@n8n/instance-ai 1.7.1 → 1.8.0

package/dist/tools/orchestration/build-workflow-agent.tool.js

@@ -1,6 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.buildWorkflowAgentInputSchema = exports.DETACHED_BUILDER_REQUIREMENTS = void 0;
+exports.getBuilderSessionMemory = getBuilderSessionMemory;
+exports.builderWorkflowWorkspaceLayout = builderWorkflowWorkspaceLayout;
+exports.materializeBuilderRuntimeSkills = materializeBuilderRuntimeSkills;
 exports.buildWarmBuilderFollowUp = buildWarmBuilderFollowUp;
 exports.recordSuccessfulWorkflowBuilds = recordSuccessfulWorkflowBuilds;
 exports.determineVerificationReadiness = determineVerificationReadiness;
@@ -8,45 +11,129 @@ exports.determineSetupRequirement = determineSetupRequirement;
 exports.mergeLatestVerificationIntoOutcome = mergeLatestVerificationIntoOutcome;
 exports.withTerminalLoopState = withTerminalLoopState;
 exports.finalizeBuildResult = finalizeBuildResult;
+exports.createMainWorkflowSnapshot = createMainWorkflowSnapshot;
+exports.shouldFinalSubmitMainWorkflow = shouldFinalSubmitMainWorkflow;
 exports.supportingWorkflowIdsFromSubmitAttempts = supportingWorkflowIdsFromSubmitAttempts;
 exports.resultFromPostStreamError = resultFromPostStreamError;
 exports.resultFromTerminalRemediation = resultFromTerminalRemediation;
 exports.resultFromLaterFailedMainSubmit = resultFromLaterFailedMainSubmit;
 exports.attemptFromAutoResubmit = attemptFromAutoResubmit;
 exports.shouldRecoverSavedWorkflowAfterFailedSubmit = shouldRecoverSavedWorkflowAfterFailedSubmit;
+exports.settleMissingMainWorkflowSubmit = settleMissingMainWorkflowSubmit;
 exports.startBuildWorkflowAgentTask = startBuildWorkflowAgentTask;
 exports.createBuildWorkflowAgentTool = createBuildWorkflowAgentTool;
-const agent_1 = require("@mastra/core/agent");
-const tools_1 = require("@mastra/core/tools");
+const agents_1 = require("@n8n/agents");
 const workflow_sdk_1 = require("@n8n/workflow-sdk");
 const n8n_workflow_1 = require("n8n-workflow");
 const nanoid_1 = require("nanoid");
 const node_crypto_1 = require("node:crypto");
 const zod_1 = require("zod");
+const agent_persistence_1 = require("./agent-persistence");
 const build_workflow_agent_prompt_1 = require("./build-workflow-agent.prompt");
 const builder_memory_compaction_1 = require("./builder-memory-compaction");
 const display_utils_1 = require("./display-utils");
 const tracing_utils_1 = require("./tracing-utils");
 const verify_built_workflow_tool_1 = require("./verify-built-workflow.tool");
-const register_with_mastra_1 = require("../../agent/register-with-mastra");
+const runtime_workspace_1 = require("../../agent/runtime-workspace");
 const sub_agent_briefing_1 = require("../../agent/sub-agent-briefing");
 const max_steps_1 = require("../../constants/max-steps");
-const model_settings_1 = require("../../constants/model-settings");
-const resumable_stream_executor_1 = require("../../runtime/resumable-stream-executor");
+const materialize_runtime_skills_1 = require("../../skills/materialize-runtime-skills");
+const runtime_skills_1 = require("../../skills/runtime-skills");
 const consume_with_hitl_1 = require("../../stream/consume-with-hitl");
+const tool_registry_1 = require("../../tool-registry");
 const langsmith_tracing_1 = require("../../tracing/langsmith-tracing");
 const extract_code_1 = require("../../workflow-builder/extract-code");
 const workflow_loop_1 = require("../../workflow-loop");
 const sandbox_fs_1 = require("../../workspace/sandbox-fs");
 const sandbox_setup_1 = require("../../workspace/sandbox-setup");
+const scoped_workspace_1 = require("../../workspace/scoped-workspace");
 const template_telemetry_1 = require("../../workspace/template-telemetry");
 const credentials_tool_1 = require("../credentials.tool");
+const data_tables_tool_1 = require("../data-tables.tool");
+const ask_user_tool_1 = require("../shared/ask-user.tool");
 const resolve_credentials_1 = require("../workflows/resolve-credentials");
 const submit_workflow_identity_1 = require("../workflows/submit-workflow-identity");
 const workflow_json_utils_1 = require("../workflows/workflow-json-utils");
 const workflows_tool_1 = require("../workflows.tool");
-function createBuilderResourceId(userId) {
-    return `${userId}:workflow-builder`;
+const WORKFLOW_NOT_SUBMITTED_FAILURE_SIGNATURE = 'workflow:not_submitted';
+const WORKFLOW_FINAL_SUBMIT_FAILED_FAILURE_SIGNATURE = 'workflow:final_submit_failed';
+function getBuilderSessionMemory(context, useSharedWorkspace) {
+    return useSharedWorkspace ? context.memory : undefined;
+}
+const BUILDER_WORK_ITEMS_DIR = 'builder-work-items';
+function safeWorkItemPathSegment(workItemId) {
+    const slug = workItemId
+        .replace(/[^A-Za-z0-9_-]+/g, '-')
+        .replace(/^-+|-+$/g, '')
+        .slice(0, 48);
+    const hash = (0, node_crypto_1.createHash)('sha256').update(workItemId).digest('hex').slice(0, 8);
+    return `${slug || 'work-item'}-${hash}`;
+}
+function builderWorkflowWorkspaceLayout(root, workItemId) {
+    const relativeWorkItemRoot = `${BUILDER_WORK_ITEMS_DIR}/${safeWorkItemPathSegment(workItemId)}`;
+    const workItemRoot = `${root}/${relativeWorkItemRoot}`;
+    return {
+        workItemRoot,
+        sourceDir: `${workItemRoot}/src`,
+        chunksDir: `${workItemRoot}/chunks`,
+        mainWorkflowPath: `${workItemRoot}/src/workflow.ts`,
+        tsconfigPath: `${workItemRoot}/tsconfig.json`,
+        relativeMainWorkflowPath: `${relativeWorkItemRoot}/src/workflow.ts`,
+    };
+}
+function renderBuilderTaskTsconfig() {
+    return `${JSON.stringify({
+        extends: '../../tsconfig.json',
+        include: ['src/**/*.ts', 'chunks/**/*.ts'],
+    }, null, 2)}\n`;
+}
+async function writeBuilderWorkspaceFile(workspace, filePath, content) {
+    if (workspace.filesystem) {
+        await workspace.filesystem.writeFile(filePath, content, { recursive: true });
+        return;
+    }
+    await (0, sandbox_fs_1.writeFileViaSandbox)(workspace, filePath, content);
+}
+async function materializeBuilderRuntimeSkills(context, workspace, root) {
+    const source = context.runtimeSkillCatalog ?? context.runtimeSkills;
+    if (!(0, runtime_skills_1.hasRuntimeSkills)(source)) {
+        return { workspace, source };
+    }
+    let materialized;
+    try {
+        const workspaceRoot = await (0, sandbox_setup_1.getWorkspaceRoot)(workspace);
+        materialized = await (0, materialize_runtime_skills_1.createPrebakedRuntimeSkillsFromWorkspace)({
+            source,
+            workspace,
+            root: workspaceRoot,
+            workspaceRoot: root,
+            logger: context.logger,
+        });
+    }
+    catch (error) {
+        context.logger.debug('Could not inspect prebaked runtime skills; materializing live', {
+            error: error instanceof Error ? error.message : String(error),
+        });
+    }
+    materialized ??= await (0, materialize_runtime_skills_1.materializeRuntimeSkillsIntoWorkspace)({
+        source,
+        workspace,
+        root,
+        logger: context.logger,
+    });
+    if (!materialized)
+        return { workspace, source };
+    return {
+        workspace: (0, scoped_workspace_1.createScopedWorkspace)(workspace, root, materialized.env),
+        source: materialized.source,
+    };
+}
+function toToolRegistry(tools) {
+    const registry = (0, tool_registry_1.createToolRegistry)();
+    for (const tool of tools) {
+        registry.set(tool.name, tool);
+    }
+    return registry;
 }
 const BUILDER_WORKFLOW_ACTIONS = [
     'list',
@@ -61,19 +148,19 @@ const BUILDER_CREDENTIAL_ACTIONS = [
 ];
 const BUILDER_SANDBOX_TOOL_NAMES = [
     'nodes',
-    'workflows',
-    'credentials',
     'executions',
-    'data-tables',
-    'ask-user',
+    data_tables_tool_1.DATA_TABLES_TOOL_ID,
+    'parse-file',
+    ask_user_tool_1.ASK_USER_TOOL_ID,
     'research',
 ];
 const BUILDER_TOOL_MODE_TOOL_NAMES = [
     'build-workflow',
     'nodes',
     'workflows',
-    'data-tables',
-    'ask-user',
+    data_tables_tool_1.DATA_TABLES_TOOL_ID,
+    'parse-file',
+    ask_user_tool_1.ASK_USER_TOOL_ID,
     'research',
 ];
 function createBuilderWorkflowsTool(context) {
@@ -104,29 +191,6 @@ function buildWarmBuilderFollowUp(input) {
     parts.push('', '<requested-change>', input.task, '</requested-change>', '</builder-follow-up>');
     return parts.join('\n');
 }
-async function ensureBuilderMemoryThread(context, binding) {
-    if (!context.memory)
-        return false;
-    try {
-        const existingThread = await context.memory.getThreadById({ threadId: binding.thread });
-        if (existingThread)
-            return true;
-        const now = new Date();
-        await context.memory.saveThread({
-            thread: {
-                id: binding.thread,
-                resourceId: binding.resource,
-                title: 'Workflow Builder',
-                createdAt: now,
-                updatedAt: now,
-            },
-        });
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
 async function promoteMainWorkflow(context, logger, workflowId) {
     if (!workflowId || !context)
         return;
@@ -140,20 +204,18 @@ async function promoteMainWorkflow(context, logger, workflowId) {
 function isRecord(value) {
     return typeof value === 'object' && value !== null;
 }
-function isExecutableTool(tool) {
-    return isRecord(tool) && typeof tool.execute === 'function';
-}
 function recordSuccessfulWorkflowBuilds(tool, onWorkflowId) {
-    if (!isExecutableTool(tool))
+    if (!tool?.handler)
         return;
-    const execute = tool.execute.bind(tool);
-    tool.execute = async (...args) => {
-        const result = await execute(...args);
+    const original = tool.handler;
+    const wrapped = async (input, ctx) => {
+        const result = await original(input, ctx);
         if (isRecord(result) && result.success === true && typeof result.workflowId === 'string') {
             onWorkflowId(result.workflowId);
         }
         return result;
     };
+    Object.assign(tool, { handler: wrapped });
 }
 function detectTriggerType(_attempt) {
     return 'manual_or_testable';
@@ -337,6 +399,10 @@ async function finalizeBuildResult(context, workItemId, result) {
         outcome: await finalBuildOutcome(context, workItemId, result.outcome),
     };
 }
+async function reportAndFinalizeBuildResult(context, workItemId, result) {
+    await context.workflowTaskService?.reportBuildOutcome(result.outcome);
+    return await finalizeBuildResult(context, workItemId, result);
+}
 async function buildOutcomeWithLatestVerification(context, workItemId, taskId, attempt, finalText, supportingWorkflowIds = []) {
     const outcome = buildOutcome(workItemId, context.runId, taskId, attempt, finalText, supportingWorkflowIds);
     return await finalBuildOutcome(context, workItemId, outcome);
@@ -359,14 +425,14 @@ payload. The pin-data adapter injects it as the trigger node's output.
