@qwen-code/qwen-code 0.18.0 → 0.18.1-nightly.20260616.a68b2e1e7

package/chunks/{web-fetch-CZ7LLKPE.js → web-fetch-RHZMF3MP.js}

@@ -2,21 +2,21 @@
 "use strict";
 import {
   runSideQuery
-} from "./chunk-HLPLOD42.js";
+} from "./chunk-VXHYMZXW.js";
 import "./chunk-OFEVLU4C.js";
 import {
   BaseDeclarativeTool,
   BaseToolInvocation,
   ToolDisplayNames,
   ToolNames
-} from "./chunk-XV4HCEVI.js";
+} from "./chunk-6WPY6ES3.js";
 import {
   fetchWithTimeout,
   isPrivateIp
-} from "./chunk-SEGYWKIH.js";
+} from "./chunk-FIQECJTQ.js";
 import {
   createDebugLogger
-} from "./chunk-HR7SV7AY.js";
+} from "./chunk-HA2UEYZP.js";
 import "./chunk-Z2Z3GUXZ.js";
 import {
   init_esbuild_shims

package/chunks/{workflow-L2ZUUDT2.js → workflow-NEMDQB75.js}

@@ -1,18 +1,61 @@
 // Force strict mode and setup for ESM
 "use strict";
-import "./chunk-SKBPNJEW.js";
+import {
+  AgentEventEmitter,
+  FileDiscoveryService,
+  GitWorktreeService,
+  WorkspaceContext,
+  generateAgentWorktreeSlug,
+  rebuildToolRegistryOnOverride,
+  writeWorktreeSessionMarker
+} from "./chunk-H4ZDM3N6.js";
+import "./chunk-K5PGHDBN.js";
+import "./chunk-VXHYMZXW.js";
+import "./chunk-O4PICXES.js";
+import "./chunk-TW522KN6.js";
+import "./chunk-BJ5HQ23U.js";
+import "./chunk-SFRV6BGY.js";
+import "./chunk-ZOFNJQNJ.js";
+import "./chunk-WPTCDQN6.js";
+import "./chunk-OMX7CUOE.js";
+import "./chunk-MLZQVCF3.js";
+import "./chunk-LD2XBG6Z.js";
+import "./chunk-CPVI5J2L.js";
+import "./chunk-ZMIBJS45.js";
+import "./chunk-77WXWU44.js";
+import "./chunk-B4ZF2KSI.js";
+import "./chunk-A3OEZT2F.js";
+import "./chunk-3PJXIDKI.js";
+import "./chunk-UWCTAVOD.js";
+import "./chunk-OFEVLU4C.js";
+import "./chunk-IQHSD7K5.js";
+import "./chunk-LYRSMKLS.js";
+import {
+  SyntheticOutputTool
+} from "./chunk-26QELEL2.js";
 import {
   BaseDeclarativeTool,
   BaseToolInvocation,
   ToolDisplayNames,
   ToolNames
-} from "./chunk-XV4HCEVI.js";
+} from "./chunk-6WPY6ES3.js";
+import "./chunk-IDYDPBBN.js";
+import "./chunk-FIQECJTQ.js";
 import {
   createChildAbortController
 } from "./chunk-64WXLC72.js";
+import "./chunk-LXYWINWF.js";
+import "./chunk-NNIYWQIS.js";
+import "./chunk-LYSND7KR.js";
+import "./chunk-55ZMG67I.js";
+import "./chunk-H6BD2ELD.js";
+import "./chunk-5IFG2VC4.js";
 import {
   createDebugLogger
-} from "./chunk-HR7SV7AY.js";
+} from "./chunk-HA2UEYZP.js";
+import "./chunk-ZERZSAZL.js";
+import "./chunk-QN5NZ3UQ.js";
+import "./chunk-BR4QREVK.js";
 import "./chunk-Z2Z3GUXZ.js";
 import {
   init_esbuild_shims
@@ -317,32 +360,85 @@ function createWorkflowSandbox(opts) {
             );
           }
         }
-        if (agentOpts.schema !== undefined) {
-          throw new Error(
-            'agent({schema}) is not supported in P1. ' +
-            'Schema enforcement / StructuredOutput contract is scheduled for P3.'
