@n8n/instance-ai 1.12.4 → 1.13.1

package/skills/workflow-builder/SKILL.md

@@ -2,11 +2,15 @@
 name: workflow-builder
 description: >-
   Default path for all single-workflow work: new one-off workflows, existing-
-  workflow edits, verification repairs, and workflow-local data tables. Use
-  build-workflow directly — do not load planning or create-tasks first. Load
-  planning only when multiple coordinated workflows or shared cross-task data
-  tables require a dependency-aware task graph.
+  workflow edits, verification repairs, and workflow-local data tables. Write
+  or edit a workspace source file, then call build-workflow with filePath. Do
+  not load planning or create-tasks first. Load planning only when multiple
+  coordinated workflows or shared cross-task data tables require a
+  dependency-aware task graph.
 recommended_tools:
+  - read_file
+  - write_file
+  - edit_file
   - build-workflow
   - workflows
   - nodes
@@ -19,103 +23,50 @@ recommended_tools:
 # Workflow Builder
 
 You are an expert n8n workflow builder. You generate complete, valid
-TypeScript code using `@n8n/workflow-sdk`.
+TypeScript code using `@n8n/workflow-sdk` for new workflows and for existing
+saved workflow changes.
 
 This skill runs inside the orchestrator. It does not introduce a separate
-builder agent, delegated handoff, sandbox workspace, or separate tool allowlist.
-Use the orchestrator tools already available in the current turn. If a relevant
-orchestrator or MCP tool is available through tool search, use it when it helps
-complete the build.
-
-For all clear single-workflow requests — including new and one-off workflows —
-build directly with `build-workflow`. Do not load `planning` or call
-`create-tasks` first. Only load `planning` when the orchestrator routing rules
-require coordinated multi-artifact work. Use this skill during an approved
-`<planned-task-follow-up type="build-workflow">` turn, or for direct
-single-workflow builds and edits.
-
-Do not call `delegate` to build, patch, fix, verify, or update workflows. The
-builder work happens here with the workflow-builder guidance and the
-orchestrator's tools.
-
-## Output Discipline
-
-- Your text output is visible to the user. Be concise and natural.
-- Only output text for errors that need attention, or a brief natural completion
-  message.
-- No emojis, no filler phrases, no markdown headers in your text output.
-- When conversation context is provided, use it to continue naturally. Do not
-  repeat information the user already knows.
-
-### No Narration
-
-Do not announce what you are about to do. The user already sees tool calls in
-real time. Stay silent while working; speak only on completion or when blocked.
-
-Bad:
-
-- "I'll build this workflow. Let me start by discovering credentials..."
-- "I'll start by reading the current workflow code..."
-- "I don't see any pinData, so let me check..."
-
-Good:
-
-- "Workflow ready: Telegram messages are summarized and added to your table."
-- "Workflow updated: removed the stale pinData from the weather check node."
-- "Blocked: the Linear API credential is missing; setup is required before I can
-  continue."
-
-## Tool Surface
-
-Tool names are part of the compatibility contract. Keep using the same tool
-names the old builder used:
-
-- `build-workflow` to save TypeScript SDK code or apply targeted patches.
-- `workflows(action="get-as-code")` before precise patches to an existing
-  workflow when you need the current code.
-- `workflows(action="get")`, `workflows(action="list")`, and
-  `workflows(action="setup")` when inspection or setup routing is needed.
-- `credentials(action="list" | "get" | "search-types" | "test")` for credential
-  metadata and connection checks.
-- `nodes(action="suggested")` for known workflow categories.
-- `nodes(action="search")` for service-specific node discovery.
-- `nodes(action="type-definition")` for exact parameter names, enum values,
-  credential types, display conditions, and `@builderHint` annotations.
-- `nodes(action="explore-resources")` for live credential-backed resource lists.
-- `data-tables(action="list" | "create" | "schema")` for Data Table work.
-- `parse-file` for parseable user attachments.
-- `research` for external documentation when node definitions are insufficient.
-- `ask-user` only when a human choice is needed.
-- `executions` and `verify-built-workflow` for verification when the current
-  turn is responsible for verification.
-- `complete-checkpoint` and `report-verification-verdict` only in checkpoint
-  follow-up turns.
+builder agent, delegated handoff, or separate tool allowlist. Use the
+orchestrator tools and runtime workspace file tools already available in the
+current turn. If a relevant agent tool or MCP tool is available through tool
+search, use it when it helps complete the build. Do not call `delegate` to build, patch, fix, verify, or update workflows.
+
+For clear new single-workflow requests, write or edit a TypeScript SDK source
+file in the workspace, then build directly with `build-workflow({ filePath })`.
+For existing saved workflow edits, call
+`workflows(action="get-as-code", workflowId)`, write the returned code to a
+`.workflow.ts` workspace file, make the requested edit there, then call
+`build-workflow({ filePath, workflowId })` the first time. Do not load
+`planning` or call `create-tasks` first. Only load `planning` when the
+orchestrator routing rules require coordinated multi-artifact work. Use this
+skill during an approved `<planned-task-follow-up type="build-workflow">` turn,
+or for direct single-workflow builds and edits.
+
+Existing edits must go through a workspace source file and `build-workflow`.
 