 ### Submit discipline
 
 **Every file edit MUST be followed by submit-workflow before you do anything else.**
-The system tracks file hashes. If you edit the code and then call \`executions(action="run")\` or finish without re-submitting, your work is discarded. The sequence is always: edit → submit → then verify/run.
+The system tracks file hashes. If you edit the code and then call \`executions(action="run")\`, \`verify-built-workflow\`, or finish without re-submitting, your work is discarded. The sequence is always: edit → submit → then verify/run.
 
 ### Verification
 
-- If submit-workflow returned mocked credentials, call \`verify-built-workflow\` with the workItemId.
+- If submit-workflow returned mocked credentials, call \`verify-built-workflow\` with the workItemId and workflowId from this task.
 - Otherwise pick based on trigger type:
   - **Manual / Schedule** — \`executions(action="run")\`.
-  - **Form Trigger** — \`verify-built-workflow\` with \`inputData\` as a flat field map, e.g. \`{name: "Alice", email: "a@b.c"}\`. Do NOT wrap in \`formFields\` — production Form Trigger emits fields directly on \`$json\`, and the adapter rejects wrapped payloads.
+  - **Form Trigger** — pass \`inputData\` as a flat field map, e.g. \`{name: "Alice", email: "a@b.c"}\`. Do NOT wrap in \`formFields\` — production Form Trigger emits fields directly on \`$json\`, and the adapter rejects wrapped payloads.
   - **Webhook** — \`verify-built-workflow\` with \`inputData\` as the body payload, e.g. \`{event: "signup", userId: "..."}\`. Adapter wraps it under \`body\`; downstream expressions use \`$json.body.<field>\`.
   - **Chat Trigger** — \`verify-built-workflow\` with \`{chatInput: "user message"}\`.
   - **Other event triggers (Linear, GitHub, Slack, MCP, etc.)** — \`verify-built-workflow\` with \`inputData\` matching the trigger's expected payload shape.
@@ -378,26 +444,44 @@ The system tracks file hashes. If you edit the code and then call \`executions(a
 ### Resource discovery
 
 Before writing code that uses external services, **resolve real resource IDs**:
-- Call \`nodes(action="explore-resources")\` for any parameter with searchListMethod when a matching explicit credential is attached (calendars, spreadsheets, channels, models, etc.)
+- Call \`nodes(action="explore-resources")\` for any parameter with searchListMethod (calendars, spreadsheets, channels, models, etc.)
 - Do NOT use "primary", "default", or any assumed identifier — look up the actual value
 - Call \`nodes(action="suggested")\` early if the workflow fits a known category (web_app, form_input, data_persistence, etc.) — the pattern hints prevent common mistakes
 - Check @builderHint annotations in node type definitions for critical configuration guidance
+
+### Publishing
+
+Do NOT call \`workflows(action="publish")\` for the main workflow. Publishing is the user's decision after testing. Your job ends at a successful submit. The only exception is sub-workflows in the compositional pattern — those must be published so the parent workflow can reference them.
 `;
 function hashContent(content) {
     return (0, node_crypto_1.createHash)('sha256')
         .update(content ?? '', 'utf8')
         .digest('hex');
 }
-function createLinkedAbortController(parentSignal) {
-    const controller = new AbortController();
-    if (parentSignal.aborted) {
-        controller.abort(parentSignal.reason);
-        return controller;
+function createMainWorkflowSnapshot(content) {
+    if (content === null) {
+        return { exists: false };
     }
-    parentSignal.addEventListener('abort', () => controller.abort(parentSignal.reason), {
-        once: true,
+    return {
+        exists: true,
+        sourceHash: hashContent(content),
+    };
+}
+function shouldFinalSubmitMainWorkflow(input) {
+    return (input.current.exists &&
+        (!input.initial.exists || input.initial.sourceHash !== input.current.sourceHash));
+}
+function buildNotSubmittedOutcome(workItemId, runId, taskId, finalText, failureSignature = WORKFLOW_NOT_SUBMITTED_FAILURE_SIGNATURE) {
+    return withDeterministicRouting({
+        workItemId,
+        runId,
+        taskId,
+        submitted: false,
+        triggerType: 'manual_or_testable',
+        needsUserInput: false,
+        failureSignature,
+        summary: finalText,
     });
-    return controller;
 }
 function deterministicSuffix(seed, label, length) {
     return (0, node_crypto_1.createHash)('sha256')
@@ -534,7 +618,6 @@ async function compactSuccessfulBuilderMemory(input) {
         await (0, builder_memory_compaction_1.compactBuilderMemoryThread)({
             context: input.context,
             binding: input.binding,
-            sessionId: input.activeBuilderSession?.sessionId,
             workflowId: input.workflowId,
             workItemId: input.workItemId,
             sourceFilePath: input.mainWorkflowPath,
@@ -551,6 +634,26 @@ async function compactSuccessfulBuilderMemory(input) {
     catch {
     }
 }
+async function finalizeSuccessfulMainWorkflowSubmit(input) {
+    await promoteMainWorkflow(input.domainContext, input.context.logger, input.mainWorkflowAttempt.workflowId);
+    await compactSuccessfulBuilderMemory({
+        context: input.context,
+        binding: input.binding,
+        domainContext: input.domainContext,
+        workflowId: input.mainWorkflowAttempt.workflowId,
+        workItemId: input.workItemId,
+        mainWorkflowPath: input.mainWorkflowPath,
+        mainWorkflowAttempt: input.mainWorkflowAttempt,
+        lastRequestedChange: input.lastRequestedChange,
+        finalText: input.finalText,
+        shouldUseBuilderMemory: input.shouldUseBuilderMemory,
+    });
+    const outcome = await buildOutcomeWithLatestVerification(input.context, input.workItemId, input.taskId, input.mainWorkflowAttempt, input.finalText, supportingWorkflowIdsFromSubmitAttempts(input.submitAttemptHistory, input.mainWorkflowPath, input.mainWorkflowAttempt.workflowId, input.mainWorkflowAttempt.referencedWorkflowIds));
+    return {
+        text: input.finalText,
+        outcome,
+    };
+}
 function resultFromLaterFailedMainSubmit(input) {
     if (!shouldRecoverSavedWorkflowAfterFailedSubmit(input.failedAttempt))
         return undefined;
@@ -589,6 +692,126 @@ function formatSubmitWorkflowErrors(output, fallback) {
     const errors = output.errors?.join(' ') ?? '';
     return errors.length > 0 ? errors : fallback;
 }
+async function settleMissingMainWorkflowSubmit(input) {
+    const currentSnapshot = createMainWorkflowSnapshot(input.currentMainWorkflow);
+    const shouldFinalSubmit = shouldFinalSubmitMainWorkflow({
+        initial: input.initialMainWorkflowSnapshot,
+        current: currentSnapshot,
+    });
+    input.context.trackTelemetry?.('Builder finished without submit', {
+        thread_id: input.context.threadId,
+        run_id: input.runId,
+        work_item_id: input.workItemId,
+        ...(input.workflowId ? { workflow_id: input.workflowId } : {}),
+        has_main_workflow_file: currentSnapshot.exists,
+        main_workflow_changed: shouldFinalSubmit,
+        final_settlement: shouldFinalSubmit
+            ? 'final_submit'
+            : input.currentMainWorkflow === null
+                ? 'missing_file'
+                : 'unchanged_file',
+    });
+    if (!shouldFinalSubmit) {
+        const text = input.currentMainWorkflow === null
+            ? 'Error: workflow builder finished without creating or submitting /src/workflow.ts.'