-          );
-        }
-        if (agentOpts.isolation !== undefined) {
+        // P3: schema + model + agentType + isolation are all wired through
+        // createProductionDispatch \u2192 SubagentManager.createAgentHeadless.
+        // The dispatch surfaces descriptive errors for "agent type not found",
+        // "isolation:'remote' is not available in this build", parent-dirty
+        // refuse, worktree creation failures, and StructuredOutput contract
+        // violations ("completed without calling StructuredOutput after 2
+        // in-conversation nudges").
+        if (
+          agentOpts.isolation !== undefined &&
+          agentOpts.isolation !== 'worktree' &&
+          agentOpts.isolation !== 'remote'
+        ) {
           throw new Error(
-            "agent({isolation: '" + agentOpts.isolation + "'}) is not supported in P1. " +
-            'Worktree / remote isolation is scheduled for a later phase.'
+            "agent({isolation: '" + agentOpts.isolation + "'}): unknown isolation mode. " +
+            "Known modes are: 'worktree', 'remote'."
           );
         }
-        if (agentOpts.model !== undefined) {
-          throw new Error(
-            'agent({model}) is not supported in P1. Model override is scheduled for a later phase.'
-          );
-        }
-        if (agentOpts.agentType !== undefined) {
-          throw new Error('agent({agentType}) is not supported in P1.');
-        }
         if (typeof agentOpts.phase === 'string' && agentOpts.phase.length > 0) {
           if (__b.lastPhase() !== agentOpts.phase) {
             __b.pushPhase(agentOpts.phase);
           }
         }
-        return __b.hostAgent(prompt, agentOpts);
+        // SECURITY (P3 R2 self-review): user-script-controlled agentOpts
+        // cross the vm/host boundary verbatim via vmAsync's hostFn.apply.
+        // A Proxy / inherited-getter / non-plain object in agentOpts.schema
+        // would let host-side code (SyntheticOutputTool constructor + AJV
+        // compile) trigger user-controlled trap handlers that execute with
+        // the host realm's full surface. Revive agentOpts through JSON
+        // round-trip BEFORE crossing so the host only ever sees vm-realm
+        // plain objects with vm-realm prototypes. Same mechanism that
+        // makes args + parallel/pipeline results safe.
+        var safeOpts;
+        try {
+          safeOpts = JSON.parse(JSON.stringify(agentOpts));
+        } catch (e) {
+          throw new Error(
+            "agent() opts contain a non-JSON-serializable value: " +
+            String(e && e.message != null ? e.message : e)
+          );
+        }
+        // SECURITY (PR #4947 R1 wenshao, extended for P3): vmAsync's resolve
+        // path is verbatim (no re-wrap of resolved values). Host-realm
+        // strings cross the boundary harmlessly because primitives have no
+        // prototype identity. But P3's schema-mode dispatch returns the
+        // validated structured_output args as a host-realm OBJECT --
+        // handing that to the script reopens the T1/T8/T14 escape:
+        // result.constructor.constructor("return process")() would walk
+        // the host Object.prototype chain to the host Function
+        // constructor. Per-call JSON revival inside this vm runInContext
+        // block makes the returned object carry vm-realm prototypes (same
+        // mechanism as parallel/pipeline reviveInRealm and the args
+        // global revival). The fallback to null on a non-serializable
+        // resolve mirrors the errors-as-data convention parallel/pipeline
+        // already use for individual slot failures.
+        // R3 review (wenshao T3 [Suggestion]): the null fallback below is
+        // a SECURITY backstop, not a contract path. In schema mode the
+        // host return is the validated args of a structured_output tool
+        // call -- LLM tool_call payloads are always JSON-serializable
+        // (the model sends them through the OpenAI tool-call protocol
+        // which serializes through JSON itself) and SyntheticOutputTool's
+        // AJV validation runs over the parsed JSON, so a non-serializable
+        // host return is unreachable in production schema mode. The
+        // sentinel preserves the errors-as-data convention parallel /
+        // pipeline already use for individual slot failures, and stays as
+        // residual defense for any future dispatch path whose return
+        // value isn't a tool_call payload. logRevivalFailure surfaces
+        // the actionable detail (slot 0 + the error string) to operators
+        // so a real trigger in production isn't silent.
