@qwen-code/qwen-code 0.22.0 → 0.22.2-preview.0

package/chunks/{workflow-2FCMBTBZ.js → workflow-QHOIIXJO.js}

@@ -3,116 +3,118 @@
 import {
   resolveSavedWorkflowScript,
   writeWorkflowSnapshot
-} from "./chunk-5HJUPACR.js";
+} from "./chunk-LRLMDV5X.js";
 import {
   AgentEventEmitter,
   FileDiscoveryService,
   attachJsonlTranscriptWriter,
   buildAgentTranscriptAttach,
+  getRuleDisplayName,
   isTerminalWorkflowStatus,
   rebuildToolRegistryOnOverride,
   resolveExternalWorktreeDir,
+  resolveToolName,
   toModelVisibleSubagentResult
-} from "./chunk-T6XLJRQY.js";
+} from "./chunk-D6XO27Z5.js";
 import "./chunk-GOFAQQZA.js";
+import "./chunk-5M6IDOMF.js";
 import "./chunk-TWPJO254.js";
 import "./chunk-CQ35AJ4Z.js";
-import "./chunk-5M6IDOMF.js";
-import "./chunk-KVGR4MCF.js";
-import "./chunk-XZJKSETB.js";
-import "./chunk-YMVFIYHV.js";
+import "./chunk-3UZCLCXR.js";
+import "./chunk-TOF4UZHH.js";
+import "./chunk-O3BUXIPM.js";
+import "./chunk-ZLTEQYNC.js";
 import {
   parsePositiveIntegerEnv
 } from "./chunk-6PVPNMXU.js";
-import "./chunk-7DYNJFES.js";
-import "./chunk-DJEHYM4H.js";
+import "./chunk-AYVIGUUK.js";
 import "./chunk-IRH27ZC2.js";
 import "./chunk-QHWCP53L.js";
-import "./chunk-AZF6SME3.js";
+import "./chunk-JECO75XD.js";
 import "./chunk-O6GEWCJA.js";
 import "./chunk-T26EAKDL.js";
 import {
   GitWorktreeService,
   generateAgentWorktreeSlug,
   writeWorktreeSessionMarker
-} from "./chunk-GIWB5QLV.js";
+} from "./chunk-LJP2BBMK.js";
 import "./chunk-CPBF7KYF.js";
-import "./chunk-VUMLT7E5.js";
-import "./chunk-ISJMN3ML.js";
-import "./chunk-XLDFW44M.js";
-import "./chunk-Q54XG7IX.js";
-import "./chunk-FEMQ6Y7W.js";
-import "./chunk-2TRNCJK4.js";
-import "./chunk-NUGZAFR2.js";
-import "./chunk-LDGWX737.js";
+import "./chunk-5Y2JCJAH.js";
+import "./chunk-T2CRBIDJ.js";
+import "./chunk-77TOMRBG.js";
+import "./chunk-DEYPMJPD.js";
+import "./chunk-T6OODF2U.js";
+import "./chunk-27ONXAFY.js";
+import "./chunk-ZEADBZLO.js";
+import "./chunk-FN5C6C7G.js";
 import {
   SUBAGENT_PLAN_LIFECYCLE_TOOLS
-} from "./chunk-VLRBJ24J.js";
+} from "./chunk-BVE5EMIG.js";
 import "./chunk-MLXTMF7H.js";
 import "./chunk-NAVJD2PQ.js";
-import "./chunk-WRT324N6.js";
-import "./chunk-YDJRMQU4.js";
-import "./chunk-SJ4HB27T.js";
+import "./chunk-FVDQ5E67.js";
+import "./chunk-V3GINY6K.js";
+import "./chunk-QHMLYMMS.js";
+import "./chunk-SDVF6A42.js";
 import "./chunk-P3QQPMQA.js";
-import "./chunk-2UZJWSVD.js";
+import "./chunk-ILPXSKGQ.js";
 import "./chunk-SAH4BD2J.js";
-import "./chunk-VSNPOSDN.js";
+import "./chunk-ZKAZP2ZG.js";
 import {
   runWithAgentContext
-} from "./chunk-I432KXWD.js";
+} from "./chunk-DP7LABIB.js";
 import "./chunk-S6LOFUVP.js";
-import "./chunk-7IV52LTO.js";
-import "./chunk-AXMWHKXA.js";
+import "./chunk-2LD5U7Q3.js";
 import {
   createAbortController,
   createChildAbortController
 } from "./chunk-DJ2GSRLV.js";
-import "./chunk-2J3OJGTL.js";
-import "./chunk-LI4YHTQK.js";
-import "./chunk-QKBYFU2Q.js";
-import "./chunk-C72BXMJ5.js";
+import "./chunk-I6VVOZDK.js";
+import "./chunk-K2OJUPOE.js";
+import "./chunk-CFKIH3D3.js";
+import "./chunk-EB4VDXNI.js";
+import "./chunk-FJWICLG7.js";
 import {
   WorkflowRunEvent,
   logWorkflowRun,
   read,
   writeLine
-} from "./chunk-FDD2IUEL.js";
+} from "./chunk-UX3IFLJM.js";
 import "./chunk-YRLW2MSX.js";
 import "./chunk-VGC4I5JJ.js";
-import "./chunk-IWOWEENB.js";
-import "./chunk-HIK2OF33.js";
-import "./chunk-ZRYQMWEP.js";
-import "./chunk-2E3V7G6Y.js";
-import "./chunk-F6WFNA7U.js";
+import "./chunk-WBT3STGU.js";
+import "./chunk-PVBT5QPD.js";
+import "./chunk-IPQA4SR5.js";
 import "./chunk-WZAD4ZNJ.js";
 import "./chunk-FPGTNKCP.js";
-import "./chunk-YHC2EYYG.js";
-import "./chunk-PZRUV52H.js";
-import "./chunk-JGUBDRBC.js";
-import "./chunk-HDKCKCYO.js";
+import "./chunk-SLEWBQWM.js";
+import "./chunk-4X5GYZFO.js";
+import "./chunk-XZA32HII.js";
+import "./chunk-7QGEJI7M.js";
+import "./chunk-GTUKW3I6.js";
 import "./chunk-HHJLM3WQ.js";
 import {
   stripAnsiAndControl
-} from "./chunk-GAHYKJPV.js";
+} from "./chunk-6US7BF3G.js";
 import "./chunk-74TONY4F.js";
 import {
   SyntheticOutputTool
-} from "./chunk-XL5K4SVK.js";
-import "./chunk-WZDM44SB.js";
-import "./chunk-K623ENWT.js";
+} from "./chunk-VL4YX3FH.js";
+import "./chunk-JUIJ3FXC.js";
+import "./chunk-E6FGMDFQ.js";
 import "./chunk-AQ37AY7B.js";
 import {
   WorkspaceContext
-} from "./chunk-K52PZNU4.js";
+} from "./chunk-RRKNX553.js";
 import {
   BaseDeclarativeTool,
   BaseToolInvocation,
   ToolDisplayNames,
   ToolNames
-} from "./chunk-6NFAEG54.js";
+} from "./chunk-KOJ6MHD5.js";
 import {
   createDebugLogger
-} from "./chunk-A5F2YNO6.js";
+} from "./chunk-2NNTE2ED.js";
 import "./chunk-75DOP5OR.js";
 import "./chunk-DMTGGOSA.js";
 import "./chunk-YQ3U5MUC.js";
@@ -128,15 +130,320 @@ import {
 // packages/core/src/tools/workflow/workflow.ts
 init_esbuild_shims();
 
-// packages/core/src/agents/runtime/workflow-orchestrator.ts