+            : 'Error: workflow builder finished without submitting /src/workflow.ts; the file was unchanged from the start of the run.';
+        return await reportAndFinalizeBuildResult(input.context, input.workItemId, {
+            text,
+            outcome: buildNotSubmittedOutcome(input.workItemId, input.runId, input.taskId, text),
+        });
+    }
+    if (!input.submitTool?.handler) {
+        const text = 'Error: workflow builder wrote /src/workflow.ts, but submit-workflow was unavailable for final settlement.';
+        return await reportAndFinalizeBuildResult(input.context, input.workItemId, {
+            text,
+            outcome: buildNotSubmittedOutcome(input.workItemId, input.runId, input.taskId, text, WORKFLOW_FINAL_SUBMIT_FAILED_FAILURE_SIGNATURE),
+        });
+    }
+    const attemptsBeforeFinalSubmit = input.submitAttemptHistory.length;
+    let finalSubmit;
+    try {
+        const submitInput = { filePath: input.mainWorkflowPath };
+        if (input.workflowId) {
+            submitInput.workflowId = input.workflowId;
+        }
+        finalSubmit = (await input.submitTool.handler(submitInput, {}));
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        const recordedAttempt = input.submitAttempts.get(input.mainWorkflowPath);
+        if (isFreshAttemptForHash(recordedAttempt, input.currentMainWorkflowHash)) {
+            if (recordedAttempt.success) {
+                return await input.onSuccessfulSubmit(recordedAttempt);
+            }
+            if (shouldRecoverSavedWorkflowAfterFailedSubmit(recordedAttempt)) {
+                const recovered = resultFromLaterFailedMainSubmit({
+                    failedAttempt: recordedAttempt,
+                    submitAttempts: input.submitAttemptHistory,
+                    mainWorkflowPath: input.mainWorkflowPath,
+                    workItemId: input.workItemId,
+                    runId: input.runId,
+                    taskId: input.taskId,
+                });
+                if (recovered) {
+                    return await input.onRecoveredSubmit(recovered);
+                }
+            }
+            const recordedErrors = recordedAttempt.errors?.join(' ') ?? message;
+            const text = `Error: final submit of /src/workflow.ts failed. ${recordedErrors}`;
+            return await finalizeBuildResult(input.context, input.workItemId, {
+                text,
+                outcome: buildOutcome(input.workItemId, input.runId, input.taskId, recordedAttempt, text),
+            });
+        }
+        const text = `Error: final submit of /src/workflow.ts failed before recording an attempt. ${message}`;
+        const result = {
+            text,
+            outcome: buildNotSubmittedOutcome(input.workItemId, input.runId, input.taskId, text, WORKFLOW_FINAL_SUBMIT_FAILED_FAILURE_SIGNATURE),
+        };
+        if (input.submitAttemptHistory.length === attemptsBeforeFinalSubmit) {
+            return await reportAndFinalizeBuildResult(input.context, input.workItemId, result);
+        }
+        return await finalizeBuildResult(input.context, input.workItemId, result);
+    }
+    const refreshedAttempt = attemptFromAutoResubmit({
+        latestAttempt: input.submitAttempts.get(input.mainWorkflowPath),
+        resubmit: finalSubmit,
+        filePath: input.mainWorkflowPath,
+        sourceHash: input.currentMainWorkflowHash,
+    });
+    if (finalSubmit.success && refreshedAttempt?.success) {
+        return await input.onSuccessfulSubmit(refreshedAttempt);
+    }
+    if (refreshedAttempt &&
+        !refreshedAttempt.success &&
+        shouldRecoverSavedWorkflowAfterFailedSubmit(refreshedAttempt)) {
+        const recovered = resultFromLaterFailedMainSubmit({
+            failedAttempt: refreshedAttempt,
+            submitAttempts: input.submitAttemptHistory,
+            mainWorkflowPath: input.mainWorkflowPath,
+            workItemId: input.workItemId,
+            runId: input.runId,
+            taskId: input.taskId,
+        });
+        if (recovered) {
+            return await input.onRecoveredSubmit(recovered);
+        }
+    }
+    const finalSubmitErrors = refreshedAttempt?.errors?.join(' ') ??
+        formatSubmitWorkflowErrors(finalSubmit, 'Final submit did not record a main workflow attempt.');
+    const text = `Error: final submit of /src/workflow.ts failed. ${finalSubmitErrors}`;
+    const result = {
+        text,
+        outcome: refreshedAttempt
+            ? buildOutcome(input.workItemId, input.runId, input.taskId, refreshedAttempt, text)
+            : buildNotSubmittedOutcome(input.workItemId, input.runId, input.taskId, text, WORKFLOW_FINAL_SUBMIT_FAILED_FAILURE_SIGNATURE),
+    };
+    const reportedMainAttempt = input.submitAttempts.get(input.mainWorkflowPath);
+    if (!refreshedAttempt || refreshedAttempt !== reportedMainAttempt) {
+        return await reportAndFinalizeBuildResult(input.context, input.workItemId, result);
+    }
+    return await finalizeBuildResult(input.context, input.workItemId, result);
+}
 async function startBuildWorkflowAgentTask(context, input) {
     if (!context.spawnBackgroundTask) {
         return {
@@ -598,41 +821,42 @@ async function startBuildWorkflowAgentTask(context, input) {
         };
     }
     const spawnBackgroundTask = context.spawnBackgroundTask;
-    const factory = context.builderSandboxFactory;
+    const sharedWorkspace = context.workspace;
     const domainContext = context.domainContext;
-    const useSandbox = !!factory && !!domainContext;
+    const useSandbox = !!sharedWorkspace && !!domainContext;
     let builderTools;
     let prompt = build_workflow_agent_prompt_1.BUILDER_AGENT_PROMPT;
-    let availableCredentials;
+    let credMap;
     if (useSandbox) {
-        const credentialSnapshot = await (0, resolve_credentials_1.buildCredentialSnapshot)(domainContext.credentialService);
-        availableCredentials = credentialSnapshot.list;
+        credMap = await (0, resolve_credentials_1.buildCredentialMap)(domainContext.credentialService);
         const builderWorkflowsTool = createBuilderWorkflowsTool(domainContext);
         const builderCredentialsTool = createBuilderCredentialsTool(domainContext);
-        builderTools = {};
+        builderTools = (0, tool_registry_1.createToolRegistry)();
         for (const name of BUILDER_SANDBOX_TOOL_NAMES) {
-            if (context.domainTools[name]) {
-                builderTools[name] = context.domainTools[name];
+            const tool = context.domainTools.get(name);
+            if (tool) {
+                builderTools.set(name, tool);
             }
         }
-        builderTools.workflows = builderWorkflowsTool;
-        builderTools.credentials = builderCredentialsTool;
+        builderTools.set('workflows', builderWorkflowsTool);
+        builderTools.set(credentials_tool_1.CREDENTIALS_TOOL_ID, builderCredentialsTool);
         if (context.workflowTaskService && context.domainContext) {
-            builderTools['verify-built-workflow'] = (0, verify_built_workflow_tool_1.createVerifyBuiltWorkflowTool)(context);
+            builderTools.set('verify-built-workflow', (0, verify_built_workflow_tool_1.createVerifyBuiltWorkflowTool)(context));
         }
     }
     else {
-        builderTools = {};
+        builderTools = (0, tool_registry_1.createToolRegistry)();
         for (const name of BUILDER_TOOL_MODE_TOOL_NAMES) {
-            if (name in context.domainTools) {
-                builderTools[name] = context.domainTools[name];
+            const tool = context.domainTools.get(name);
+            if (tool) {
+                builderTools.set(name, tool);
             }
         }
         if (domainContext) {
-            builderTools.workflows = createBuilderWorkflowsTool(domainContext);
-            builderTools.credentials = createBuilderCredentialsTool(domainContext);
+            builderTools.set('workflows', createBuilderWorkflowsTool(domainContext));
+            builderTools.set(credentials_tool_1.CREDENTIALS_TOOL_ID, createBuilderCredentialsTool(domainContext));
         }
-        if (!builderTools['build-workflow']) {
+        if (!builderTools.has('build-workflow')) {
             return { result: 'Error: build-workflow tool not available.', taskId: '', agentId: '' };
         }
     }
@@ -645,22 +869,17 @@ async function startBuildWorkflowAgentTask(context, input) {
         deterministicIds?.workItemId ??