 ## Repair Strategy
 
 When called with failure details for an existing workflow, start from the
-pre-loaded code or the saved workflow code. Do not re-discover node types that
-are already present unless the repair touches their parameters, resources,
-credentials, versions, or wiring semantics.
+workspace source file if one is available in the conversation or tool output. If
+you only have a saved n8n workflow ID, use `workflows(action="get-as-code")`,
+write the returned code to a stable `src/workflows/<name>.workflow.ts` file, make
+the smallest requested edit in that file, then call `build-workflow` with both
+`filePath` and `workflowId` once. Later repairs should reuse the same
+`filePath`; `build-workflow` remembers the bound workflow ID.
 
-For small fixes, prefer patch mode:
-
-```json
-{
-  "workflowId": "existing-id",
-  "patches": [{ "old_str": "exact old code", "new_str": "replacement code" }]
-}
-```
-
-Patches apply to the last submitted code, or the tool fetches the saved workflow
-when `workflowId` is provided. Use full code for larger rewrites.
+For repairs, edit the workspace file directly and call `build-workflow` again
+with the same `filePath`. Do not send inline workflow code or string patches to
+`build-workflow`.
 
 ## Escalation
 
 If you are stuck or need information only a human can provide, use `ask-user`.
-Do not retry the same failing approach more than twice. Never solicit API keys,
-tokens, passwords, or other secrets through `ask-user`; route credential
-collection through workflow setup or credential setup surfaces.
+Do not retry the same failing approach more than twice. Never re-ask a question
+the user has already answered, deferred, or skipped — treat a skip as permission
+to assume a sensible default or leave the detail for setup, and move on. Never
+solicit API keys, tokens, passwords, or other secrets through `ask-user`; route
+credential collection through workflow setup or credential setup surfaces.
 
 ## Placeholders
 
@@ -146,6 +97,11 @@ digests or reports, non-trivial branching, or Code nodes, read
 Use it as the build checklist for source preservation, fan-out/fan-in,
 effect-specific gating, list itemization, and Code-node safety.
 
+When mapping downstream fields from an OpenAI node, read
+`knowledge-base/reference/open-ai-output-shape.md` (v2+ text/response uses
+`$json.output[0].content[0].text`; v1 text/message uses `$json.message.content`
+— not `$json.text`).
+
 ## Mandatory Process
 
 1. Research. If the workflow fits a known category, call
@@ -169,11 +125,21 @@ effect-specific gating, list itemization, and Code-node safety.
    method name, method type, credential type, and credential ID. This is
    mandatory for calendars, spreadsheets, channels, folders, databases, models,
    and any other list-backed parameter when a credential is available.
-6. Build complete TypeScript SDK code and call `build-workflow`.
+6. Pick a stable workspace `filePath` for the source file, typically
+   `src/workflows/main.workflow.ts` for a one-off new workflow, or a clearly
+   named `.workflow.ts` file when multiple source files are useful. For an
+   existing workflow with no source file in context, call
+   `workflows(action="get-as-code", workflowId)`, write the returned code to the
+   chosen `.workflow.ts` file, and pass the n8n `workflowId` only on the first
+   `build-workflow` call.
+7. Write complete TypeScript SDK code to the workspace `filePath`, or read and
+   selectively edit the existing `.workflow.ts` file for workflow changes. Do
+   not put secrets in the source file.
+8. Call `build-workflow` with `filePath`.
    For planned build follow-ups where `buildTask.isSupportingWorkflow === true`,
    pass `isSupportingWorkflow: true`; that saved supporting workflow is the
    task's final deliverable.
-7. Trace wiring before declaring done. For IF, Switch, Merge, AI-agent, loop, or
+9. Trace wiring before declaring done. For IF, Switch, Merge, AI-agent, loop, or
    multi-workflow wiring, trace each branch from source to target. Confirm IF
    branches are wired on the workflow builder (`.to(ifNode).onTrue(...).onFalse(...)`
    or `.to(ifNode.onTrue(...).onFalse(...))`), not as standalone calls on the IF
@@ -183,13 +149,15 @@ effect-specific gating, list itemization, and Code-node safety.
    every requested side effect is on a wired branch. Switch outputs use zero-based
    `.onCase(index, target)`, Merge modes match the data shape, and sub-nodes are
    attached to the correct parent.
-8. Fix errors. If `build-workflow` returns errors, repair with targeted patches
-   when possible, or resubmit full SDK code for larger changes. Save again before
-   any verification step.
-9. Modify existing workflows with `workflowId` plus patches where possible. Use
-   `workflows(action="get-as-code")` first when you need to identify exact code
-   to replace.
-10. Finish with a concise completion message only when the build, required
+10. Fix errors by editing the same workspace source file and calling
+    `build-workflow` again with the same `filePath`. Save again before any
+    verification step.
+11. Modify existing workflows by editing the workspace `.workflow.ts` source
+    file. If the file was created from `workflows(action="get-as-code")`, pass
+    the real n8n `workflowId` on the first `build-workflow` call so the file is
+    bound to the saved workflow. Never pass local SDK workflow IDs as n8n
+    workflow IDs.
+12. Finish with a concise completion message only when the build, required
     setup routing, or required verification path is complete.
 