-init_esbuild_shims();
-import { randomBytes } from "node:crypto";
-import { AsyncLocalStorage } from "node:async_hooks";
-import * as os from "node:os";
-
 // packages/core/src/agents/runtime/workflow-sandbox.ts
 init_esbuild_shims();
 import * as vm from "node:vm";
+
+// packages/core/src/agents/runtime/workflow-meta-literal.ts
+init_esbuild_shims();
+var WorkflowMetaSyntaxError = class extends Error {
+  static {
+    __name(this, "WorkflowMetaSyntaxError");
+  }
+  index;
+  constructor(message, index) {
+    super(message);
+    this.name = "WorkflowMetaSyntaxError";
+    this.index = index;
+  }
+};
+function parseWorkflowMetaLiteral(source) {
+  const parser = new MetaLiteralParser(source);
+  parser.skipTrivia();
+  const value = parser.parseValue(0);
+  parser.skipTrivia();
+  if (parser.index < source.length) {
+    throw parser.fail("unexpected trailing content");
+  }
+  return value;
+}
+__name(parseWorkflowMetaLiteral, "parseWorkflowMetaLiteral");
+var MAX_DEPTH = 32;
+var WHITESPACE = /* @__PURE__ */ new Set([" ", "	", "\n", "\r", "\f", "\v", "\xA0", "\uFEFF"]);
+var ID_START = /[A-Za-z_$]/;
+var ID_PART = /[A-Za-z0-9_$]/;
+var MetaLiteralParser = class {
+  constructor(src) {
+    this.src = src;
+  }
+  static {
+    __name(this, "MetaLiteralParser");
+  }
+  index = 0;
+  fail(message) {
+    const from = Math.max(0, this.index - 24);
+    const snippet = this.src.slice(from, this.index + 24).replace(/\s+/g, " ").trim();
+    return new WorkflowMetaSyntaxError(
+      `${message} at position ${this.index} (near "${snippet}"). meta must be a plain object literal \u2014 strings, numbers, booleans, null, arrays and objects only, with no variables, function calls, spreads, accessors or template substitutions.`,
+      this.index
+    );
+  }
+  skipTrivia() {
+    for (; ; ) {
+      while (this.index < this.src.length && WHITESPACE.has(this.src[this.index])) {
+        this.index++;
+      }
+      if (this.src.startsWith("//", this.index)) {
+        let end = this.index + 2;
+        while (end < this.src.length && !"\n\r\u2028\u2029".includes(this.src[end])) {
+          end++;
+        }
+        if (this.src[end] === "\r" && this.src[end + 1] === "\n") end++;
+        this.index = end < this.src.length ? end + 1 : this.src.length;
+        continue;
+      }
+      if (this.src.startsWith("/*", this.index)) {
+        const end = this.src.indexOf("*/", this.index + 2);
+        if (end === -1) throw this.fail("unterminated comment");
+        this.index = end + 2;
+        continue;
+      }
+      return;
+    }
+  }
+  parseValue(depth) {
+    if (depth > MAX_DEPTH) throw this.fail("meta literal is nested too deeply");
+    this.skipTrivia();
+    const c = this.src[this.index];
+    if (c === void 0) throw this.fail("unexpected end of meta literal");
+    if (c === "{") return this.parseObject(depth);
+    if (c === "[") return this.parseArray(depth);
+    if (c === '"' || c === "'" || c === "`") return this.parseString();
+    if (c === "-" || c >= "0" && c <= "9") return this.parseNumber();
+    if (this.src.startsWith("true", this.index)) return this.word("true", true);
+    if (this.src.startsWith("false", this.index)) {
+      return this.word("false", false);
+    }
+    if (this.src.startsWith("null", this.index)) return this.word("null", null);
+    if (c === "/")
+      throw this.fail("regular expressions are not allowed in meta");
+    throw this.fail("unsupported value");
+  }
+  word(literal, value) {
+    const after = this.src[this.index + literal.length];
+    if (after !== void 0 && ID_PART.test(after)) {
+      throw this.fail("unsupported value");
+    }
+    this.index += literal.length;
+    return value;
+  }
+  parseObject(depth) {
+    this.index++;
+    const out = /* @__PURE__ */ Object.create(null);
+    for (; ; ) {
+      this.skipTrivia();
+      const c = this.src[this.index];
+      if (c === "}") {
+        this.index++;
+        return out;
+      }
+      if (c === void 0) throw this.fail("unterminated object");
+      if (this.src.startsWith("...", this.index)) {
+        throw this.fail("spread is not allowed in meta");
+      }
+      if (c === "[") throw this.fail("computed keys are not allowed in meta");
+      const key = this.parseKey();
+      this.skipTrivia();
+      if (this.src[this.index] === "(") {
+        throw this.fail("methods are not allowed in meta");
+      }
+      if (this.src[this.index] !== ":")
+        throw this.fail('expected ":" after key');
+      this.index++;
+      out[key] = this.parseValue(depth + 1);
+      this.skipTrivia();
+      if (this.src[this.index] === ",") {
+        this.index++;
+        continue;
+      }
+      if (this.src[this.index] === "}") {
+        this.index++;
+        return out;
+      }
+      throw this.fail('expected "," or "}"');
+    }
+  }
+  parseKey() {
+    const c = this.src[this.index];
+    if (c === '"' || c === "'" || c === "`") return this.parseString();