         (input.workflowId ? `${context.runId}:default` : `wi_${(0, nanoid_1.nanoid)(8)}`);
     const { workflowId } = input;
-    const reusedBuilderSession = useSandbox && workflowId
-        ? context.builderSandboxSessionRegistry?.acquireByWorkflowId(context.threadId, workflowId)
-        : undefined;
-    const workItemId = reusedBuilderSession?.workItemId ?? baseWorkItemId;
-    const builderThreadId = reusedBuilderSession?.builderThreadId ?? (0, node_crypto_1.randomUUID)();
-    const builderResourceId = reusedBuilderSession?.builderResourceId ?? createBuilderResourceId(context.userId);
+    const workItemId = baseWorkItemId;
+    const relativeMainWorkflowPath = builderWorkflowWorkspaceLayout('', workItemId).relativeMainWorkflowPath;
+    const builderThreadId = (0, node_crypto_1.randomUUID)();
+    const builderResourceId = (0, agent_persistence_1.createSubAgentResourceId)(context.threadId, 'workflow-builder');
     const builderMemoryBinding = {
         resource: builderResourceId,
         thread: builderThreadId,
     };
     let additionalContext = '';
-    if (reusedBuilderSession && workflowId) {
-        additionalContext = '';
-    }
-    else if (useSandbox && workflowId) {
-        additionalContext = `[CONTEXT: Modifying existing workflow ${workflowId}. The current code is pre-loaded in ~/workspace/src/workflow.ts — read it first, then edit. Use workflowId "${workflowId}" when calling submit-workflow.]\n\n[WORK ITEM ID: ${workItemId}]`;
+    if (useSandbox && workflowId) {
+        additionalContext = `[CONTEXT: Modifying existing workflow ${workflowId}. The current code is pre-loaded in ${relativeMainWorkflowPath} — read it first, then edit. Use workflowId "${workflowId}" when calling submit-workflow.]\n\n[WORK ITEM ID: ${workItemId}]`;
     }
     else if (useSandbox) {
         additionalContext = `[WORK ITEM ID: ${workItemId}]`;
@@ -669,451 +888,187 @@ async function startBuildWorkflowAgentTask(context, input) {
         additionalContext = `[CONTEXT: Modifying existing workflow ${workflowId}. Use workflowId "${workflowId}" when calling build-workflow.]`;
     }
     const runningTaskSummaries = context.getRunningTaskSummaries?.();
-    const briefing = reusedBuilderSession && workflowId
-        ? buildWarmBuilderFollowUp({
-            task: input.task,
-            conversationContext: input.conversationContext,
-            workflowId,
-            workItemId,
-        })
-        : await (0, sub_agent_briefing_1.buildSubAgentBriefing)({
+    const briefing = await (0, sub_agent_briefing_1.buildSubAgentBriefing)({
+        task: input.task,
+        conversationContext: input.conversationContext,
+        additionalContext: additionalContext || undefined,
+        requirements: useSandbox ? exports.DETACHED_BUILDER_REQUIREMENTS : undefined,
+        iteration: context.iterationLog
+            ? {
+                log: context.iterationLog,
+                threadId: context.threadId,
+                taskKey: `build:${workflowId ?? 'new'}`,
+            }
+            : undefined,
+        runningTasks: runningTaskSummaries,
+    });
+    const detachedTraceFactory = (0, tracing_utils_1.createDetachedSubAgentTraceFactory)(context, {
+        agentId: subAgentId,
+        role: 'workflow-builder',
+        kind: 'builder',
+        taskId,
+        plannedTaskId: input.plannedTaskId,
+        workItemId,
+        inputs: {
             task: input.task,
+            workflowId: input.workflowId,
             conversationContext: input.conversationContext,
-            additionalContext: additionalContext || undefined,
-            requirements: useSandbox ? exports.DETACHED_BUILDER_REQUIREMENTS : undefined,
-            iteration: context.iterationLog
-                ? {
-                    log: context.iterationLog,
-                    threadId: context.threadId,
-                    taskKey: `build:${workflowId ?? 'new'}`,
-                }
-                : undefined,
-            runningTasks: runningTaskSummaries,
-        });
-    let traceContext;
-    try {
-        traceContext = await (0, tracing_utils_1.createDetachedSubAgentTracing)(context, {
-            agentId: subAgentId,
-            role: 'workflow-builder',
-            kind: 'builder',
-            taskId,
-            plannedTaskId: input.plannedTaskId,
-            workItemId,
-            inputs: {
-                task: input.task,
-                workflowId: input.workflowId,
-                conversationContext: input.conversationContext,
-            },
-        });
-    }
-    catch (error) {
-        if (reusedBuilderSession) {
-            void context.builderSandboxSessionRegistry?.release(reusedBuilderSession.sessionId, {
-                keep: true,
-                reason: 'trace_setup_failed',
-            });
-        }
-        throw error;
-    }
-    let spawnOutcome;
-    try {
-        spawnOutcome = spawnBackgroundTask({
-            taskId,
-            threadId: context.threadId,
-            agentId: subAgentId,
+        },
+    });
+    const createTraceContext = async () => await detachedTraceFactory();
+    const spawnOutcome = spawnBackgroundTask({
+        taskId,
+        threadId: context.threadId,
+        agentId: subAgentId,
+        role: 'workflow-builder',
+        createTraceContext,
+        plannedTaskId: input.plannedTaskId,
+        workItemId,
+        dedupeKey: {
             role: 'workflow-builder',
-            traceContext,
             plannedTaskId: input.plannedTaskId,
-            workItemId,
-            dedupeKey: {
-                role: 'workflow-builder',
-                plannedTaskId: input.plannedTaskId,
-                workflowId: input.workflowId,
-            },
-            parentCheckpointId: context.isCheckpointFollowUp === true ? context.checkpointTaskId : undefined,
-            run: async (signal, drainCorrections, waitForCorrection) => await (0, tracing_utils_1.withTraceContextActor)(traceContext, async () => {
-                let builderWs;
-                let activeBuilderSession = reusedBuilderSession;
+            workflowId: input.workflowId,
+        },
+        parentCheckpointId: context.isCheckpointFollowUp === true ? context.checkpointTaskId : undefined,
+        run: async (signal, drainCorrections, waitForCorrection, { traceContext }) => await (0, tracing_utils_1.withTraceContextActor)(traceContext, async () => {
+            const submitAttempts = new Map();
+            const submitAttemptHistory = [];
+            if (useSandbox && sharedWorkspace && domainContext) {
+                let workspace = sharedWorkspace;
+                const root = await (0, sandbox_setup_1.getWorkspaceRoot)(workspace);
+                const materializedRuntimeSkills = await materializeBuilderRuntimeSkills(context, workspace, root);
+                workspace = materializedRuntimeSkills.workspace;
+                const runtimeSkills = materializedRuntimeSkills.source;
+                const builderLayout = builderWorkflowWorkspaceLayout(root, workItemId);
                 let telemetrySession;
-                let telemetryWorkspace;
-                const submitAttempts = new Map();
-                const submitAttemptHistory = [];
-                const builderAbortController = createLinkedAbortController(signal);
-                const terminalRemediationGuard = (0, workflow_loop_1.createTerminalRemediationGuard)((remediation) => {
-                    context.trackTelemetry?.('Builder terminal remediation reached', {
-                        thread_id: context.threadId,
-                        run_id: context.runId,
-                        work_item_id: workItemId,
-                        category: remediation.category,
-                        attempt_count: remediation.attemptCount,
-                        reason: remediation.reason,
-                    });
-                    builderAbortController.abort(new Error(remediation.guidance));
-                });
-                let clearFilesystemMutationGuard;
+                let unsubscribeTelemetry;
                 try {
-                    if (useSandbox) {
-                        let workspace;
-                        let root;
-                        if (activeBuilderSession) {
-                            workspace = activeBuilderSession.workspace;
-                            root = activeBuilderSession.root;
-                        }
-                        else {
-                            builderWs = await factory.create(subAgentId, domainContext);
-                            workspace = builderWs.workspace;
-                            root = await (0, sandbox_setup_1.getWorkspaceRoot)(workspace);
-                        }
-                        telemetrySession = (0, template_telemetry_1.createTemplateTelemetrySession)({
-                            context,
-                            threadId: context.threadId,
-                            runId: context.runId,
-                            workItemId,
-                            userRequestExcerpt: input.task,
-                        });
-                        telemetryWorkspace = workspace;
-                        (0, template_telemetry_1.attachTemplateTelemetrySession)(workspace, telemetrySession);
-                        const templateToolObserver = (0, template_telemetry_1.createTypedToolObserver)(telemetrySession);
-                        prompt = (0, build_workflow_agent_prompt_1.createSandboxBuilderAgentPrompt)(root);
-                        if (!activeBuilderSession && builderWs) {
-                            activeBuilderSession = context.builderSandboxSessionRegistry?.create({
-                                threadId: context.threadId,
-                                workflowId,
-                                workItemId,
-                                builderThreadId,
-                                builderResourceId,
-                                builderWorkspace: builderWs,
-                                root,
-                            });
-                        }
-                        if (!reusedBuilderSession && workflowId && domainContext) {
-                            try {
-                                const json = await domainContext.workflowService.getAsWorkflowJSON(workflowId);
-                                const rawCode = (0, workflow_sdk_1.generateWorkflowCode)(json);
-                                const code = `${extract_code_1.SDK_IMPORT_STATEMENT}\n\n${rawCode}`;
-                                if (workspace.filesystem) {
-                                    await workspace.filesystem.writeFile(`${root}/src/workflow.ts`, code, {
-                                        recursive: true,
-                                    });
-                                }
-                            }
-                            catch {
-                            }
-                        }
-                        const mainWorkflowPath = `${root}/src/workflow.ts`;
-                        const setFilesystemMutationGuard = activeBuilderSession?.setFilesystemMutationGuard ??
-                            builderWs?.setFilesystemMutationGuard;
-                        if (setFilesystemMutationGuard) {
-                            setFilesystemMutationGuard(() => terminalRemediationGuard.get());
-                            clearFilesystemMutationGuard = () => setFilesystemMutationGuard(undefined);
-                        }
-                        const finishTerminalRemediation = async (remediation) => {
-                            const terminalResult = resultFromTerminalRemediation({
-                                remediation,
-                                submitAttempts: submitAttemptHistory,
-                                mainWorkflowPath,
-                                workItemId,
-                                runId: context.runId,
-                                taskId,
-                            });
-                            if (terminalResult.outcome.submitted && terminalResult.outcome.workflowId) {
-                                await promoteMainWorkflow(domainContext, context.logger, terminalResult.outcome.workflowId);
-                            }
-                            return await finalizeBuildResult(context, workItemId, terminalResult);
-                        };
-                        builderTools['submit-workflow'] = (0, submit_workflow_identity_1.createIdentityEnforcedSubmitWorkflowTool)({
-                            context: domainContext,
-                            workspace,
-                            availableCredentials,
-                            root,
-                            currentRunId: context.runId,
-                            tracingRoot: traceContext?.rootRun,
-                            getWorkflowLoopState: async () => await context.workflowTaskService?.getWorkflowLoopState(workItemId),
-                            getTerminalRemediation: () => terminalRemediationGuard.get(),
-                            onGuardFired: (event) => {
-                                context.trackTelemetry?.('Builder remediation guard fired', {
-                                    thread_id: context.threadId,
-                                    run_id: context.runId,
-                                    work_item_id: workItemId,
-                                    workflow_id: event.workflowId,
-                                    category: event.category,
-                                    attempt_count: event.attemptCount,
-                                    reason: event.reason,
-                                });
-                            },
-                            onTerminalRemediation: (remediation) => {
-                                terminalRemediationGuard.record(remediation);
-                            },
-                            onAttempt: async (attempt) => {
-                                submitAttempts.set(attempt.filePath, attempt);
-                                submitAttemptHistory.push(attempt);
-                                if (attempt.filePath !== mainWorkflowPath) {
-                                    return;
-                                }
-                                if (attempt.success && attempt.workflowId && activeBuilderSession) {
-                                    context.builderSandboxSessionRegistry?.aliasWorkflowId(activeBuilderSession.sessionId, attempt.workflowId);
-                                }
-                                if (!context.workflowTaskService) {
-                                    return;
-                                }
-                                await context.workflowTaskService.reportBuildOutcome(buildOutcome(workItemId, context.runId, taskId, attempt, attempt.success
-                                    ? 'Workflow submitted and ready for verification.'
