@qwen-code/qwen-code 0.22.0 → 0.22.2-nightly.20260828.7357136dd1

package/chunks/{workflow-2FCMBTBZ.js → workflow-JBXU3IGA.js}

@@ -1,118 +1,121 @@
 // Force strict mode and setup for ESM
 "use strict";
 import {
+  isSymlinkedRoot,
   resolveSavedWorkflowScript,
   writeWorkflowSnapshot
-} from "./chunk-5HJUPACR.js";
+} from "./chunk-CRKKHXTI.js";
 import {
   AgentEventEmitter,
-  FileDiscoveryService,
   attachJsonlTranscriptWriter,
   buildAgentTranscriptAttach,
+  deriveApprovalModeConfig,
+  deriveConfig,
+  deriveWorktreeConfig,
+  getRuleDisplayName,
   isTerminalWorkflowStatus,
   rebuildToolRegistryOnOverride,
   resolveExternalWorktreeDir,
+  resolveToolName,
   toModelVisibleSubagentResult
-} from "./chunk-T6XLJRQY.js";
+} from "./chunk-EWIQ3NAE.js";
 import "./chunk-GOFAQQZA.js";
+import "./chunk-5M6IDOMF.js";
 import "./chunk-TWPJO254.js";
 import "./chunk-CQ35AJ4Z.js";
-import "./chunk-5M6IDOMF.js";
-import "./chunk-KVGR4MCF.js";
-import "./chunk-XZJKSETB.js";
-import "./chunk-YMVFIYHV.js";
+import "./chunk-EKSCLBBF.js";
+import "./chunk-LUEHOUHM.js";
+import "./chunk-WXEA74YB.js";
+import "./chunk-42IDLQWS.js";
 import {
   parsePositiveIntegerEnv
 } from "./chunk-6PVPNMXU.js";
-import "./chunk-7DYNJFES.js";
-import "./chunk-DJEHYM4H.js";
+import "./chunk-JB4JIVTJ.js";
+import "./chunk-DJBQCO2E.js";
 import "./chunk-IRH27ZC2.js";
 import "./chunk-QHWCP53L.js";
-import "./chunk-AZF6SME3.js";
+import "./chunk-D5LUXLUH.js";
 import "./chunk-O6GEWCJA.js";
 import "./chunk-T26EAKDL.js";
 import {
   GitWorktreeService,
   generateAgentWorktreeSlug,
   writeWorktreeSessionMarker
-} from "./chunk-GIWB5QLV.js";
+} from "./chunk-2SXSLSQE.js";
 import "./chunk-CPBF7KYF.js";
-import "./chunk-VUMLT7E5.js";
-import "./chunk-ISJMN3ML.js";
-import "./chunk-XLDFW44M.js";
-import "./chunk-Q54XG7IX.js";
-import "./chunk-FEMQ6Y7W.js";
-import "./chunk-2TRNCJK4.js";
-import "./chunk-NUGZAFR2.js";
-import "./chunk-LDGWX737.js";
+import "./chunk-6W2IK5KC.js";
+import "./chunk-TTX2JUE6.js";
+import "./chunk-4K7KNVWH.js";
+import "./chunk-SMPR7SPO.js";
+import "./chunk-JWALNCLT.js";
+import "./chunk-NIFYWDYN.js";
+import "./chunk-C2X7KY45.js";
+import "./chunk-XLLQJRAH.js";
+import "./chunk-7J6OTNGO.js";
 import {
   SUBAGENT_PLAN_LIFECYCLE_TOOLS
-} from "./chunk-VLRBJ24J.js";
+} from "./chunk-V5J4J5TP.js";
 import "./chunk-MLXTMF7H.js";
 import "./chunk-NAVJD2PQ.js";
-import "./chunk-WRT324N6.js";
-import "./chunk-YDJRMQU4.js";
-import "./chunk-SJ4HB27T.js";
-import "./chunk-P3QQPMQA.js";
-import "./chunk-2UZJWSVD.js";
-import "./chunk-SAH4BD2J.js";
-import "./chunk-VSNPOSDN.js";
+import "./chunk-B466ZSHZ.js";
+import "./chunk-4QHPPXK2.js";
+import "./chunk-QHMLYMMS.js";
+import "./chunk-3WK3QDNV.js";
+import "./chunk-PQEISIKS.js";
+import "./chunk-EB6QRGHM.js";
 import {
   runWithAgentContext
-} from "./chunk-I432KXWD.js";
+} from "./chunk-CMHFCLBU.js";
 import "./chunk-S6LOFUVP.js";
-import "./chunk-7IV52LTO.js";
-import "./chunk-AXMWHKXA.js";
+import "./chunk-CFKIH3D3.js";
+import "./chunk-2LD5U7Q3.js";
 import {
   createAbortController,
   createChildAbortController
 } from "./chunk-DJ2GSRLV.js";
-import "./chunk-2J3OJGTL.js";
-import "./chunk-LI4YHTQK.js";
-import "./chunk-QKBYFU2Q.js";
-import "./chunk-C72BXMJ5.js";
+import "./chunk-DYXFD5RO.js";
+import "./chunk-Y3QL45LS.js";
 import {
   WorkflowRunEvent,
   logWorkflowRun,
   read,
   writeLine
-} from "./chunk-FDD2IUEL.js";
-import "./chunk-YRLW2MSX.js";
+} from "./chunk-SZLBBZH4.js";
+import "./chunk-XBVNNDPK.js";
 import "./chunk-VGC4I5JJ.js";
-import "./chunk-IWOWEENB.js";
-import "./chunk-HIK2OF33.js";
-import "./chunk-ZRYQMWEP.js";
-import "./chunk-2E3V7G6Y.js";
-import "./chunk-F6WFNA7U.js";
+import {
+  isWithinRoot
+} from "./chunk-BKWNKLZB.js";
+import "./chunk-6PJOTWAN.js";
+import "./chunk-BWORX6FA.js";
 import "./chunk-WZAD4ZNJ.js";
 import "./chunk-FPGTNKCP.js";
-import "./chunk-YHC2EYYG.js";
-import "./chunk-PZRUV52H.js";
-import "./chunk-JGUBDRBC.js";
-import "./chunk-HDKCKCYO.js";
+import "./chunk-6DIGWMGT.js";
+import "./chunk-3K6TUZHS.js";
+import "./chunk-XZA32HII.js";
+import "./chunk-23RFD54N.js";
+import "./chunk-PPKZ7JOE.js";
 import "./chunk-HHJLM3WQ.js";
 import {
   stripAnsiAndControl
-} from "./chunk-GAHYKJPV.js";
+} from "./chunk-B5PHIJGI.js";
 import "./chunk-74TONY4F.js";
 import {
   SyntheticOutputTool
-} from "./chunk-XL5K4SVK.js";
-import "./chunk-WZDM44SB.js";
-import "./chunk-K623ENWT.js";
+} from "./chunk-XF63PKEN.js";
+import "./chunk-CAJTKR6W.js";
+import "./chunk-ZU4UDIWX.js";
 import "./chunk-AQ37AY7B.js";
-import {
-  WorkspaceContext
-} from "./chunk-K52PZNU4.js";
+import "./chunk-PDQGMSZK.js";
 import {
   BaseDeclarativeTool,
   BaseToolInvocation,
   ToolDisplayNames,
   ToolNames
-} from "./chunk-6NFAEG54.js";
+} from "./chunk-UTLCH2FK.js";
 import {
   createDebugLogger
-} from "./chunk-A5F2YNO6.js";
+} from "./chunk-UHQFIS7N.js";
 import "./chunk-75DOP5OR.js";
 import "./chunk-DMTGGOSA.js";
 import "./chunk-YQ3U5MUC.js";
@@ -128,15 +131,320 @@ import {
 // packages/core/src/tools/workflow/workflow.ts
 init_esbuild_shims();
 
-// packages/core/src/agents/runtime/workflow-orchestrator.ts
-init_esbuild_shims();
-import { randomBytes } from "node:crypto";
-import { AsyncLocalStorage } from "node:async_hooks";
-import * as os from "node:os";
-
 // packages/core/src/agents/runtime/workflow-sandbox.ts
 init_esbuild_shims();
 import * as vm from "node:vm";
+
+// packages/core/src/agents/runtime/workflow-meta-literal.ts
+init_esbuild_shims();
+var WorkflowMetaSyntaxError = class extends Error {
+  static {
+    __name(this, "WorkflowMetaSyntaxError");
+  }
+  index;
+  constructor(message, index) {
+    super(message);
+    this.name = "WorkflowMetaSyntaxError";
+    this.index = index;
+  }
+};
+function parseWorkflowMetaLiteral(source) {
+  const parser = new MetaLiteralParser(source);
+  parser.skipTrivia();
+  const value = parser.parseValue(0);
+  parser.skipTrivia();
+  if (parser.index < source.length) {
+    throw parser.fail("unexpected trailing content");
+  }
+  return value;
+}
+__name(parseWorkflowMetaLiteral, "parseWorkflowMetaLiteral");
+var MAX_DEPTH = 32;
+var WHITESPACE = /* @__PURE__ */ new Set([" ", "	", "\n", "\r", "\f", "\v", "\xA0", "\uFEFF"]);
+var ID_START = /[A-Za-z_$]/;
+var ID_PART = /[A-Za-z0-9_$]/;