+        return __b.hostAgent(prompt, safeOpts).then(function (value) {
+          if (value === null || typeof value !== 'object') {
+            return value;
+          }
+          try {
+            return JSON.parse(JSON.stringify(value));
+          } catch (e) {
+            __b.logRevivalFailure(0, String(e && e.message != null ? e.message : e));
+            return null;
+          }
+        });
       });
 
       // --- parallel / pipeline ---
@@ -513,6 +609,7 @@ __name(createWorkflowSandbox, "createWorkflowSandbox");
 // packages/core/src/agents/runtime/workflow-prompts.ts
 init_esbuild_shims();
 var WORKFLOW_SUBAGENT_SYSTEM_PROMPT = 'You are a subagent spawned by a workflow orchestration script. Use the tools available to complete the task.\nCRITICAL: Your final text response is returned **verbatim** as a string to the calling script \u2014 it is your return value, not a message to a human.\n- Output the literal result (data, JSON, text). Do NOT output confirmations like "Done." or "Sent."\n- If asked for JSON, return ONLY the raw JSON \u2014 no code fences, no prose, no markdown.\n- Do NOT use SendUserMessage to deliver your answer. Put your answer in your final text response.\n- Be concise. The script will parse your output.';
+var WORKFLOW_SUBAGENT_SYSTEM_PROMPT_WITH_SCHEMA = "You are a subagent spawned by a workflow orchestration script. Use the tools available to complete the task.\nCRITICAL: You MUST deliver your final answer by calling the `structured_output` tool with arguments that conform to its parameter schema. Plain-text final answers are DISCARDED \u2014 only a valid `structured_output` call returns a result to the calling script.\n- Use other tools (Read, Grep, etc.) to gather information first.\n- When ready, call `structured_output` ONCE with the conforming JSON object.\n- If validation fails, the error tells you what to fix. Try again with corrected fields.\n- After two failed attempts, the run terminates \u2014 get the arguments right.\n- Do NOT use SendUserMessage to deliver your answer.\n- Be concise; the script reads only the structured payload, not your prose.";
 
 // packages/core/src/utils/concurrencyLimiter.ts
 init_esbuild_shims();
@@ -635,43 +732,400 @@ function generateRunId() {
   return `wf_${randomBytes(8).toString("hex")}`;
 }
 __name(generateRunId, "generateRunId");
+function sanitizeForErrorMessage(value) {
+  return value.replace(/[\u0000-\u001f\u007f]+/g, " ");
+}
+__name(sanitizeForErrorMessage, "sanitizeForErrorMessage");
 function createProductionDispatch(config, signal) {
   return async (prompt, opts) => {
-    const { AgentHeadless, ContextState } = await import("./agent-headless-TU3EPMYU.js");
+    const { AgentHeadless, ContextState } = await import("./agent-headless-SY7VJUHV.js");
     const ctx = new ContextState();
     ctx.set("task_prompt", prompt);
-    const subagent = await AgentHeadless.create(
-      opts.label ?? "workflow-agent",
+    if (opts.agentType === void 0 && opts.model === void 0 && opts.isolation === void 0 && opts.schema === void 0) {
+      const subagent = await AgentHeadless.create(
+        opts.label ?? "workflow-agent",
+        config,
+        {
+          systemPrompt: WORKFLOW_SUBAGENT_SYSTEM_PROMPT,
+          initialMessages: []
+        },
+        {},
+        // T11 (PR #4732 R1): bound resource ceiling so a single agent() call
+        // cannot loop the model indefinitely. Without this, runConfig was {}
+        // and the loop guards never tripped — combined with the cancellation
+        // bug below, workflows were effectively unkillable.
+        {
+          max_turns: WORKFLOW_SUBAGENT_MAX_TURNS,
+          max_time_minutes: WORKFLOW_SUBAGENT_MAX_TIME_MINUTES
+        },
+        // T11 (PR #4732 R1): disallow SendMessage / ExitPlanMode to align with
+        // upstream Tg8 — closes the back-channel that would let a subagent
+        // deliver its answer via user message instead of the script's read.