 Do not produce visible output until the final step, unless blocked.
@@ -208,13 +176,13 @@ Use the current turn's higher-priority instructions to decide who verifies:
 
 Build/save success is not workflow-quality evidence. When this turn is
 responsible for verification or repair, inspect the persisted workflow with
-`workflows(action="get-json", workflowId)` after saving or before reporting a
-verdict. Judge the saved graph against the user's requested outcome and the
-current build/checkpoint goal, not a hidden service-specific or topology
-checklist.
+`workflows(action="get-as-code", workflowId)` or read the bound workspace
+source file after saving or before reporting a verdict. Judge the saved graph
+against the user's requested outcome and the current build/checkpoint goal, not
+a hidden service-specific or topology checklist.
 If the saved workflow is only a draft, misses the intended outcome, or has weak
-evidence, patch the same workflow with `build-workflow`, then inspect and verify
-again.
+evidence, edit the same workflow source file and call `build-workflow` with the
+same `filePath`, then inspect and verify again.
 
 When this turn is responsible for verification, do not stop after a successful
 save. The job is done when one of these is true:
@@ -238,8 +206,9 @@ Trigger input shapes:
 
 If verification returns remediation with `shouldEdit: false`, stop editing and
 follow its guidance. If verification fails with `shouldEdit: true`, make one
-batched code repair, call `build-workflow` again, and retry within the repair
-budget. If a failure repeats, stop and explain the blocker.
+batched source-file repair, call `build-workflow` again with the same
+`filePath`, and retry within the repair budget. If a failure repeats, stop and
+explain the blocker.
 
 Do not publish the main workflow automatically. Publishing is the user's
 decision after testing.
@@ -296,14 +265,15 @@ a main workflow. This is part of an approved build task, not a reason to call
 Use this pattern when a workflow is large, has reusable chunks, or benefits from
 independent testing. Simple workflows should stay in one workflow.
 
-1. Build each supporting workflow first with `build-workflow` and
-   `isSupportingWorkflow: true`.
+1. Write a source file for each supporting workflow, then build it with
+   `build-workflow` and `isSupportingWorkflow: true`.
 2. Give each supporting workflow an `executeWorkflowTrigger` (version 1.1) with
    an explicit input schema.
 3. Use the returned supporting `workflowId` in the main workflow's
    `executeWorkflow` node with `source: 'database'`.
-4. Save the main workflow last with `build-workflow` and without
-   `isSupportingWorkflow`; this is the build task's final deliverable outcome.
+4. Create or edit the main workflow source file last, then save it with
+   `build-workflow` and without `isSupportingWorkflow`; this is the build task's
+   final deliverable outcome.
 5. Do not publish the main workflow automatically. Supporting workflows may be
    published when the parent workflow needs them active for verification or
    runtime references, but only after their setup requirements are resolved.
@@ -411,6 +381,13 @@ column names.
   later referenced by `$json` expressions, including optional trigger fields
   used in filters (for example Slack `subtype`, `bot_id`, `text`, `user`, `ts`,
   `channel`). Missing optional fields make expression-path validation fail.
+- SDK node `output` mocks are raw `$json` objects. Do not wrap mock items in
+  n8n runtime item envelopes like `{ json: { ... } }` unless downstream
+  expressions intentionally read `$json.json.*`. Correct:
+  `output: [{ orderId: 'ord_123', total: 42 }]`; wrong:
+  `output: [{ json: { orderId: 'ord_123', total: 42 } }]`.
+  Code node `jsCode` may still return runtime items like `[{ json: { ... } }]`;
+  this rule applies to SDK `node({ output: [...] })` mocks.
 