+var MetaLiteralParser = class {
+  constructor(src) {
+    this.src = src;
+  }
+  static {
+    __name(this, "MetaLiteralParser");
+  }
+  index = 0;
+  fail(message) {
+    const from = Math.max(0, this.index - 24);
+    const snippet = this.src.slice(from, this.index + 24).replace(/\s+/g, " ").trim();
+    return new WorkflowMetaSyntaxError(
+      `${message} at position ${this.index} (near "${snippet}"). meta must be a plain object literal \u2014 strings, numbers, booleans, null, arrays and objects only, with no variables, function calls, spreads, accessors or template substitutions.`,
+      this.index
+    );
+  }
+  skipTrivia() {
+    for (; ; ) {
+      while (this.index < this.src.length && WHITESPACE.has(this.src[this.index])) {
+        this.index++;
+      }
+      if (this.src.startsWith("//", this.index)) {
+        let end = this.index + 2;
+        while (end < this.src.length && !"\n\r\u2028\u2029".includes(this.src[end])) {
+          end++;
+        }
+        if (this.src[end] === "\r" && this.src[end + 1] === "\n") end++;
+        this.index = end < this.src.length ? end + 1 : this.src.length;
+        continue;
+      }
+      if (this.src.startsWith("/*", this.index)) {
+        const end = this.src.indexOf("*/", this.index + 2);
+        if (end === -1) throw this.fail("unterminated comment");
+        this.index = end + 2;
+        continue;
+      }
+      return;
+    }
+  }
+  parseValue(depth) {
+    if (depth > MAX_DEPTH) throw this.fail("meta literal is nested too deeply");
+    this.skipTrivia();
+    const c = this.src[this.index];
+    if (c === void 0) throw this.fail("unexpected end of meta literal");
+    if (c === "{") return this.parseObject(depth);
+    if (c === "[") return this.parseArray(depth);
+    if (c === '"' || c === "'" || c === "`") return this.parseString();
+    if (c === "-" || c >= "0" && c <= "9") return this.parseNumber();
+    if (this.src.startsWith("true", this.index)) return this.word("true", true);
+    if (this.src.startsWith("false", this.index)) {
+      return this.word("false", false);
+    }
+    if (this.src.startsWith("null", this.index)) return this.word("null", null);
+    if (c === "/")
+      throw this.fail("regular expressions are not allowed in meta");
+    throw this.fail("unsupported value");
+  }
+  word(literal, value) {
+    const after = this.src[this.index + literal.length];
+    if (after !== void 0 && ID_PART.test(after)) {
+      throw this.fail("unsupported value");
+    }
+    this.index += literal.length;
+    return value;
+  }
+  parseObject(depth) {
+    this.index++;
+    const out = /* @__PURE__ */ Object.create(null);
+    for (; ; ) {
+      this.skipTrivia();
+      const c = this.src[this.index];
+      if (c === "}") {
+        this.index++;
+        return out;
+      }
+      if (c === void 0) throw this.fail("unterminated object");
+      if (this.src.startsWith("...", this.index)) {
+        throw this.fail("spread is not allowed in meta");
+      }
+      if (c === "[") throw this.fail("computed keys are not allowed in meta");
+      const key = this.parseKey();
+      this.skipTrivia();
+      if (this.src[this.index] === "(") {
+        throw this.fail("methods are not allowed in meta");
+      }
+      if (this.src[this.index] !== ":")
+        throw this.fail('expected ":" after key');
+      this.index++;
+      out[key] = this.parseValue(depth + 1);
+      this.skipTrivia();
+      if (this.src[this.index] === ",") {
+        this.index++;
+        continue;
+      }
+      if (this.src[this.index] === "}") {
+        this.index++;
+        return out;
+      }
+      throw this.fail('expected "," or "}"');
+    }
+  }
+  parseKey() {
+    const c = this.src[this.index];
+    if (c === '"' || c === "'" || c === "`") return this.parseString();
+    if (c !== void 0 && ID_START.test(c)) {
+      const start = this.index;
+      while (this.index < this.src.length && ID_PART.test(this.src[this.index])) {
+        this.index++;
+      }
+      const word = this.src.slice(start, this.index);
+      if (word === "get" || word === "set" || word === "async") {
+        const save = this.index;
+        this.skipTrivia();
+        const next = this.src[this.index];
+        const startsPropertyName = next !== void 0 && (ID_START.test(next) || next === '"' || next === "'" || next === "[");
+        this.index = save;
+        if (startsPropertyName) {
+          throw this.fail(
+            word === "async" ? "async members are not allowed in meta" : `${word}ters are not allowed in meta`
+          );
+        }
+      }
+      return word;
+    }
+    throw this.fail("expected a property name");
+  }
+  parseArray(depth) {
+    this.index++;
+    const out = [];
+    for (; ; ) {
+      this.skipTrivia();
+      const c = this.src[this.index];
+      if (c === "]") {
+        this.index++;
+        return out;
+      }
+      if (c === void 0) throw this.fail("unterminated array");
+      if (this.src.startsWith("...", this.index)) {
+        throw this.fail("spread is not allowed in meta");
+      }
+      if (c === ",") throw this.fail("missing array element");
+      out.push(this.parseValue(depth + 1));
+      this.skipTrivia();
+      if (this.src[this.index] === ",") {
+        this.index++;
+        continue;
+      }
+      if (this.src[this.index] === "]") {
+        this.index++;
+        return out;
+      }
+      throw this.fail('expected "," or "]"');
+    }
+  }
+  parseString() {
+    const quote = this.src[this.index++];
+    let out = "";
+    for (; ; ) {
+      const c = this.src[this.index];
+      if (c === void 0) throw this.fail("unterminated string");
+      if (c === quote) {
+        this.index++;
+        return out;
+      }
+      if (c === "\n" || c === "\r") {
+        if (quote !== "`") throw this.fail("unterminated string");
+        if (c === "\r") {
+          this.index++;
+          if (this.src[this.index] === "\n") this.index++;
+          out += "\n";
+          continue;
+        }
+      }
+      if (quote === "`" && c === "$" && this.src[this.index + 1] === "{") {
+        throw this.fail("template substitutions are not allowed in meta");
+      }
+      if (c === "\\") {
+        out += this.parseEscape();
+        continue;
+      }
+      out += c;
+      this.index++;
+    }
+  }