+        { tools: ["*"], disallowedTools: WORKFLOW_SUBAGENT_DISALLOWED_TOOLS }
+      );
+      await subagent.execute(ctx, signal);
+      const mode = subagent.getTerminateMode();
+      if (mode !== "GOAL" /* GOAL */) {
+        throw new Error(
+          `Workflow subagent did not complete (terminate mode: ${mode}).`
+        );
+      }
+      return subagent.getFinalText();
+    }
+    return runOverridePath(config, ctx, opts, signal);
+  };
+}
+__name(createProductionDispatch, "createProductionDispatch");
+async function runOverridePath(config, ctx, opts, signal) {
+  if (opts.isolation === "remote") {
+    throw new Error(
+      "agent({isolation:'remote'}) is not available in this build."
+    );
+  }
+  const subagentMgr = config.getSubagentManager();
+  let baseConfig;
+  if (opts.agentType !== void 0) {
+    const resolved = await subagentMgr.findSubagentByName(opts.agentType);
+    if (!resolved) {
+      const safeAgentType = sanitizeForErrorMessage(opts.agentType);
+      throw new Error(
+        `agent({agentType}): agent type '${safeAgentType}' not found.`
+      );
+    }
+    baseConfig = resolved;
+  } else {
+    baseConfig = {
+      name: opts.label ?? "workflow-agent",
+      description: "Default workflow subagent (per-call overrides).",
+      systemPrompt: WORKFLOW_SUBAGENT_SYSTEM_PROMPT,
+      level: "session",
+      isBuiltin: false
+    };
+  }
+  let schemaSystemPrompt;
+  if (opts.schema !== void 0) {
+    schemaSystemPrompt = opts.agentType !== void 0 && baseConfig.systemPrompt ? `${baseConfig.systemPrompt}
+
+${WORKFLOW_SUBAGENT_SYSTEM_PROMPT_WITH_SCHEMA}` : WORKFLOW_SUBAGENT_SYSTEM_PROMPT_WITH_SCHEMA;
+  }
+  let schemaTools;
+  if (opts.schema !== void 0 && baseConfig.tools && baseConfig.tools.length > 0 && !baseConfig.tools.includes("*") && !baseConfig.tools.includes(ToolNames.STRUCTURED_OUTPUT)) {
+    schemaTools = [...baseConfig.tools, ToolNames.STRUCTURED_OUTPUT];
+  }
+  const augmented = {
+    ...baseConfig,
+    ...opts.model !== void 0 ? { model: opts.model } : {},
+    ...schemaSystemPrompt !== void 0 ? { systemPrompt: schemaSystemPrompt } : {},
+    ...schemaTools !== void 0 ? { tools: schemaTools } : {},
+    disallowedTools: Array.from(
+      /* @__PURE__ */ new Set([
+        ...baseConfig.disallowedTools ?? [],
+        ...WORKFLOW_SUBAGENT_DISALLOWED_TOOLS
+      ])
+    )
+  };
+  let worktreeIsolation = null;
+  let effectiveContext = config;
+  if (opts.isolation === "worktree") {
+    worktreeIsolation = await provisionWorkflowWorktree(config);
+    effectiveContext = createWorktreeConfigOverride(
       config,
+      worktreeIsolation.path
+    );
+  }
+  let onParentAbort;
+  try {
+    let schemaState = null;
+    if (opts.schema !== void 0) {
+      effectiveContext = await createSchemaConfigOverride(
+        effectiveContext,
+        opts.schema
+      );
+      schemaState = createSchemaModeState();
+    }
+    let dispatchSignal = signal;
+    if (schemaState) {
+      const child = new AbortController();
+      if (signal) {
+        if (signal.aborted) {
+          child.abort(signal.reason);
+        } else {
+          onParentAbort = /* @__PURE__ */ __name(() => child.abort(signal.reason), "onParentAbort");
+          signal.addEventListener("abort", onParentAbort);
+        }
+      }
+      schemaState.abortController = child;
+      dispatchSignal = child.signal;
+    }
+    const eventEmitter = schemaState ? createSchemaEventEmitter(schemaState) : void 0;
+    const { subagent, dispose } = await subagentMgr.createAgentHeadless(
+      augmented,
+      effectiveContext,
       {
-        systemPrompt: WORKFLOW_SUBAGENT_SYSTEM_PROMPT,
-        initialMessages: []
-      },
-      {},
-      // T11 (PR #4732 R1): bound resource ceiling so a single agent() call
-      // cannot loop the model indefinitely. Without this, runConfig was {}
-      // and the loop guards never tripped — combined with the cancellation
-      // bug below, workflows were effectively unkillable.