+    if (c !== void 0 && ID_START.test(c)) {
+      const start = this.index;
+      while (this.index < this.src.length && ID_PART.test(this.src[this.index])) {
+        this.index++;
+      }
+      const word = this.src.slice(start, this.index);
+      if (word === "get" || word === "set" || word === "async") {
+        const save = this.index;
+        this.skipTrivia();
+        const next = this.src[this.index];
+        const startsPropertyName = next !== void 0 && (ID_START.test(next) || next === '"' || next === "'" || next === "[");
+        this.index = save;
+        if (startsPropertyName) {
+          throw this.fail(
+            word === "async" ? "async members are not allowed in meta" : `${word}ters are not allowed in meta`
+          );
+        }
+      }
+      return word;
+    }
+    throw this.fail("expected a property name");
+  }
+  parseArray(depth) {
+    this.index++;
+    const out = [];
+    for (; ; ) {
+      this.skipTrivia();
+      const c = this.src[this.index];
+      if (c === "]") {
+        this.index++;
+        return out;
+      }
+      if (c === void 0) throw this.fail("unterminated array");
+      if (this.src.startsWith("...", this.index)) {
+        throw this.fail("spread is not allowed in meta");
+      }
+      if (c === ",") throw this.fail("missing array element");
+      out.push(this.parseValue(depth + 1));
+      this.skipTrivia();
+      if (this.src[this.index] === ",") {
+        this.index++;
+        continue;
+      }
+      if (this.src[this.index] === "]") {
+        this.index++;
+        return out;
+      }
+      throw this.fail('expected "," or "]"');
+    }
+  }
+  parseString() {
+    const quote = this.src[this.index++];
+    let out = "";
+    for (; ; ) {
+      const c = this.src[this.index];
+      if (c === void 0) throw this.fail("unterminated string");
+      if (c === quote) {
+        this.index++;
+        return out;
+      }
+      if (c === "\n" || c === "\r") {
+        if (quote !== "`") throw this.fail("unterminated string");
+        if (c === "\r") {
+          this.index++;
+          if (this.src[this.index] === "\n") this.index++;
+          out += "\n";
+          continue;
+        }
+      }
+      if (quote === "`" && c === "$" && this.src[this.index + 1] === "{") {
+        throw this.fail("template substitutions are not allowed in meta");
+      }
+      if (c === "\\") {
+        out += this.parseEscape();
+        continue;
+      }
+      out += c;
+      this.index++;
+    }
+  }
+  parseEscape() {
+    this.index++;
+    const c = this.src[this.index++];
+    switch (c) {
+      case "n":
+        return "\n";
+      case "t":
+        return "	";
+      case "r":
+        return "\r";
+      case "b":
+        return "\b";
+      case "f":
+        return "\f";
+      case "v":
+        return "\v";
+      case "0":
+        if (/[0-9]/.test(this.src[this.index] ?? "")) {
+          throw this.fail("octal escapes are not allowed in meta");
+        }
+        return "\0";
+      case "x": {
+        const hex = this.src.slice(this.index, this.index + 2);
+        if (!/^[0-9a-fA-F]{2}$/.test(hex)) {
+          throw this.fail("invalid \\x escape");
+        }
+        this.index += 2;
+        return String.fromCharCode(parseInt(hex, 16));
+      }
+      case "u": {
+        if (this.src[this.index] === "{") {
+          const end = this.src.indexOf("}", this.index);
+          const hex2 = end === -1 ? "" : this.src.slice(this.index + 1, end);
+          if (!/^[0-9a-fA-F]{1,6}$/.test(hex2)) {
+            throw this.fail("invalid \\u{...} escape");
+          }
+          const code = parseInt(hex2, 16);
+          if (code > 1114111) throw this.fail("invalid \\u{...} escape");
+          this.index = end + 1;
+          return String.fromCodePoint(code);
+        }
+        const hex = this.src.slice(this.index, this.index + 4);
+        if (!/^[0-9a-fA-F]{4}$/.test(hex)) {
+          throw this.fail("invalid \\u escape");
+        }
+        this.index += 4;
+        return String.fromCharCode(parseInt(hex, 16));
+      }
+      case "\n":
+        return "";
+      // line continuation
+      case "\r":
+        if (this.src[this.index] === "\n") this.index++;
+        return "";
+      case "\u2028":
+      case "\u2029":
+        return "";
+      case void 0:
+        throw this.fail("unterminated escape sequence");
+      default:
+        return c;
+    }
+  }
+  parseNumber() {
+    const start = this.index;
+    if (this.src[this.index] === "-") this.index++;
+    while (this.index < this.src.length && /[0-9]/.test(this.src[this.index])) {
+      this.index++;
+    }
+    if (this.src[this.index] === ".") {
+      this.index++;
+      while (this.index < this.src.length && /[0-9]/.test(this.src[this.index])) {
+        this.index++;
+      }
+    }
+    if (this.src[this.index] === "e" || this.src[this.index] === "E") {
+      this.index++;