+  parseEscape() {
+    this.index++;
+    const c = this.src[this.index++];
+    switch (c) {
+      case "n":
+        return "\n";
+      case "t":
+        return "	";
+      case "r":
+        return "\r";
+      case "b":
+        return "\b";
+      case "f":
+        return "\f";
+      case "v":
+        return "\v";
+      case "0":
+        if (/[0-9]/.test(this.src[this.index] ?? "")) {
+          throw this.fail("octal escapes are not allowed in meta");
+        }
+        return "\0";
+      case "x": {
+        const hex = this.src.slice(this.index, this.index + 2);
+        if (!/^[0-9a-fA-F]{2}$/.test(hex)) {
+          throw this.fail("invalid \\x escape");
+        }
+        this.index += 2;
+        return String.fromCharCode(parseInt(hex, 16));
+      }
+      case "u": {
+        if (this.src[this.index] === "{") {
+          const end = this.src.indexOf("}", this.index);
+          const hex2 = end === -1 ? "" : this.src.slice(this.index + 1, end);
+          if (!/^[0-9a-fA-F]{1,6}$/.test(hex2)) {
+            throw this.fail("invalid \\u{...} escape");
+          }
+          const code = parseInt(hex2, 16);
+          if (code > 1114111) throw this.fail("invalid \\u{...} escape");
+          this.index = end + 1;
+          return String.fromCodePoint(code);
+        }
+        const hex = this.src.slice(this.index, this.index + 4);
+        if (!/^[0-9a-fA-F]{4}$/.test(hex)) {
+          throw this.fail("invalid \\u escape");
+        }
+        this.index += 4;
+        return String.fromCharCode(parseInt(hex, 16));
+      }
+      case "\n":
+        return "";
+      // line continuation
+      case "\r":
+        if (this.src[this.index] === "\n") this.index++;
+        return "";
+      case "\u2028":
+      case "\u2029":
+        return "";
+      case void 0:
+        throw this.fail("unterminated escape sequence");
+      default:
+        return c;
+    }
+  }
+  parseNumber() {
+    const start = this.index;
+    if (this.src[this.index] === "-") this.index++;
+    while (this.index < this.src.length && /[0-9]/.test(this.src[this.index])) {
+      this.index++;
+    }
+    if (this.src[this.index] === ".") {
+      this.index++;
+      while (this.index < this.src.length && /[0-9]/.test(this.src[this.index])) {
+        this.index++;
+      }
+    }
+    if (this.src[this.index] === "e" || this.src[this.index] === "E") {
+      this.index++;
+      if (this.src[this.index] === "+" || this.src[this.index] === "-") {
+        this.index++;
+      }
+      while (this.index < this.src.length && /[0-9]/.test(this.src[this.index])) {
+        this.index++;
+      }
+    }
+    const after = this.src[this.index];
+    if (after !== void 0 && ID_PART.test(after)) {
+      throw this.fail("unsupported numeric literal");
+    }
+    const text = this.src.slice(start, this.index);
+    const value = Number(text);
+    if (text.length === 0 || !Number.isFinite(value)) {
+      throw this.fail("unsupported numeric literal");
+    }
+    return value;
+  }
+};
+
+// packages/core/src/agents/runtime/workflow-sandbox.ts
 function findMetaBlockBounds(source) {
   const re = /^\s*export\s+const\s+meta\s*=\s*\{/;
   const match = re.exec(source);
@@ -195,7 +503,7 @@ function findMetaBlockBounds(source) {
   }
   if (depth !== 0) {
     throw new Error(
-      "stripExportMeta: unbalanced braces in export const meta declaration \u2014 the workflow script cannot be safely stripped. Check the meta block syntax."
+      "unbalanced braces in export const meta declaration \u2014 the workflow script cannot be safely stripped. Check the meta block syntax."
     );
   }
   const endBraceIncl = i - 1;
@@ -208,45 +516,86 @@ function extractAndStripMeta(source) {
   if (!bounds) return { stripped: source, meta: null };
   const metaSource = source.slice(bounds.startBrace, bounds.endBraceIncl + 1);
   const stripped = source.slice(0, bounds.exportIdx) + source.slice(bounds.afterMeta);
-  const metaContext = vm.createContext(/* @__PURE__ */ Object.create(null));
   let raw;
   try {
-    raw = new vm.Script(`(${metaSource})`).runInContext(metaContext);
+    raw = parseWorkflowMetaLiteral(metaSource);
   } catch (e) {
     const msg = e instanceof Error ? e.message : String(e);
-    throw new Error(
-      `extractAndStripMeta: failed to evaluate meta object literal: ${msg}`
-    );
+    throw new Error(`invalid meta object literal: ${msg}`);
   }
-  rejectThenablesInMeta(raw);
   const meta = validateMeta(raw);
   return { stripped, meta };
 }
 __name(extractAndStripMeta, "extractAndStripMeta");
-function rejectThenablesInMeta(value, seen = /* @__PURE__ */ new WeakSet()) {
-  if (value === null || typeof value !== "object") return;
-  if (seen.has(value)) return;
-  seen.add(value);
-  const maybeThen = value.then;
-  if (typeof maybeThen === "function") {
-    try {
-      value.catch(() => {
-      });
-    } catch {
-    }
-    throw new Error(
-      "extractAndStripMeta: meta values must not be Promises (no async / dynamic import allowed in meta literal)"
-    );
-  }
-  if (Array.isArray(value)) {
-    for (const v of value) rejectThenablesInMeta(v, seen);
-    return;
-  }
-  for (const v of Object.values(value)) {
-    rejectThenablesInMeta(v, seen);
-  }
+var WORKFLOW_SCRIPT_FILENAME = "workflow.js";
+function wrapWorkflowBody(strippedSource) {
+  return `(async () => {'use strict';
+${strippedSource}
+})()`;
 }
-__name(rejectThenablesInMeta, "rejectThenablesInMeta");
+__name(wrapWorkflowBody, "wrapWorkflowBody");
+function compileWorkflowScript(scriptSource) {
+  const { stripped, meta } = extractAndStripMeta(scriptSource);
+  const bounds = findMetaBlockBounds(scriptSource);
+  const compilable = bounds ? scriptSource.slice(0, bounds.exportIdx) + scriptSource.slice(bounds.exportIdx, bounds.afterMeta).replace(/[^\r\n\u2028\u2029]/g, " ") + scriptSource.slice(bounds.afterMeta) : stripped;
+  const script = new vm.Script(wrapWorkflowBody(compilable), {
+    filename: WORKFLOW_SCRIPT_FILENAME
+  });
+  return { script, meta };
+}
+__name(compileWorkflowScript, "compileWorkflowScript");
+var COMPILE_ERROR_LINE_WIDTH = 80;
+function describeWorkflowCompileError(error, authorLineCount) {
+  const err = error instanceof Error ? error : new Error(String(error));
+  const stack = typeof err.stack === "string" ? err.stack : "";