-      {
-        max_turns: WORKFLOW_SUBAGENT_MAX_TURNS,
-        max_time_minutes: WORKFLOW_SUBAGENT_MAX_TIME_MINUTES
-      },
-      // T11 (PR #4732 R1): disallow SendMessage / ExitPlanMode to align with
-      // upstream Tg8 — closes the back-channel that would let a subagent
-      // deliver its answer via user message instead of the script's read.
-      { tools: ["*"], disallowedTools: WORKFLOW_SUBAGENT_DISALLOWED_TOOLS }
+        // Workflow always bounds resource ceiling regardless of agentType's
+        // own runConfig / maxTurns — these are workflow-level safety bounds,
+        // not subagent-level preferences. P5 will refine via budget.
+        runConfigOverrides: {
+          max_turns: WORKFLOW_SUBAGENT_MAX_TURNS,
+          max_time_minutes: WORKFLOW_SUBAGENT_MAX_TIME_MINUTES
+        },
+        eventEmitter
+      }
     );
-    await subagent.execute(ctx, signal);
-    const mode = subagent.getTerminateMode();
-    if (mode !== "GOAL" /* GOAL */) {
-      throw new Error(
-        `Workflow subagent did not complete (terminate mode: ${mode}).`
+    try {
+      await subagent.execute(ctx, dispatchSignal);
+      if (schemaState) {
+        if (schemaState.result !== null) {
+          if (worktreeIsolation) {
+            const isolation = worktreeIsolation;
+            worktreeIsolation = null;
+            const preserved = await cleanupWorkflowWorktree(isolation);
+            if (preserved) {
+              debugLogger.info(
+                `[Workflow] Schema-mode subagent preserved worktree at ${preserved.path ?? "(directory removed)"} on branch ${preserved.branch}. The structured payload is returned verbatim; recover the work from the preserved path / branch.`
+              );
+            }
+          }
+          return schemaState.result;
+        }
+        if (signal?.aborted) {
+          throw new DOMException("Workflow aborted.", "AbortError");
+        }
+        const mode2 = subagent.getTerminateMode();
+        if (mode2 !== "GOAL" /* GOAL */ && mode2 !== "CANCELLED" /* CANCELLED */) {
+          throw new Error(
+            `Workflow subagent did not complete (terminate mode: ${mode2}).`
+          );
+        }
+        if (schemaState.attempts > 2) {
+          throw new Error(
+            "subagent completed without calling StructuredOutput (after 2 in-conversation nudges)."
+          );
+        }
+        throw new Error(
+          "subagent completed without calling structured_output (no validation attempt \u2014 model produced plain-text content)."
+        );
+      }
+      const mode = subagent.getTerminateMode();
+      if (mode !== "GOAL" /* GOAL */) {
+        throw new Error(
+          `Workflow subagent did not complete (terminate mode: ${mode}).`
+        );
+      }
+      let finalText = subagent.getFinalText();
+      if (worktreeIsolation) {
+        const isolation = worktreeIsolation;
+        worktreeIsolation = null;
+        const preserved = await cleanupWorkflowWorktree(isolation);
+        if (preserved && typeof finalText === "string") {
+          finalText = appendWorktreePreservedSuffix(finalText, preserved);
+        }
+      }
+      return finalText;
+    } finally {
+      await dispose();
+    }
+  } finally {
+    if (onParentAbort && signal) {
+      signal.removeEventListener("abort", onParentAbort);
+    }
+    if (worktreeIsolation) {
+      try {
+        await cleanupWorkflowWorktree(worktreeIsolation);
+      } catch (error) {
+        debugLogger.warn(
+          `Workflow worktree cleanup in fallback finally failed for ${worktreeIsolation.path}: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  }
+}
+__name(runOverridePath, "runOverridePath");
+async function provisionWorkflowWorktree(config) {
+  const cwd = config.getTargetDir();
+  if (/\.qwen[\\/]worktrees[\\/]/.test(cwd)) {
+    throw new Error(
+      `agent({isolation:'worktree'}): parent is already inside a worktree (${cwd}). Nested isolation worktrees are not supported \u2014 the subagent's inherited paths would still reference the outer worktree.`