+      if (this.src[this.index] === "+" || this.src[this.index] === "-") {
+        this.index++;
+      }
+      while (this.index < this.src.length && /[0-9]/.test(this.src[this.index])) {
+        this.index++;
+      }
+    }
+    const after = this.src[this.index];
+    if (after !== void 0 && ID_PART.test(after)) {
+      throw this.fail("unsupported numeric literal");
+    }
+    const text = this.src.slice(start, this.index);
+    const value = Number(text);
+    if (text.length === 0 || !Number.isFinite(value)) {
+      throw this.fail("unsupported numeric literal");
+    }
+    return value;
+  }
+};
+
+// packages/core/src/agents/runtime/workflow-sandbox.ts
 function findMetaBlockBounds(source) {
   const re = /^\s*export\s+const\s+meta\s*=\s*\{/;
   const match = re.exec(source);
@@ -195,7 +502,7 @@ function findMetaBlockBounds(source) {
   }
   if (depth !== 0) {
     throw new Error(
-      "stripExportMeta: unbalanced braces in export const meta declaration \u2014 the workflow script cannot be safely stripped. Check the meta block syntax."
+      "unbalanced braces in export const meta declaration \u2014 the workflow script cannot be safely stripped. Check the meta block syntax."
     );
   }
   const endBraceIncl = i - 1;
@@ -208,45 +515,86 @@ function extractAndStripMeta(source) {
   if (!bounds) return { stripped: source, meta: null };
   const metaSource = source.slice(bounds.startBrace, bounds.endBraceIncl + 1);
   const stripped = source.slice(0, bounds.exportIdx) + source.slice(bounds.afterMeta);
-  const metaContext = vm.createContext(/* @__PURE__ */ Object.create(null));
   let raw;
   try {
-    raw = new vm.Script(`(${metaSource})`).runInContext(metaContext);
+    raw = parseWorkflowMetaLiteral(metaSource);
   } catch (e) {
     const msg = e instanceof Error ? e.message : String(e);
-    throw new Error(
-      `extractAndStripMeta: failed to evaluate meta object literal: ${msg}`
-    );
+    throw new Error(`invalid meta object literal: ${msg}`);
   }
-  rejectThenablesInMeta(raw);
   const meta = validateMeta(raw);
   return { stripped, meta };
 }
 __name(extractAndStripMeta, "extractAndStripMeta");
-function rejectThenablesInMeta(value, seen = /* @__PURE__ */ new WeakSet()) {
-  if (value === null || typeof value !== "object") return;
-  if (seen.has(value)) return;
-  seen.add(value);
-  const maybeThen = value.then;
-  if (typeof maybeThen === "function") {
-    try {
-      value.catch(() => {
-      });
-    } catch {
-    }
-    throw new Error(
-      "extractAndStripMeta: meta values must not be Promises (no async / dynamic import allowed in meta literal)"
-    );
-  }
-  if (Array.isArray(value)) {
-    for (const v of value) rejectThenablesInMeta(v, seen);
-    return;
-  }
-  for (const v of Object.values(value)) {
-    rejectThenablesInMeta(v, seen);
-  }
+var WORKFLOW_SCRIPT_FILENAME = "workflow.js";
+function wrapWorkflowBody(strippedSource) {
+  return `(async () => {'use strict';
+${strippedSource}
+})()`;
+}
+__name(wrapWorkflowBody, "wrapWorkflowBody");
+function compileWorkflowScript(scriptSource) {
+  const { stripped, meta } = extractAndStripMeta(scriptSource);
+  const bounds = findMetaBlockBounds(scriptSource);
+  const compilable = bounds ? scriptSource.slice(0, bounds.exportIdx) + scriptSource.slice(bounds.exportIdx, bounds.afterMeta).replace(/[^\r\n\u2028\u2029]/g, " ") + scriptSource.slice(bounds.afterMeta) : stripped;
+  const script = new vm.Script(wrapWorkflowBody(compilable), {
+    filename: WORKFLOW_SCRIPT_FILENAME
+  });
+  return { script, meta };
 }
-__name(rejectThenablesInMeta, "rejectThenablesInMeta");
+__name(compileWorkflowScript, "compileWorkflowScript");
+var COMPILE_ERROR_LINE_WIDTH = 80;
+function describeWorkflowCompileError(error, authorLineCount) {
+  const err = error instanceof Error ? error : new Error(String(error));
+  const stack = typeof err.stack === "string" ? err.stack : "";
+  const frame = [];
+  for (const line of stack.split("\n")) {
+    if (frame.length >= 3 && /^\s+at\s/.test(line)) break;
+    frame.push(line);
+  }
+  const header = frame[0] ?? "";
+  const match = /^.*?:(\d+)$/.exec(header);
+  if (frame.length < 3 || !match) {
+    return err.message;
+  }
+  const bodyLine = Number(match[1]) - 1;
+  if (bodyLine < 1) return err.message;
+  if (bodyLine > authorLineCount) {
+    return "The script ends with unmatched or incomplete syntax. Check parentheses, brackets, braces, quotes, and template literals near the end.";
+  }
+  const rendered = clampSourceFrame(frame[1] ?? "", frame[2] ?? "");
+  const tail = frame.slice(3).filter((l) => l.trim().length > 0).join("\n");
+  return [`line ${bodyLine}`, rendered, tail].filter(Boolean).join("\n");
+}
+__name(describeWorkflowCompileError, "describeWorkflowCompileError");
+function clampSourceFrame(sourceLine, caretLine) {
+  if (sourceLine.length <= COMPILE_ERROR_LINE_WIDTH) {
+    return `${sourceLine}
+${caretLine}`;
+  }
+  const caret = /\^+/.exec(caretLine);