+  const frame = [];
+  for (const line of stack.split("\n")) {
+    if (frame.length >= 3 && /^\s+at\s/.test(line)) break;
+    frame.push(line);
+  }
+  const header = frame[0] ?? "";
+  const match = /^.*?:(\d+)$/.exec(header);
+  if (frame.length < 3 || !match) {
+    return err.message;
+  }
+  const bodyLine = Number(match[1]) - 1;
+  if (bodyLine < 1) return err.message;
+  if (bodyLine > authorLineCount) {
+    return "The script ends with unmatched or incomplete syntax. Check parentheses, brackets, braces, quotes, and template literals near the end.";
+  }
+  const rendered = clampSourceFrame(frame[1] ?? "", frame[2] ?? "");
+  const tail = frame.slice(3).filter((l) => l.trim().length > 0).join("\n");
+  return [`line ${bodyLine}`, rendered, tail].filter(Boolean).join("\n");
+}
+__name(describeWorkflowCompileError, "describeWorkflowCompileError");
+function clampSourceFrame(sourceLine, caretLine) {
+  if (sourceLine.length <= COMPILE_ERROR_LINE_WIDTH) {
+    return `${sourceLine}
+${caretLine}`;
+  }
+  const caret = /\^+/.exec(caretLine);
+  if (!caret) return "";
+  const caretCol = caret.index;
+  const start = Math.max(
+    0,
+    Math.min(
+      caretCol - Math.floor(COMPILE_ERROR_LINE_WIDTH / 2),
+      sourceLine.length - COMPILE_ERROR_LINE_WIDTH
+    )
+  );
+  const prefix = start > 0 ? "\u2026" : "";
+  const window = sourceLine.slice(start, start + COMPILE_ERROR_LINE_WIDTH);
+  const suffix = start + COMPILE_ERROR_LINE_WIDTH < sourceLine.length ? "\u2026" : "";
+  const visibleCaretStart = Math.max(caretCol, start);
+  const visibleCaretEnd = Math.min(
+    caretCol + caret[0].length,
+    start + COMPILE_ERROR_LINE_WIDTH
+  );
+  const shiftedCaret = " ".repeat(prefix.length + visibleCaretStart - start) + "^".repeat(visibleCaretEnd - visibleCaretStart);
+  return `${prefix}${window}${suffix}
+${shiftedCaret}`;
+}
+__name(clampSourceFrame, "clampSourceFrame");
 function validateMeta(value) {
   if (value === null || typeof value !== "object") {
     throw new Error("meta must be an object");
@@ -1227,8 +1576,8 @@ function createWorkflowSandbox(opts) {
   const flushUnconsumedRejections = /* @__PURE__ */ __name(async () => {
     unconsumedSettled = true;
     if (nextUnconsumedId === 1) return;
-    await new Promise((resolve) => {
-      setImmediate(resolve);
+    await new Promise((resolve2) => {
+      setImmediate(resolve2);
     });
     for (const rec of unconsumedRejections.values()) {
       const rootState = unconsumedRoots.get(rec.rootId);
@@ -1283,14 +1632,8 @@ function createWorkflowSandbox(opts) {
       let rearmWatchdogOnAbort;
       process.on("unhandledRejection", adoptionEscapeHook);
       try {
-        const { stripped, meta } = extractAndStripMeta(scriptSource);
+        const { script, meta } = compileWorkflowScript(scriptSource);
         extractedMeta = meta;
-        const wrapped = `(async () => {
-${stripped}
-})()`;
-        const script = new vm.Script(wrapped, {
-          filename: "workflow.js"
-        });
         const runOpts = {
           timeout: 3e4
         };
@@ -1341,6 +1684,12 @@ ${stripped}
 }
 __name(createWorkflowSandbox, "createWorkflowSandbox");
 
+// packages/core/src/agents/runtime/workflow-orchestrator.ts
+init_esbuild_shims();
+import { randomBytes } from "node:crypto";
+import { AsyncLocalStorage } from "node:async_hooks";
+import * as os from "node:os";
+
 // packages/core/src/agents/runtime/workflow-budget.ts
 init_esbuild_shims();
 var debugLogger2 = createDebugLogger("WORKFLOW_BUDGET");
@@ -1428,7 +1777,7 @@ var WorkflowBudgetExceededError = class extends Error {
 
 // packages/core/src/agents/runtime/workflow-stall.ts
 init_esbuild_shims();
-var DEFAULT_STALL_MS = 6e4;
+var DEFAULT_STALL_MS = 18e4;
 var MAX_STALL_ATTEMPTS = 3;
 var MAX_WORKFLOW_STALL_MS_ENV = "QWEN_CODE_WORKFLOW_STALL_SECONDS";
 function resolveStallMs(perCall, env = process.env) {
@@ -1713,14 +2062,14 @@ var WorkflowDispatchScheduler = class {
     };
   }
   run(thunk) {
-    return new Promise((resolve, reject) => {
+    return new Promise((resolve2, reject) => {
       if (this.signal?.aborted) {
         reject(abortError());
         return;
       }
       this.queue.push({
         thunk,
-        resolve,
+        resolve: resolve2,
         reject
       });
       this.pump();
@@ -1744,8 +2093,8 @@ var WorkflowDispatchScheduler = class {
   waitUntilRunning() {
     if (this.signal?.aborted) return Promise.reject(abortError());
     if (this.state === "running") return Promise.resolve();
-    return new Promise((resolve, reject) => {
-      this.gateWaiters.push({ resolve, reject });
+    return new Promise((resolve2, reject) => {
+      this.gateWaiters.push({ resolve: resolve2, reject });
     });
   }
   snapshot() {
@@ -2002,7 +2351,7 @@ function attachDispatchTranscript(config, agentId, prompt, agentName, emitter, a
 }
 __name(attachDispatchTranscript, "attachDispatchTranscript");
 async function runSingleDispatch(config, prompt, opts, attemptSignal, emitter, workflowAgentId, agentIdentity, onTokens) {
-  const { AgentHeadless, ContextState } = await import("./agent-headless-LLVKZZ4P.js");
+  const { AgentHeadless, ContextState } = await import("./agent-headless-L5T4Y4OZ.js");
   const ctx = new ContextState();
   ctx.set("task_prompt", prompt);
   debugLogger.debug(`[workflow] Dispatch ${workflowAgentId}`);
@@ -2028,7 +2377,11 @@ async function runSingleDispatch(config, prompt, opts, attemptSignal, emitter, w
       { tools: ["*"], disallowedTools: WORKFLOW_SUBAGENT_DISALLOWED_TOOLS },
       // P-stall: the stall-watchdog emitter observes reasoning-loop events
       // (round/tool/usage) to detect a hang and abort `attemptSignal`.
-      emitter
+      emitter,
+      void 0,
+      void 0,
+      prompt,
+      workflowAgentId
     );
     try {
       await runWithAgentContext(
@@ -2118,6 +2471,7 @@ ${WORKFLOW_SUBAGENT_SYSTEM_PROMPT_WITH_SCHEMA}` : WORKFLOW_SUBAGENT_SYSTEM_PROMP
   };
   let worktreeIsolation = null;
   let effectiveContext = config;
+  let approvalCleanup;
   if (opts.isolation !== void 0 && opts.workingDir !== void 0) {
     throw new Error(
       "agent({workingDir, isolation}): incompatible options. workingDir pins the agent to a worktree you already own; isolation creates a fresh one and removes it afterwards. Pass one."
