@miphamai/cli 0.14.0 → 0.15.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miphamai/cli",
-  "version": "0.14.0",
+  "version": "0.15.0",
   "description": "Mipham Code — Multi-model open-core intelligent coding terminal by MiphamAI",
   "keywords": [
     "ai",

package/src/agent/sub-agent.ts

@@ -4,6 +4,7 @@ import type { SubAgentType, SubAgentOptions, AgentDefinition } from './types'
 import { createAgentContext } from './agent-context'
 import { getBackgroundAgentRegistry } from './background-registry'
 import type { HookEngine } from '../core/hooks'
+import type { PermissionSystem } from '../core/permission'
 
 const TYPE_SYSTEM_PROMPTS: Record<SubAgentType, string> = {
   general: 'You are a focused sub-agent. Complete the assigned task thoroughly and return results.',
@@ -27,6 +28,7 @@ export class SubAgent {
   constructor(
     private registry: ProviderRegistry,
     private toolRegistry: Map<string, ToolDefinition>,
+    private permission?: PermissionSystem,
     private hookEngine?: HookEngine,
   ) {}
 
@@ -113,6 +115,9 @@ export class SubAgent {
     const agentType = options.type || 'general'
     const agentDef = options.agentDef
 
+    // Resolve execution directory: worktree isolation or process cwd
+    const execCwd = options.worktreePath || process.cwd()
+
     // Resolve system prompt: agentDef > options.systemPrompt > builtin type
     const systemPrompt =
       agentDef?.systemPrompt || options.systemPrompt || TYPE_SYSTEM_PROMPTS[agentType]
@@ -229,9 +234,21 @@ export class SubAgent {
             continue
           }
 
+          // Security: check permission before executing
+          // Sub-agents run without user interaction — tools requiring approval are rejected
+          if (this.permission?.needsApproval(tool, tu.input)) {
+            currentMessages.push({
+              role: 'user' as const,
+              content:
+                `Tool "${tu.name}" requires user approval (permission: ask). ` +
+                `Cannot execute in non-interactive sub-agent context.`,
+            })
+            continue
+          }
+
           try {
             const result = await tool.execute(tu.input, {
-              cwd: process.cwd(),
+              cwd: execCwd,
               sessionId: 'sub-agent',
               provider: '',
               model: resolvedModel,

package/src/agent/types.ts

@@ -44,4 +44,6 @@ export interface SubAgentOptions {
   runInBackground?: boolean
   /** Optional callback for streaming progress chunks during background execution. */
   onProgress?: (chunk: string) => void
+  /** When set, tool executions use this path as cwd (git worktree isolation). */
+  worktreePath?: string
 }

package/src/core/engine.ts

@@ -16,6 +16,7 @@ import type { AgentViewManager } from '../agent-view/agent-view-manager'
 import type { SkillsLoader } from '../skills/loader'
 import { getBackgroundAgentRegistry } from '../agent/background-registry'
 import { RulesLoader } from './rules-loader'
+import { UsageTracker } from './usage-tracker'
 import { buildRequest, sendInferenceCheck, isInferenceHookEnabled } from './inference-hook'
 
 export class QueryEngine {
@@ -82,6 +83,7 @@ export class QueryEngine {
   private rulesLoader?: RulesLoader
   /** Files touched in the current turn (for rules matching). */
   private touchedFiles: Set<string> = new Set()
+  private usageTracker = new UsageTracker()
   /** Inference hook (DLP) configuration. */
   private inferenceHookConfig?: InferenceHookConfig
 
@@ -238,6 +240,10 @@ export class QueryEngine {
     return this.permission
   }
 
+  getUsageTracker(): UsageTracker {
+    return this.usageTracker
+  }
+
   async *process(userInput: string, signal?: AbortSignal): AsyncGenerator<StreamChunk> {
     // Fire UserPromptSubmit hooks before processing
     if (this.hookEngine) {
@@ -293,6 +299,8 @@ export class QueryEngine {
     let assistantContent = ''
     let reasoningContent = ''
     let thinkingContent = ''
+    let turnApiInputTokens = 0
+    let turnApiOutputTokens = 0
     const toolUses: Array<{ id: string; name: string; input: Record<string, unknown> }> = []
 