+  if (!caret) return "";
+  const caretCol = caret.index;
+  const start = Math.max(
+    0,
+    Math.min(
+      caretCol - Math.floor(COMPILE_ERROR_LINE_WIDTH / 2),
+      sourceLine.length - COMPILE_ERROR_LINE_WIDTH
+    )
+  );
+  const prefix = start > 0 ? "\u2026" : "";
+  const window = sourceLine.slice(start, start + COMPILE_ERROR_LINE_WIDTH);
+  const suffix = start + COMPILE_ERROR_LINE_WIDTH < sourceLine.length ? "\u2026" : "";
+  const visibleCaretStart = Math.max(caretCol, start);
+  const visibleCaretEnd = Math.min(
+    caretCol + caret[0].length,
+    start + COMPILE_ERROR_LINE_WIDTH
+  );
+  const shiftedCaret = " ".repeat(prefix.length + visibleCaretStart - start) + "^".repeat(visibleCaretEnd - visibleCaretStart);
+  return `${prefix}${window}${suffix}
+${shiftedCaret}`;
+}
+__name(clampSourceFrame, "clampSourceFrame");
 function validateMeta(value) {
   if (value === null || typeof value !== "object") {
     throw new Error("meta must be an object");
@@ -1283,14 +1631,8 @@ function createWorkflowSandbox(opts) {
       let rearmWatchdogOnAbort;
       process.on("unhandledRejection", adoptionEscapeHook);
       try {
-        const { stripped, meta } = extractAndStripMeta(scriptSource);
+        const { script, meta } = compileWorkflowScript(scriptSource);
         extractedMeta = meta;
-        const wrapped = `(async () => {
-${stripped}
-})()`;
-        const script = new vm.Script(wrapped, {
-          filename: "workflow.js"
-        });
         const runOpts = {
           timeout: 3e4
         };
@@ -1341,6 +1683,12 @@ ${stripped}
 }
 __name(createWorkflowSandbox, "createWorkflowSandbox");
 
+// packages/core/src/agents/runtime/workflow-orchestrator.ts
+init_esbuild_shims();
+import { randomBytes } from "node:crypto";
+import { AsyncLocalStorage } from "node:async_hooks";
+import * as os from "node:os";
+
 // packages/core/src/agents/runtime/workflow-budget.ts
 init_esbuild_shims();
 var debugLogger2 = createDebugLogger("WORKFLOW_BUDGET");
@@ -1428,7 +1776,7 @@ var WorkflowBudgetExceededError = class extends Error {
 
 // packages/core/src/agents/runtime/workflow-stall.ts
 init_esbuild_shims();
-var DEFAULT_STALL_MS = 6e4;
+var DEFAULT_STALL_MS = 18e4;
 var MAX_STALL_ATTEMPTS = 3;
 var MAX_WORKFLOW_STALL_MS_ENV = "QWEN_CODE_WORKFLOW_STALL_SECONDS";
 function resolveStallMs(perCall, env = process.env) {
@@ -2002,7 +2350,7 @@ function attachDispatchTranscript(config, agentId, prompt, agentName, emitter, a
 }
 __name(attachDispatchTranscript, "attachDispatchTranscript");
 async function runSingleDispatch(config, prompt, opts, attemptSignal, emitter, workflowAgentId, agentIdentity, onTokens) {
-  const { AgentHeadless, ContextState } = await import("./agent-headless-LLVKZZ4P.js");
+  const { AgentHeadless, ContextState } = await import("./agent-headless-3ZC4LX3E.js");
   const ctx = new ContextState();
   ctx.set("task_prompt", prompt);
   debugLogger.debug(`[workflow] Dispatch ${workflowAgentId}`);
@@ -2897,6 +3245,21 @@ var WorkflowRunHandle = class {
     return this.scheduler.resume();
   }
 };
+var WorkflowScriptNotLaunchedError = class extends Error {
+  constructor(detail) {
+    super(
+      `Workflow script is invalid and was not launched:
+${detail}
+
+Workflow scripts must be plain JavaScript \u2014 the usual causes are TypeScript syntax (type annotations, interfaces, generics) and broken string quoting or escaping. Metadata must use literal values.`
+    );
+    this.detail = detail;
+    this.name = "WorkflowScriptNotLaunchedError";
+  }
+  static {
+    __name(this, "WorkflowScriptNotLaunchedError");
+  }
+};
 var WorkflowRunner = class {
   static {
     __name(this, "WorkflowRunner");
@@ -2911,6 +3274,16 @@ var WorkflowRunner = class {
     ) : void 0;
     const script = loaded?.script ?? options.script ?? "";
     const scriptPath = loaded?.scriptPath ?? options.scriptPath;
+    try {
+      compileWorkflowScript(script);
+    } catch (error) {
+      throw new WorkflowScriptNotLaunchedError(
+        describeWorkflowCompileError(
+          error,
+          script.split(/\r\n|[\n\r\u2028\u2029]/).length
+        )
+      );
+    }
     const runId = options.resumeFromRunId ?? `wf_${randomBytes2(8).toString("hex")}`;
     const storage = config.storage;
     const journal = storage ? new WorkflowJournal(storage.getWorkflowRunJournalPath(runId)) : void 0;
@@ -3110,7 +3483,7 @@ var WORKFLOW_PARAM_SCHEMA = {
   properties: {
     script: {
       type: "string",