@@ -2125,10 +2479,9 @@ ${WORKFLOW_SUBAGENT_SYSTEM_PROMPT_WITH_SCHEMA}` : WORKFLOW_SUBAGENT_SYSTEM_PROMP
   }
   if (opts.isolation === "worktree") {
     worktreeIsolation = await provisionWorkflowWorktree(config);
-    effectiveContext = createDirScopedConfigOverride(
-      config,
-      worktreeIsolation.path
-    );
+    effectiveContext = deriveWorktreeConfig(config, worktreeIsolation.path, {
+      customIgnoreFiles: config.getFileFilteringOptions().customIgnoreFiles
+    });
   } else if (opts.workingDir !== void 0) {
     if (typeof opts.workingDir !== "string" || opts.workingDir.trim().length === 0) {
       throw new Error(
@@ -2145,7 +2498,17 @@ ${WORKFLOW_SUBAGENT_SYSTEM_PROMPT_WITH_SCHEMA}` : WORKFLOW_SUBAGENT_SYSTEM_PROMP
         `agent({workingDir: ${sanitizeForErrorMessage(JSON.stringify(opts.workingDir))}}): ${sanitizeForErrorMessage(resolved.error)}`
       );
     }
-    effectiveContext = createDirScopedConfigOverride(config, resolved.path);
+    effectiveContext = deriveWorktreeConfig(config, resolved.path, {
+      customIgnoreFiles: config.getFileFilteringOptions().customIgnoreFiles
+    });
+  }
+  if (effectiveContext !== config) {
+    const approvalHandle = deriveApprovalModeConfig(
+      effectiveContext,
+      config.getApprovalMode()
+    );
+    approvalCleanup = approvalHandle.cleanup;
+    effectiveContext = approvalHandle.config;
   }
   let onParentAbort;
   try {
@@ -2186,7 +2549,9 @@ ${WORKFLOW_SUBAGENT_SYSTEM_PROMPT_WITH_SCHEMA}` : WORKFLOW_SUBAGENT_SYSTEM_PROMP
           max_turns: resolveSubagentMaxTurns(),
           max_time_minutes: resolveSubagentMaxTimeMinutes()
         },
-        eventEmitter
+        eventEmitter,
+        taskName: String(ctx.get("task_prompt")),
+        subagentId: workflowAgentId
       }
     );
     try {
@@ -2256,6 +2621,7 @@ ${WORKFLOW_SUBAGENT_SYSTEM_PROMPT_WITH_SCHEMA}` : WORKFLOW_SUBAGENT_SYSTEM_PROMP
     if (onParentAbort && signal) {
       signal.removeEventListener("abort", onParentAbort);
     }
+    approvalCleanup?.();
     if (worktreeIsolation) {
       try {
         await cleanupWorkflowWorktree(worktreeIsolation);
@@ -2338,26 +2704,6 @@ async function provisionWorkflowWorktree(config) {
   };
 }
 __name(provisionWorkflowWorktree, "provisionWorkflowWorktree");
-function createDirScopedConfigOverride(base, wtPath) {
-  const ov = Object.create(base);
-  ov.targetDir = wtPath;
-  ov.cwd = wtPath;
-  ov.getTargetDir = () => wtPath;
-  ov.getCwd = () => wtPath;
-  ov.getWorkingDir = () => wtPath;
-  ov.getProjectRoot = () => wtPath;
-  const wtFileService = new FileDiscoveryService(
-    wtPath,
-    base.getFileFilteringOptions().customIgnoreFiles
-  );
-  ov.fileDiscoveryService = wtFileService;
-  ov.getFileService = () => wtFileService;
-  const wtWorkspace = new WorkspaceContext(wtPath);
-  ov.workspaceContext = wtWorkspace;
-  ov.getWorkspaceContext = () => wtWorkspace;
-  return ov;
-}
-__name(createDirScopedConfigOverride, "createDirScopedConfigOverride");
 async function cleanupWorkflowWorktree(isolation) {
   const wtService = new GitWorktreeService(isolation.repoRoot);
   const [hasChanges, hasUnmerged] = await Promise.all([
@@ -2447,7 +2793,7 @@ function attachSchemaListeners(emitter, state) {
 }
 __name(attachSchemaListeners, "attachSchemaListeners");
 async function createSchemaConfigOverride(base, schema) {
-  const override = Object.create(base);
+  const override = deriveConfig(base);
   await rebuildToolRegistryOnOverride(override, base);
   const registry = override.getToolRegistry();
   registry.registerTool(new SyntheticOutputTool(schema));
@@ -2897,6 +3243,21 @@ var WorkflowRunHandle = class {
     return this.scheduler.resume();
   }
 };
+var WorkflowScriptNotLaunchedError = class extends Error {
+  constructor(detail) {
+    super(
+      `Workflow script is invalid and was not launched:
+${detail}
+
+Workflow scripts must be plain JavaScript \u2014 the usual causes are TypeScript syntax (type annotations, interfaces, generics) and broken string quoting or escaping. Metadata must use literal values.`
+    );
+    this.detail = detail;
+    this.name = "WorkflowScriptNotLaunchedError";
+  }
+  static {
+    __name(this, "WorkflowScriptNotLaunchedError");
+  }
+};
 var WorkflowRunner = class {
   static {
     __name(this, "WorkflowRunner");
@@ -2911,6 +3272,16 @@ var WorkflowRunner = class {
     ) : void 0;
     const script = loaded?.script ?? options.script ?? "";
     const scriptPath = loaded?.scriptPath ?? options.scriptPath;
+    try {
+      compileWorkflowScript(script);
+    } catch (error) {
+      throw new WorkflowScriptNotLaunchedError(
+        describeWorkflowCompileError(
+          error,
+          script.split(/\r\n|[\n\r\u2028\u2029]/).length
+        )
+      );
+    }
     const runId = options.resumeFromRunId ?? `wf_${randomBytes2(8).toString("hex")}`;
     const storage = config.storage;
     const journal = storage ? new WorkflowJournal(storage.getWorkflowRunJournalPath(runId)) : void 0;
@@ -3104,17 +3475,18 @@ function extractErrorMessage2(error) {
 __name(extractErrorMessage2, "extractErrorMessage");
 
 // packages/core/src/tools/workflow/workflow.ts
+import { promises as fs } from "node:fs";
 import * as path from "node:path";
 var WORKFLOW_PARAM_SCHEMA = {
   type: "object",
   properties: {
     script: {
       type: "string",
-      description: `JavaScript source of the workflow. Wrapped as an async IIFE. May call the injected globals \`phase(title)\`, \`log(msg)\`, \`agent(prompt, opts?)\`, and read \`args\`. agent() opts: \`{ label?, phase?, schema?, model?, agentType?, isolation?, workingDir?, stallMs? }\`. \`schema\` (JSON Schema object): the subagent must deliver its result by calling \`structured_output\` with arguments matching the schema; agent() resolves to the validated object. Two failed attempts produce a terminal error "subagent completed without calling StructuredOutput (after 2 in-conversation nudges)". \`agentType\` (string): resolves against the declarative-agents registry (\`.qwen/agents/<name>.md\`, project then user then built-in). Unresolved names throw "agent({agentType}): agent type 'X' not found". \`model\` (string): per-call model override; routes provider correctly via the subagent runtime view. \`isolation\`: \`'worktree'\` provisions a fresh git worktree under \`<projectRoot>/.qwen/worktrees/agent-<7hex>\`; the worktree is auto-removed if no changes, otherwise the path and branch are returned alongside the result. \`'remote'\` throws "agent({isolation:'remote'}) is not available in this build" (parity with upstream). isolation=worktree refuses to run when the parent working tree has uncommitted changes (the subagent would see a stale HEAD). \`workingDir\` (string): pin the subagent to an EXISTING git worktree of this repository that the caller owns \u2014 nothing is created and nothing is removed. Use it when the directory the agent must work in already exists and its uncommitted state is the point (a review worktree, a checkout a previous step provisioned) \u2014 exactly the case isolation cannot serve. Mutually exclusive with \`isolation\`. The path must be a linked worktree of this repository registered via \`git worktree add\` (it may live anywhere on disk) \u2014 the main checkout is not eligible. \`stallMs\` (number, ms): a no-progress watchdog, not a wall-clock cap. The dispatch is aborted and retried (up to ${MAX_STALL_ATTEMPTS} attempts total) after this many milliseconds with no observable subagent progress once progress has begun (a dispatch that produces no first response is bounded by the subagent time cap, not this watchdog); the timer is suspended while a tool is in flight, so a legitimately slow tool is not a stall. Default ${DEFAULT_STALL_MS} (override via \`${MAX_WORKFLOW_STALL_MS_ENV}\`, whole seconds); \`0\` disables the watchdog. Wall time per attempt is bounded separately. Workflow subagents always have SendMessage / Monitor / EnterPlanMode / ExitPlanMode in their disallowed-tool floor regardless of agentType. Concurrency: \`parallel([() => agent(...), ...])\` runs thunks through a shared per-run window (default \`max(1, min(16, cpus-2))\` agents in flight; override via \`${MAX_WORKFLOW_CONCURRENCY_ENV}\`) and resolves to a position-aligned array \u2014 a thunk that throws, or resolves to a non-JSON-serializable value, becomes \`null\` at its index (errors-as-data); parallel() itself rejects only on invalid arguments or abort. \`pipeline(items, ...stages)\` runs each item through the stages (staggered, no inter-stage barrier); a stage that throws, returns \`null\`, or returns a non-JSON-serializable value drops that item to \`null\`. Pass THUNKS to parallel, not eager calls: \`parallel([() => agent(...)])\`, not \`parallel([agent(...)])\`. At most ${DEFAULT_MAX_AGENTS_PER_RUN} agent() calls per run (override via \`${MAX_WORKFLOW_AGENTS_ENV}\`). \`Date.now()\` and \`Math.random()\` both throw \u2014 workflow scripts must be deterministic for resume. \`export const meta = {...}\` declarations are stripped before execution.`