     // Stream model response
@@ -331,6 +339,12 @@ export class QueryEngine {
           })
         }
 
+        if (chunk.type === 'usage' && chunk.inputTokens !== undefined) {
+          // Accumulate API-reported token counts for this turn
+          turnApiInputTokens += chunk.inputTokens
+          turnApiOutputTokens += chunk.outputTokens || 0
+        }
+
         if (chunk.type === 'stop') {
           // Add assistant response to context
           if (assistantContent || reasoningContent || thinkingContent) {
@@ -417,6 +431,31 @@ export class QueryEngine {
       })
     }
 
+    // Record API token usage for this turn, attributed to executed tools
+    if (turnApiInputTokens > 0 || turnApiOutputTokens > 0) {
+      if (toolUses.length > 0) {
+        // Attribute tokens equally across all tools invoked this turn
+        const perTool = toolUses.length
+        for (const tu of toolUses) {
+          this.usageTracker.recordApiUsage(
+            Math.round(turnApiInputTokens / perTool),
+            Math.round(turnApiOutputTokens / perTool),
+            tu.name,
+          )
+        }
+      } else {
+        this.usageTracker.recordApiUsage(turnApiInputTokens, turnApiOutputTokens, 'chat')
+      }
+    } else {
+      // Fallback: API doesn't report usage — use char-based estimate
+      const estimated = Math.round((assistantContent.length + userInput.length) / 4)
+      if (toolUses.length > 0) {
+        for (const tu of toolUses) {
+          this.usageTracker.recordEstimatedUsage(Math.round(estimated / toolUses.length), tu.name)
+        }
+      }
+    }
+
     // Inject path-scoped rules for touched files
     this.injectRules()
 
@@ -721,6 +760,7 @@ export class QueryEngine {
         artifactServer: this.artifactServer,
         agentRegistry: this.agentRegistry,
         backgroundAgentRegistry: getBackgroundAgentRegistry(),
+        permissionSystem: this.permission,
       })
 
       // Track touched files for rules matching

package/src/core/permission.ts

@@ -223,6 +223,11 @@ export class PermissionSystem {
       case 'auto':
         // Safety checks handled by hook layer (PreToolUse hooks).
         // Bypass the static permission system so hooks are the sole gate.
+        // Exception: SendMessage always goes through the permission classifier
+        // so deny/allow rules are honored for cross-session messages.
+        if (tool.name === 'SendMessage') {
+          return 'mode-baseline'
+        }
         return 'bypass'
 
       case 'dontAsk':