-      description: `JavaScript source of the workflow. Wrapped as an async IIFE. May call the injected globals \`phase(title)\`, \`log(msg)\`, \`agent(prompt, opts?)\`, and read \`args\`. agent() opts: \`{ label?, phase?, schema?, model?, agentType?, isolation?, workingDir?, stallMs? }\`. \`schema\` (JSON Schema object): the subagent must deliver its result by calling \`structured_output\` with arguments matching the schema; agent() resolves to the validated object. Two failed attempts produce a terminal error "subagent completed without calling StructuredOutput (after 2 in-conversation nudges)". \`agentType\` (string): resolves against the declarative-agents registry (\`.qwen/agents/<name>.md\`, project then user then built-in). Unresolved names throw "agent({agentType}): agent type 'X' not found". \`model\` (string): per-call model override; routes provider correctly via the subagent runtime view. \`isolation\`: \`'worktree'\` provisions a fresh git worktree under \`<projectRoot>/.qwen/worktrees/agent-<7hex>\`; the worktree is auto-removed if no changes, otherwise the path and branch are returned alongside the result. \`'remote'\` throws "agent({isolation:'remote'}) is not available in this build" (parity with upstream). isolation=worktree refuses to run when the parent working tree has uncommitted changes (the subagent would see a stale HEAD). \`workingDir\` (string): pin the subagent to an EXISTING git worktree of this repository that the caller owns \u2014 nothing is created and nothing is removed. Use it when the directory the agent must work in already exists and its uncommitted state is the point (a review worktree, a checkout a previous step provisioned) \u2014 exactly the case isolation cannot serve. Mutually exclusive with \`isolation\`. The path must be a linked worktree of this repository registered via \`git worktree add\` (it may live anywhere on disk) \u2014 the main checkout is not eligible. \`stallMs\` (number, ms): a no-progress watchdog, not a wall-clock cap. The dispatch is aborted and retried (up to ${MAX_STALL_ATTEMPTS} attempts total) after this many milliseconds with no observable subagent progress once progress has begun (a dispatch that produces no first response is bounded by the subagent time cap, not this watchdog); the timer is suspended while a tool is in flight, so a legitimately slow tool is not a stall. Default ${DEFAULT_STALL_MS} (override via \`${MAX_WORKFLOW_STALL_MS_ENV}\`, whole seconds); \`0\` disables the watchdog. Wall time per attempt is bounded separately. Workflow subagents always have SendMessage / Monitor / EnterPlanMode / ExitPlanMode in their disallowed-tool floor regardless of agentType. Concurrency: \`parallel([() => agent(...), ...])\` runs thunks through a shared per-run window (default \`max(1, min(16, cpus-2))\` agents in flight; override via \`${MAX_WORKFLOW_CONCURRENCY_ENV}\`) and resolves to a position-aligned array \u2014 a thunk that throws, or resolves to a non-JSON-serializable value, becomes \`null\` at its index (errors-as-data); parallel() itself rejects only on invalid arguments or abort. \`pipeline(items, ...stages)\` runs each item through the stages (staggered, no inter-stage barrier); a stage that throws, returns \`null\`, or returns a non-JSON-serializable value drops that item to \`null\`. Pass THUNKS to parallel, not eager calls: \`parallel([() => agent(...)])\`, not \`parallel([agent(...)])\`. At most ${DEFAULT_MAX_AGENTS_PER_RUN} agent() calls per run (override via \`${MAX_WORKFLOW_AGENTS_ENV}\`). \`Date.now()\` and \`Math.random()\` both throw \u2014 workflow scripts must be deterministic for resume. \`export const meta = {...}\` declarations are stripped before execution.`
+      description: `JavaScript source of the workflow. Wrapped as an async IIFE. May call the injected globals \`phase(title)\`, \`log(msg)\`, \`agent(prompt, opts?)\`, and read \`args\`. agent() opts: \`{ label?, phase?, schema?, model?, agentType?, isolation?, workingDir?, stallMs? }\`. \`schema\` (JSON Schema object): the subagent must deliver its result by calling \`structured_output\` with arguments matching the schema; agent() resolves to the validated object. Two failed attempts produce a terminal error "subagent completed without calling StructuredOutput (after 2 in-conversation nudges)". \`agentType\` (string): resolves against the declarative-agents registry (\`.qwen/agents/<name>.md\`, project then user then built-in). Unresolved names throw "agent({agentType}): agent type 'X' not found". \`model\` (string): per-call model override; routes provider correctly via the subagent runtime view. \`isolation\`: \`'worktree'\` provisions a fresh git worktree under \`<projectRoot>/.qwen/worktrees/agent-<7hex>\`; the worktree is auto-removed if no changes, otherwise the path and branch are returned alongside the result. \`'remote'\` throws "agent({isolation:'remote'}) is not available in this build" (parity with upstream). isolation=worktree refuses to run when the parent working tree has uncommitted changes (the subagent would see a stale HEAD). \`workingDir\` (string): pin the subagent to an EXISTING git worktree of this repository that the caller owns \u2014 nothing is created and nothing is removed. Use it when the directory the agent must work in already exists and its uncommitted state is the point (a review worktree, a checkout a previous step provisioned) \u2014 exactly the case isolation