+    );
+  }
+  const probe = new GitWorktreeService(cwd);
+  const gitCheck = await probe.checkGitAvailable();
+  if (!gitCheck.available) {
+    throw new Error(
+      `agent({isolation:'worktree'}): ${gitCheck.error ?? "git is not available"}.`
+    );
+  }
+  if (!await probe.isGitRepository()) {
+    throw new Error(
+      `agent({isolation:'worktree'}): ${cwd} is not a git repository.`
+    );
+  }
+  const projectRoot = await probe.getRepoTopLevel() ?? cwd;
+  const wtService = projectRoot === cwd ? probe : new GitWorktreeService(projectRoot);
+  let parentDirty = false;
+  try {
+    parentDirty = await wtService.hasWorktreeChanges(projectRoot);
+  } catch (error) {
+    debugLogger.warn(
+      `[Workflow] hasWorktreeChanges failed at ${projectRoot}: ${error}`
+    );
+    parentDirty = true;
+  }
+  if (parentDirty) {
+    throw new Error(
+      `agent({isolation:'worktree'}): parent working tree at ${projectRoot} has uncommitted changes that would not propagate into the isolated worktree. The subagent would see the prior HEAD instead of the current state. Commit or stash the changes, then re-run.`
+    );
+  }
+  const slug = generateAgentWorktreeSlug();
+  let parentBranch;
+  try {
+    parentBranch = await wtService.getCurrentBranch();
+  } catch (error) {
+    debugLogger.warn(
+      `[Workflow] getCurrentBranch failed at ${projectRoot}: ${error}`
+    );
+  }
+  const created = await wtService.createUserWorktree(slug, parentBranch, {
+    symlinkDirectories: config.getWorktreeSymlinkDirectories()
+  });
+  if (!created.success || !created.worktree) {
+    throw new Error(
+      `agent({isolation:'worktree'}): failed to create worktree: ${created.error ?? "unknown error"}.`
+    );
+  }
+  try {
+    await writeWorktreeSessionMarker(
+      created.worktree.path,
+      config.getSessionId()
+    );
+  } catch (error) {
+    debugLogger.warn(
+      `[Workflow] failed to write session marker at ${created.worktree.path}: ${error}`
+    );
+  }
+  return {
+    slug,
+    path: created.worktree.path,
+    branch: created.worktree.branch,
+    repoRoot: projectRoot
+  };
+}
+__name(provisionWorkflowWorktree, "provisionWorkflowWorktree");
+function createWorktreeConfigOverride(base, wtPath) {
+  const ov = Object.create(base);
+  ov.targetDir = wtPath;
+  ov.cwd = wtPath;
+  ov.getTargetDir = () => wtPath;
+  ov.getCwd = () => wtPath;
+  ov.getWorkingDir = () => wtPath;
+  ov.getProjectRoot = () => wtPath;
+  const wtFileService = new FileDiscoveryService(wtPath);
+  ov.fileDiscoveryService = wtFileService;
+  ov.getFileService = () => wtFileService;
+  const wtWorkspace = new WorkspaceContext(wtPath);
+  ov.workspaceContext = wtWorkspace;
+  ov.getWorkspaceContext = () => wtWorkspace;
+  return ov;
+}
+__name(createWorktreeConfigOverride, "createWorktreeConfigOverride");
+async function cleanupWorkflowWorktree(isolation) {
+  const wtService = new GitWorktreeService(isolation.repoRoot);
+  const [hasChanges, hasUnmerged] = await Promise.all([
+    wtService.hasWorktreeChanges(isolation.path).catch((error) => {
+      debugLogger.warn(
+        `[Workflow] hasWorktreeChanges failed for ${isolation.path}: ${error}`
+      );
+      return true;
+    }),
+    wtService.hasUnmergedWorktreeCommits(isolation.slug).catch((error) => {
+      debugLogger.warn(
+        `[Workflow] hasUnmergedWorktreeCommits failed for ${isolation.slug}: ${error}`
+      );
+      return true;
+    })
+  ]);
+  if (hasChanges || hasUnmerged) {
+    debugLogger.info(
+      `[Workflow] Preserving isolation worktree ${isolation.path} (branch ${isolation.branch}, hasChanges=${hasChanges}, hasUnmerged=${hasUnmerged})`
+    );
+    return { path: isolation.path, branch: isolation.branch };
+  }
+  try {
+    const result = await wtService.removeUserWorktree(isolation.slug, {
+      deleteBranch: true
+    });
+    if (!result.success) {
+      debugLogger.warn(
+        `[Workflow] Failed to remove ephemeral worktree ${isolation.path}: ${result.error}`
+      );