 Use this import shape unless the task needs fewer symbols:
 
@@ -450,12 +427,9 @@ Follow these rules strictly when generating workflows:
 1. Always use `newCredential()` for authentication. Never use placeholder
    strings, fake API keys, hardcoded auth values, invented credential IDs, or
    raw `mock-*` IDs.
-2. Skip-on-empty is n8n's default behaviour: when a node outputs zero items,
-   downstream nodes simply do not run and the branch ends silently. Trust it —
-   do not add `alwaysOutputData: true` just to keep a chain alive, and do not
-   add an IF gate before a loop only to check whether items exist. To make an
-   outcome happen even with zero items, wire it via the control-flow rule
-   below.
+2. Zero items end the branch — downstream nodes do not run. Trust this default;
+   do not add `alwaysOutputData: true` or empty-check IF gates unless rule 4's
+   mandatory-outcome case applies.
 3. Use `executeOnce: true` for a node that receives many items but should run
    once, such as a summary notification, report generation, shared-context
    fetch, or API call that does not vary per input item. Duplicate
@@ -470,16 +444,11 @@ Follow these rules strictly when generating workflows:
      statements on the IF node variable.
    - Many mutually exclusive paths keyed off a value: Switch with
      `.onCase(index, target)`.
-   - An outcome that must happen even when zero items remain: a node that
-     receives zero items does not run at all — `items.length === 0` logic
-     inside a downstream node is dead code, and an IF placed after an empty
-     output never fires. The fix goes on the PRODUCER, not the consumer:
-     `alwaysOutputData: true` in the config of the node whose output can be
-     empty (the fetch or the filter) makes it emit one empty-marker item
-     (empty `$json`) instead of ending the branch; an IF then separates that
-     marker from real items. Putting the flag on the node you want to run
-     does nothing. Example:
-     `node({ type: 'n8n-nodes-base.httpRequest', config: { alwaysOutputData: true, name: 'Fetch Posts', parameters: { /* ... */ } } })`
+   - Mandatory outcome when upstream can be empty (digest/alert must still send):
+     set `alwaysOutputData: true` on every node that can emit zero items before
+     the effect — often both the HTTP fetch (empty `[]`) and the filter (all rows
+     dropped). Not on the formatter or notifier; consumers that receive zero
+     items never run.
    - A Filter or IF only selects items; it does not perform the requested side
      effect. If the user asks to archive, update, delete, send, or create only
      matching items, wire the corresponding action node on the matching path.
@@ -505,13 +474,6 @@ Follow these rules strictly when generating workflows:
   definitions and `@builderHint` annotations are the source of truth.
 - Use live `nodes(action="explore-resources")` for resource locator, list, and
   model fields when credentials are available.
-- Resource-locator `list` and `id` modes hold opaque IDs picked from real data —
-  never put a human-readable name in their `value` (a sheet/board/folder title
-  in `list` mode can never resolve, in production or in tests). When you only
-  know the resource by name and the locator offers a `name` (or `url`) mode,
-  use that mode with the known name. Fall back to id mode with an empty value
-  and a `cachedResultName` only when no name mode exists and no credential is
-  available to resolve a real ID.
 - If a configuration is unclear after reading the definition, ask for
   clarification or use placeholders. Do not guess.
 - Pay attention to `@builderHint` annotations in search results and type

package/dist/tools/workflows/submit-workflow-identity.d.ts

@@ -1,39 +0,0 @@
-import type { CredentialMap } from './resolve-credentials';
-import { type SubmitWorkflowAttempt, type SubmitWorkflowInput, type SubmitWorkflowOutput } from './submit-workflow.tool';
-import type { InstanceAiContext } from '../../types';
-import type { RemediationMetadata, WorkflowLoopState } from '../../workflow-loop/workflow-loop-state';
-import type { SandboxWorkspace } from '../../workspace/sandbox-fs';
-export type SubmitExecute = (input: SubmitWorkflowInput) => Promise<SubmitWorkflowOutput>;
-interface SubmitGuardOptions {
-    getWorkflowLoopState?: () => Promise<WorkflowLoopState | undefined>;
-    getTerminalRemediation?: () => RemediationMetadata | undefined;
-    currentRunId?: string;
-    onGuardFired?: (event: {
-        workflowId?: string;
-        category: RemediationMetadata['category'];
-        attemptCount?: number;
-        reason?: string;
-    }) => void;
-    onTerminalRemediation?: (remediation: RemediationMetadata) => void;
-}
-interface SubmitBudgetTracker {
-    recordAttempt(attempt: SubmitWorkflowAttempt): SubmitWorkflowAttempt;
-    applyToOutput(path: string, output: SubmitWorkflowOutput): SubmitWorkflowOutput;
-}
-export declare function createPreSaveBudgetTracker(): SubmitBudgetTracker;
-export declare function wrapSubmitExecuteWithIdentity(underlying: SubmitExecute, resolvePath: (rawFilePath: string | undefined) => string, options?: SubmitGuardOptions & {
-    budgetTracker?: SubmitBudgetTracker;
-}): SubmitExecute;
-export declare function withDefaultWorkflowFilePath(input: SubmitWorkflowInput, defaultFilePath: string | undefined): SubmitWorkflowInput;
-export declare function createIdentityEnforcedSubmitWorkflowTool(args: {
-    context: InstanceAiContext;
-    workspace: SandboxWorkspace;
-    credentialMap?: CredentialMap;
-    onAttempt: (attempt: SubmitWorkflowAttempt) => Promise<void> | void;
-    root: string;
-    defaultFilePath?: string;
-    currentRunId?: string;
-    getWorkflowLoopState?: () => Promise<WorkflowLoopState | undefined>;
-    onGuardFired?: SubmitGuardOptions['onGuardFired'];
-}): import("@n8n/agents").BuiltTool;
-export {};