cannot serve. Mutually exclusive with \`isolation\`. The path must be a linked worktree of this repository registered via \`git worktree add\` (it may live anywhere on disk) \u2014 the main checkout is not eligible. \`stallMs\` (number, ms): a no-progress watchdog, not a wall-clock cap. The dispatch is aborted and retried (up to ${MAX_STALL_ATTEMPTS} attempts total) after this many milliseconds with no observable subagent progress \u2014 including before the first response arrives; the timer is suspended while a tool is in flight, so a legitimately slow tool is not a stall. Default ${DEFAULT_STALL_MS} (override via \`${MAX_WORKFLOW_STALL_MS_ENV}\`, whole seconds); \`0\` disables the watchdog. Wall time per attempt is bounded separately. Workflow subagents always have SendMessage / Monitor / EnterPlanMode / ExitPlanMode in their disallowed-tool floor regardless of agentType. Concurrency: \`parallel([() => agent(...), ...])\` runs thunks through a shared per-run window (default \`max(1, min(16, cpus-2))\` agents in flight; override via \`${MAX_WORKFLOW_CONCURRENCY_ENV}\`) and resolves to a position-aligned array \u2014 a thunk that throws, or resolves to a non-JSON-serializable value, becomes \`null\` at its index (errors-as-data); parallel() itself rejects only on invalid arguments or abort. \`pipeline(items, ...stages)\` runs each item through the stages (staggered, no inter-stage barrier); a stage that throws, returns \`null\`, or returns a non-JSON-serializable value drops that item to \`null\`. Pass THUNKS to parallel, not eager calls: \`parallel([() => agent(...)])\`, not \`parallel([agent(...)])\`. At most ${DEFAULT_MAX_AGENTS_PER_RUN} agent() calls per run (override via \`${MAX_WORKFLOW_AGENTS_ENV}\`). \`Date.now()\` and \`Math.random()\` both throw \u2014 workflow scripts must be deterministic for resume. \`export const meta = {...}\` declarations are stripped before execution.`
     },
     scriptPath: {
       type: "string",
@@ -3147,7 +3520,23 @@ var WorkflowToolInvocation = class extends BaseToolInvocation {
   setCallId(callId) {
     this.callId = callId;
   }
+  /**
+   * Cache so the transcript header and the approval dialog cannot disagree,
+   * and so an oversized script is scanned once per invocation rather than
+   * once per surface that asks.
+   */
+  metaCache;
+  resolveMeta() {
+    if (this.metaCache === void 0) {
+      this.metaCache = this.params.script ? readMetaForConfirmation(this.params.script) : null;
+    }
+    return this.metaCache;
+  }
   getDescription() {
+    const meta = this.resolveMeta();
+    if (meta) {
+      return `Run workflow: ${sanitizeLine(meta.name)}`;
+    }
     if (this.params.scriptPath && this.params.script === void 0) {
       return `Run saved workflow (${path.basename(this.params.scriptPath)})`;
     }
@@ -3159,6 +3548,54 @@ var WorkflowToolInvocation = class extends BaseToolInvocation {
   getDefaultPermission() {
     return Promise.resolve("ask");
   }
+  /**
+   * Show what is about to run, and scope the grant that approves it.
+   *
+   * Without this override the base class renders `Confirm WorkflowTool` over
+   * `Run a workflow script (4127 chars)` — a character count standing in for
+   * arbitrary model-authored JavaScript that may fan out to
+   * `DEFAULT_MAX_AGENTS_PER_RUN` subagents, provision git worktrees and spend
+   * an uncapped token budget. The asymmetry is visible within one run: the
+   * subagent approvals this workflow bubbles up each get a full dialog.
+   *
+   * Two properties of the grant matter as much as the disclosure:
+   *
+   *   - An inline `script` can never be pre-approved. It is fresh
+   *     model-authored source every time, so a blanket "always allow" would
+   *     transfer consent from the script the user read to every script the
+   *     model writes afterwards. `hideAlwaysAllow` removes the option and the
+   *     empty `permissionRules` stops `injectPermissionRulesIfMissing` from
+   *     supplying the bare-tool-name rule, which `buildPermissionRules`
+   *     documents as matching *all* invocations.
+   *   - A `scriptPath` names a file on disk that the user chose, so it can be
+   *     pre-approved — but scoped to that path. The rule is built with the
+   *     same helpers the matcher uses so a tool rename moves both sides.
+   */
+  getConfirmationDetails(_abortSignal) {
+    const meta = this.resolveMeta();
+    const body = buildConfirmationPrompt(this.params, meta);
+    const banner = resolveUsageBanner(
+      this.config,
+      this.config.getWorkflowRunRegistry?.(),
+      resolveMaxTokensPerWorkflow()
+    );
+    const isInlineScript = this.params.script !== void 0;
+    const details = {
+      type: "info",
+      title: "Run a dynamic workflow?",
+      prompt: banner ? `${banner}${body}` : body,
+      // The body is a script excerpt and a phase list: rendering it as
+      // Markdown would swallow the very characters the reader needs to see.
