from '../github/client.js';
 import { GitHubPlatformAdapter } from '../github/platform-adapter.js';
 import { createGitLabClient } from '../gitlab/client.js';
 import { GitLabPlatformAdapter } from '../gitlab/platform-adapter.js';
 import { loadWorkflowArtifact, saveWorkflowArtifact, updateWorkflowArtifact, workflowArtifactExists, } from '../lib/workflow-artifacts.js';
-import { addReviewArtifactFinding, createReviewArtifactPayload, getReviewArtifactStatus, isReviewArtifactPayload, updateReviewArtifactFindings, } from '../lib/review-artifact.js';
+import { addReviewArtifactFinding, createReviewArtifactPayload, getReviewArtifactStatus, isReviewArtifactPayload, reviewArtifactToReviewResult, updateReviewArtifactFindings, } from '../lib/review-artifact.js';
+import { renderAgentPermissions, renderAgentValidation } from '../lib/agent-permissions.js';
 import { runAgent } from './run-agent.js';
 import { TraceCollector } from '../lib/trace-collector.js';
 import { renderTraceHtml } from '../lib/trace-html.js';
 import { buildWorkflowGraph, formatWorkflowGraphMermaid, } from '../lib/workflow/graph.js';
-import { computeActiveWorkflowNodes, createSkippedWorkflowNodeResult, findWorkflowSegmentIndex, getNodeKind, getNodeNeeds, getWorkflowExecutionOrder, getWorkflowExecutionWaves, getWorkflowNodeSkipReason, getWorkflowNodes, hasWorkflowControlNodes, normalizeWorkflowBooleanLike, renderTemplate, runControlWorkflowNode, splitWorkflowSegments, } from '../lib/workflow/planning.js';
+import { computeActiveWorkflowNodes, createSkippedWorkflowNodeResult, findWorkflowSegmentIndex, getNodeKind, getNodeNeeds, getWorkflowExecutionOrder, getWorkflowExecutionWaves, getWorkflowNodeSkipReason, getWorkflowNodes, hasWorkflowControlNodes, isPotentialWorkspaceMutation, normalizeWorkflowBooleanLike, renderTemplate, runControlWorkflowNode, splitWorkflowSegments, } from '../lib/workflow/planning.js';
 import { getWorkflowInputConfigType } from '../lib/workflow/input.js';
 export { compileWorkflowPlan, } from '../lib/workflow/compiled-plan.js';
 function createWorkflowLock() {
@@ -186,7 +190,7 @@ function hasConfiguredAgentPrompt(config, agentId) {
     const runConfig = resolveAgentRunConfig(config, agentId);
     return runConfig.prompt !== undefined || runConfig.promptFile !== undefined;
 }
-function createAgentOptions(prompt, options, workingDir) {
+function createAgentOptions(prompt, options, workingDir, node, context) {
     return {
         prompt,
         jsonOutput: false,
@@ -196,6 +200,16 @@ function createAgentOptions(prompt, options, workingDir) {
         quiet: true,
         allowImplicitStdin: false,
         ignoreConfiguredOutput: true,
+        ...(node.permissions
+            ? {
+                permissions: renderAgentPermissions(node.permissions, (value) => renderTemplate(value, context)),
+            }
+            : {}),
+        ...(node.validation
+            ? {
+                validation: renderAgentValidation(node.validation, (value) => renderTemplate(value, context)),
+            }
+            : {}),
     };
 }
 async function writeWorkflowFile(workingDir, relativeOutputPath, content) {
@@ -255,7 +269,7 @@ async function runAgentWorkflowNode(config, nodeId, node, options, workingDir, c
         throw new Error(`Workflow agent node "${nodeId}" must define input or configure ` +
             `agents.overrides.${agentId}.run.prompt/promptFile.`);
     }
-    const agentOptions = createAgentOptions(prompt, options, workingDir);
+    const agentOptions = createAgentOptions(prompt, options, workingDir, node, context);
     if (executionContext?.traceCollector && prompt) {
         agentOptions.traceCollector = executionContext.traceCollector;
         executionContext.traceCollector.setContext(nodeId, agentId, prompt);
@@ -273,6 +287,8 @@ async function runAgentWorkflowNode(config, nodeId, node, options, workingDir, c
         type: 'agent',
         agent: agentId,
         response: result.response,
+        usage: result.usage,
+        workspaceChanges: result.workspaceChanges,
         output,
         writes,
     };
@@ -291,7 +307,7 @@ async function runAgentsWorkflowNode(config, nodeId, node, options, workingDir,