+      description: `JavaScript source of the workflow. Wrapped as an async IIFE. May call the injected globals \`phase(title)\`, \`log(msg)\`, \`agent(prompt, opts?)\`, and read \`args\`. agent() opts: \`{ label?, phase?, schema?, model?, agentType?, isolation?, workingDir?, stallMs? }\`. \`schema\` (JSON Schema object): the subagent must deliver its result by calling \`structured_output\` with arguments matching the schema; agent() resolves to the validated object. Two failed attempts produce a terminal error "subagent completed without calling StructuredOutput (after 2 in-conversation nudges)". \`agentType\` (string): resolves against the declarative-agents registry (\`.qwen/agents/<name>.md\`, project then user then built-in). Unresolved names throw "agent({agentType}): agent type 'X' not found". \`model\` (string): per-call model override; routes provider correctly via the subagent runtime view. \`isolation\`: \`'worktree'\` provisions a fresh git worktree under \`<projectRoot>/.qwen/worktrees/agent-<7hex>\`; the worktree is auto-removed if no changes, otherwise the path and branch are returned alongside the result. \`'remote'\` throws "agent({isolation:'remote'}) is not available in this build" (parity with upstream). isolation=worktree refuses to run when the parent working tree has uncommitted changes (the subagent would see a stale HEAD). \`workingDir\` (string): pin the subagent to an EXISTING git worktree of this repository that the caller owns \u2014 nothing is created and nothing is removed. Use it when the directory the agent must work in already exists and its uncommitted state is the point (a review worktree, a checkout a previous step provisioned) \u2014 exactly the case isolation cannot serve. Mutually exclusive with \`isolation\`. The path must be a linked worktree of this repository registered via \`git worktree add\` (it may live anywhere on disk) \u2014 the main checkout is not eligible. \`stallMs\` (number, ms): a no-progress watchdog, not a wall-clock cap. The dispatch is aborted and retried (up to ${MAX_STALL_ATTEMPTS} attempts total) after this many milliseconds with no observable subagent progress \u2014 including before the first response arrives; the timer is suspended while a tool is in flight, so a legitimately slow tool is not a stall. Default ${DEFAULT_STALL_MS} (override via \`${MAX_WORKFLOW_STALL_MS_ENV}\`, whole seconds); \`0\` disables the watchdog. Wall time per attempt is bounded separately. Workflow subagents always have SendMessage / Monitor / EnterPlanMode / ExitPlanMode in their disallowed-tool floor regardless of agentType. Concurrency: \`parallel([() => agent(...), ...])\` runs thunks through a shared per-run window (default \`max(1, min(16, cpus-2))\` agents in flight; override via \`${MAX_WORKFLOW_CONCURRENCY_ENV}\`) and resolves to a position-aligned array \u2014 a thunk that throws, or resolves to a non-JSON-serializable value, becomes \`null\` at its index (errors-as-data); parallel() itself rejects only on invalid arguments or abort. \`pipeline(items, ...stages)\` runs each item through the stages (staggered, no inter-stage barrier); a stage that throws, returns \`null\`, or returns a non-JSON-serializable value drops that item to \`null\`. Pass THUNKS to parallel, not eager calls: \`parallel([() => agent(...)])\`, not \`parallel([agent(...)])\`. At most ${DEFAULT_MAX_AGENTS_PER_RUN} agent() calls per run (override via \`${MAX_WORKFLOW_AGENTS_ENV}\`). \`Date.now()\` and \`Math.random()\` both throw \u2014 workflow scripts must be deterministic for resume. \`export const meta = {...}\` declarations are stripped before execution.`
     },
     scriptPath: {
       type: "string",
-      description: "Optional. Absolute path to a saved workflow `.js` file to load and run instead of inline `script`. Primarily set by the `/<name>` saved-workflow slash command. Provide exactly ONE of `script` or `scriptPath`. The file is read at execution time, so edits to a saved workflow take effect on the next run."
+      description: "Optional. Absolute path to a workflow `.js` file to load and run instead of inline `script`. Primarily set by the `/<name>` saved-workflow slash command; a tool that generated a script for this run hands you its path the same way. The file must resolve inside a saved-workflow directory (`.qwen/workflows`, `~/.qwen/workflows`) or the generated-scripts root (`$QWEN_CODE_PROJECT_DIR/workflows/generated` \u2014 the per-project runtime dir, not the project tree) \u2014 any other path is refused. Provide exactly ONE of `script` or `scriptPath`. The file is read at execution time, so edits to a saved workflow take effect on the next run."
     },
     args: {
       description: "Optional structured value bound to the `args` global. Pass actual JSON, not a stringified value."
@@ -3147,9 +3519,29 @@ var WorkflowToolInvocation = class extends BaseToolInvocation {
   setCallId(callId) {
     this.callId = callId;
   }
+  /**
+   * Cache so the transcript header and the approval dialog cannot disagree,
+   * and so an oversized script is scanned once per invocation rather than
+   * once per surface that asks.
+   */
+  metaCache;
+  resolveMeta() {
+    if (this.metaCache === void 0) {
+      this.metaCache = this.params.script ? readMetaForConfirmation(this.params.script) : null;
+    }
+    return this.metaCache;
+  }
   getDescription() {
+    const meta = this.resolveMeta();
+    if (meta) {
+      return `Run workflow: ${sanitizeLine(meta.name)}`;
+    }
     if (this.params.scriptPath && this.params.script === void 0) {
-      return `Run saved workflow (${path.basename(this.params.scriptPath)})`;
+      const kind = isGeneratedWorkflowScriptPath(
+        this.config,
+        this.params.scriptPath
+      ) ? "generated workflow script" : "saved workflow";
+      return `Run ${kind} (${path.basename(this.params.scriptPath)})`;
     }
     return `Run a workflow script (${this.params.script?.length ?? 0} chars)`;
   }
@@ -3159,6 +3551,62 @@ var WorkflowToolInvocation = class extends BaseToolInvocation {
   getDefaultPermission() {
     return Promise.resolve("ask");
   }
+  /**
+   * Show what is about to run, and scope the grant that approves it.
+   *
+   * Without this override the base class renders `Confirm WorkflowTool` over
+   * `Run a workflow script (4127 chars)` — a character count standing in for
+   * arbitrary model-authored JavaScript that may fan out to
+   * `DEFAULT_MAX_AGENTS_PER_RUN` subagents, provision git worktrees and spend
+   * an uncapped token budget. The asymmetry is visible within one run: the
+   * subagent approvals this workflow bubbles up each get a full dialog.
+   *
+   * Two properties of the grant matter as much as the disclosure:
+   *
+   *   - An inline `script` can never be pre-approved. It is fresh
+   *     model-authored source every time, so a blanket "always allow" would
+   *     transfer consent from the script the user read to every script the
+   *     model writes afterwards. `hideAlwaysAllow` removes the option and the
+   *     empty `permissionRules` stops `injectPermissionRulesIfMissing` from
+   *     supplying the bare-tool-name rule, which `buildPermissionRules`
+   *     documents as matching *all* invocations.
+   *   - A `scriptPath` names a file on disk that the user chose, so it can be
+   *     pre-approved — but scoped to that path. The rule is built with the
+   *     same helpers the matcher uses so a tool rename moves both sides.