package/src/core/usage-tracker.ts

@@ -0,0 +1,103 @@
+/**
+ * UsageTracker — per-session token usage tracking with per-tool attribution.
+ *
+ * Tracks actual API-reported token counts (when available) and falls back
+ * to character-estimated counts. Token costs are attributed to the tool
+ * invoked in each turn — MCP tools (prefixed `mcp__`) get correct
+ * per-invocation attribution, not inflated cumulative costs.
+ */
+
+export interface ToolUsage {
+  /** Total input tokens attributed to this tool. */
+  inputTokens: number
+  /** Total output tokens attributed to this tool. */
+  outputTokens: number
+  /** Number of times this tool was invoked. */
+  calls: number
+}
+
+export interface UsageSummary {
+  /** Total input tokens from API (0 if API data unavailable). */
+  apiInputTokens: number
+  /** Total output tokens from API (0 if API data unavailable). */
+  apiOutputTokens: number
+  /** Estimated total tokens (chars/4 heuristic, always available). */
+  estimatedTokens: number
+  /** Per-tool breakdown, keyed by tool name. "chat" = text-only turns. */
+  tools: Record<string, ToolUsage>
+}
+
+export class UsageTracker {
+  private _apiInputTokens = 0
+  private _apiOutputTokens = 0
+  private _estimatedTokens = 0
+  private _toolUsage = new Map<string, ToolUsage>()
+
+  /** Record API-reported token usage for a turn, attributed to the given tool. */
+  recordApiUsage(inputTokens: number, outputTokens: number, toolName?: string): void {
+    this._apiInputTokens += inputTokens
+    this._apiOutputTokens += outputTokens
+    this._recordTool(toolName || 'chat', inputTokens, outputTokens)
+  }
+
+  /** Record character-estimated token usage for a turn. */
+  recordEstimatedUsage(tokenCount: number, toolName?: string): void {
+    this._estimatedTokens += tokenCount
+    this._recordToolEstimated(toolName || 'chat', tokenCount)
+  }
+
+  /** Get a summary of all usage for the current session. */
+  getSummary(): UsageSummary {
+    const tools: Record<string, ToolUsage> = {}
+    for (const [name, usage] of this._toolUsage) {
+      tools[name] = { ...usage }
+    }
+    return {
+      apiInputTokens: this._apiInputTokens,
+      apiOutputTokens: this._apiOutputTokens,
+      estimatedTokens: this._estimatedTokens,
+      tools,
+    }
+  }
+
+  /** Reset all counters for a new session. */
+  reset(): void {
+    this._apiInputTokens = 0
+    this._apiOutputTokens = 0
+    this._estimatedTokens = 0
+    this._toolUsage.clear()
+  }
+
+  /** Total API tokens (input + output). */
+  get totalApiTokens(): number {
+    return this._apiInputTokens + this._apiOutputTokens
+  }
+
+  /** Whether any real API usage data has been recorded. */
+  get hasApiData(): boolean {
+    return this._apiInputTokens > 0 || this._apiOutputTokens > 0
+  }
+
+  // ── Private helpers ──
+
+  private _recordTool(name: string, inputTokens: number, outputTokens: number): void {
+    const existing = this._toolUsage.get(name)
+    if (existing) {
+      existing.inputTokens += inputTokens
+      existing.outputTokens += outputTokens
+      existing.calls++
+    } else {
+      this._toolUsage.set(name, { inputTokens, outputTokens, calls: 1 })
+    }
+  }
+
+  private _recordToolEstimated(name: string, tokenCount: number): void {
+    const existing = this._toolUsage.get(name)
+    if (existing) {
+      existing.inputTokens += tokenCount
+      existing.calls++
+    } else {
+      this._toolUsage.set(name, { inputTokens: tokenCount, outputTokens: 0, calls: 1 })
+    }
+  }
+}

package/src/providers/anthropic.ts

@@ -194,7 +194,15 @@ export class AnthropicProvider implements ProviderInstance {
             }
 
             case 'message_delta': {
-              // Contains stop_reason and usage info
+              // Capture token usage for accurate cost tracking
+              if (event.usage) {
+                yield {
+                  type: 'usage',
+                  inputTokens: event.usage.input_tokens,
+                  outputTokens: event.usage.output_tokens,
+                }
+              }
+              // Contains stop_reason; also handles late input_json_delta
               if (event.delta?.type === 'input_json_delta' && event.delta.partial_json) {
                 accumulatedToolInput += event.delta.partial_json
               }

package/src/providers/openai-compat.ts

@@ -99,6 +99,16 @@ export class OpenAICompatProvider implements ProviderInstance {
         try {
           const parsed = JSON.parse(data)
           const choice = parsed.choices?.[0]
+
+          // Capture token usage when available (final chunk with stream_options.include_usage)
+          if (parsed.usage) {
+            yield {
+              type: 'usage',
+              inputTokens: parsed.usage.prompt_tokens,
+              outputTokens: parsed.usage.completion_tokens,
+            }
+          }
+
           if (!choice) continue
 
           const delta = choice.delta

package/src/shared/types.ts

@@ -81,6 +81,7 @@ export interface ToolContext {
   artifactServer?: import('../artifacts/server').ArtifactServer
   agentRegistry?: import('../agent/agent-registry').AgentRegistry
   backgroundAgentRegistry?: import('../agent/background-registry').BackgroundAgentRegistry
+  permissionSystem?: import('../core/permission').PermissionSystem
 }
 