                 `agents.overrides.${missingPromptAgent}.run.prompt/promptFile.`);
         }
     }
-    const responses = await Promise.all(agentIds.map((agentId) => runAgent(config, agentId, createAgentOptions(prompt, options, workingDir))));
+    const responses = await Promise.all(agentIds.map((agentId) => runAgent(config, agentId, createAgentOptions(prompt, options, workingDir, node, context))));
     const response = responses
         .map((result) => `## ${result.agent}\n\n${result.response.trim()}`.trim())
         .join('\n\n');
@@ -392,6 +408,27 @@ async function runActionWorkflowNode(config, nodeId, node, options, workingDir,
     if (node.action === 'code-quality-report') {
         return runCodeQualityReportWorkflowNode(nodeId, node, workingDir, context);
     }
+    if (node.action === 'plan-wiki-update') {
+        return runPlanWikiUpdateWorkflowNode(nodeId, node, workingDir, context);
+    }
+    if (node.action === 'sync-okf-indexes') {
+        return runSyncOkfIndexesWorkflowNode(nodeId, node, workingDir, context);
+    }
+    if (node.action === 'validate-okf-wiki') {
+        return runValidateOkfWikiWorkflowNode(nodeId, node, workingDir, context);
+    }
+    if (node.action === 'summarize-wiki-run') {
+        return runSummarizeWikiRunWorkflowNode(nodeId, node, context);
+    }
+    if (node.action === 'record-wiki-state') {
+        return runRecordWikiStateWorkflowNode(nodeId, node, workingDir, context);
+    }
+    if (node.action === 'check-wiki-state') {
+        return runCheckWikiStateWorkflowNode(nodeId, node, workingDir, context);
+    }
+    if (node.action === 'check-wiki-clean') {
+        return runCheckWikiCleanWorkflowNode(nodeId, node, workingDir, context);
+    }
     if (node.action === 'post-comment') {
         return runPostCommentWorkflowNode(nodeId, node, options, workingDir, context, executionContext);
     }
@@ -545,13 +582,45 @@ async function runGitBranchWorkflowNode(nodeId, node, workingDir, context, execu
 async function runGitCommitWorkflowNode(nodeId, node, workingDir, context, executionContext) {
     const git = await requireWorkflowGitRepo(nodeId, workingDir, executionContext);
     const message = requireStringActionOption(nodeId, node, 'message', context);
+    const useChangeRequestAuthor = getBooleanActionOption(node, 'useChangeRequestAuthor', context);
+    let commitGit = git;
+    if (useChangeRequestAuthor) {
+        const configuredSource = getStringActionOption(node, 'source', context)?.trim();
+        const sourceArtifact = configuredSource ?? 'change';
+        const source = context.artifacts[sourceArtifact];
+        const platform = isReviewSource(source) && typeof source.context.platform === 'string'
+            ? source.context.platform
+            : undefined;
+        const pullRequest = isReviewSource(source) && isPullRequest(source.context.pullRequest)
+            ? source.context.pullRequest
+            : undefined;
+        const name = pullRequest?.author.trim();
+        const email = pullRequest?.authorEmail?.trim();
+        if (!isWorkflowPlatform(platform) ||
+            !name ||
+            name === 'Unknown' ||
+            /[\0\r\n]/.test(name) ||
+            !email ||
+            /[\0\r\n]/.test(email) ||
+            !/^[^\s<>@]+@[^\s<>@]+$/.test(email)) {
+            throw new Error(`Workflow git-commit node "${nodeId}" with.useChangeRequestAuthor requires source artifact "${sourceArtifact}" to contain a GitHub PR or GitLab MR creator identity.`);
+        }
+        const environment = Object.fromEntries(Object.entries(process.env).filter((entry) => entry[1] !== undefined));
+        commitGit = simpleGit({ baseDir: workingDir }).env({
+            ...environment,
+            GIT_AUTHOR_NAME: name,
+            GIT_AUTHOR_EMAIL: email,
+            GIT_COMMITTER_NAME: name,
+            GIT_COMMITTER_EMAIL: email,
+        });
+    }
     const paths = hasActionOption(node, 'paths') || hasActionOption(node, 'path')
         ? getPathActionOption(nodeId, node, context, workingDir)
         : undefined;
     if (paths) {
         await git.add(paths);
     }
-    const commit = paths ? await git.commit(message, paths) : await git.commit(message);