+      return { path: isolation.path, branch: isolation.branch };
+    }
+    if (result.branchPreserved) {
+      debugLogger.warn(
+        `[Workflow] Removed worktree directory ${isolation.path} but kept branch ${isolation.branch} (unmerged commits at delete time)`
       );
+      return { branch: isolation.branch };
     }
-    return subagent.getFinalText();
+  } catch (error) {
+    debugLogger.warn(
+      `[Workflow] Failed to remove ephemeral worktree ${isolation.path}: ${error}`
+    );
+    return { path: isolation.path, branch: isolation.branch };
+  }
+  return null;
+}
+__name(cleanupWorkflowWorktree, "cleanupWorkflowWorktree");
+function appendWorktreePreservedSuffix(finalText, preserved) {
+  const sep = finalText.endsWith("\n") ? "\n" : "\n\n";
+  if (preserved.path) {
+    return `${finalText}${sep}[worktree preserved: ${preserved.path} (branch ${preserved.branch})]`;
+  }
+  return `${finalText}${sep}[worktree directory removed; branch ${preserved.branch} preserved \u2014 recover with \`git worktree add <path> ${preserved.branch}\`]`;
+}
+__name(appendWorktreePreservedSuffix, "appendWorktreePreservedSuffix");
+function createSchemaModeState() {
+  return {
+    result: null,
+    attempts: 0,
+    pendingArgs: /* @__PURE__ */ new Map(),
+    abortController: new AbortController()
   };
 }
-__name(createProductionDispatch, "createProductionDispatch");
+__name(createSchemaModeState, "createSchemaModeState");
+function createSchemaEventEmitter(state) {
+  const emitter = new AgentEventEmitter();
+  const targetTool = ToolNames.STRUCTURED_OUTPUT;
+  emitter.on("tool_call" /* TOOL_CALL */, (evt) => {
+    if (evt.name !== targetTool) return;
+    state.pendingArgs.set(evt.callId, evt.args);
+  });
+  emitter.on("tool_result" /* TOOL_RESULT */, (evt) => {
+    if (evt.name !== targetTool) return;
+    const args = state.pendingArgs.get(evt.callId);
+    state.pendingArgs.delete(evt.callId);
+    if (evt.success) {
+      if (args !== void 0 && state.result === null) {
+        state.result = args;
+        state.abortController.abort();
+      }
+      return;
+    }
+    state.attempts += 1;
+    if (state.attempts > 2 && state.result === null) {
+      state.abortController.abort();
+    }
+  });
+  return emitter;
+}
+__name(createSchemaEventEmitter, "createSchemaEventEmitter");
+async function createSchemaConfigOverride(base, schema) {
+  const override = Object.create(base);
+  await rebuildToolRegistryOnOverride(override, base);
+  const registry = override.getToolRegistry();
+  registry.registerTool(new SyntheticOutputTool(schema));
+  return override;
+}
+__name(createSchemaConfigOverride, "createSchemaConfigOverride");
 var WorkflowOrchestrator = class {
   constructor(dispatch) {
     this.dispatch = dispatch;
@@ -809,7 +1263,7 @@ var WORKFLOW_PARAM_SCHEMA = {
   properties: {
     script: {
       type: "string",
-      description: "JavaScript source of the workflow. Wrapped as an async IIFE. May call the injected globals `phase(title)`, `log(msg)`, `agent(prompt, { label? })`, and read `args`. Concurrency: `parallel([() => agent(...), ...])` runs thunks through a shared per-run window (default `max(1, min(16, cpus-2))` agents in flight; override via `QWEN_CODE_MAX_WORKFLOW_CONCURRENCY`) and resolves to a position-aligned array \u2014 a thunk that throws, or resolves to a non-JSON-serializable value, becomes `null` at its index (errors-as-data); parallel() itself rejects only on invalid arguments or abort. `pipeline(items, ...stages)` runs each item through the stages (staggered, no inter-stage barrier); a stage that throws, returns `null`, or returns a non-JSON-serializable value drops that item to `null`. Pass THUNKS to parallel, not eager calls: `parallel([() => agent(...)])`, not `parallel([agent(...)])`. At most 1000 agent() calls per run (override via `QWEN_CODE_MAX_WORKFLOW_AGENTS`). `Date.now()` and `Math.random()` both throw \u2014 workflow scripts must be deterministic for resume. `export const meta = {...}` declarations are stripped before execution."