package/dist/tools/workflows/submit-workflow-identity.js

@@ -1,181 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.createPreSaveBudgetTracker = createPreSaveBudgetTracker;
-exports.wrapSubmitExecuteWithIdentity = wrapSubmitExecuteWithIdentity;
-exports.withDefaultWorkflowFilePath = withDefaultWorkflowFilePath;
-exports.createIdentityEnforcedSubmitWorkflowTool = createIdentityEnforcedSubmitWorkflowTool;
-const agents_1 = require("@n8n/agents");
-const submit_workflow_tool_1 = require("./submit-workflow.tool");
-const remediation_1 = require("../../workflow-loop/remediation");
-function createPreSaveBudgetTracker() {
-    const failuresByPath = new Map();
-    function blockRemediation(attemptCount) {
-        return (0, remediation_1.createRemediation)({
-            category: 'blocked',
-            shouldEdit: false,
-            reason: 'pre_save_submit_budget_exhausted',
-            attemptCount,
-            remainingSubmitFixes: 0,
-            guidance: 'The workflow could not be saved after three submit attempts. Stop editing and explain the blocker to the user.',
-        });
-    }
-    return {
-        recordAttempt(attempt) {
-            if (attempt.success) {
-                failuresByPath.delete(attempt.filePath);
-                return attempt;
-            }
-            const attemptCount = (failuresByPath.get(attempt.filePath) ?? 0) + 1;
-            failuresByPath.set(attempt.filePath, attemptCount);
-            if (attemptCount < remediation_1.MAX_PRE_SAVE_SUBMIT_FAILURES)
-                return attempt;
-            return {
-                ...attempt,
-                remediation: blockRemediation(attemptCount),
-                errors: [
-                    ...(attempt.errors ?? []),
-                    'Submit remediation budget exhausted for this workflow file.',
-                ],
-            };
-        },
-        applyToOutput(path, output) {
-            if (output.success)
-                return output;
-            const attemptCount = failuresByPath.get(path) ?? 0;
-            if (attemptCount < remediation_1.MAX_PRE_SAVE_SUBMIT_FAILURES)
-                return output;
-            return {
-                ...output,
-                remediation: blockRemediation(attemptCount),
-                errors: [
-                    ...(output.errors ?? []),
-                    'Submit remediation budget exhausted for this workflow file.',
-                ],
-            };
-        },
-    };
-}
-function wrapSubmitExecuteWithIdentity(underlying, resolvePath, options = {}) {
-    const pending = new Map();
-    function recordTerminalRemediation(workflowId, remediation) {
-        if (!remediation || remediation.shouldEdit)
-            return;
-        options.onTerminalRemediation?.(remediation);
-        options.onGuardFired?.({
-            workflowId,
-            category: remediation.category,
-            attemptCount: remediation.attemptCount,
-            reason: remediation.reason,
-        });
-    }
-    function applyOutputGuards(path, output, fallbackWorkflowId) {
-        const guarded = options.budgetTracker?.applyToOutput(path, output) ?? output;
-        recordTerminalRemediation(guarded.workflowId ?? fallbackWorkflowId, guarded.remediation);
-        return guarded;
-    }
-    async function blockedByTerminalRemediation(workflowId) {
-        const terminalRemediation = options.getTerminalRemediation?.() ??
-            (0, remediation_1.terminalRemediationFromState)(await options.getWorkflowLoopState?.(), options.currentRunId);
-        if (!terminalRemediation)
-            return undefined;
-        options.onTerminalRemediation?.(terminalRemediation);
-        options.onGuardFired?.({
-            workflowId,
-            category: terminalRemediation.category,
-            attemptCount: terminalRemediation.attemptCount,
-            reason: terminalRemediation.reason,
-        });
-        return {
-            success: false,
-            errors: [terminalRemediation.guidance],
-            remediation: terminalRemediation,
-        };
-    }
-    return async (input) => {