 // ── Artifact Types ──
@@ -128,7 +129,15 @@ export interface TaskNotification {
 
 // ── Stream Types ──
 export interface StreamChunk {
-  type: 'text' | 'tool_use' | 'tool_result' | 'thinking' | 'stop' | 'error' | 'task_notification'
+  type:
+    | 'text'
+    | 'tool_use'
+    | 'tool_result'
+    | 'thinking'
+    | 'stop'
+    | 'error'
+    | 'task_notification'
+    | 'usage'
   content?: string
   toolUse?: ToolUseContent
   tool_use_id?: string
@@ -139,6 +148,10 @@ export interface StreamChunk {
   thinking?: string
   /** Background task notification payload (type: 'task_notification'). */
   taskNotification?: TaskNotification
+  /** API-reported input token count (type: 'usage'). */
+  inputTokens?: number
+  /** API-reported output token count (type: 'usage'). */
+  outputTokens?: number
 }
 
 // ── Config Types ──

package/src/skills/fork-executor.ts

@@ -2,6 +2,7 @@ import { SubAgent } from '../agent/sub-agent'
 import type { ProviderRegistry } from '../providers/registry'
 import type { ToolDefinition, SkillDefinition } from '../shared/index.ts'
 import type { AgentDefinition } from '../agent/types'
+import type { PermissionSystem } from '../core/permission'
 
 /**
  * Execute a skill in an isolated subagent context (context: fork).
@@ -15,6 +16,7 @@ export async function executeForkedSkill(
   args: string,
   registry: ProviderRegistry,
   toolRegistry: Map<string, ToolDefinition>,
+  permissionSystem?: PermissionSystem,
 ): Promise<string> {
   const agentDef: AgentDefinition = {
     name: `skill:${skill.name}`,
@@ -27,7 +29,7 @@ export async function executeForkedSkill(
     source: 'builtin',
   }
 
-  const sub = new SubAgent(registry, toolRegistry)
+  const sub = new SubAgent(registry, toolRegistry, permissionSystem)
   const prompt = args
     ? `Execute the "${skill.name}" skill with arguments: ${args}`
     : `Execute the "${skill.name}" skill.`

package/src/tools/agent/agent.ts

@@ -60,7 +60,7 @@ export const agentTool: ToolDefinition = {
     const agentDef = ctx.agentRegistry?.resolve(agentType)
 
     try {
-      const sub = new SubAgent(registry, toolRegistry)
+      const sub = new SubAgent(registry, toolRegistry, ctx.permissionSystem)
       const result = await sub.execute(prompt, description, {
         type: agentType,
         agentDef,

package/src/tools/agent/skill.ts

@@ -52,6 +52,7 @@ export const skillTool: ToolDefinition = {
             args,
             registry,
             ctx.toolRegistry || new Map(),
+            ctx.permissionSystem,
           )
           // Return to AI as internal context
           return { success: true, content: `[Forked skill "${skillName}" result]:\n${result}` }

package/src/ui/commands.ts

@@ -689,22 +689,47 @@ const recapCmd: CommandHandler = (ctx) => {
 
 const usageCmd: CommandHandler = (ctx) => {
   const c = ctx.engine.getContext()
-  const tokens = c.getEstimatedTokens()
+  const estTokens = c.getEstimatedTokens()
   const msgs = c.getMessages()
   const maxTokens = 200_000
-  const pct = ((tokens / maxTokens) * 100).toFixed(1)
+  const pct = ((estTokens / maxTokens) * 100).toFixed(1)
+
+  const tracker = ctx.engine.getUsageTracker()
+  const summary = tracker.getSummary()
+
+  // Build per-tool breakdown
+  const toolLines: string[] = []
+  const sortedTools = Object.entries(summary.tools).sort(
+    (a, b) => b[1].inputTokens + b[1].outputTokens - (a[1].inputTokens + a[1].outputTokens),
+  )
+  for (const [name, usage] of sortedTools) {
+    const total = usage.inputTokens + usage.outputTokens
+    const prefix = name.startsWith('mcp__') ? '🔌 ' : '  '
+    toolLines.push(
+      `${prefix}${name.padEnd(18)} ${total.toLocaleString().padStart(8)} tokens (${usage.calls} call${usage.calls !== 1 ? 's' : ''})`,
+    )
+  }
+
+  const apiTotal = summary.apiInputTokens + summary.apiOutputTokens
+  const apiLine =
+    summary.apiInputTokens > 0 || summary.apiOutputTokens > 0
+      ? `API tokens:      ${summary.apiInputTokens.toLocaleString().padStart(8)} in / ${summary.apiOutputTokens.toLocaleString().padStart(6)} out (${apiTotal.toLocaleString()} total)`
+      : 'API tokens:      (no API usage data yet)'
+
+  const toolSection = toolLines.length > 0 ? `\n── Per-Tool ──\n${toolLines.join('\n')}` : ''
 