+   */
+  async getConfirmationDetails(_abortSignal) {
+    const meta = this.resolveMeta();
+    const isGeneratedScriptPath = this.params.scriptPath !== void 0 && await isGeneratedWorkflowScriptPathCanonical(
+      this.config,
+      this.params.scriptPath
+    );
+    const body = buildConfirmationPrompt(
+      this.params,
+      meta,
+      isGeneratedScriptPath
+    );
+    const banner = resolveUsageBanner(
+      this.config,
+      this.config.getWorkflowRunRegistry?.(),
+      resolveMaxTokensPerWorkflow()
+    );
+    const isInlineScript = this.params.script !== void 0;
+    const details = {
+      type: "info",
+      title: "Run a dynamic workflow?",
+      prompt: banner ? `${banner}${body}` : body,
+      // The body is a script excerpt and a phase list: rendering it as
+      // Markdown would swallow the very characters the reader needs to see.
+      renderPromptAsPlainText: true,
+      hideAlwaysAllow: isInlineScript,
+      permissionRules: isInlineScript ? [] : [
+        `${getRuleDisplayName(resolveToolName(ToolNames.WORKFLOW))}(scriptPath:${this.params.scriptPath})`
+      ],
+      onConfirm: /* @__PURE__ */ __name(async (_outcome, _payload) => {
+      }, "onConfirm")
+    };
+    return details;
+  }
   async execute(signal, updateOutput, _shellExecutionConfig) {
     const runInBackground = this.params.run_in_background === true;
     if (runInBackground && signal.aborted) {
@@ -3182,6 +3630,16 @@ var WorkflowToolInvocation = class extends BaseToolInvocation {
       if (runInBackground && signal.aborted) {
         return backgroundStartCancelledResult();
       }
+      if (error instanceof WorkflowScriptNotLaunchedError) {
+        return {
+          llmContent: [{ text: error.message }],
+          returnDisplay: error.message,
+          error: {
+            message: error.message,
+            type: "invalid_tool_params" /* INVALID_TOOL_PARAMS */
+          }
+        };
+      }
       throw error;
     }
     if (runInBackground) {
@@ -3293,6 +3751,106 @@ function resolveUsageBanner(config, registry, budgetTotal) {
   return buildUsageBanner(budgetTotal);
 }
 __name(resolveUsageBanner, "resolveUsageBanner");
+var CONFIRM_SCRIPT_EXCERPT_CHARS = 1200;
+var CONFIRM_ARGS_CHARS = 300;
+var CONFIRM_MAX_PHASES = 12;
+function sanitizeLine(text) {
+  return stripAnsiAndControl(text);
+}
+__name(sanitizeLine, "sanitizeLine");
+function sanitizeBlock(text) {
+  return text.replace(/\t/g, "  ").split("\n").map((line) => stripAnsiAndControl(line)).join("\n");
+}
+__name(sanitizeBlock, "sanitizeBlock");
+function clampForDisplay(text, max) {
+  if (text.length <= max) return text;
+  return `${text.slice(0, max)}
+\u2026 (${text.length - max} more characters)`;
+}
+__name(clampForDisplay, "clampForDisplay");
+function readMetaForConfirmation(script) {
+  try {
+    return extractAndStripMeta(script).meta;
+  } catch {
+    return null;
+  }
+}
+__name(readMetaForConfirmation, "readMetaForConfirmation");
+function isGeneratedWorkflowScriptPath(config, scriptPath) {
+  return isWithinRoot(scriptPath, config.storage.getGeneratedWorkflowsDir());
+}
+__name(isGeneratedWorkflowScriptPath, "isGeneratedWorkflowScriptPath");
+async function isGeneratedWorkflowScriptPathCanonical(config, scriptPath) {
+  const root = config.storage.getGeneratedWorkflowsDir();
+  if (await isSymlinkedRoot(root)) return false;
+  let realScriptPath;
+  try {
+    realScriptPath = await fs.realpath(scriptPath);
+  } catch {
+    return isWithinRoot(scriptPath, root);
+  }
+  let realRoot;
+  try {
+    realRoot = await fs.realpath(root);
+  } catch {
+    realRoot = path.resolve(root);
+  }
+  return isWithinRoot(realScriptPath, realRoot);
+}
+__name(isGeneratedWorkflowScriptPathCanonical, "isGeneratedWorkflowScriptPathCanonical");
+function buildConfirmationPrompt(params, meta, isGeneratedScriptPath) {
+  const lines = [];
+  if (meta) {
+    lines.push(`Workflow: ${sanitizeLine(meta.name)}`);
+    lines.push(sanitizeLine(meta.description));
+  } else if (params.scriptPath) {
+    const label = isGeneratedScriptPath ? "Generated workflow script" : "Saved workflow";
+    lines.push(`${label}: ${sanitizeLine(params.scriptPath)}`);
+  } else {
+    lines.push("Workflow: (the script declares no meta block)");
+  }
+  if (meta?.phases?.length) {
+    const shown = meta.phases.slice(0, CONFIRM_MAX_PHASES);
+    lines.push("", `Phases (${meta.phases.length}):`);
+    shown.forEach((phase, i) => {
+      const detail = phase.detail ? ` \u2014 ${sanitizeLine(phase.detail)}` : "";
+      lines.push(`  ${i + 1}. ${sanitizeLine(phase.title)}${detail}`);
+    });
+    if (meta.phases.length > shown.length) {
+      lines.push(`  \u2026 and ${meta.phases.length - shown.length} more`);
+    }
+  }
+  if (params.scriptPath && meta) {
+    lines.push("", `Loaded from: ${sanitizeLine(params.scriptPath)}`);
+  }
+  if (params.resumeFromRunId) {
+    lines.push("", `Resuming run: ${sanitizeLine(params.resumeFromRunId)}`);
+  }
+  if (params.args !== void 0) {
+    let rendered;
+    try {
+      rendered = JSON.stringify(params.args) ?? String(params.args);
+    } catch {
+      rendered = "(args are not JSON-serializable)";
+    }
+    lines.push(
+      "",
+      `Args: ${clampForDisplay(sanitizeLine(rendered), CONFIRM_ARGS_CHARS)}`
+    );
+  }
+  if (params.script) {
+    lines.push(
+      "",
+      "Script:",
+      clampForDisplay(
+        sanitizeBlock(params.script),
+        CONFIRM_SCRIPT_EXCERPT_CHARS
+      )
+    );
+  }
+  return lines.join("\n");
+}
+__name(buildConfirmationPrompt, "buildConfirmationPrompt");
 function buildUsageBanner(total) {
   if (total === null) {
     return `> Workflows have no per-run token cap. Set \`${MAX_TOKENS_PER_WORKFLOW_ENV}=<n>\` (env) for a soft cap. Suppress this notice with \`skipWorkflowUsageWarning: true\` in settings.
@@ -3347,13 +3905,25 @@ function safeStringifyDisplayPayload(payload) {
 __name(safeStringifyDisplayPayload, "safeStringifyDisplayPayload");
 var WORKFLOW_TOOL_DESCRIPTION = `Execute a workflow script that orchestrates subagents deterministically.
 
+**Only on an explicit request**
+
+Do not call this tool unless the user has asked for multi-agent orchestration. A run can dispatch up to ${DEFAULT_MAX_AGENTS_PER_RUN} subagents and spend tokens accordingly, so that scale has to be requested rather than inferred. It counts as requested when any of these holds:
+
+- The user's message contains the word \`workflow\`; a system reminder confirms it when it does.
+- The user asked for orchestration in their own words \u2014 run a workflow, fan out agents, orchestrate this with subagents.
+- A skill or slash command the user invoked instructs you to use this tool.
+- The user named a saved workflow to run, reached through \`workflow('<name>')\` or \`scriptPath\`.
+- The user asked to resume or continue an earlier run, which is \`resumeFromRunId\`.