+    const commit = paths ? await commitGit.commit(message, paths) : await commitGit.commit(message);
     const output = {
         commit: commit.commit,
         message,
@@ -1124,16 +1193,59 @@ function createPlatformChangeSource(platform, name, projectId, pullRequest, chan
         workingDir,
     };
 }
+function getPatchChangeCounts(patch) {
+    let additions = 0;
+    let deletions = 0;
+    for (const line of patch.split('\n')) {
+        if (line.startsWith('+'))
+            additions += 1;
+        if (line.startsWith('-'))
+            deletions += 1;
+    }
+    return { additions, deletions };
+}
 async function loadGitHubChangeSource(nodeId, node, workingDir, context, executionContext) {
     const owner = requireStringActionOption(nodeId, node, 'owner', context);
     const repo = requireStringActionOption(nodeId, node, 'repo', context);
     const prNumber = requireNumberActionOption(nodeId, node, 'pr', context);
     const projectId = `${owner}/${repo}`;
     const platformClient = getWorkflowPlatformClient(executionContext, 'github');
-    const [pullRequest, changedFiles] = await Promise.all([
-        platformClient.getPullRequest(projectId, prNumber),
-        platformClient.getChangedFiles(projectId, prNumber),
-    ]);
+    const requireCompleteDiff = getBooleanActionOption(node, 'requireCompleteDiff', context);
+    let pullRequest;
+    let changedFiles;
+    if (requireCompleteDiff) {
+        const before = await platformClient.getPullRequest(projectId, prNumber);
+        changedFiles = await platformClient.getChangedFiles(projectId, prNumber);
+        const after = await platformClient.getPullRequest(projectId, prNumber);
+        if (before.headSha !== after.headSha) {
+            throw new Error(`Workflow change-source node "${nodeId}" cannot review an unstable pull request head.`);
+        }
+        const platformData = after.platformData;
+        const expectedFileCount = platformData && typeof platformData === 'object' && 'changed_files' in platformData
+            ? platformData.changed_files
+            : undefined;
+        if (typeof expectedFileCount !== 'number' ||
+            !Number.isInteger(expectedFileCount) ||
+            expectedFileCount !== changedFiles.length) {
+            throw new Error(`Workflow change-source node "${nodeId}" did not receive the complete GitHub file list.`);
+        }
+        const incompleteFiles = changedFiles.filter((file) => {
+            if (!file.patch || file.patch.length === 0)
+                return true;
+            const counts = getPatchChangeCounts(file.patch);
+            return counts.additions !== file.additions || counts.deletions !== file.deletions;
+        });
+        if (incompleteFiles.length > 0) {
+            throw new Error(`Workflow change-source node "${nodeId}" did not receive complete patches for: ${incompleteFiles.map((file) => file.filename).join(', ')}`);
+        }
+        pullRequest = after;
+    }
+    else {
+        [pullRequest, changedFiles] = await Promise.all([
+            platformClient.getPullRequest(projectId, prNumber),
+            platformClient.getChangedFiles(projectId, prNumber),
+        ]);
+    }
     return createPlatformChangeSource('github', `GitHub PR ${projectId}#${prNumber}`, projectId, pullRequest, changedFiles, workingDir);
 }
 async function loadGitLabChangeSource(nodeId, node, workingDir, context, executionContext) {
@@ -1556,6 +1668,154 @@ async function runCodeQualityReportWorkflowNode(nodeId, node, workingDir, contex
         writes: reportPath,
     };
 }
+async function runSyncOkfIndexesWorkflowNode(nodeId, node, workingDir, context) {
+    const root = getStringActionOption(node, 'root', context)?.trim() ?? 'wiki';
+    const version = getStringActionOption(node, 'version', context)?.trim() ?? '0.1';
+    const result = await synchronizeOkfIndexes(workingDir, root, version);
+    return {
+        id: nodeId,
+        type: 'action',
+        action: node.action,
+        response: `synchronized ${result.indexes} OKF indexes under ${result.root} (${result.updated} updated)`,
+        output: result,
+    };
+}
+function getWikiInstructionsActionOptions(node, context) {