-        const resolvedPath = resolvePath(input.filePath);
-        const terminalResult = await blockedByTerminalRemediation(input.workflowId);
-        if (terminalResult)
-            return terminalResult;
-        const existing = pending.get(resolvedPath);
-        if (existing) {
-            let boundId;
-            try {
-                boundId = await existing;
-            }
-            catch (error) {
-                const terminalAfterFailure = await blockedByTerminalRemediation(input.workflowId);
-                if (terminalAfterFailure)
-                    return terminalAfterFailure;
-                const message = error instanceof Error ? error.message : String(error);
-                return {
-                    success: false,
-                    errors: [`Previous submit-workflow for this file failed: ${message}`],
-                    remediation: (0, remediation_1.createRemediation)({
-                        category: 'code_fixable',
-                        shouldEdit: true,
-                        reason: 'previous_submit_failed',
-                        guidance: 'The previous submit-workflow call for this file failed. Fix the workflow code and submit again.',
-                    }),
-                };
-            }
-            const terminalAfterWait = await blockedByTerminalRemediation(boundId);
-            if (terminalAfterWait)
-                return terminalAfterWait;
-            const result = await underlying({ ...input, workflowId: boundId });
-            return applyOutputGuards(resolvedPath, result, boundId);
-        }
-        let resolveFn;
-        let rejectFn;
-        const promise = new Promise((res, rej) => {
-            resolveFn = res;
-            rejectFn = rej;
-        });
-        promise.catch(() => { });
-        pending.set(resolvedPath, promise);
-        try {
-            const result = await underlying(input);
-            const guarded = applyOutputGuards(resolvedPath, result, input.workflowId);
-            if (guarded.success && typeof guarded.workflowId === 'string') {
-                resolveFn?.(guarded.workflowId);
-            }
-            else {
-                rejectFn?.(new Error(guarded.errors?.join(' ') ?? 'submit-workflow failed'));
-                pending.delete(resolvedPath);
-            }
-            return guarded;
-        }
-        catch (error) {
-            rejectFn?.(error);
-            pending.delete(resolvedPath);
-            throw error;
-        }
-    };
-}
-function withDefaultWorkflowFilePath(input, defaultFilePath) {
-    return defaultFilePath && !input.filePath ? { ...input, filePath: defaultFilePath } : input;
-}
-function createIdentityEnforcedSubmitWorkflowTool(args) {
-    const budgetTracker = createPreSaveBudgetTracker();
-    const underlying = (0, submit_workflow_tool_1.createSubmitWorkflowTool)(args.context, args.workspace, args.credentialMap, async (attempt) => {
-        await args.onAttempt(budgetTracker.recordAttempt(attempt));
-    }, { root: args.root, defaultFilePath: args.defaultFilePath });
-    const underlyingExecute = underlying.handler;
-    if (!underlyingExecute) {
-        throw new Error('createSubmitWorkflowTool returned a tool without a handler');
-    }
-    const wrappedExecute = wrapSubmitExecuteWithIdentity(underlyingExecute, (rawFilePath) => rawFilePath
-        ? (0, submit_workflow_tool_1.resolveSandboxWorkflowFilePath)(rawFilePath, args.root)
-        : (args.defaultFilePath ?? (0, submit_workflow_tool_1.resolveSandboxWorkflowFilePath)(rawFilePath, args.root)), {
-        budgetTracker,
-        currentRunId: args.currentRunId,
-        getWorkflowLoopState: args.getWorkflowLoopState,
-        onGuardFired: args.onGuardFired,
-    });
-    return new agents_1.Tool('submit-workflow')
-        .description(underlying.description)
-        .input(submit_workflow_tool_1.submitWorkflowInputSchema)
-        .output(submit_workflow_tool_1.submitWorkflowOutputSchema)
-        .handler(async (input) => await wrappedExecute(withDefaultWorkflowFilePath(input, args.defaultFilePath)))
-        .build();
-}
-//# sourceMappingURL=submit-workflow-identity.js.map