-                                    : (attempt.errors?.join(' ') ?? 'Workflow submission failed.'), supportingWorkflowIdsFromSubmitAttempts(submitAttemptHistory, mainWorkflowPath, attempt.workflowId, attempt.referencedWorkflowIds)));
-                            },
-                        });
-                        const tracedBuilderTools = (0, tracing_utils_1.traceSubAgentTools)(context, builderTools, 'workflow-builder');
-                        const shouldUseBuilderMemory = activeBuilderSession
-                            ? await ensureBuilderMemoryThread(context, builderMemoryBinding)
-                            : false;
-                        const subAgent = new agent_1.Agent({
-                            id: subAgentId,
-                            name: 'Workflow Builder Agent',
-                            instructions: {
-                                role: 'system',
-                                content: prompt,
-                                providerOptions: {
-                                    anthropic: { cacheControl: { type: 'ephemeral' } },
-                                },
-                            },
-                            model: context.modelId,
-                            tools: tracedBuilderTools,
-                            workspace,
-                            memory: shouldUseBuilderMemory ? context.memory : undefined,
-                        });
-                        (0, langsmith_tracing_1.mergeTraceRunInputs)(traceContext?.actorRun, (0, langsmith_tracing_1.buildAgentTraceInputs)({
-                            systemPrompt: prompt,
-                            tools: tracedBuilderTools,
-                            modelId: context.modelId,
-                        }));
-                        (0, register_with_mastra_1.registerWithMastra)(subAgentId, subAgent, context.storage);
-                        const traceParent = (0, langsmith_tracing_1.getTraceParentRun)();
-                        let finalText;
+                    telemetrySession = (0, template_telemetry_1.createTemplateTelemetrySession)({
+                        context,
+                        threadId: context.threadId,
+                        runId: context.runId,
+                        workItemId,
+                        userRequestExcerpt: input.task,
+                        templatesVersion: domainContext.templatesService?.getVersion() ?? null,
+                    });
+                    (0, template_telemetry_1.attachTemplateTelemetrySession)(workspace, telemetrySession);
+                    const templateToolObserver = (0, template_telemetry_1.createTypedToolObserver)(telemetrySession);
+                    unsubscribeTelemetry = context.eventBus.subscribe(context.threadId, (stored) => {
+                        if (stored.event.agentId !== subAgentId)
+                            return;
+                        templateToolObserver(stored.event);
+                    });
+                    prompt = (0, build_workflow_agent_prompt_1.createSandboxBuilderAgentPrompt)(root, {
+                        mainWorkflowPath: builderLayout.mainWorkflowPath,
+                        sourceDir: builderLayout.sourceDir,
+                        chunksDir: builderLayout.chunksDir,
+                        tsconfigPath: builderLayout.tsconfigPath,
+                    });
+                    await writeBuilderWorkspaceFile(workspace, builderLayout.tsconfigPath, renderBuilderTaskTsconfig());
+                    if (workflowId) {
                         try {
-                            const hitlResult = await (0, langsmith_tracing_1.withTraceParentContext)(traceParent, async () => {
-                                const llmStepTraceHooks = (0, resumable_stream_executor_1.createLlmStepTraceHooks)(traceParent);
-                                const resumeOptions = {
-                                    modelSettings: { temperature: model_settings_1.TEMPERATURE.BUILDER },
-                                    providerOptions: {
-                                        anthropic: { cacheControl: { type: 'ephemeral' } },
-                                    },
-                                    ...(shouldUseBuilderMemory
-                                        ? { memory: builderMemoryBinding, savePerStep: true }
-                                        : {}),
-                                };
-                                const stream = await subAgent.stream(briefing, {
-                                    maxSteps: max_steps_1.MAX_STEPS.BUILDER,
-                                    abortSignal: builderAbortController.signal,
-                                    modelSettings: { temperature: model_settings_1.TEMPERATURE.BUILDER },
-                                    providerOptions: {
-                                        anthropic: { cacheControl: { type: 'ephemeral' } },
-                                    },
-                                    ...(shouldUseBuilderMemory
-                                        ? { memory: builderMemoryBinding, savePerStep: true }
-                                        : {}),
-                                    ...(llmStepTraceHooks?.executionOptions ?? {}),
-                                });
-                                return await (0, consume_with_hitl_1.consumeStreamWithHitl)({
-                                    agent: subAgent,
-                                    stream: stream,
-                                    runId: context.runId,
-                                    agentId: subAgentId,
-                                    eventBus: context.eventBus,
-                                    logger: context.logger,
-                                    threadId: context.threadId,
-                                    abortSignal: builderAbortController.signal,
-                                    waitForConfirmation: context.waitForConfirmation,
-                                    drainCorrections,
-                                    waitForCorrection,
-                                    onActivity: () => context.touchBackgroundTask?.(taskId),
-                                    llmStepTraceHooks,
-                                    maxSteps: max_steps_1.MAX_STEPS.BUILDER,
-                                    resumeOptions,
-                                    onStreamEvent: templateToolObserver,
-                                });
-                            });
-                            const terminalRemediation = terminalRemediationGuard.get();
-                            if (terminalRemediation) {
-                                return await finishTerminalRemediation(terminalRemediation);
-                            }
-                            finalText = await hitlResult.text;
+                            const json = await domainContext.workflowService.getAsWorkflowJSON(workflowId);
+                            const rawCode = (0, workflow_sdk_1.generateWorkflowCode)(json);
+                            const code = `${extract_code_1.SDK_IMPORT_STATEMENT}\n\n${rawCode}`;
+                            await writeBuilderWorkspaceFile(workspace, builderLayout.mainWorkflowPath, code);
                         }
-                        catch (error) {
-                            const terminalRemediation = terminalRemediationGuard.get();
-                            if (terminalRemediation) {
-                                return await finishTerminalRemediation(terminalRemediation);
-                            }
-                            const recovered = resultFromPostStreamError({
-                                error,
-                                submitAttempts: submitAttemptHistory,
-                                mainWorkflowPath,
-                                workItemId,
-                                runId: context.runId,
-                                taskId,
-                            });
-                            if (recovered) {
-                                await promoteMainWorkflow(domainContext, context.logger, recovered.outcome.workflowId);
-                                return await finalizeBuildResult(context, workItemId, recovered);
-                            }
-                            throw error;
-                        }
-                        const terminalRemediation = terminalRemediationGuard.get();
-                        if (terminalRemediation) {
-                            return await finishTerminalRemediation(terminalRemediation);
+                        catch {
                         }
-                        const mainWorkflowAttempt = submitAttempts.get(mainWorkflowPath);
-                        const currentMainWorkflow = await (0, sandbox_fs_1.readFileViaSandbox)(workspace, mainWorkflowPath);
-                        const currentMainWorkflowHash = hashContent(currentMainWorkflow);
-                        if (!mainWorkflowAttempt) {
-                            const text = 'Error: workflow builder finished without submitting /src/workflow.ts.';
-                            return {
-                                text,
-                                outcome: buildOutcome(workItemId, context.runId, taskId, undefined, text),
-                            };
-                        }
-                        if (!mainWorkflowAttempt.success) {
-                            const recovered = resultFromLaterFailedMainSubmit({
-                                failedAttempt: mainWorkflowAttempt,
-                                submitAttempts: submitAttemptHistory,
-                                mainWorkflowPath,
-                                workItemId,
-                                runId: context.runId,
-                                taskId,
+                    }
+                    else {
+                        await writeBuilderWorkspaceFile(workspace, builderLayout.mainWorkflowPath, `${extract_code_1.SDK_IMPORT_STATEMENT}\n\n`);
+                    }
+                    const mainWorkflowPath = builderLayout.mainWorkflowPath;
+                    const initialMainWorkflowSnapshot = createMainWorkflowSnapshot(await (0, sandbox_fs_1.readFileViaSandbox)(workspace, mainWorkflowPath));
+                    builderTools.set('submit-workflow', (0, submit_workflow_identity_1.createIdentityEnforcedSubmitWorkflowTool)({
+                        context: domainContext,
+                        workspace,
+                        credentialMap: credMap,
+                        root,
+                        defaultFilePath: mainWorkflowPath,
+                        currentRunId: context.runId,
+                        getWorkflowLoopState: async () => await context.workflowTaskService?.getWorkflowLoopState(workItemId),
+                        onGuardFired: (event) => {
+                            context.trackTelemetry?.('Builder remediation guard fired', {
+                                thread_id: context.threadId,
+                                run_id: context.runId,
+                                work_item_id: workItemId,
+                                workflow_id: event.workflowId,
+                                category: event.category,
+                                attempt_count: event.attemptCount,
+                                reason: event.reason,
                             });
-                            if (recovered) {
-                                await promoteMainWorkflow(domainContext, context.logger, recovered.outcome.workflowId);
-                                return await finalizeBuildResult(context, workItemId, recovered);
+                        },
+                        onAttempt: async (attempt) => {
+                            submitAttempts.set(attempt.filePath, attempt);
+                            submitAttemptHistory.push(attempt);
+                            if (attempt.filePath !== mainWorkflowPath) {
+                                return;
                             }
-                            const errorText = mainWorkflowAttempt.errors?.join(' ') ?? 'Unknown submit-workflow failure.';
-                            const text = `Error: workflow builder stopped after a failed submit-workflow for /src/workflow.ts. ${errorText}`;
-                            return {
-                                text,
-                                outcome: buildOutcome(workItemId, context.runId, taskId, mainWorkflowAttempt, text),
-                            };
-                        }
-                        if (mainWorkflowAttempt.sourceHash !== currentMainWorkflowHash) {
-                            const submitTool = tracedBuilderTools['submit-workflow'];
-                            if (submitTool && 'execute' in submitTool) {
-                                const resubmit = await submitTool.execute({
-                                    filePath: mainWorkflowPath,
-                                    workflowId: mainWorkflowAttempt.workflowId,
-                                });
-                                const refreshedAttempt = attemptFromAutoResubmit({
-                                    latestAttempt: submitAttempts.get(mainWorkflowPath),
-                                    resubmit,
-                                    filePath: mainWorkflowPath,
-                                    sourceHash: currentMainWorkflowHash,
-                                });
-                                if (resubmit.success && refreshedAttempt?.success) {
-                                    await promoteMainWorkflow(domainContext, context.logger, refreshedAttempt.workflowId);
-                                    await compactSuccessfulBuilderMemory({
-                                        context,
-                                        binding: builderMemoryBinding,
-                                        activeBuilderSession,
-                                        domainContext,
-                                        workflowId: refreshedAttempt.workflowId,
-                                        workItemId,
-                                        mainWorkflowPath,
-                                        mainWorkflowAttempt: refreshedAttempt,
-                                        lastRequestedChange: input.task,
-                                        finalText,
-                                        shouldUseBuilderMemory,
-                                    });
-                                    const outcome = await buildOutcomeWithLatestVerification(context, workItemId, taskId, refreshedAttempt, finalText, supportingWorkflowIdsFromSubmitAttempts(submitAttemptHistory, mainWorkflowPath, refreshedAttempt.workflowId, refreshedAttempt.referencedWorkflowIds));
-                                    return {
-                                        text: finalText,
-                                        outcome,
-                                    };
-                                }
-                                const resubmitErrors = refreshedAttempt?.errors?.join(' ') ??