+    const instructionsPath = getStringActionOption(node, 'instructionsPath', context)?.trim();
+    const instructions = getStringActionOption(node, 'instructions', context);
+    return {
+        ...(instructionsPath ? { instructionsPath } : {}),
+        ...(instructions !== undefined ? { instructions } : {}),
+    };
+}
+async function runPlanWikiUpdateWorkflowNode(nodeId, node, workingDir, context) {
+    const root = getStringActionOption(node, 'root', context)?.trim() ?? 'wiki';
+    const statePath = getStringActionOption(node, 'statePath', context)?.trim() ?? '.drs/wiki-state.json';
+    const result = await planWikiUpdate(workingDir, root, statePath, getWikiInstructionsActionOptions(node, context));
+    return {
+        id: nodeId,
+        type: 'action',
+        action: node.action,
+        response: `${result.mode}: ${result.reason}`,
+        output: result,
+    };
+}
+async function runValidateOkfWikiWorkflowNode(nodeId, node, workingDir, context) {
+    const root = getStringActionOption(node, 'root', context)?.trim() ?? 'wiki';
+    const version = getStringActionOption(node, 'version', context)?.trim() ?? '0.1';
+    const result = await validateOkfBundle(workingDir, root, version);
+    if (!result.valid) {
+        throw new Error(`Workflow validate-okf-wiki node "${nodeId}" found ${result.errors.length} error(s):\n${formatOkfValidationErrors(result)}`);
+    }
+    return {
+        id: nodeId,
+        type: 'action',
+        action: node.action,
+        response: `validated ${result.concepts} OKF concepts under ${result.root} with ` +
+            `${result.warnings.length} warning(s); graph: ${result.graph.nodeCount} nodes, ` +
+            `${result.graph.directedEdgeCount} directed edges, ` +
+            `${result.graph.orphanConceptCount} orphans, ` +
+            `${result.graph.weaklyConnectedConceptCount} weakly connected`,
+        output: result,
+    };
+}
+function runSummarizeWikiRunWorkflowNode(nodeId, node, context) {
+    const planName = getStringActionOption(node, 'plan', context)?.trim() ?? 'wikiDelta';
+    const validationName = getStringActionOption(node, 'validation', context)?.trim() ?? 'wikiValidation';
+    const agentNodeId = getStringActionOption(node, 'agentNode', context)?.trim() ?? 'maintain-wiki';
+    const plan = requireWikiUpdatePlan(context.artifacts[planName], nodeId, planName);
+    const validation = requireWikiValidation(context.artifacts[validationName], nodeId, validationName);
+    const agentNode = context.nodes[agentNodeId];
+    if (plan.shouldRun &&
+        (!agentNode || agentNode.status === 'skipped' || agentNode.type !== 'agent')) {
+        throw new Error(`Workflow summarize-wiki-run node "${nodeId}" expected completed agent node "${agentNodeId}".`);
+    }
+    const startedAt = context.startedAt ? Date.parse(context.startedAt) : Date.now();
+    const summary = createWikiRunSummary({
+        plan,
+        validation,
+        modelInvoked: plan.shouldRun,
+        usage: plan.shouldRun ? agentNode?.usage : undefined,
+        workspaceChanges: plan.shouldRun ? agentNode?.workspaceChanges : undefined,
+        elapsedMs: Date.now() - (Number.isFinite(startedAt) ? startedAt : Date.now()),
+    });
+    const response = formatWikiRunSummaryHuman(summary);
+    return {
+        id: nodeId,
+        type: 'action',
+        action: node.action,
+        response,
+        output: { ...validation, summary, summaryMarkdown: formatWikiRunSummaryMarkdown(summary) },
+    };
+}
+function requireWikiUpdatePlan(value, nodeId, artifactName) {
+    if (!isRecord(value) ||
+        !['generate', 'reconcile', 'update', 'noop'].includes(String(value.mode)) ||
+        typeof value.shouldRun !== 'boolean' ||
+        typeof value.changedPathCount !== 'number') {
+        throw new Error(`Workflow summarize-wiki-run node "${nodeId}" needs a wiki update plan artifact at "${artifactName}".`);
+    }
+    return value;
+}
+function requireWikiValidation(value, nodeId, artifactName) {
+    if (!isRecord(value) ||
+        typeof value.valid !== 'boolean' ||
+        typeof value.root !== 'string' ||
+        typeof value.concepts !== 'number' ||