   return {
     content: stripIndent`
       ── Usage Dashboard ──
-      Context tokens:  ~${tokens.toLocaleString()} / ${maxTokens.toLocaleString()}  (${pct}%)
+      ${apiLine}
+      Context tokens:  ~${estTokens.toLocaleString()} / ${maxTokens.toLocaleString()}  (${pct}%)
       Messages:         ${msgs.length}
       Provider:         ${ctx.providerId}
       Model:            ${ctx.modelId}
 
       ${'█'.repeat(Math.ceil(Number(pct) / 5))}${'░'.repeat(20 - Math.ceil(Number(pct) / 5))} ${pct}%
+      ${toolSection}
 
-      Note: Token counting is approximate (chars/4).
       Use /context for detailed stats, /compact to free space.
     `,
   }
@@ -4093,8 +4118,14 @@ const forkCmd: CommandHandler = async (ctx, args) => {
     'general',
     async (_signal) => {
       const { SubAgent } = await import('../agent/sub-agent')
-      const sa = new SubAgent(ctx.engine.getRegistry(), ctx.engine.getTools())
-      const result = await sa.execute(prompt, 'fork: ' + prompt.slice(0, 60), {})
+      const sa = new SubAgent(
+        ctx.engine.getRegistry(),
+        ctx.engine.getTools(),
+        ctx.engine.getPermission(),
+      )
+      const result = await sa.execute(prompt, 'fork: ' + prompt.slice(0, 60), {
+        worktreePath: wtPath,
+      })
       try {
         const { execSync: ex } = await import('node:child_process')
         ex(`git -C ${wtPath} add -A`, { stdio: 'ignore', timeout: 10_000 })

package/src/workflow/primitives/agent.ts

@@ -1,6 +1,7 @@
 import { SubAgent } from '../../agent/sub-agent'
 import type { ProviderRegistry } from '../../providers/registry'
 import type { ToolDefinition } from '../../shared/index.ts'
+import type { PermissionSystem } from '../../core/permission'
 import { validateJSONSchema, formatValidationErrors } from '../schema-validator'
 
 export interface WorkflowAgentOpts {
@@ -12,17 +13,28 @@ export interface WorkflowAgentOpts {
   effort?: 'low' | 'medium' | 'high' | 'max'
   /** Maximum retries on schema validation failure (default: 2). */
   maxRetries?: number
+  /** Permission system for sub-agent tool execution (optional). */
+  permissionSystem?: PermissionSystem
+  /** Run the agent in an isolated git worktree (optional). */
+  isolation?: 'worktree'
 }
 
 /**
  * Workflow agent() primitive — creates a SubAgent with optional
- * provider/model override and structured output schema validation.
+ * provider/model override, structured output schema validation,
+ * and git worktree isolation.
  *
  * When `schema` is provided:
  *   1. The sub-agent is prompted to return valid JSON matching the schema.
  *   2. The result is JSON.parsed and validated against the schema.
  *   3. On validation failure, the sub-agent is retried with error feedback.
  *   4. Returns the validated object, or { raw, validationErrors } on final failure.
+ *
+ * When `isolation: 'worktree'` is set:
+ *   1. A git worktree is created at .claude/worktrees/wf-<slug>
+ *   2. The sub-agent runs with its cwd set to the worktree path
+ *   3. Changes are auto-committed (best-effort)
+ *   4. The worktree is cleaned up after execution
  */
 export async function workflowAgent(
   prompt: string,
@@ -39,6 +51,26 @@ export async function workflowAgent(
 