+
+Otherwise do not call it, however well the task would parallelize. Do the work in the main loop, or spawn a single subagent for one self-contained piece. When a workflow would genuinely be the better tool, say in one sentence what it would fan out over and roughly how many agents that is, then let the user decide \u2014 and mention that including the word \`workflow\` next time skips the ask.
+
 **What a workflow is for**
 
 Reach for one to be comprehensive (decompose the work and cover every part in parallel), to be confident (independent perspectives and adversarial checks before an answer is committed to), or to take on scale a single context cannot hold \u2014 migrations, audits, broad sweeps. The script is where that structure is encoded: what fans out, what verifies, what synthesizes. Parallelism on its own is not a reason; work that is already one short sequence of edits belongs in the main loop.
 
 **Runtime** \u2014 see the \`script\` parameter for the detailed authoring contract.
 
-\`phase(title)\`, \`log(msg)\`, \`agent(prompt, opts?)\`, \`parallel(thunks)\`, \`pipeline(items, ...stages)\`, \`workflow(nameOrRef, args?)\`, plus the \`args\` and \`budget\` globals. \`workflow()\` runs a saved workflow inline under this run's caps and nests one level only \u2014 a workflow reached through \`workflow()\` cannot call \`workflow()\` itself, and doing so throws. Saved workflows are \`<name>.js\` files under \`<projectRoot>/.qwen/workflows\` (project scope, also surfaced as \`/<name>\` slash commands) or \`~/.qwen/workflows\` (user scope, lower precedence when both define the same name); \`workflow('<name>')\` resolves against those two directories, while \`scriptPath\` takes an absolute path to a script anywhere. Default \`max(1, min(16, cpus-2))\` agents in flight per run (\`${MAX_WORKFLOW_CONCURRENCY_ENV}\`), up to ${DEFAULT_MAX_AGENTS_PER_RUN} agents total (\`${MAX_WORKFLOW_AGENTS_ENV}\`), under a 30-minute wall-clock cap per run (\`QWEN_CODE_MAX_WORKFLOW_SECONDS\`) \u2014 a fan-out near the agent cap will not fit inside the default cap. Each subagent attempt is separately capped at ${DEFAULT_WORKFLOW_SUBAGENT_MAX_TURNS} turns (\`${WORKFLOW_SUBAGENT_MAX_TURNS_ENV}\`) and ${DEFAULT_WORKFLOW_SUBAGENT_MAX_TIME_MINUTES} minutes (\`${WORKFLOW_SUBAGENT_MAX_MINUTES_ENV}\`) \u2014 an attempt that hits either becomes \`null\` in \`parallel()\`/\`pipeline()\`, indistinguishable from a missing agent, so raise them for legitimately long work. A per-run output-token cap may also be in effect: read \`budget.total\` (\`null\` = uncapped) before committing to a large fan-out, because once the cap is reached every further \`agent()\` call is refused \u2014 a bare sequential \`await agent()\` sees the rejection, while inside \`parallel()\`/\`pipeline()\` the refused slot becomes \`null\` and the script keeps running on partial results. Per-call \`agent({ schema, agentType, model, isolation: 'worktree', workingDir, stallMs })\` covers structured-output contracts, declarative-agent selection, model override, git-worktree-isolated subagents, pinning an agent to a caller-owned worktree, and the no-progress stall watchdog (\`stallMs: 0\` disables it). \`resumeFromRunId\` resumes a prior run \u2014 agent() calls whose rolling prefix-hash matches the journal are served from cache for the longest unchanged prefix. Runs appear in the background-tasks view and the \`/workflows\` dialog (live phase tree, token usage, cooperative pause/resume, cancel); \`run_in_background: true\` returns a run handle immediately in the interactive TUI and delivers completion through the conversation. Scripts run in a node:vm sandbox with no filesystem or shell access \u2014 all I/O happens through the spawned agents.
+\`phase(title)\`, \`log(msg)\`, \`agent(prompt, opts?)\`, \`parallel(thunks)\`, \`pipeline(items, ...stages)\`, \`workflow(nameOrRef, args?)\`, plus the \`args\` and \`budget\` globals. \`workflow()\` runs a saved workflow inline under this run's caps and nests one level only \u2014 a workflow reached through \`workflow()\` cannot call \`workflow()\` itself, and doing so throws. Saved workflows are \`<name>.js\` files under \`<projectRoot>/.qwen/workflows\` (project scope, also surfaced as \`/<name>\` slash commands) or \`~/.qwen/workflows\` (user scope, lower precedence when both define the same name); \`workflow('<name>')\` resolves against those two directories, while \`scriptPath\` takes an absolute path to a script inside either of them or inside the generated-scripts root (\`$QWEN_CODE_PROJECT_DIR/workflows/generated\` \u2014 the per-project runtime dir, not the project tree \u2014 where a tool emitting a one-run script writes it; never a slash command, never resolvable by name); a path outside those roots is refused. Default \`max(1, min(16, cpus-2))\` agents in flight per run (\`${MAX_WORKFLOW_CONCURRENCY_ENV}\`), up to ${DEFAULT_MAX_AGENTS_PER_RUN} agents total (\`${MAX_WORKFLOW_AGENTS_ENV}\`), under a 30-minute wall-clock cap per run (\`QWEN_CODE_MAX_WORKFLOW_SECONDS\`) \u2014 a fan-out near the agent cap will not fit inside the default cap. Each subagent attempt is separately capped at ${DEFAULT_WORKFLOW_SUBAGENT_MAX_TURNS} turns (\`${WORKFLOW_SUBAGENT_MAX_TURNS_ENV}\`) and ${DEFAULT_WORKFLOW_SUBAGENT_MAX_TIME_MINUTES} minutes (\`${WORKFLOW_SUBAGENT_MAX_MINUTES_ENV}\`) \u2014 an attempt that hits either becomes \`null\` in \`parallel()\`/\`pipeline()\`, indistinguishable from a missing agent, so raise them for legitimately long work. A per-run output-token cap may also be in effect: read \`budget.total\` (\`null\` = uncapped) before committing to a large fan-out, because once the cap is reached every further \`agent()\` call is refused \u2014 a bare sequential \`await agent()\` sees the rejection, while inside \`parallel()\`/\`pipeline()\` the refused slot becomes \`null\` and the script keeps running on partial results. Per-call \`agent({ schema, agentType, model, isolation: 'worktree', workingDir, stallMs })\` covers structured-output contracts, declarative-agent selection, model override, git-worktree-isolated subagents, pinning an agent to a caller-owned worktree, and the no-progress stall watchdog (\`stallMs: 0\` disables it). \`resumeFromRunId\` resumes a prior run \u2014 agent() calls whose rolling prefix-hash matches the journal are served from cache for the longest unchanged prefix. Runs appear in the background-tasks view and the \`/workflows\` dialog (live phase tree, token usage, cooperative pause/resume, cancel); \`run_in_background: true\` returns a run handle immediately in the interactive TUI and delivers completion through the conversation. Scripts run in a node:vm sandbox with no filesystem or shell access \u2014 all I/O happens through the spawned agents.
 
 **Scout first, then orchestrate**
 
@@ -3403,7 +3973,7 @@ var WorkflowTool = class extends BaseDeclarativeTool {
     const hasScript = typeof params.script === "string" && params.script.length > 0;
     const hasPath = typeof params.scriptPath === "string" && params.scriptPath.length > 0;
     if (!hasScript && !hasPath) {
-      return "WorkflowTool: provide `script` (inline source) or `scriptPath` (a saved workflow file).";
+      return "WorkflowTool: provide `script` (inline source) or `scriptPath` (a workflow script file).";
     }
     if (hasScript && hasPath) {
       return "WorkflowTool: provide exactly one of `script` or `scriptPath`, not both.";
@@ -3428,6 +3998,11 @@ var WorkflowTool = class extends BaseDeclarativeTool {
 export {
   WorkflowTool
 };
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
 /**
  * @license
  * Copyright 2025 Qwen