-                                    formatSubmitWorkflowErrors(resubmit, 'Auto-re-submit failed.');
-                                if (refreshedAttempt &&
-                                    !refreshedAttempt.success &&
-                                    shouldRecoverSavedWorkflowAfterFailedSubmit(refreshedAttempt)) {
-                                    const recovered = resultFromLaterFailedMainSubmit({
-                                        failedAttempt: refreshedAttempt,
-                                        submitAttempts: submitAttemptHistory,
-                                        mainWorkflowPath,
-                                        workItemId,
-                                        runId: context.runId,
-                                        taskId,
-                                    });
-                                    if (recovered) {
-                                        await promoteMainWorkflow(domainContext, context.logger, recovered.outcome.workflowId);
-                                        return await finalizeBuildResult(context, workItemId, recovered);
-                                    }
-                                }
-                                const text = `Error: auto-re-submit of edited /src/workflow.ts failed. ${resubmitErrors}`;
-                                return {
-                                    text,
-                                    outcome: buildOutcome(workItemId, context.runId, taskId, refreshedAttempt ?? undefined, text),
-                                };
+                            if (!context.workflowTaskService) {
+                                return;
                             }
-                        }
-                        await promoteMainWorkflow(domainContext, context.logger, mainWorkflowAttempt.workflowId);
-                        await compactSuccessfulBuilderMemory({
-                            context,
-                            binding: builderMemoryBinding,
-                            activeBuilderSession,
-                            domainContext,
-                            workflowId: mainWorkflowAttempt.workflowId,
-                            workItemId,
-                            mainWorkflowPath,
-                            mainWorkflowAttempt,
-                            lastRequestedChange: input.task,
-                            finalText,
-                            shouldUseBuilderMemory,
-                        });
-                        const outcome = await buildOutcomeWithLatestVerification(context, workItemId, taskId, mainWorkflowAttempt, finalText, supportingWorkflowIdsFromSubmitAttempts(submitAttemptHistory, mainWorkflowPath, mainWorkflowAttempt.workflowId, mainWorkflowAttempt.referencedWorkflowIds));
-                        return {
-                            text: finalText,
-                            outcome,
-                        };
-                    }
-                    let fallbackMainWorkflowId;
-                    recordSuccessfulWorkflowBuilds(builderTools['build-workflow'], (workflowId) => {
-                        fallbackMainWorkflowId = workflowId;
-                    });
+                            await context.workflowTaskService.reportBuildOutcome(buildOutcome(workItemId, context.runId, taskId, attempt, attempt.success
+                                ? 'Workflow submitted and ready for verification.'
+                                : (attempt.errors?.join(' ') ?? 'Workflow submission failed.')));
+                        },
+                    }));
                     const tracedBuilderTools = (0, tracing_utils_1.traceSubAgentTools)(context, builderTools, 'workflow-builder');
-                    const subAgent = new agent_1.Agent({
-                        id: subAgentId,
-                        name: 'Workflow Builder Agent',
-                        instructions: {
-                            role: 'system',
-                            content: prompt,
-                            providerOptions: {
-                                anthropic: { cacheControl: { type: 'ephemeral' } },
-                            },
+                    const runtimeWorkspaceTools = toToolRegistry(workspace.getTools());
+                    const builderMemory = getBuilderSessionMemory(context, true);
+                    const shouldUseBuilderMemory = Boolean(builderMemory);
+                    const subAgent = new agents_1.Agent('Workflow Builder Agent')
+                        .model(context.modelId)
+                        .instructions(prompt, {
+                        providerOptions: {
+                            anthropic: { cacheControl: { type: 'ephemeral' } },
                         },
-                        model: context.modelId,
-                        tools: tracedBuilderTools,
+                    })
+                        .tool((0, tool_registry_1.toolRegistryValues)(tracedBuilderTools))
+                        .checkpoint(context.checkpointStore ?? 'memory');
+                    (0, runtime_workspace_1.attachRuntimeWorkspaceCapabilities)(subAgent, { workspace, runtimeSkills });
+                    if (builderMemory) {
+                        subAgent.memory(builderMemory);
+                    }
+                    const telemetry = traceContext?.getTelemetry?.({
+                        agentRole: 'workflow-builder',
+                        functionId: 'instance-ai.subagent.workflow-builder',
+                        executionMode: 'background_subagent',
+                        metadata: { agent_id: subAgentId, task_id: taskId },
                     });
+                    if (telemetry) {
+                        subAgent.telemetry(telemetry);
+                    }
                     (0, langsmith_tracing_1.mergeTraceRunInputs)(traceContext?.actorRun, (0, langsmith_tracing_1.buildAgentTraceInputs)({
                         systemPrompt: prompt,
                         tools: tracedBuilderTools,
+                        runtimeTools: runtimeWorkspaceTools,
+                        runtimeSkills: runtimeSkills?.registry,
                         modelId: context.modelId,
                     }));
-                    (0, register_with_mastra_1.registerWithMastra)(subAgentId, subAgent, context.storage);
-                    const traceParent = (0, langsmith_tracing_1.getTraceParentRun)();
-                    const hitlResult = await (0, langsmith_tracing_1.withTraceParentContext)(traceParent, async () => {
-                        const llmStepTraceHooks = (0, resumable_stream_executor_1.createLlmStepTraceHooks)(traceParent);
+                    let finalText;
+                    try {
+                        const persistence = await (0, agent_persistence_1.createSubAgentPersistence)(context, {
+                            agentKind: 'workflow-builder',
+                            threadId: builderThreadId,
+                            resourceId: builderResourceId,
+                        });
                         const resumeOptions = {
-                            modelSettings: { temperature: model_settings_1.TEMPERATURE.BUILDER },
                             providerOptions: {
                                 anthropic: { cacheControl: { type: 'ephemeral' } },
                             },
                         };
                         const stream = await subAgent.stream(briefing, {
-                            maxSteps: max_steps_1.MAX_STEPS.BUILDER,
+                            maxIterations: max_steps_1.MAX_STEPS.BUILDER,
                             abortSignal: signal,
-                            modelSettings: { temperature: model_settings_1.TEMPERATURE.BUILDER },
+                            persistence,
                             providerOptions: {
                                 anthropic: { cacheControl: { type: 'ephemeral' } },
                             },
-                            ...(llmStepTraceHooks?.executionOptions ?? {}),
                         });
-                        return await (0, consume_with_hitl_1.consumeStreamWithHitl)({
+                        const hitlResult = await (0, consume_with_hitl_1.consumeStreamWithHitl)({
                             agent: subAgent,
-                            stream: stream,
+                            stream,
                             runId: context.runId,
                             agentId: subAgentId,
                             eventBus: context.eventBus,
@@ -1123,21 +1078,167 @@ async function startBuildWorkflowAgentTask(context, input) {
                             waitForConfirmation: context.waitForConfirmation,
                             drainCorrections,
                             waitForCorrection,
-                            onActivity: () => context.touchBackgroundTask?.(taskId),
-                            llmStepTraceHooks,
-                            maxSteps: max_steps_1.MAX_STEPS.BUILDER,
+                            maxIterations: max_steps_1.MAX_STEPS.BUILDER,
                             resumeOptions,
+                            persistence,
+                        });
+                        finalText = await (0, consume_with_hitl_1.requireCompletedHitlText)(hitlResult, 'Workflow builder sub-agent');
+                    }
+                    catch (error) {
+                        const recovered = resultFromPostStreamError({
+                            error,
+                            submitAttempts: submitAttemptHistory,
+                            mainWorkflowPath,
+                            workItemId,
+                            runId: context.runId,
+                            taskId,
                         });
+                        if (recovered) {
+                            await promoteMainWorkflow(domainContext, context.logger, recovered.outcome.workflowId);
+                            return await finalizeBuildResult(context, workItemId, recovered);
+                        }
+                        throw error;
+                    }
+                    const mainWorkflowAttempt = submitAttempts.get(mainWorkflowPath);
+                    const currentMainWorkflow = await (0, sandbox_fs_1.readFileViaSandbox)(workspace, mainWorkflowPath);
+                    const currentMainWorkflowHash = hashContent(currentMainWorkflow);
+                    if (!mainWorkflowAttempt) {
+                        return await settleMissingMainWorkflowSubmit({
+                            context,
+                            workItemId,
+                            runId: context.runId,
+                            taskId,
+                            workflowId,
+                            mainWorkflowPath,
+                            initialMainWorkflowSnapshot,
+                            currentMainWorkflow,
+                            currentMainWorkflowHash,
+                            submitTool: tracedBuilderTools.get('submit-workflow'),
+                            submitAttempts,
+                            submitAttemptHistory,
+                            finalText,
+                            onSuccessfulSubmit: async (attempt) => await finalizeSuccessfulMainWorkflowSubmit({
+                                context,
+                                binding: builderMemoryBinding,
+                                domainContext,
+                                workItemId,
+                                taskId,
+                                mainWorkflowPath,
+                                mainWorkflowAttempt: attempt,
+                                submitAttemptHistory,
+                                lastRequestedChange: input.task,
+                                finalText,
+                                shouldUseBuilderMemory,
+                            }),
+                            onRecoveredSubmit: async (recovered) => {
+                                await promoteMainWorkflow(domainContext, context.logger, recovered.outcome.workflowId);
+                                return await finalizeBuildResult(context, workItemId, recovered);
+                            },
+                        });
+                    }
+                    if (!mainWorkflowAttempt.success) {
+                        const recovered = resultFromLaterFailedMainSubmit({
+                            failedAttempt: mainWorkflowAttempt,
+                            submitAttempts: submitAttemptHistory,
+                            mainWorkflowPath,
+                            workItemId,
+                            runId: context.runId,
+                            taskId,
+                        });
+                        if (recovered) {
+                            await promoteMainWorkflow(domainContext, context.logger, recovered.outcome.workflowId);
+                            return await finalizeBuildResult(context, workItemId, recovered);
+                        }
+                        const errorText = mainWorkflowAttempt.errors?.join(' ') ?? 'Unknown submit-workflow failure.';
+                        const text = `Error: workflow builder stopped after a failed submit-workflow for ${mainWorkflowPath}. ${errorText}`;
+                        return {
+                            text,
+                            outcome: buildOutcome(workItemId, context.runId, taskId, mainWorkflowAttempt, text),
+                        };
+                    }
+                    if (mainWorkflowAttempt.sourceHash !== currentMainWorkflowHash) {
+                        const submitTool = tracedBuilderTools.get('submit-workflow');
+                        if (submitTool?.handler) {
+                            const resubmit = (await submitTool.handler({
+                                filePath: mainWorkflowPath,
+                                workflowId: mainWorkflowAttempt.workflowId,
+                            }, {}));
+                            const refreshedAttempt = attemptFromAutoResubmit({
+                                latestAttempt: submitAttempts.get(mainWorkflowPath),
+                                resubmit,
+                                filePath: mainWorkflowPath,
+                                sourceHash: currentMainWorkflowHash,
+                            });
+                            if (resubmit.success && refreshedAttempt?.success) {
+                                await promoteMainWorkflow(domainContext, context.logger, refreshedAttempt.workflowId);
+                                await compactSuccessfulBuilderMemory({
+                                    context,
+                                    binding: builderMemoryBinding,
+                                    domainContext,
+                                    workflowId: refreshedAttempt.workflowId,
+                                    workItemId,
+                                    mainWorkflowPath,
+                                    mainWorkflowAttempt: refreshedAttempt,
+                                    lastRequestedChange: input.task,
+                                    finalText,
+                                    shouldUseBuilderMemory,
+                                });
+                                const outcome = await buildOutcomeWithLatestVerification(context, workItemId, taskId, refreshedAttempt, finalText);
+                                return {
+                                    text: finalText,
+                                    outcome,
+                                };
+                            }
+                            const resubmitErrors = refreshedAttempt?.errors?.join(' ') ??