+        !Array.isArray(value.errors) ||
+        !Array.isArray(value.warnings) ||
+        !isRecord(value.graph)) {
+        throw new Error(`Workflow summarize-wiki-run node "${nodeId}" needs an OKF validation artifact at "${artifactName}".`);
+    }
+    return value;
+}
+function isRecord(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+async function runRecordWikiStateWorkflowNode(nodeId, node, workingDir, context) {
+    const root = getStringActionOption(node, 'root', context)?.trim() ?? 'wiki';
+    const statePath = getStringActionOption(node, 'statePath', context)?.trim() ?? '.drs/wiki-state.json';
+    const result = await recordWikiState(workingDir, root, statePath, getWikiInstructionsActionOptions(node, context));
+    return {
+        id: nodeId,
+        type: 'action',
+        action: node.action,
+        response: `recorded wiki state for ${result.root} at ${result.gitHead}`,
+        output: result,
+        writes: statePath,
+    };
+}
+async function runCheckWikiCleanWorkflowNode(nodeId, node, workingDir, context) {
+    const root = getStringActionOption(node, 'root', context)?.trim() ?? 'wiki';
+    const statePath = getStringActionOption(node, 'statePath', context)?.trim() ?? '.drs/wiki-state.json';
+    const result = await checkWikiClean(workingDir, root, statePath);
+    if (!result.clean) {
+        throw new Error(`Workflow check-wiki-clean node "${nodeId}" found stale wiki output:\n${result.changedPaths.map((filePath) => `- ${filePath}`).join('\n')}`);
+    }
+    return {
+        id: nodeId,
+        type: 'action',
+        action: node.action,
+        response: `wiki bundle ${result.root} and state ${result.statePath} are current`,
+        output: result,
+    };
+}
+async function runCheckWikiStateWorkflowNode(nodeId, node, workingDir, context) {
+    const root = getStringActionOption(node, 'root', context)?.trim() ?? 'wiki';
+    const statePath = getStringActionOption(node, 'statePath', context)?.trim() ?? '.drs/wiki-state.json';
+    const result = await planWikiUpdate(workingDir, root, statePath, getWikiInstructionsActionOptions(node, context));
+    if (result.shouldRun) {
+        const paths = result.changedPaths.map((filePath) => `- ${filePath}`).join('\n');
+        throw new Error(`Workflow check-wiki-state node "${nodeId}" found a stale wiki (${result.mode}): ${result.reason}${paths ? `\n${paths}` : ''}`);
+    }
+    return {
+        id: nodeId,
+        type: 'action',
+        action: node.action,
+        response: result.reason,
+        output: result,
+    };
+}
 async function runDescribeWorkflowNode(config, nodeId, node, options, workingDir, context, executionContext) {
     const sourceArtifact = getStringActionOption(node, 'source', context) ?? 'change';
     const source = context.artifacts[sourceArtifact];
@@ -1648,15 +1908,35 @@ async function runPostReviewCommentsWorkflowNode(config, nodeId, node, options,
     const sourceArtifact = getStringActionOption(node, 'source', context) ?? 'change';
     const reviewArtifact = getStringActionOption(node, 'review', context) ?? 'review';
     const source = context.artifacts[sourceArtifact];
-    const reviewResult = context.artifacts[reviewArtifact];
+    const reviewValue = context.artifacts[reviewArtifact];
     if (!isReviewSource(source)) {
         throw new Error(`Workflow post-review-comments node "${nodeId}" needs a ReviewSource artifact.`);
     }
-    if (!isReviewResult(reviewResult)) {
-        throw new Error(`Workflow post-review-comments node "${nodeId}" needs a ReviewResult artifact.`);
-    }
     const target = resolvePostTarget(nodeId, node, context, executionContext, source);
     const pullRequest = target.pullRequest;
+    const canonicalArtifactMode = hasActionOption(node, 'expectedHeadSha');
+    const expectedHeadSha = getStringActionOption(node, 'expectedHeadSha', context)?.trim();
+    let reviewResult;
+    if (canonicalArtifactMode) {
+        if (!expectedHeadSha || !pullRequest) {
+            throw new Error(`Workflow post-review-comments node "${nodeId}" needs pull request metadata and a non-empty expectedHeadSha to validate a canonical review artifact.`);
+        }