+      renderPromptAsPlainText: true,
+      hideAlwaysAllow: isInlineScript,
+      permissionRules: isInlineScript ? [] : [
+        `${getRuleDisplayName(resolveToolName(ToolNames.WORKFLOW))}(scriptPath:${this.params.scriptPath})`
+      ],
+      onConfirm: /* @__PURE__ */ __name(async (_outcome, _payload) => {
+      }, "onConfirm")
+    };
+    return Promise.resolve(details);
+  }
   async execute(signal, updateOutput, _shellExecutionConfig) {
     const runInBackground = this.params.run_in_background === true;
     if (runInBackground && signal.aborted) {
@@ -3182,6 +3619,16 @@ var WorkflowToolInvocation = class extends BaseToolInvocation {
       if (runInBackground && signal.aborted) {
         return backgroundStartCancelledResult();
       }
+      if (error instanceof WorkflowScriptNotLaunchedError) {
+        return {
+          llmContent: [{ text: error.message }],
+          returnDisplay: error.message,
+          error: {
+            message: error.message,
+            type: "invalid_tool_params" /* INVALID_TOOL_PARAMS */
+          }
+        };
+      }
       throw error;
     }
     if (runInBackground) {
@@ -3293,6 +3740,83 @@ function resolveUsageBanner(config, registry, budgetTotal) {
   return buildUsageBanner(budgetTotal);
 }
 __name(resolveUsageBanner, "resolveUsageBanner");
+var CONFIRM_SCRIPT_EXCERPT_CHARS = 1200;
+var CONFIRM_ARGS_CHARS = 300;
+var CONFIRM_MAX_PHASES = 12;
+function sanitizeLine(text) {
+  return stripAnsiAndControl(text);
+}
+__name(sanitizeLine, "sanitizeLine");
+function sanitizeBlock(text) {
+  return text.replace(/\t/g, "  ").split("\n").map((line) => stripAnsiAndControl(line)).join("\n");
+}
+__name(sanitizeBlock, "sanitizeBlock");
+function clampForDisplay(text, max) {
+  if (text.length <= max) return text;
+  return `${text.slice(0, max)}
+\u2026 (${text.length - max} more characters)`;
+}
+__name(clampForDisplay, "clampForDisplay");
+function readMetaForConfirmation(script) {
+  try {
+    return extractAndStripMeta(script).meta;
+  } catch {
+    return null;
+  }
+}
+__name(readMetaForConfirmation, "readMetaForConfirmation");
+function buildConfirmationPrompt(params, meta) {
+  const lines = [];
+  if (meta) {
+    lines.push(`Workflow: ${sanitizeLine(meta.name)}`);
+    lines.push(sanitizeLine(meta.description));
+  } else if (params.scriptPath) {
+    lines.push(`Saved workflow: ${sanitizeLine(params.scriptPath)}`);
+  } else {
+    lines.push("Workflow: (the script declares no meta block)");
+  }
+  if (meta?.phases?.length) {
+    const shown = meta.phases.slice(0, CONFIRM_MAX_PHASES);
+    lines.push("", `Phases (${meta.phases.length}):`);
+    shown.forEach((phase, i) => {
+      const detail = phase.detail ? ` \u2014 ${sanitizeLine(phase.detail)}` : "";
+      lines.push(`  ${i + 1}. ${sanitizeLine(phase.title)}${detail}`);
+    });
+    if (meta.phases.length > shown.length) {
+      lines.push(`  \u2026 and ${meta.phases.length - shown.length} more`);
+    }
+  }
+  if (params.scriptPath && meta) {
+    lines.push("", `Loaded from: ${sanitizeLine(params.scriptPath)}`);
+  }
+  if (params.resumeFromRunId) {
+    lines.push("", `Resuming run: ${sanitizeLine(params.resumeFromRunId)}`);
+  }
+  if (params.args !== void 0) {
+    let rendered;
+    try {
+      rendered = JSON.stringify(params.args) ?? String(params.args);
+    } catch {
+      rendered = "(args are not JSON-serializable)";
+    }
+    lines.push(
+      "",
+      `Args: ${clampForDisplay(sanitizeLine(rendered), CONFIRM_ARGS_CHARS)}`
+    );
+  }
+  if (params.script) {
+    lines.push(
+      "",
+      "Script:",
+      clampForDisplay(
+        sanitizeBlock(params.script),
+        CONFIRM_SCRIPT_EXCERPT_CHARS
+      )
+    );
+  }
+  return lines.join("\n");
+}
+__name(buildConfirmationPrompt, "buildConfirmationPrompt");
 function buildUsageBanner(total) {
   if (total === null) {
     return `> Workflows have no per-run token cap. Set \`${MAX_TOKENS_PER_WORKFLOW_ENV}=<n>\` (env) for a soft cap. Suppress this notice with \`skipWorkflowUsageWarning: true\` in settings.
@@ -3347,6 +3871,18 @@ function safeStringifyDisplayPayload(payload) {
 __name(safeStringifyDisplayPayload, "safeStringifyDisplayPayload");
 var WORKFLOW_TOOL_DESCRIPTION = `Execute a workflow script that orchestrates subagents deterministically.
 
+**Only on an explicit request**
+
+Do not call this tool unless the user has asked for multi-agent orchestration. A run can dispatch up to ${DEFAULT_MAX_AGENTS_PER_RUN} subagents and spend tokens accordingly, so that scale has to be requested rather than inferred. It counts as requested when any of these holds:
+
+- The user's message contains the word \`workflow\`; a system reminder confirms it when it does.
+- The user asked for orchestration in their own words \u2014 run a workflow, fan out agents, orchestrate this with subagents.
+- A skill or slash command the user invoked instructs you to use this tool.
+- The user named a saved workflow to run, reached through \`workflow('<name>')\` or \`scriptPath\`.
+- The user asked to resume or continue an earlier run, which is \`resumeFromRunId\`.
+
+Otherwise do not call it, however well the task would parallelize. Do the work in the main loop, or spawn a single subagent for one self-contained piece. When a workflow would genuinely be the better tool, say in one sentence what it would fan out over and roughly how many agents that is, then let the user decide \u2014 and mention that including the word \`workflow\` next time skips the ask.
+
 **What a workflow is for**
 
 Reach for one to be comprehensive (decompose the work and cover every part in parallel), to be confident (independent perspectives and adversarial checks before an answer is committed to), or to take on scale a single context cannot hold \u2014 migrations, audits, broad sweeps. The script is where that structure is encoded: what fans out, what verifies, what synthesizes. Parallelism on its own is not a reason; work that is already one short sequence of edits belongs in the main loop.
@@ -3428,6 +3964,11 @@ var WorkflowTool = class extends BaseDeclarativeTool {
 export {
   WorkflowTool
 };
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
 /**
  * @license
  * Copyright 2025 Qwen