   const maxRetries = opts.maxRetries ?? 2
 
+  // ── Worktree isolation setup ──
+  let worktreePath: string | undefined
+  let worktreeBranch: string | undefined
+
+  if (opts.isolation === 'worktree') {
+    const slug = `wf-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 6)}`
+    worktreeBranch = `worktree/${slug}`
+    worktreePath = `.claude/worktrees/${slug}`
+
+    const proc = Bun.spawn(['git', 'worktree', 'add', '-b', worktreeBranch, worktreePath, 'HEAD'], {
+      stdout: 'pipe',
+      stderr: 'pipe',
+    })
+    const exitCode = await proc.exited
+    if (exitCode !== 0) {
+      const stderr = await new Response(proc.stderr).text()
+      throw new Error(`Worktree creation failed: ${stderr.slice(0, 500)}`)
+    }
+  }
+
   // Build the prompt — if schema is requested, instruct the model to return JSON
   let effectivePrompt = prompt
   if (opts.schema) {
@@ -50,64 +82,118 @@ export async function workflowAgent(
       `Return ONLY the JSON object, no other text. Do not wrap in markdown code fences.`
   }
 
-  const sub = new SubAgent(registry, toolRegistry)
+  const sub = new SubAgent(registry, toolRegistry, opts.permissionSystem)
 
-  // ── Attempt execution with optional schema validation + retry ──
+  // ── Execute with optional schema validation + retry ──
+  let result: unknown = ''
   let lastResult = ''
   let lastErrors: string[] = []
 
-  for (let attempt = 0; attempt <= maxRetries; attempt++) {
-    const retryPrompt =
-      attempt === 0
-        ? effectivePrompt
-        : `${effectivePrompt}\n\n` +
-          `[RETRY #${attempt}] Your previous response did NOT match the required schema.\n` +
-          `Validation errors:\n${lastErrors.map((e) => `  • ${e}`).join('\n')}\n\n` +
-          `Please fix the errors and return a valid JSON object matching the schema exactly.`
-
-    const result = await sub.execute(retryPrompt, opts.label || 'workflow-agent', {
-      type: 'general',
-      modelOverride: opts.model,
-      allowedTools: undefined, // use all tools by default
-    })
+  try {
+    for (let attempt = 0; attempt <= maxRetries; attempt++) {
+      const retryPrompt =
+        attempt === 0
+          ? effectivePrompt
+          : `${effectivePrompt}\n\n` +
+            `[RETRY #${attempt}] Your previous response did NOT match the required schema.\n` +
+            `Validation errors:\n${lastErrors.map((e) => `  • ${e}`).join('\n')}\n\n` +
+            `Please fix the errors and return a valid JSON object matching the schema exactly.`
 
-    lastResult = result
+      const textResult = await sub.execute(retryPrompt, opts.label || 'workflow-agent', {
+        type: 'general',
+        modelOverride: opts.model,
+        allowedTools: undefined, // use all tools by default
+        worktreePath,
+      })
 
-    // No schema — return raw result
-    if (!opts.schema) {
-      return result
-    }
+      lastResult = textResult
 
-    // Try to parse and validate
-    try {
-      // Extract JSON from potential markdown fences
-      let jsonStr = result.trim()
-      const fenceMatch = jsonStr.match(/```(?:json)?\s*\n?([\s\S]*?)\n?```/)
-      if (fenceMatch) {
-        jsonStr = fenceMatch[1]!.trim()
+      // No schema — return raw result
+      if (!opts.schema) {
+        result = textResult
+        return result
       }
 
-      const parsed = JSON.parse(jsonStr)
-      const errors = validateJSONSchema(parsed, opts.schema as Record<string, unknown>)
+      // Try to parse and validate
+      try {
+        // Extract JSON from potential markdown fences
+        let jsonStr = textResult.trim()
+        const fenceMatch = jsonStr.match(/```(?:json)?\s*\n?([\s\S]*?)\n?```/)
+        if (fenceMatch) {
+          jsonStr = fenceMatch[1]!.trim()
+        }
 