+        reviewResult = reviewArtifactToReviewResult(reviewValue, {
+            platform: target.platform,
+            projectId: target.projectId,
+            changeKind: target.platform === 'gitlab' ? 'mr' : 'pr',
+            changeNumber: target.prNumber,
+            expectedHeadSha,
+            currentHeadSha: pullRequest.headSha,
+            changedFiles: source.files,
+        });
+    }
+    else if (isReviewResult(reviewValue)) {
+        reviewResult = reviewValue;
+    }
+    else {
+        throw new Error(`Workflow post-review-comments node "${nodeId}" needs a ReviewResult artifact or a canonical review artifact with expectedHeadSha.`);
+    }
     const platformData = pullRequest?.platformData;
     const lineValidator = createWorkflowLineValidator(target.platform, source);
     const createInlinePosition = lineValidator
@@ -1664,10 +1944,15 @@ async function runPostReviewCommentsWorkflowNode(config, nodeId, node, options,
         : undefined;
     const shouldRemoveErrorComment = !hasActionOption(node, 'removeErrorComment') ||
         getBooleanActionOption(node, 'removeErrorComment', context);
-    await withWorkflowConsoleSuppressed(executionContext, options.jsonOutput === true, async () => {
-        if (shouldRemoveErrorComment) {
-            await removeErrorComment(target.platformClient, target.projectId, target.prNumber);
+    const assertCurrentHead = expectedHeadSha
+        ? async () => {
+            const latestPullRequest = await target.platformClient.getPullRequest(target.projectId, target.prNumber);
+            if (latestPullRequest.headSha !== expectedHeadSha) {
+                throw new Error('Pull request head changed before review comments could be posted.');
+            }
         }
+        : undefined;
+    await withWorkflowConsoleSuppressed(executionContext, options.jsonOutput === true, async () => {
         const cursorFixLinks = resolveCursorFixLinkOptions(config, target.projectId, workingDir);
         await postReviewComments(target.platformClient, target.projectId, target.prNumber, reviewResult.summary, reviewResult.issues, reviewResult.changeSummary, reviewResult.usage, platformData, lineValidator, createInlinePosition, cursorFixLinks, pullRequest
             ? {
@@ -1675,6 +1960,8 @@ async function runPostReviewCommentsWorkflowNode(config, nodeId, node, options,
                 sourceBranch: pullRequest.sourceBranch,
                 targetBranch: pullRequest.targetBranch,
             }
+            : undefined, assertCurrentHead, shouldRemoveErrorComment
+            ? () => removeErrorComment(target.platformClient, target.projectId, target.prNumber, assertCurrentHead)
             : undefined);
     });
     return {
@@ -2004,11 +2291,17 @@ async function runReviewWorkflowNode(config, nodeId, node, options, workingDir,
             console.warn = () => undefined;
         }
         try {
-            return await executeReview(config, {
+            const reviewSource = {
                 ...sourceForReview,
                 workingDir: sourceForReview.workingDir ?? workingDir,
                 debug: options.debug,
                 thinkingLevel: options.thinkingLevel,
+            };
+            if (!node.permissions) {
+                return await executeReview(config, reviewSource);
+            }
+            return await executeReview(config, reviewSource, {
+                permissions: renderAgentPermissions(node.permissions, (value) => renderTemplate(value, context)),
             });
         }
         finally {
@@ -2214,16 +2507,21 @@ async function runSingleWorkflowNode(config, nodeId, node, options, workingDir,
     if (getWorkflowNodeSkipReason(node, context)) {
         return createSkippedWorkflowNodeResult(nodeId);
     }
-    if (kind === 'agent') {
-        return runAgentWorkflowNode(config, nodeId, node, options, workingDir, context, executionContext);
-    }
-    if (kind === 'agents') {
-        return runAgentsWorkflowNode(config, nodeId, node, options, workingDir, context);
-    }
-    if (kind === 'control') {
-        throw new Error(`Workflow control node "${nodeId}" cannot run in the static DAG executor.`);
-    }
-    return runActionWorkflowNode(config, nodeId, node, options, workingDir, context, executionContext);