+                                formatSubmitWorkflowErrors(resubmit, 'Auto-re-submit failed.');
+                            if (refreshedAttempt &&
+                                !refreshedAttempt.success &&
+                                shouldRecoverSavedWorkflowAfterFailedSubmit(refreshedAttempt)) {
+                                const recovered = resultFromLaterFailedMainSubmit({
+                                    failedAttempt: refreshedAttempt,
+                                    submitAttempts: submitAttemptHistory,
+                                    mainWorkflowPath,
+                                    workItemId,
+                                    runId: context.runId,
+                                    taskId,
+                                });
+                                if (recovered) {
+                                    await promoteMainWorkflow(domainContext, context.logger, recovered.outcome.workflowId);
+                                    return await finalizeBuildResult(context, workItemId, recovered);
+                                }
+                            }
+                            const text = `Error: auto-re-submit of edited ${mainWorkflowPath} failed. ${resubmitErrors}`;
+                            return {
+                                text,
+                                outcome: buildOutcome(workItemId, context.runId, taskId, refreshedAttempt ?? undefined, text),
+                            };
+                        }
+                    }
+                    await promoteMainWorkflow(domainContext, context.logger, mainWorkflowAttempt.workflowId);
+                    await compactSuccessfulBuilderMemory({
+                        context,
+                        binding: builderMemoryBinding,
+                        domainContext,
+                        workflowId: mainWorkflowAttempt.workflowId,
+                        workItemId,
+                        mainWorkflowPath,
+                        mainWorkflowAttempt,
+                        lastRequestedChange: input.task,
+                        finalText,
+                        shouldUseBuilderMemory,
                     });
-                    const toolFinalText = await hitlResult.text;
-                    await promoteMainWorkflow(domainContext, context.logger, fallbackMainWorkflowId);
-                    return { text: toolFinalText };
+                    const outcome = await buildOutcomeWithLatestVerification(context, workItemId, taskId, mainWorkflowAttempt, finalText);
+                    return {
+                        text: finalText,
+                        outcome,
+                    };
                 }
                 finally {
-                    if (telemetrySession && telemetryWorkspace) {
+                    unsubscribeTelemetry?.();
+                    if (telemetrySession) {
                         try {
                             telemetrySession.flush();
-                            (0, template_telemetry_1.detachTemplateTelemetrySession)(telemetryWorkspace);
+                            (0, template_telemetry_1.detachTemplateTelemetrySession)(workspace);
                         }
                         catch (error) {
                             context.logger.warn('build-workflow-agent: failed to flush template telemetry', {
@@ -1145,36 +1246,79 @@ async function startBuildWorkflowAgentTask(context, input) {
                             });
                         }
                     }
-                    clearFilesystemMutationGuard?.();
-                    if (activeBuilderSession && context.builderSandboxSessionRegistry) {
-                        await context.builderSandboxSessionRegistry.release(activeBuilderSession.sessionId, {
-                            keep: !signal.aborted,
-                            reason: signal.aborted ? 'aborted' : 'builder_run_finished',
-                        });
-                    }
-                    else {
-                        await builderWs?.cleanup();
-                    }
                 }
-            }),
-        });
-    }
-    catch (error) {
-        if (reusedBuilderSession) {
-            void context.builderSandboxSessionRegistry?.release(reusedBuilderSession.sessionId, {
-                keep: true,
-                reason: 'spawn_failed',
+            }
+            let fallbackMainWorkflowId;
+            recordSuccessfulWorkflowBuilds(builderTools.get('build-workflow'), (workflowId) => {
+                fallbackMainWorkflowId = workflowId;
             });
-        }
-        throw error;
-    }
-    if (spawnOutcome.status === 'duplicate') {
-        if (reusedBuilderSession) {
-            void context.builderSandboxSessionRegistry?.release(reusedBuilderSession.sessionId, {
-                keep: true,
-                reason: 'spawn_duplicate',
+            const tracedBuilderTools = (0, tracing_utils_1.traceSubAgentTools)(context, builderTools, 'workflow-builder');
+            const runtimeSkills = context.runtimeSkills;
+            const subAgent = new agents_1.Agent('Workflow Builder Agent')
+                .model(context.modelId)
+                .instructions(prompt, {
+                providerOptions: {
+                    anthropic: { cacheControl: { type: 'ephemeral' } },
+                },
+            })
+                .tool((0, tool_registry_1.toolRegistryValues)(tracedBuilderTools))
+                .checkpoint(context.checkpointStore ?? 'memory');
+            (0, runtime_workspace_1.attachRuntimeWorkspaceCapabilities)(subAgent, { runtimeSkills });
+            const telemetry = traceContext?.getTelemetry?.({
+                agentRole: 'workflow-builder',
+                functionId: 'instance-ai.subagent.workflow-builder',
+                executionMode: 'background_subagent',
+                metadata: { agent_id: subAgentId, task_id: taskId },
             });
-        }
+            if (telemetry) {
+                subAgent.telemetry(telemetry);
+            }
+            (0, langsmith_tracing_1.mergeTraceRunInputs)(traceContext?.actorRun, (0, langsmith_tracing_1.buildAgentTraceInputs)({
+                systemPrompt: prompt,
+                tools: tracedBuilderTools,
+                runtimeSkills: runtimeSkills?.registry,
+                modelId: context.modelId,
+            }));
+            const resumeOptions = {
+                providerOptions: {
+                    anthropic: { cacheControl: { type: 'ephemeral' } },
+                },
+            };
+            const persistence = await (0, agent_persistence_1.createSubAgentPersistence)(context, {
+                agentKind: 'workflow-builder',
+                threadId: builderThreadId,
+                resourceId: builderResourceId,
+            });
+            const stream = await subAgent.stream(briefing, {
+                maxIterations: max_steps_1.MAX_STEPS.BUILDER,
+                abortSignal: signal,
+                persistence,
+                providerOptions: {
+                    anthropic: { cacheControl: { type: 'ephemeral' } },
+                },
+            });
+            const hitlResult = await (0, consume_with_hitl_1.consumeStreamWithHitl)({
+                agent: subAgent,
+                stream,
+                runId: context.runId,
+                agentId: subAgentId,
+                eventBus: context.eventBus,
+                logger: context.logger,
+                threadId: context.threadId,
+                abortSignal: signal,
+                waitForConfirmation: context.waitForConfirmation,
+                drainCorrections,
+                waitForCorrection,
+                maxIterations: max_steps_1.MAX_STEPS.BUILDER,
+                resumeOptions,
+                persistence,
+            });
+            const toolFinalText = await (0, consume_with_hitl_1.requireCompletedHitlText)(hitlResult, 'Workflow builder sub-agent');
+            await promoteMainWorkflow(domainContext, context.logger, fallbackMainWorkflowId);
+            return { text: toolFinalText };
+        }),
+    });
+    if (spawnOutcome.status === 'duplicate') {
         return {
             result: `Workflow build already in progress (task: ${spawnOutcome.existing.taskId}). Acknowledge and wait for the planned-task-follow-up — do not dispatch again.`,
             taskId: spawnOutcome.existing.taskId,
@@ -1182,12 +1326,6 @@ async function startBuildWorkflowAgentTask(context, input) {
         };
     }
     if (spawnOutcome.status === 'limit-reached') {
-        if (reusedBuilderSession) {
-            void context.builderSandboxSessionRegistry?.release(reusedBuilderSession.sessionId, {
-                keep: true,
-                reason: 'spawn_limit_reached',
-            });
-        }
         return {
             result: 'Could not start build: concurrent background-task limit reached. Wait for an existing task to finish and try again.',
             taskId: '',
@@ -1201,7 +1339,7 @@ async function startBuildWorkflowAgentTask(context, input) {
         payload: {
             parentId: context.orchestratorAgentId,
             role: 'workflow-builder',
-            tools: Object.keys(builderTools),
+            tools: (0, tool_registry_1.toolRegistryKeys)(builderTools),
             taskId,
             kind: 'builder',
             title: 'Building workflow',
@@ -1273,83 +1411,88 @@ async function resolveWorkflowNameForEditConfirmation(context, workflowId) {
     }
 }
 function createBuildWorkflowAgentTool(context) {
-    let consecutivePlanGuardRejections = 0;
-    const rejectWithGuard = (message) => {
-        consecutivePlanGuardRejections += 1;
-        if (consecutivePlanGuardRejections >= PLAN_GUARD_REJECTION_LIMIT) {
+    let planGuardRejectionCount = 0;
+    const rejectPlanGuardCall = (result) => {
+        planGuardRejectionCount++;