-      if (errors.length === 0) {
-        // Valid! Return the parsed object
-        return parsed
+        const parsed = JSON.parse(jsonStr)
+        const errors = validateJSONSchema(parsed, opts.schema as Record<string, unknown>)
+
+        if (errors.length === 0) {
+          // Valid! Return the parsed object
+          result = parsed
+          return result
+        }
+
+        // Not valid — collect errors for retry
+        lastErrors = [formatValidationErrors(errors)]
+      } catch (err) {
+        // JSON parse error
+        lastErrors = [`JSON parse error: ${String(err)}. Ensure your response is valid JSON only.`]
       }
+    }
 
-      // Not valid — collect errors for retry
-      lastErrors = [formatValidationErrors(errors)]
-    } catch (err) {
-      // JSON parse error
-      lastErrors = [`JSON parse error: ${String(err)}. Ensure your response is valid JSON only.`]
+    // All retries exhausted — return raw result with validation errors
+    try {
+      const parsed = JSON.parse(lastResult)
+      result = { raw: lastResult, parsed, validationErrors: lastErrors }
+    } catch {
+      result = { raw: lastResult, validationErrors: lastErrors }
     }
-  }
 
-  // All retries exhausted — return raw result with validation errors
-  try {
-    const parsed = JSON.parse(lastResult)
-    return { raw: lastResult, parsed, validationErrors: lastErrors }
-  } catch {
-    return { raw: lastResult, validationErrors: lastErrors }
+    return result
+  } finally {
+    // ── Cleanup worktree ──
+    if (worktreePath) {
+      // Best-effort: auto-commit any changes
+      try {
+        const addProc = Bun.spawn(['git', '-C', worktreePath, 'add', '-A'], {
+          stdout: 'pipe',
+          stderr: 'pipe',
+        })
+        await addProc.exited
+
+        const statusProc = Bun.spawn(['git', '-C', worktreePath, 'status', '--porcelain'], {
+          stdout: 'pipe',
+          stderr: 'pipe',
+        })
+        const status = await new Response(statusProc.stdout).text()
+        if (status.trim()) {
+          const commitMsg = opts.label ? `workflow: ${opts.label}` : 'workflow: agent changes'
+          const commitProc = Bun.spawn(['git', '-C', worktreePath, 'commit', '-m', commitMsg], {
+            stdout: 'pipe',
+            stderr: 'pipe',
+          })
+          await commitProc.exited
+        }
+      } catch {
+        /* best-effort */
+      }
+
+      // Remove worktree and branch
+      try {
+        const rmProc = Bun.spawn(['git', 'worktree', 'remove', '--force', worktreePath], {
+          stdout: 'pipe',
+          stderr: 'pipe',
+        })
+        await rmProc.exited
+        if (worktreeBranch) {
+          const brProc = Bun.spawn(['git', 'branch', '-D', worktreeBranch], {
+            stdout: 'pipe',
+            stderr: 'pipe',
+          })
+          await brProc.exited
+        }
+      } catch {
+        /* best-effort */
+      }
+    }
   }
 }

package/src/workflow/runtime.ts

@@ -96,6 +96,7 @@ export async function runWorkflow(
 
   const registry: ProviderRegistry = engine.getRegistry()
   const toolRegistry = engine.getTools()
+  const permission = engine.getPermission()
 
   const budget = createBudget(budgetTotal)
 
@@ -111,12 +112,10 @@ export async function runWorkflow(
     }
     cacheMisses++
 
-    const result = await workflowAgent(
-      prompt,
-      registry,
-      toolRegistry,
-      opts as Record<string, unknown>,
-    )
+    const result = await workflowAgent(prompt, registry, toolRegistry, {
+      ...(opts || {}),
+      permissionSystem: permission,
+    } as Record<string, unknown>)
     appendJournal(runId, {
       type: 'agent',
       prompt,