+    const run = async () => {
+        if (kind === 'agent') {
+            return runAgentWorkflowNode(config, nodeId, node, options, workingDir, context, executionContext);
+        }
+        if (kind === 'agents') {
+            return runAgentsWorkflowNode(config, nodeId, node, options, workingDir, context);
+        }
+        if (kind === 'control') {
+            throw new Error(`Workflow control node "${nodeId}" cannot run in the static DAG executor.`);
+        }
+        return runActionWorkflowNode(config, nodeId, node, options, workingDir, context, executionContext);
+    };
+    return isPotentialWorkspaceMutation(node)
+        ? withWorkflowLock(executionContext.locks.workspace, run)
+        : run();
 }
 /**
  * In-process {@link NodeExecutor} that dispatches a single non-control node
@@ -2256,6 +2554,7 @@ export async function runWorkflowNodeLocally(config, nodeId, node, options, work
         locks: {
             exit: createWorkflowLock(),
             console: createWorkflowLock(),
+            workspace: createWorkflowLock(),
         },
     };
     return runSingleWorkflowNode(config, nodeId, node, options, workingDir, context, executionContext);
@@ -2289,6 +2588,7 @@ export async function runWorkflowFromCompiledPlan(config, plan, options = {}) {
     return executeWorkflowRun(config, plan.workflowName, plan.nodes, plan.executionOrder, plan.waves, plan.output, false, options);
 }
 async function executeWorkflowRun(config, workflowName, workflowNodes, executionOrder, executionWaves, workflowOutput, hasControl, options, controlSegments) {
+    const startedAt = new Date().toISOString();
     const workflow = config.workflows?.[workflowName];
     if (!workflow) {
         throw new Error(`Unknown workflow "${workflowName}".`);
@@ -2298,7 +2598,7 @@ async function executeWorkflowRun(config, workflowName, workflowNodes, execution
     const nodes = {};
     const artifacts = {};
     const loop = {};
-    const context = { inputs, nodes, artifacts, loop };
+    const context = { startedAt, inputs, nodes, artifacts, loop };
     const executionContext = {
         gitClients: new Map(),
         platformClients: {},
@@ -2306,6 +2606,7 @@ async function executeWorkflowRun(config, workflowName, workflowNodes, execution
         locks: {
             exit: createWorkflowLock(),
             console: createWorkflowLock(),
+            workspace: createWorkflowLock(),
         },
     };
     const nodeExecutor = new LocalNodeExecutor(config, options, workingDir, executionContext);
@@ -2397,8 +2698,14 @@ async function executeWorkflowRun(config, workflowName, workflowNodes, execution
     if (options.jsonOutput) {
         console.log(formatWorkflowJson(result));
     }
-    else if (typeof result.output === 'string' && result.output.trim()) {
-        console.log(`\n${result.output}`);
+    else {
+        const wikiSummary = getWikiRunSummary(result.output);
+        if (wikiSummary) {
+            console.log(`\n${formatWikiRunSummaryHuman(wikiSummary)}`);
+        }
+        else if (typeof result.output === 'string' && result.output.trim()) {
+            console.log(`\n${result.output}`);
+        }
     }
     return result;
 }
@@ -2500,6 +2807,8 @@ function buildWorkflowDetail(name, workflow, workingDir) {
             output: node.output,
             writes: node.writes,
             json: node.json,
+            permissions: node.permissions,
+            validation: node.validation,
             routes: getWorkflowNodeRoutes(node),
         })),
         graph,
@@ -2587,6 +2896,10 @@ export function showWorkflow(config, workflowName, options = {}) {
             console.log(`    output: ${node.output}`);
         if (node.writes)
             console.log(`    writes: ${node.writes}`);
+        if (node.permissions)
+            console.log(`    permissions: ${JSON.stringify(node.permissions)}`);
+        if (node.validation)
+            console.log(`    validation: ${JSON.stringify(node.validation)}`);
         if (node.input)
             console.log(`    input: ${node.input.split('\n')[0]}`);
         if (node.with && Object.keys(node.with).length > 0) {