package/dist/tools/workflows/submit-workflow-identity.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"submit-workflow-identity.js","sourceRoot":"","sources":["../../../src/tools/workflows/submit-workflow-identity.ts"],"names":[],"mappings":";;AA4DA,gEAkDC;AAYD,sEAoHC;AAED,kEAKC;AAMD,4FAkDC;AA7RD,wCAAmC;AAGnC,iEAQgC;AAEhC,iEAIyC;AA2BzC,SAAgB,0BAA0B;IACzC,MAAM,cAAc,GAAG,IAAI,GAAG,EAAkB,CAAC;IAEjD,SAAS,gBAAgB,CAAC,YAAoB;QAC7C,OAAO,IAAA,+BAAiB,EAAC;YACxB,QAAQ,EAAE,SAAS;YACnB,UAAU,EAAE,KAAK;YACjB,MAAM,EAAE,kCAAkC;YAC1C,YAAY;YACZ,oBAAoB,EAAE,CAAC;YACvB,QAAQ,EACP,gHAAgH;SACjH,CAAC,CAAC;IACJ,CAAC;IAED,OAAO;QACN,aAAa,CAAC,OAAO;YACpB,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;gBACrB,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;gBACxC,OAAO,OAAO,CAAC;YAChB,CAAC;YAED,MAAM,YAAY,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;YACrE,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;YACnD,IAAI,YAAY,GAAG,0CAA4B;gBAAE,OAAO,OAAO,CAAC;YAEhE,OAAO;gBACN,GAAG,OAAO;gBACV,WAAW,EAAE,gBAAgB,CAAC,YAAY,CAAC;gBAC3C,MAAM,EAAE;oBACP,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC;oBACzB,6DAA6D;iBAC7D;aACD,CAAC;QACH,CAAC;QAED,aAAa,CAAC,IAAI,EAAE,MAAM;YACzB,IAAI,MAAM,CAAC,OAAO;gBAAE,OAAO,MAAM,CAAC;YAClC,MAAM,YAAY,GAAG,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnD,IAAI,YAAY,GAAG,0CAA4B;gBAAE,OAAO,MAAM,CAAC;YAC/D,OAAO;gBACN,GAAG,MAAM;gBACT,WAAW,EAAE,gBAAgB,CAAC,YAAY,CAAC;gBAC3C,MAAM,EAAE;oBACP,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;oBACxB,6DAA6D;iBAC7D;aACD,CAAC;QACH,CAAC;KACD,CAAC;AACH,CAAC;AAYD,SAAgB,6BAA6B,CAC5C,UAAyB,EACzB,WAAwD,EACxD,UAAwE,EAAE;IAE1E,MAAM,OAAO,GAAG,IAAI,GAAG,EAA2B,CAAC;IAEnD,SAAS,yBAAyB,CACjC,UAA8B,EAC9B,WAA4C;QAE5C,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,UAAU;YAAE,OAAO;QAEnD,OAAO,CAAC,qBAAqB,EAAE,CAAC,WAAW,CAAC,CAAC;QAC7C,OAAO,CAAC,YAAY,EAAE,CAAC;YACtB,UAAU;YACV,QAAQ,EAAE,WAAW,CAAC,QAAQ;YAC9B,YAAY,EAAE,WAAW,CAAC,YAAY;YACtC,MAAM,EAAE,WAAW,CAAC,MAAM;SAC1B,CAAC,CAAC;IACJ,CAAC;IAED,SAAS,iBAAiB,CACzB,IAAY,EACZ,MAA4B,EAC5B,kBAA2B;QAE3B,MAAM,OAAO,GAAG,OAAO,CAAC,aAAa,EAAE,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC;QAC7E,yBAAyB,CAAC,OAAO,CAAC,UAAU,IAAI,kBAAkB,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;QACzF,OAAO,OAAO,CAAC;IAChB,CAAC;IAED,KAAK,UAAU,4BAA4B,CAC1C,UAA8B;QAE9B,MAAM,mBAAmB,GACxB,OAAO,CAAC,sBAAsB,EAAE,EAAE;YAClC,IAAA,0CAA4B,EAAC,MAAM,OAAO,CAAC,oBAAoB,EAAE,EAAE,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;QAC5F,IAAI,CAAC,mBAAmB;YAAE,OAAO,SAAS,CAAC;QAE3C,OAAO,CAAC,qBAAqB,EAAE,CAAC,mBAAmB,CAAC,CAAC;QACrD,OAAO,CAAC,YAAY,EAAE,CAAC;YACtB,UAAU;YACV,QAAQ,EAAE,mBAAmB,CAAC,QAAQ;YACtC,YAAY,EAAE,mBAAmB,CAAC,YAAY;YAC9C,MAAM,EAAE,mBAAmB,CAAC,MAAM;SAClC,CAAC,CAAC;QACH,OAAO;YACN,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,CAAC,mBAAmB,CAAC,QAAQ,CAAC;YACtC,WAAW,EAAE,mBAAmB;SAChC,CAAC;IACH,CAAC;IAED,OAAO,KAAK,EAAE,KAAK,EAAE,EAAE;QACtB,MAAM,YAAY,GAAG,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACjD,MAAM,cAAc,GAAG,MAAM,4BAA4B,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC5E,IAAI,cAAc;YAAE,OAAO,cAAc,CAAC;QAE1C,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAE3C,IAAI,QAAQ,EAAE,CAAC;YACd,IAAI,OAAe,CAAC;YACpB,IAAI,CAAC;gBACJ,OAAO,GAAG,MAAM,QAAQ,CAAC;YAC1B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,MAAM,oBAAoB,GAAG,MAAM,4BAA4B,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;gBAClF,IAAI,oBAAoB;oBAAE,OAAO,oBAAoB,CAAC;gBAEtD,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACvE,OAAO;oBACN,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,CAAC,kDAAkD,OAAO,EAAE,CAAC;oBACrE,WAAW,EAAE,IAAA,+BAAiB,EAAC;wBAC9B,QAAQ,EAAE,cAAc;wBACxB,UAAU,EAAE,IAAI;wBAChB,MAAM,EAAE,wBAAwB;wBAChC,QAAQ,EACP,iGAAiG;qBAClG,CAAC;iBACF,CAAC;YACH,CAAC;YACD,MAAM,iBAAiB,GAAG,MAAM,4BAA4B,CAAC,OAAO,CAAC,CAAC;YACtE,IAAI,iBAAiB;gBAAE,OAAO,iBAAiB,CAAC;YAEhD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;YACnE,OAAO,iBAAiB,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QACzD,CAAC;QAED,IAAI,SAA6C,CAAC;QAClD,IAAI,QAAiD,CAAC;QACtD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAS,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YAChD,SAAS,GAAG,GAAG,CAAC;YAChB,QAAQ,GAAG,GAAG,CAAC;QAChB,CAAC,CAAC,CAAC;QAGH,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACxB,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QAEnC,IAAI,CAAC;YACJ,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC;YACvC,MAAM,OAAO,GAAG,iBAAiB,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;YAC1E,IAAI,OAAO,CAAC,OAAO,IAAI,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;gBAC/D,SAAS,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;YACjC,CAAC;iBAAM,CAAC;gBACP,QAAQ,EAAE,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,wBAAwB,CAAC,CAAC,CAAC;gBAC7E,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YAC9B,CAAC;YACD,OAAO,OAAO,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,QAAQ,EAAE,CAAC,KAAK,CAAC,CAAC;YAClB,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YAC7B,MAAM,KAAK,CAAC;QACb,CAAC;IACF,CAAC,CAAC;AACH,CAAC;AAED,SAAgB,2BAA2B,CAC1C,KAA0B,EAC1B,eAAmC;IAEnC,OAAO,eAAe,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;AAC7F,CAAC;AAMD,SAAgB,wCAAwC,CAAC,IAUxD;IACA,MAAM,aAAa,GAAG,0BAA0B,EAAE,CAAC;IACnD,MAAM,UAAU,GAAG,IAAA,+CAAwB,EAC1C,IAAI,CAAC,OAAO,EACZ,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,aAAa,EAClB,KAAK,EAAE,OAAO,EAAE,EAAE;QACjB,MAAM,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5D,CAAC,EACD,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,eAAe,EAAE,IAAI,CAAC,eAAe,EAAE,CAC1D,CAAC;IAEF,MAAM,iBAAiB,GAAG,UAAU,CAAC,OAAoC,CAAC;IAC1E,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAC/E,CAAC;IAED,MAAM,cAAc,GAAG,6BAA6B,CACnD,iBAAiB,EACjB,CAAC,WAAW,EAAE,EAAE,CACf,WAAW;QACV,CAAC,CAAC,IAAA,qDAA8B,EAAC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC;QACxD,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,IAAI,IAAA,qDAA8B,EAAC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,EACpF;QACC,aAAa;QACb,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;QAC/C,YAAY,EAAE,IAAI,CAAC,YAAY;KAC/B,CACD,CAAC;IAEF,OAAO,IAAI,aAAI,CAAC,iBAAiB,CAAC;SAChC,WAAW,CAAC,UAAU,CAAC,WAAW,CAAC;SACnC,KAAK,CAAC,gDAAyB,CAAC;SAChC,MAAM,CAAC,iDAA0B,CAAC;SAClC,OAAO,CACP,KAAK,EAAE,KAAK,EAAE,EAAE,CACf,MAAM,cAAc,CAAC,2BAA2B,CAAC,KAAK,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC,CAC/E;SACA,KAAK,EAAE,CAAC;AACX,CAAC"}