+      description: "JavaScript source of the workflow. Wrapped as an async IIFE. May call the injected globals `phase(title)`, `log(msg)`, `agent(prompt, opts?)`, and read `args`. agent() opts: `{ label?, phase?, schema?, model?, agentType?, isolation? }`. `schema` (JSON Schema object): the subagent must deliver its result by calling `structured_output` with arguments matching the schema; agent() resolves to the validated object. Two failed attempts produce a terminal error \"subagent completed without calling StructuredOutput (after 2 in-conversation nudges)\". `agentType` (string): resolves against the declarative-agents registry (`.qwen/agents/<name>.md`, project then user then built-in). Unresolved names throw \"agent({agentType}): agent type 'X' not found\". `model` (string): per-call model override; routes provider correctly via the subagent runtime view. `isolation`: `'worktree'` provisions a fresh git worktree under `<projectRoot>/.qwen/worktrees/agent-<7hex>`; the worktree is auto-removed if no changes, otherwise the path and branch are returned alongside the result. `'remote'` throws \"agent({isolation:'remote'}) is not available in this build\" (parity with upstream). isolation=worktree refuses to run when the parent working tree has uncommitted changes (the subagent would see a stale HEAD). Workflow subagents always have SendMessage / ExitPlanMode in their disallowed-tool floor regardless of agentType. Concurrency: `parallel([() => agent(...), ...])` runs thunks through a shared per-run window (default `max(1, min(16, cpus-2))` agents in flight; override via `QWEN_CODE_MAX_WORKFLOW_CONCURRENCY`) and resolves to a position-aligned array \u2014 a thunk that throws, or resolves to a non-JSON-serializable value, becomes `null` at its index (errors-as-data); parallel() itself rejects only on invalid arguments or abort. `pipeline(items, ...stages)` runs each item through the stages (staggered, no inter-stage barrier); a stage that throws, returns `null`, or returns a non-JSON-serializable value drops that item to `null`. Pass THUNKS to parallel, not eager calls: `parallel([() => agent(...)])`, not `parallel([agent(...)])`. At most 1000 agent() calls per run (override via `QWEN_CODE_MAX_WORKFLOW_AGENTS`). `Date.now()` and `Math.random()` both throw \u2014 workflow scripts must be deterministic for resume. `export const meta = {...}` declarations are stripped before execution."
     },
     args: {
       description: "Optional structured value bound to the `args` global. Pass actual JSON, not a stringified value."
@@ -926,7 +1380,7 @@ var WorkflowTool = class extends BaseDeclarativeTool {
     super(
       ToolNames.WORKFLOW,
       ToolDisplayNames.WORKFLOW,
-      "Execute a workflow script that orchestrates subagents. Supports `phase`, `log`, sequential `agent`, and concurrent fan-out via `parallel(thunks)` / `pipeline(items, ...stages)` (default `max(1, min(16, cpus-2))` agents in flight per run, up to 1000 agents total; both env-overridable). No schema, no resume, no background execution yet. Scripts run in a node:vm sandbox without access to the filesystem or shell; all I/O happens through the spawned agents.",
+      "Execute a workflow script that orchestrates subagents. Supports `phase`, `log`, sequential `agent`, concurrent fan-out via `parallel(thunks)` / `pipeline(items, ...stages)` (default `max(1, min(16, cpus-2))` agents in flight per run, up to 1000 agents total; both env-overridable), per-call `agent({ schema, agentType, model, isolation: 'worktree' })` for structured-output contracts, declarative-agent selection, model override, and git-worktree-isolated subagents. No resume and no background execution yet (scheduled for later phases). Scripts run in a node:vm sandbox without access to the filesystem or shell; all I/O happens through the spawned agents.",
       "other" /* Other */,
       WORKFLOW_PARAM_SCHEMA,
       /* isOutputMarkdown */