+        if (planGuardRejectionCount >= PLAN_GUARD_REJECTION_LIMIT) {
             context.logger.warn('build-workflow-with-agent plan-guard rejection limit reached — aborting run', {
                 threadId: context.threadId,
-                rejectionCount: consecutivePlanGuardRejections,
+                rejectionCount: planGuardRejectionCount,
             });
             throw new n8n_workflow_1.UserError('Stopped: the agent looped on `build-workflow-with-agent` rejections without correcting them. Try again or rephrase the request.');
         }
-        return { result: message, taskId: '' };
+        return { result, taskId: '' };
     };
-    return (0, tools_1.createTool)({
-        id: 'build-workflow-with-agent',
-        description: 'Build or modify an n8n workflow using a specialized builder agent. ' +
-            'The agent handles node discovery, schema lookups, code generation, and validation internally. ' +
-            'For edits to an existing workflow, call directly with `bypassPlan: true`, the existing `workflowId`, and a one-sentence `reason` — the orchestrator runs a lightweight verify afterwards. ' +
-            'For new workflows, multi-workflow builds, or data-table schema changes, go through `plan` — ' +
-            'a runtime guard rejects direct calls without `bypassPlan: true` outside replan/checkpoint follow-ups, because those paths need the orchestrator-run checkpoint for end-to-end verification.',
-        inputSchema: exports.buildWorkflowAgentInputSchema,
-        outputSchema: zod_1.z.object({
-            result: zod_1.z.string(),
-            taskId: zod_1.z.string(),
-        }),
-        suspendSchema: buildWorkflowAgentSuspendSchema,
-        resumeSchema: buildWorkflowAgentResumeSchema,
-        execute: async (input, ctx) => {
-            const isPostPlanFollowUpRun = isPostPlanFollowUp(context);
-            if (isBuildViaPlanGuardEnabled() && !isPostPlanFollowUpRun) {
-                if (!input.bypassPlan) {
-                    context.logger.warn('build-workflow-with-agent called outside plan/replan context — rejecting', {
-                        threadId: context.threadId,
-                        hasWorkflowId: Boolean(input.workflowId),
-                    });
-                    return rejectWithGuard('STOP. Call `plan` with a `build-workflow` task — do NOT retry this tool. Direct builder calls outside a plan are only allowed for edits to an existing workflow (`bypassPlan: true` + `workflowId` + one-sentence `reason`).');
-                }
-                if (!input.workflowId) {
-                    return rejectWithGuard('STOP. `bypassPlan: true` is for edits to an EXISTING workflow only. For new workflows call `plan` with a `build-workflow` task — do NOT retry this tool without a `workflowId`.');
-                }
-                if (!input.reason || input.reason.trim().length === 0) {
-                    return rejectWithGuard('STOP. `bypassPlan: true` requires a one-sentence `reason` (e.g. "swap Slack channel"). Retry once with `reason` set; do not retry without it.');
-                }
-                context.logger.warn('build-workflow-with-agent bypassing plan with bypassPlan=true', {
+    return new agents_1.Tool('build-workflow-with-agent')
+        .description('Build or modify an n8n workflow using a specialized builder agent. ' +
+        'The agent handles node discovery, schema lookups, code generation, and validation internally. ' +
+        'For edits to an existing workflow, call directly with `bypassPlan: true`, the existing `workflowId`, and a one-sentence `reason` — the orchestrator runs a lightweight verify afterwards. ' +
+        'For new workflows, multi-workflow builds, or data-table schema changes, go through `plan` — ' +
+        'a runtime guard rejects direct calls without `bypassPlan: true` outside replan/checkpoint follow-ups, because those paths need the orchestrator-run checkpoint for end-to-end verification.')
+        .input(exports.buildWorkflowAgentInputSchema)
+        .output(zod_1.z.object({
+        result: zod_1.z.string(),
+        taskId: zod_1.z.string(),
+    }))
+        .suspend(buildWorkflowAgentSuspendSchema)
+        .resume(buildWorkflowAgentResumeSchema)
+        .handler(async (input, ctx) => {
+        const isPostPlanFollowUpRun = isPostPlanFollowUp(context);
+        if (isBuildViaPlanGuardEnabled() && !isPostPlanFollowUpRun) {
+            if (!input.bypassPlan) {
+                context.logger.warn('build-workflow-with-agent called outside plan/replan context — rejecting', {
                     threadId: context.threadId,
-                    workflowId: input.workflowId,
-                    reason: input.reason,
+                    hasWorkflowId: Boolean(input.workflowId),
                 });
+                return rejectPlanGuardCall('STOP. Direct builder calls require `bypassPlan: true` + an existing ' +
+                    '`workflowId` + a one-sentence `reason`. Use that combination for any edit to ' +
+                    'an existing workflow. For new workflows, multi-workflow builds, or data-table ' +
+                    'schema changes, call `plan` with a `build-workflow` task instead — the planner ' +
+                    'discovers credentials, data tables, and best practices, and schedules an ' +
+                    'orchestrator-run verification checkpoint.');
+            }
+            if (!input.workflowId) {
+                return rejectPlanGuardCall('STOP. `bypassPlan: true` is for edits to an EXISTING workflow and requires a ' +
+                    '`workflowId`. New workflow builds must go through `plan` so an orchestrator-run ' +
+                    'verification checkpoint is scheduled. Call `plan` with a `build-workflow` task ' +
+                    'instead.');
+            }
+            if (!input.reason || input.reason.trim().length === 0) {
+                return rejectPlanGuardCall('STOP. `bypassPlan: true` requires a one-sentence `reason` describing the edit ' +
+                    '(e.g. "swap Slack channel", "fix Code node shape issue").');
+            }
+            context.logger.warn('build-workflow-with-agent bypassing plan with bypassPlan=true', {
+                threadId: context.threadId,
+                workflowId: input.workflowId,
+                reason: input.reason,
+            });
+        }
+        planGuardRejectionCount = 0;
+        if (input.workflowId && !isPostPlanFollowUpRun && context.domainContext) {
+            const updateWorkflowPermission = context.domainContext.permissions?.updateWorkflow ?? 'require_approval';
+            if (updateWorkflowPermission === 'blocked') {
+                return { result: 'Action blocked by admin', taskId: '' };
             }
-            if (input.workflowId && !isPostPlanFollowUpRun && context.domainContext) {
-                const updateWorkflowPermission = context.domainContext.permissions?.updateWorkflow ?? 'require_approval';
-                if (updateWorkflowPermission === 'blocked') {
-                    return { result: 'Action blocked by admin', taskId: '' };
+            const isOwnInFlightWorkflow = context.domainContext.aiCreatedWorkflowIds?.has(input.workflowId) ?? false;
+            if (!isOwnInFlightWorkflow) {
+                const resumeData = ctx.resumeData;
+                const needsApproval = updateWorkflowPermission !== 'always_allow';
+                if (needsApproval && (resumeData === undefined || resumeData === null)) {
+                    const workflowName = await resolveWorkflowNameForEditConfirmation(context, input.workflowId);
+                    return await ctx.suspend({
+                        requestId: (0, nanoid_1.nanoid)(),
+                        message: `Edit ${workflowName} (ID: ${input.workflowId})`,
+                        severity: 'warning',
+                    });
                 }
-                const isOwnInFlightWorkflow = context.domainContext.aiCreatedWorkflowIds?.has(input.workflowId) ?? false;
-                if (!isOwnInFlightWorkflow) {
-                    const resumeData = ctx?.agent?.resumeData;
-                    const suspend = ctx?.agent?.suspend;
-                    const needsApproval = updateWorkflowPermission !== 'always_allow';
-                    if (needsApproval && (resumeData === undefined || resumeData === null)) {
-                        const workflowName = await resolveWorkflowNameForEditConfirmation(context, input.workflowId);
-                        const reason = input.reason?.trim();
-                        await suspend?.({
-                            requestId: (0, nanoid_1.nanoid)(),
-                            message: `Edit existing workflow "${workflowName}" (ID: ${input.workflowId})?${reason ? ` Reason: ${reason}` : ''}`,
-                            severity: 'warning',
-                        });
-                        return { result: '', taskId: '' };
-                    }
-                    if (resumeData !== undefined && resumeData !== null && !resumeData.approved) {
-                        return { result: 'User declined the workflow edit.', taskId: '' };
-                    }
+                if (resumeData !== undefined && resumeData !== null && !resumeData.approved) {
+                    return { result: 'User declined the workflow edit.', taskId: '' };
                 }
             }
-            consecutivePlanGuardRejections = 0;
-            const result = await startBuildWorkflowAgentTask(context, input);
-            return { result: result.result, taskId: result.taskId };
-        },
-    });
+        }
+        const result = await startBuildWorkflowAgentTask(context, input);
+        return { result: result.result, taskId: result.taskId };
+    })
+        .build();
 }
 //# sourceMappingURL=build-workflow-agent.tool.js.map